Merge pull request #339 from bmc-toolbox/smc-support-olderfw

supermicro/firmware: support firmware installs on BMCs running older firmware

providers/supermicro/firmware_bios.go

@@ -234,7 +234,12 @@ func (c *Client) uploadBIOSFirmware(ctx context.Context, fwReader io.Reader) err
 		case "csrf-token":
 			// Add csrf token field
 			h := make(textproto.MIMEHeader)
-			h.Set("Content-Disposition", `form-data; name="CSRF-TOKEN"`)
+			// BMCs with newer firmware (>=1.74.09) accept the form with this name value
+			// h.Set("Content-Disposition", `form-data; name="CSRF-TOKEN"`)
+			//
+			// the BMCs running older firmware (<=1.23.06) versions expects the name value in this format
+			// and the newer firmware (>=1.74.09) seem to be backwards compatible with this name value format.
+			h.Set("Content-Disposition", `form-data; name="CSRF_TOKEN"`)
 
 			if partWriter, err = payloadWriter.CreatePart(h); err != nil {
 				return errors.Wrap(ErrMultipartForm, err.Error())

providers/supermicro/firmware_bmc.go

@@ -155,7 +155,12 @@ func (c *Client) uploadBMCFirmware(ctx context.Context, fwReader io.Reader) erro
 		case "csrf-token":
 			// Add csrf token field
 			h := make(textproto.MIMEHeader)
-			h.Set("Content-Disposition", `form-data; name="CSRF-TOKEN"`)
+			// BMCs with newer firmware (>=1.74.09) accept the form with this name value
+			// h.Set("Content-Disposition", `form-data; name="CSRF-TOKEN"`)
+			//
+			// the BMCs running older firmware (<=1.23.06) versions expects the name value in this format
+			// this seems to be backwards compatible with the newer firmware.
+			h.Set("Content-Disposition", `form-data; name="CSRF_TOKEN"`)
 
 			if partWriter, err = payloadWriter.CreatePart(h); err != nil {
 				return errors.Wrap(ErrMultipartForm, err.Error())

providers/supermicro/firmware_bmc_test.go

@@ -145,7 +145,7 @@ func Test_uploadBMCFirmware(t *testing.T) {
 				part, err = reader.NextPart()
 				assert.Nil(t, err)
 
-				assert.Equal(t, `form-data; name="CSRF-TOKEN"`, part.Header.Get("Content-Disposition"))
+				assert.Equal(t, `form-data; name="CSRF_TOKEN"`, part.Header.Get("Content-Disposition"))
 			},
 		},
 	}

providers/supermicro/supermicro.go

@@ -348,8 +348,20 @@ func (c *Client) query(ctx context.Context, endpoint, method string, payload io.
 
 	if c.csrfToken != "" {
 		req.Header.Add("Csrf-Token", c.csrfToken)
+		// because old firmware
+		req.Header.Add("CSRF_TOKEN", c.csrfToken)
 	}
 
+	// required on  X11SCM-F with 1.23.06 and older BMC firmware
+	// https://go.googlesource.com/go/+/go1.20/src/net/http/request.go#124
+	req.Host, err = hostIP(c.host)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	// required on  X11SCM-F with 1.23.06 and older BMC firmware
+	req.Header.Add("Referer", c.host)
+
 	for k, v := range headers {
 		req.Header.Add(k, v)
 	}
@@ -411,3 +423,17 @@ func (c *Client) query(ctx context.Context, endpoint, method string, payload io.
 
 	return body, resp.StatusCode, nil
 }
+
+func hostIP(hostURL string) (string, error) {
+	hostURLParsed, err := url.Parse(hostURL)
+	if err != nil {
+		return "", err
+	}
+
+	if strings.Contains(hostURLParsed.Host, ":") {
+		return strings.Split(hostURLParsed.Host, ":")[0], nil
+
+	}
+
+	return hostURLParsed.Host, nil
+}

providers/supermicro/supermicro_test.go

@@ -44,6 +44,11 @@ func Test_parseToken(t *testing.T) {
 			</html>`),
 			"fYQ/Xhd1AvA+kP/bM/tO5mhOzv4eM5evCOH/YSuBN70",
 		},
+		{
+			"token with key type 4 found",
+			[]byte(`<script>SmcCsrfInsert ("CSRF_TOKEN", "RYjdEjWIhU+PCRFMBP2ZRPPePcQ4n3dM3s+rCgTnBBU");</script></body>`),
+			"RYjdEjWIhU+PCRFMBP2ZRPPePcQ4n3dM3s+rCgTnBBU",
+		},
 	}
 
 	for _, tc := range testcases {