Add optional Redfish session token caching to reduce BMC audit log spam

bmc/dialer.go

@@ -0,0 +1,103 @@
+// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and IronCore contributors
+// SPDX-License-Identifier: Apache-2.0
+
+package bmc
+
+import (
+	"context"
+	"net/http"
+	"sync/atomic"
+
+	"github.com/stmcginnis/gofish"
+)
+
+// Dialer creates BMC connections.
+type Dialer interface {
+	Dial(ctx context.Context, o Options) (BMC, error)
+}
+
+// DirectDialer creates a fresh basic-auth BMC connection on every Dial call.
+type DirectDialer struct{}
+
+func (DirectDialer) Dial(ctx context.Context, o Options) (BMC, error) {
+	return NewRedfishBMCClient(ctx, o)
+}
+
+// SessionDialer dials using a shared SessionCache, reusing tokens across calls.
+// On 401/403 it invalidates the cached session and retries once.
+type SessionDialer struct {
+	cache *SessionCache
+}
+
+func NewSessionDialer(cache *SessionCache) *SessionDialer {
+	return &SessionDialer{cache: cache}
+}
+
+type redfishClientHolder interface {
+	Client() *gofish.APIClient
+}
+
+func (p *SessionDialer) Dial(ctx context.Context, o Options) (BMC, error) {
+	o.SessionCache = p.cache
+
+	bmcClient, err := NewRedfishBMCClient(ctx, o)
+	if err != nil {
+		if IsSessionExpiredError(err) {
+			p.cache.Invalidate(SessionCacheKey{Endpoint: o.Endpoint, Username: o.Username})
+			bmcClient, err = NewRedfishBMCClient(ctx, o)
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if holder, ok := bmcClient.(redfishClientHolder); ok {
+		httpClient := holder.Client().HTTPClient
+		base := httpClient.Transport
+		if base == nil {
+			base = http.DefaultTransport
+		}
+		httpClient.Transport = &retryRoundTripper{
+			base:  base,
+			cache: p.cache,
+			key:   SessionCacheKey{Endpoint: o.Endpoint, Username: o.Username},
+			opts:  o,
+		}
+	}
+
+	return bmcClient, nil
+}
+
+// retryRoundTripper recovers from BMC-side session eviction (e.g. BMC restart)
+// without surfacing a 401/403 to the caller.
+type retryRoundTripper struct {
+	base    http.RoundTripper
+	cache   *SessionCache
+	key     SessionCacheKey
+	opts    Options
+	retried atomic.Bool
+}
+
+func (r *retryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := r.base.RoundTrip(req)
+	if err != nil {
+		return resp, err
+	}
+	if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
+		return resp, nil
+	}
+	if !r.retried.CompareAndSwap(false, true) {
+		return resp, nil
+	}
+	_ = resp.Body.Close()
+
+	r.cache.Invalidate(r.key)
+	session, sessionErr := r.cache.GetOrCreate(req.Context(), r.opts)
+	if sessionErr != nil {
+		return nil, sessionErr
+	}
+
+	retryReq := req.Clone(req.Context())
+	retryReq.Header.Set("X-Auth-Token", session.Token)
+	return r.base.RoundTrip(retryReq)
+}

bmc/redfish.go

@@ -44,26 +44,22 @@ const (
 
 // Options contain the options for the BMC redfish client.
 type Options struct {
-	Endpoint  string
-	Username  string
-	Password  string
-	BasicAuth bool
+	Endpoint string
+	Username string
+	Password string
 
-	// TLS configuration
-	InsecureTLS bool // Skip TLS certificate verification
+	InsecureTLS bool
 
 	ResourcePollingInterval time.Duration
 	ResourcePollingTimeout  time.Duration
 	PowerPollingInterval    time.Duration
 	PowerPollingTimeout     time.Duration
 
-	// AdditionalVendors maps a manufacturer string (as reported by Redfish)
-	// to a factory that wraps the base Redfish client in a vendor-specific
-	// implementation. Entries are merged on top of DefaultVendors() by
-	// NewRedfishBMCClient, so callers only need to supply the extra OEMs
-	// they want to add. Existing built-in manufacturers can be overridden
-	// by registering the same key.
 	AdditionalVendors map[Manufacturer]VendorFactory
+
+	// SessionCache enables Redfish session token caching when non-nil.
+	// Created by the manager at startup and shared across all controllers.
+	SessionCache *SessionCache
 }
 
 // RedfishBaseBMC is the base implementation of the BMC interface for Redfish.
@@ -84,19 +80,33 @@ func (e *InvalidBIOSSettingsError) Error() string {
 	return fmt.Sprintf("Settings Name: %s\nSettings Value: %v\nError: %s", e.SettingName, e.SettingValue, e.Message)
 }
 
-// newRedfishBaseBMCClient creates a new RedfishBaseBMC with the given connection details (internal use only).
 func newRedfishBaseBMCClient(ctx context.Context, options Options) (*RedfishBaseBMC, error) {
-	clientConfig := gofish.ClientConfig{
-		Endpoint:  options.Endpoint,
-		Username:  options.Username,
-		Password:  options.Password,
-		Insecure:  options.InsecureTLS,
-		BasicAuth: options.BasicAuth,
-	}
-	client, err := gofish.ConnectContext(ctx, clientConfig)
+	var client *gofish.APIClient
+	var err error
+
+	if options.SessionCache != nil {
+		session, sessionErr := options.SessionCache.GetOrCreate(ctx, options)
+		if sessionErr != nil {
+			return nil, sessionErr
+		}
+		client, err = gofish.ConnectContext(ctx, gofish.ClientConfig{
+			Endpoint: options.Endpoint,
+			Session:  session,
+			Insecure: options.InsecureTLS,
+		})
+	} else {
+		client, err = gofish.ConnectContext(ctx, gofish.ClientConfig{
+			Endpoint:  options.Endpoint,
+			Username:  options.Username,
+			Password:  options.Password,
+			Insecure:  options.InsecureTLS,
+			BasicAuth: true,
+		})
+	}
 	if err != nil {
 		return nil, err
 	}
+
 	bmc := &RedfishBaseBMC{client: client}
 	if options.ResourcePollingInterval == 0 {
 		options.ResourcePollingInterval = DefaultResourcePollingInterval
@@ -129,8 +139,12 @@ func NewRedfishBMCClient(ctx context.Context, options Options) (BMC, error) {
 
 	manufacturer, err := base.getSystemManufacturer()
 	if err != nil {
-		// If we can't determine the manufacturer (e.g. no systems yet during
-		// endpoint discovery), fall back to the base implementation.
+		// Propagate authentication errors so the caller can invalidate the session
+		// cache and retry. For other errors (e.g. no systems yet during endpoint
+		// discovery), fall back to the base implementation.
+		if IsSessionExpiredError(err) {
+			return nil, err
+		}
 		return base, nil
 	}
 	base.manufacturer = manufacturer
@@ -143,9 +157,6 @@ func NewRedfishBMCClient(ctx context.Context, options Options) (BMC, error) {
 		vendors[k] = v
 	}
 	if factory, ok := vendors[Manufacturer(manufacturer)]; ok {
-		if factory == nil {
-			return nil, fmt.Errorf("nil vendor factory registered for manufacturer %q", manufacturer)
-		}
 		client := factory(base)
 		if client == nil {
 			return nil, fmt.Errorf("vendor factory for manufacturer %q returned nil", manufacturer)
@@ -176,11 +187,17 @@ func (r *RedfishBaseBMC) Manufacturer() Manufacturer {
 	return Manufacturer(r.manufacturer)
 }
 
-// Logout closes the BMC client connection by logging out
+// Logout closes the BMC client connection. When session caching is enabled
+// the session is owned by the cache, so Logout only closes idle connections.
 func (r *RedfishBaseBMC) Logout() {
-	if r.client != nil {
-		r.client.Logout()
+	if r.client == nil {
+		return
+	}
+	if r.options.SessionCache != nil {
+		r.client.HTTPClient.CloseIdleConnections()
+		return
 	}
+	r.client.Logout()
 }
 
 // PowerOn powers on the system using Redfish.