diff --git a/CMakeLists.txt b/CMakeLists.txt index 2855c28f..825673a4 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -239,11 +239,6 @@ include_directories(${LIBNETCONF2_INCLUDE_DIRS}) list(APPEND CMAKE_REQUIRED_INCLUDES ${LIBNETCONF2_INCLUDE_DIRS}) list(APPEND CMAKE_REQUIRED_LIBRARIES ${LIBNETCONF2_LIBRARIES}) -# SSH and TLS enabled -if(LIBNETCONF2_ENABLED_SSH_TLS) - list(APPEND SERVER_SRC src/netconf_server.c) -endif() - # link compat use_compat() diff --git a/src/main.c b/src/main.c index 0e543d72..91c26c1d 100644 --- a/src/main.c +++ b/src/main.c @@ -43,7 +43,6 @@ #include "netconf_confirmed_commit.h" #include "netconf_monitoring.h" #include "netconf_nmda.h" -#include "netconf_server.h" #include "netconf_subscribed_notifications.h" #include "yang_push.h" @@ -611,11 +610,6 @@ server_init(void) /* set libnetconf2 global PRC callback */ nc_set_global_rpc_clb(np2srv_rpc_cb); -#ifdef NC_ENABLED_SSH_TLS - /* set libnetconf2 SSH pubkey auth callback */ - nc_server_ssh_set_pubkey_auth_clb(np2srv_pubkey_auth_cb, NULL, NULL); -#endif - /* restore a previous confirmed commit if restore file exists */ ncc_try_restore(); @@ -725,6 +719,39 @@ server_open_pidfile(const char *pidfile) return 0; } +/** + * @brief Callback for handling netconf-server, ietf-keystore and ietf-truststore data changes. + * + * The diff is given to libnetconf2, which then handles the changes. + * + * @param session sysrepo session. + * @param[in] sub_id Subscription identifier. + * @param[in] module_name Module's name. + * @param[in] xpath XPath. + * @param[in] event Event. + * @param[in] request_id Request identifier. + * @param private_data Private data. + * + * @return SR_ERR_OK on success, on error any other value. + */ +static int +np2srv_libnetconf2_config_cb(sr_session_ctx_t *session, uint32_t UNUSED(sub_id), const char *UNUSED(module_name), + const char *UNUSED(xpath), sr_event_t UNUSED(event), uint32_t UNUSED(request_id), void *UNUSED(private_data)) +{ + int rc = 0; + const struct lyd_node *diff = NULL; + + /* get diff and apply it */ + diff = sr_get_change_diff(session); + rc = nc_server_config_setup_diff(diff); + if (rc) { + ERR("Configuring NETCONF server failed."); + return rc; + } + + return SR_ERR_OK; +} + /** * @brief Subscribe to all the handled RPCs of the server. * diff --git a/src/netconf_server.c b/src/netconf_server.c deleted file mode 100644 index 91ba6761..00000000 --- a/src/netconf_server.c +++ /dev/null @@ -1,187 +0,0 @@ -/** - * @file netconf_server.c - * @author Michal Vasko - * @brief ietf-netconf-server callbacks - * - * @copyright - * Copyright (c) 2019 - 2021 Deutsche Telekom AG. - * Copyright (c) 2017 - 2021 CESNET, z.s.p.o. - * - * This source code is licensed under BSD 3-Clause License (the "License"). - * You may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://opensource.org/licenses/BSD-3-Clause - */ - -#define _GNU_SOURCE /* asprintf() */ - -#include "netconf_server.h" - -#include -#include -#include -#include -#include -#include -#include - -#include -#include -#include - -#include "common.h" -#include "compat.h" -#include "log.h" - -int -np2srv_libnetconf2_config_cb(sr_session_ctx_t *session, uint32_t UNUSED(sub_id), const char *UNUSED(module_name), - const char *UNUSED(xpath), sr_event_t UNUSED(event), uint32_t UNUSED(request_id), void *UNUSED(private_data)) -{ - int rc = 0; - const struct lyd_node *diff = NULL; - - /* get diff and apply it */ - diff = sr_get_change_diff(session); - rc = nc_server_config_setup_diff(diff); - if (rc) { - ERR("Configuring NETCONF server failed."); - return rc; - } - - return SR_ERR_OK; -} - -#ifdef NC_ENABLED_SSH_TLS - -static int -np2srv_validate_posix_username(const char *username) -{ - /* use POSIX username definition - * https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_437 */ - - /* not empty */ - if (strlen(username) == 0) { - return -1; - } - - /* no hyphen as first char */ - if (username[0] == '-') { - return -1; - } - - /* check for Portable Filename Character Set */ - for (unsigned long i = 0; i < strlen(username); i++) { - if (!(isalnum(username[i]) || (username[i] == '.') || (username[i] == '_') || (username[i] == '-'))) { - return -1; - } - } - - return 0; -} - -int -np2srv_pubkey_auth_cb(const struct nc_session *session, ssh_key key, void *UNUSED(user_data)) -{ - FILE *f = NULL; - struct passwd *pwd; - ssh_key pub_key = NULL; - enum ssh_keytypes_e ktype; - const char *username; - char *line = NULL, *ptr, *ptr2; - size_t n; - int r, ret = 1, line_num = 0; - - username = nc_session_get_username(session); - - errno = 0; - pwd = getpwnam(username); - - if (!NP2SRV_SSH_AUTHORIZED_KEYS_ARG_IS_USERNAME && !pwd) { - ERR("Failed to find user entry for \"%s\" (%s).", username, errno ? strerror(errno) : "User not found"); - goto cleanup; - } - - if (!pwd && np2srv_validate_posix_username(username)) { - ERR("The username \"%s\" is not a valid posix username.", username); - goto cleanup; - } - - /* check any authorized keys */ - r = asprintf(&line, NP2SRV_SSH_AUTHORIZED_KEYS_PATTERN, NP2SRV_SSH_AUTHORIZED_KEYS_ARG_IS_USERNAME ? username : pwd->pw_dir); - if (r == -1) { - EMEM; - line = NULL; - goto cleanup; - } - n = r; - - f = fopen(line, "r"); - if (!f) { - if (errno == ENOENT) { - VRB("User \"%s\" has no authorized_keys file.", username); - } else { - ERR("Failed to open \"%s\" authorized_keys file (%s).", line, strerror(errno)); - } - goto cleanup; - } - - while (getline(&line, &n, f) > -1) { - ++line_num; - - /* separate key type */ - ptr = line; - for (ptr2 = ptr; !isspace(ptr2[0]); ++ptr2) {} - if (ptr2[0] == '\0') { - WRN("Invalid authorized key format of \"%s\" (line %d).", username, line_num); - continue; - } - ptr2[0] = '\0'; - - /* detect key type */ - ktype = ssh_key_type_from_name(ptr); - if (ktype == SSH_KEYTYPE_UNKNOWN) { - WRN("Unknown key type \"%s\" (line %d).", ptr, line_num); - continue; - } - - /* separate key data */ - ptr = ptr2 + 1; - for (ptr2 = ptr; !isspace(ptr2[0]); ++ptr2) {} - ptr2[0] = '\0'; - - r = ssh_pki_import_pubkey_base64(ptr, ktype, &pub_key); - if (r != SSH_OK) { - WRN("Failed to import authorized key of \"%s\" (%s, line %d).", - username, r == SSH_EOF ? "Unexpected end-of-file" : "SSH error", line_num); - continue; - } - - /* compare public keys */ - if (!ssh_key_cmp(key, pub_key, SSH_KEY_CMP_PUBLIC)) { - /* key matches */ - ret = 0; - goto cleanup; - } - - /* not a match, next key */ - ssh_key_free(pub_key); - pub_key = NULL; - } - if (!feof(f)) { - WRN("Failed reading from authorized_keys file of \"%s\".", username); - goto cleanup; - } - - /* no match */ - -cleanup: - if (f) { - fclose(f); - } - free(line); - ssh_key_free(pub_key); - return ret; -} - -#endif /* NC_ENABLED_SSH_TLS */ diff --git a/src/netconf_server.h b/src/netconf_server.h deleted file mode 100644 index df46ac04..00000000 --- a/src/netconf_server.h +++ /dev/null @@ -1,47 +0,0 @@ -/** - * @file netconf_server.h - * @author Michal Vasko - * @brief ietf-netconf-server callbacks header - * - * @copyright - * Copyright (c) 2019 - 2021 Deutsche Telekom AG. - * Copyright (c) 2017 - 2021 CESNET, z.s.p.o. - * - * This source code is licensed under BSD 3-Clause License (the "License"). - * You may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://opensource.org/licenses/BSD-3-Clause - */ - -#ifndef NP2SRV_NETCONF_SERVER_H_ -#define NP2SRV_NETCONF_SERVER_H_ - -#include -#include - -/** - * @brief Callback for handling netconf-server, ietf-keystore and ietf-truststore data changes. - * - * The diff is given to libnetconf2, which then handles the changes. - * - * @param session sysrepo session. - * @param[in] sub_id Subscription identifier. - * @param[in] module_name Module's name. - * @param[in] xpath XPath. - * @param[in] event Event. - * @param[in] request_id Request identifier. - * @param private_data Private data. - * - * @return SR_ERR_OK on success, on error any other value. - */ -int np2srv_libnetconf2_config_cb(sr_session_ctx_t *session, uint32_t sub_id, const char *module_name, const char *xpath, - sr_event_t event, uint32_t request_id, void *private_data); - -#ifdef NC_ENABLED_SSH_TLS - -int np2srv_pubkey_auth_cb(const struct nc_session *session, ssh_key key, void *user_data); - -#endif /* NC_ENABLED_SSH_TLS */ - -#endif /* NP2SRV_NETCONF_SERVER_H_ */