docs: design notes for a Redfish/IPMI BMC driver

No code yet. The README explains why one Redfish driver with vendor quirk
modules beats a Supermicro-only IPMI driver, and keeps IPMI over LAN as a
read-only fallback. docs/ holds a draft for a new ManagementController
role base in napalm-device-types, the getter-to-resource map, the first
test device (Supermicro X10DRL-i, Redfish firmware 3.91), the security
points (IPMI RAKP hash disclosure, power control, credentials) and the
test plan with DMTF mockups and fixtures to record.

docs/security.md

@@ -0,0 +1,43 @@
+# Security
+
+A BMC can power a server off, mount virtual media and open a remote console. Its
+credentials are worth as much as root on every machine it manages.
+
+## Credentials
+
+- Use a dedicated BMC account for netOrk, not the factory administrator. A read-only role
+  (Redfish `ReadOnly`) suffices for everything except power control, which needs
+  `Operator`.
+- netOrk's credential gating applies unchanged: no job without credentials.
+- Close Redfish sessions after each poll. BMCs allow few concurrent sessions, and a leaked
+  session can lock the web UI out.
+
+## IPMI over LAN
+
+- IPMI 2.0's RAKP handshake returns a salted hash of the user's password to any client that
+  names a valid user, before authentication (CVE-2013-4786). The hash can be cracked
+  offline. This is part of the protocol, not a bug a firmware update fixes.
+- Cipher suite 0 (no authentication) is enabled on some BMCs and allows login with any
+  password.
+- So the `ipmi` entry point is read-only and a fallback only. `get_management_protocols`
+  reporting `IPMI.ProtocolEnabled = true` should become a finding in netOrk, with the advice
+  to disable IPMI over LAN where Redfish is available.
+
+## Power control
+
+- `set_power_state` can take a production server down. In netOrk it needs a
+  `ConfirmDialog`, a permission of its own, and an audit log entry.
+- `ForceOff`/`ForceRestart`/`PowerCycle` skip the OS shutdown; offer `GracefulShutdown`/
+  `GracefulRestart` first.
+- `reboot_host` restarts only the BMC (`Manager.Reset`). The managed server keeps running.
+
+## Firmware
+
+BMC firmware versions from `UpdateService/FirmwareInventory` feed netOrk's vulnerability
+management. Supermicro BMCs in particular have had serious published vulnerabilities, and
+the X10 Redfish firmware line is no longer updated.
+
+## Network placement
+
+A BMC belongs in a management network that only administrators and netOrk can reach. A BMC
+reachable from a user or guest VLAN is itself a finding for the segmentation checks.