Fix: Virual-Media: get https protocol back

5 files changed, 63 insertions, 29 deletions

diff --git a/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media.bbappend b/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media.bbappend
index c4a9e78498..a6491007a6 100644
--- a/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media.bbappend
+++ b/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media.bbappend
@@ -6,7 +6,7 @@ SRC_URI += "\
     file://0003-virtual-media.1-Add-MountPointStateMachine-forceDisc.patch \
     file://0004-virtual-media.1-Fix-MountPointStateMachine-forceDisc.patch \
     file://0005-virtual-media.1-Fix-Use-machine.forceDisconnectNbd.patch \
-    file://0006-Upd-disable-tls13-ciphers-for-http-protocol.patch \
+    file://0006-Fix-redirect-CA-path-to-generic-one.patch \
     file://0007-Upd-rename-Slot_-0123-to-USB-0123-in-virtual-media.j.patch \
     file://0008-virtual-media.3-Upd-Use-umount2-.-instead-of-umount.patch \
     file://0009-virtual-media.3-Upd-Just-re-name-smb-netdev-.hpp.patch \
diff --git a/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media/0006-Fix-redirect-CA-path-to-generic-one.patch b/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media/0006-Fix-redirect-CA-path-to-generic-one.patch
new file mode 100644
index 0000000000..e8455134ae
--- /dev/null
+++ b/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media/0006-Fix-redirect-CA-path-to-generic-one.patch
@@ -0,0 +1,25 @@
+From 4095df744b8e2ef2fa6184df636a35166426b9b0 Mon Sep 17 00:00:00 2001
+From: Alexandr Ilenko <AIlenko@IBS.RU>
+Date: Thu, 22 Sep 2022 09:39:44 +0300
+Subject: [PATCH] Fix: redirect CA path to generic one
+
+---
+ src/state/activating_state.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/state/activating_state.cpp b/src/state/activating_state.cpp
+index 47c4737..f2d3ebd 100644
+--- a/src/state/activating_state.cpp
++++ b/src/state/activating_state.cpp
+@@ -307,7 +307,7 @@ std::unique_ptr<resource::Process>
+         // ... to mount http resource at url
+         "url=" + url,
+         // custom OpenBMC path for CA
+-        "cainfo=", "capath=/etc/ssl/certs/authority", "ssl-version=tlsv1.2",
++        "cainfo=", "capath=/etc/ssl/certs", "ssl-version=tlsv1.2",
+         "followlocation=false",
+         "ssl-cipher-list="
+         "ECDHE-RSA-AES256-GCM-SHA384:"
+-- 
+2.35.1
+
diff --git a/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media/0006-Upd-disable-tls13-ciphers-for-http-protocol.patch b/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media/0006-Upd-disable-tls13-ciphers-for-http-protocol.patch
deleted file mode 100644
index a902b463fb..0000000000
--- a/meta-ibs/meta-cp2-5422/recipes-phosphor/virtual-media/virtual-media/0006-Upd-disable-tls13-ciphers-for-http-protocol.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From ec722934ab52b372ef03b2f53c92961d040d078e Mon Sep 17 00:00:00 2001
-From: Alexandr Ilenko <AIlenko@IBS.RU>
-Date: Mon, 6 Jun 2022 21:53:02 +0300
-Subject: [PATCH 6/8] Upd: disable "tls13-ciphers" for http protocol
-
----
- src/state/activating_state.cpp | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/state/activating_state.cpp b/src/state/activating_state.cpp
-index 6ae7932..f926547 100644
---- a/src/state/activating_state.cpp
-+++ b/src/state/activating_state.cpp
-@@ -307,9 +307,10 @@ std::unique_ptr<resource::Process>
-         "followlocation=false",
-         "ssl-cipher-list="
-         "ECDHE-RSA-AES256-GCM-SHA384:"
--        "ECDHE-ECDSA-AES256-GCM-SHA384",
-+        "ECDHE-ECDSA-AES256-GCM-SHA384"}; /*,
-         "tls13-ciphers="
-         "TLS_AES_256_GCM_SHA384"};
-+        */
- 
-     // Authenticate if needed
-     if (machine.getTarget()->credentials)
--- 
-2.35.1
-
diff --git a/meta-ibs/meta-cp2-5422/recipes-support/nbdkit/nbdkit/0001-Fix-Force-add-CURLOPT_TLS13_CIPHERS-macro.patch b/meta-ibs/meta-cp2-5422/recipes-support/nbdkit/nbdkit/0001-Fix-Force-add-CURLOPT_TLS13_CIPHERS-macro.patch
new file mode 100644
index 0000000000..c74e5f2a3d
--- /dev/null
+++ b/meta-ibs/meta-cp2-5422/recipes-support/nbdkit/nbdkit/0001-Fix-Force-add-CURLOPT_TLS13_CIPHERS-macro.patch
@@ -0,0 +1,33 @@
+From cdb78422f717013dd483f972e4f5c112fe532696 Mon Sep 17 00:00:00 2001
+From: Alexandr Ilenko <AIlenko@IBS.RU>
+Date: Wed, 21 Sep 2022 10:35:12 +0300
+Subject: [PATCH] Fix: Force add CURLOPT_TLS13_CIPHERS macro
+
+---
+ plugins/curl/curl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/plugins/curl/curl.c b/plugins/curl/curl.c
+index 9a818bfa..e4fb3d65 100644
+--- a/plugins/curl/curl.c
++++ b/plugins/curl/curl.c
+@@ -560,6 +560,16 @@ curl_open (int readonly)
+   if (ssl_cipher_list)
+     curl_easy_setopt (h->c, CURLOPT_SSL_CIPHER_LIST, ssl_cipher_list);
+   if (tls13_ciphers) {
++// It looks that commit with "#ifdef CURLOPT_TLS13_CIPHERS" was incorrect.
++// Because curl provides "CURLOPT_TLS13_CIPHERS"  as an enum constant,
++// not as a macro.
++// Let`s (re-)define the macro for new versions of BMC Virtual-Media`s
++// tuning options
++#ifdef CURLOPT_TLS13_CIPHERS
++#  error Something goes wrong with CURLOPT_TLS13_CIPHERS again.
++#else
++#  define CURLOPT_TLS13_CIPHERS (CURLOPT_TLS13_CIPHERS)
++#endif
+ #ifdef CURLOPT_TLS13_CIPHERS
+     curl_easy_setopt (h->c, CURLOPT_TLS13_CIPHERS, tls13_ciphers);
+ #else
+-- 
+2.35.1
+
diff --git a/meta-ibs/meta-cp2-5422/recipes-support/nbdkit/nbdkit_%.bbappend b/meta-ibs/meta-cp2-5422/recipes-support/nbdkit/nbdkit_%.bbappend
index d5d1e4466e..aac1a9e5d1 100644
--- a/meta-ibs/meta-cp2-5422/recipes-support/nbdkit/nbdkit_%.bbappend
+++ b/meta-ibs/meta-cp2-5422/recipes-support/nbdkit/nbdkit_%.bbappend
@@ -1,3 +1,7 @@
 FILESEXTRAPATHS:append := "${THISDIR}/${PN}:"
 
 WARN_QA:remove = " buildpaths"
+
+SRC_URI += "\
+    file://0001-Fix-Force-add-CURLOPT_TLS13_CIPHERS-macro.patch \
+    "