peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-08-06 23:43:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Introduce infix-crypto-types

Browse Source 
To only show supported types, simpler when autogenerate web/cli.
This commit is contained in:
Mattias Walström
2025-02-08 13:40:35 +01:00
parent 7d646c9494
commit 0cb2987de4
19 changed files with 177 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog.md
+10
View File
@@ -4,6 +4,16 @@ Change Log
All notable changes to the project are documented in this file.
[v25.02.0][UNRELASED] -
-------------------------
### Changes
- YANG type for SSH private/public keys has changed, from
ietf-crypto-types to infix-crypto-types
### Fixes
[v25.01.0][] - 2025-01-31
-------------------------
package/confd/confd.mk
+1 -1
View File
@@ -4,7 +4,7 @@
#
################################################################################
CONFD_VERSION = 1.4
CONFD_VERSION = 1.5
CONFD_SITE_METHOD = local
CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
CONFD_LICENSE = BSD-3-Clause
patches/netopeer2/2.2.35/0001-Allow-factory-as-copy-from-only-in-rpc-copy-config.patch
+2 -2
View File
@@ -1,11 +1,11 @@
From 2950046cd17bf9296a0b70b8f6b38114f6985864 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Thu, 22 Jun 2023 10:24:57 +0200
Subject: [PATCH 1/3] Allow 'factory' as copy-from (only) in rpc copy-config
Subject: [PATCH 1/4] Allow 'factory' as copy-from (only) in rpc copy-config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Organization: Addiva Elektronik
Organization: Wires
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Mattias Walström <lazzer@gmail.com>
patches/netopeer2/2.2.35/0002-Disable-local-users-backwards-compat-with-older-mode.patch
+2 -2
View File
@@ -1,11 +1,11 @@
From d2e4e60838761e2bdd02d651b8e0bea47cc2dcb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
Date: Tue, 2 Jul 2024 14:56:15 +0200
Subject: [PATCH 2/3] Disable local users (backwards compat with older model)
Subject: [PATCH 2/4] Disable local users (backwards compat with older model)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Organization: Addiva Elektronik
Organization: Wires
Drop local-users, because if enabled netopeer require all users that
should be allowed to use NETCONF to also be configured in the updated
patches/netopeer2/2.2.35/0003-Do-not-generate-data-in-sysrepo.patch
+72
View File
@@ -0,0 +1,72 @@
From 2f09813c91def7672c036c7f713302cb3a12cf18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
Date: Tue, 4 Feb 2025 20:14:50 +0100
Subject: [PATCH 4/4] Do not generate data in sysrepo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Organization: Wires
We generate the host keys and configuration for netconf on boot, do not generate anything when
building/installing netopeer2
Signed-off-by: Mattias Walström <lazzer@gmail.com>
---
CMakeLists.txt | 40 ----------------------------------------
1 file changed, 40 deletions(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4341be1..f1c4ae8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -383,47 +383,7 @@ if(SYSREPO_SETUP)
message(FATAL_ERROR \" OUTPUT:\\n \${CMD_OUT_F}\\n ERROR:\\n \${CMD_ERR_F}\")
endif()
")
-
- # generate hostkey
- install(CODE "
- message(STATUS \"Generating a new RSA host key \\\"genkey\\\" if not already added (merge_hostkey.sh)...\")
- set(ENV{SYSREPOCTL_EXECUTABLE} \"${SYSREPOCTL_EXECUTABLE}\")
- set(ENV{SYSREPOCFG_EXECUTABLE} \"${SYSREPOCFG_EXECUTABLE}\")
- execute_process(COMMAND \"\$ENV{DESTDIR}${DATA_DIR}/scripts/merge_hostkey.sh\"
- RESULT_VARIABLE CMD_RES
- OUTPUT_VARIABLE CMD_OUT
- ERROR_VARIABLE CMD_ERR
- OUTPUT_STRIP_TRAILING_WHITESPACE
- ERROR_STRIP_TRAILING_WHITESPACE)
- if(NOT CMD_RES EQUAL 0)
- string(REPLACE \"\\n\" \"\\n \" CMD_OUT_F \"\${CMD_OUT}\")
- string(REPLACE \"\\n\" \"\\n \" CMD_ERR_F \"\${CMD_ERR}\")
- message(FATAL_ERROR \" OUTPUT:\\n \${CMD_OUT_F}\\n ERROR:\\n \${CMD_ERR_F}\")
- endif()
- ")
-
- # merge listen config
- install(CODE "
- message(STATUS \"Merging default server listen configuration if there is none (merge_config.sh)...\")
- set(ENV{SYSREPOCTL_EXECUTABLE} \"${SYSREPOCTL_EXECUTABLE}\")
- set(ENV{SYSREPOCFG_EXECUTABLE} \"${SYSREPOCFG_EXECUTABLE}\")
- set(ENV{NP2_VERSION} \"${NP2SRV_VERSION}\")
- execute_process(COMMAND \"\$ENV{DESTDIR}${DATA_DIR}/scripts/merge_config.sh\"
- RESULT_VARIABLE CMD_RES
- OUTPUT_VARIABLE CMD_OUT
- ERROR_VARIABLE CMD_ERR
- OUTPUT_STRIP_TRAILING_WHITESPACE
- ERROR_STRIP_TRAILING_WHITESPACE)
- if(NOT CMD_RES EQUAL 0)
- string(REPLACE \"\\n\" \"\\n \" CMD_OUT_F \"\${CMD_OUT}\")
- string(REPLACE \"\\n\" \"\\n \" CMD_ERR_F \"\${CMD_ERR}\")
- message(FATAL_ERROR \" OUTPUT:\\n \${CMD_OUT_F}\\n ERROR:\\n \${CMD_ERR_F}\")
- endif()
- ")
-else()
- message(WARNING "Server will refuse to start if the modules are not installed!")
endif()
-
# tests
if(ENABLE_TESTS OR (BUILD_NETOPEER2_LIB AND NETOPEER2_LIB_TESTS))
if(ENABLE_TESTS)
--
2.43.0
src/confd/configure.ac
+2 -1
View File
@@ -1,6 +1,6 @@
AC_PREREQ(2.61)
# confd version is same as system YANG model version, step on breaking changes
AC_INIT([confd], [1.4], [https://github.com/kernelkit/infix/issues])
AC_INIT([confd], [1.5], [https://github.com/kernelkit/infix/issues])
AM_INIT_AUTOMAKE(1.11 foreign subdir-objects)
AM_SILENT_RULES(yes)
@@ -18,6 +18,7 @@ AC_CONFIG_FILES([
share/migrate/1.2/Makefile
share/migrate/1.3/Makefile
share/migrate/1.4/Makefile
share/migrate/1.5/Makefile
src/Makefile
yang/Makefile
])
src/confd/share/factory.d/10-netconf-server.json
+2 -2
View File
@@ -4,9 +4,9 @@
"asymmetric-key": [
{
"name": "genkey",
"public-key-format": "ietf-crypto-types:ssh-public-key-format",
"public-key-format": "infix-crypto-types:ssh-public-key-format",
"public-key": "",
"private-key-format": "ietf-crypto-types:rsa-private-key-format",
"private-key-format": "infix-crypto-types:rsa-private-key-format",
"cleartext-private-key": "",
"certificates": {}
}
src/confd/share/migrate/1.5/10-change-key-types.sh
Executable
+12
View File
@@ -0,0 +1,12 @@
#!/bin/sh
# Rename SSH key type in keystore, from ietf-crypto-types to infix-crypto-types
#
file=$1
temp=${file}.tmp
jq '.["ietf-keystore:keystore"]["asymmetric-keys"]["asymmetric-key"][] |= (
.["public-key-format"] |= sub("ietf-crypto-types";"infix-crypto-types") |
.["private-key-format"] |= sub("ietf-crypto-types";"infix-crypto-types"))' "$file" > "$temp" &&
mv "$temp" "$file"
src/confd/share/migrate/1.5/Makefile.am
+2
View File
@@ -0,0 +1,2 @@
migratedir = $(pkgdatadir)/migrate/1.5
dist_migrate_DATA = 10-change-key-types.sh
src/confd/share/migrate/Makefile.am
+1 -1
View File
@@ -1,2 +1,2 @@
SUBDIRS = 1.0 1.1 1.2 1.3 1.4
SUBDIRS = 1.0 1.1 1.2 1.3 1.4 1.5
migratedir = $(pkgdatadir)/migrate
src/confd/src/ietf-keystore.c
+2 -2
View File
@@ -88,8 +88,8 @@ static int change_cb(sr_session_ctx_t *session, uint32_t sub_id, const char *mod
continue;
}
if (!strcmp(private_key_format, "ietf-crypto-types:rsa-private-key-format") &&
!strcmp(public_key_format, "ietf-crypto-types:ssh-public-key-format")) {
if (!strcmp(private_key_format, "infix-crypto-types:rsa-private-key-format") &&
!strcmp(public_key_format, "infix-crypto-types:ssh-public-key-format")) {
char *pub_key = NULL, *priv_key = NULL, *name;
name = srx_get_str(session, "%s/name", entry->xpath);
src/confd/src/infix-services.c
+4 -4
View File
@@ -21,7 +21,7 @@
#define SSH_HOSTKEYS "/etc/ssh/hostkeys"
#define SSH_HOSTKEYS_NEXT SSH_HOSTKEYS"+"
#define LLDP_CONFIG "/etc/lldpd.d/confd.conf"
#define LLDP_CONFIG_NEXT LLDP_CONFIG"+"
@@ -354,7 +354,7 @@ static int lldp_change(sr_session_ctx_t *session, uint32_t sub_id, const char *m
else
if (erase(LLDP_CONFIG))
ERRNO("Failed to remove old %s", LLDP_CONFIG);
svc_change(session, event, xpath, "lldp", "lldpd");
break;
@@ -553,12 +553,12 @@ static int change_keystore_cb(sr_session_ctx_t *session, uint32_t sub_id, const
private_key_type = lydx_get_cattr(change, "private-key-format");
public_key_type = lydx_get_cattr(change, "public-key-format");
if (strcmp(private_key_type, "ietf-crypto-types:rsa-private-key-format")) {
if (strcmp(private_key_type, "infix-crypto-types:rsa-private-key-format")) {
INFO("Private key %s is not of SSH type", name);
continue;
}
if (strcmp(public_key_type, "ietf-crypto-types:ssh-public-key-format")) {
if (strcmp(public_key_type, "infix-crypto-types:ssh-public-key-format")) {
INFO("Public key %s is not of SSH type", name);
continue;
}
src/confd/yang/confd.inc
+2
View File
@@ -40,6 +40,8 @@ MODULES=(
"infix-ethernet-interface@2024-02-27.yang"
"infix-factory-default@2023-06-28.yang"
"infix-interfaces@2025-01-08.yang -e vlan-filtering"
"infix-crypto-types@2025-02-04.yang"
"infix-keystore@2025-02-04.yang"
# from rousette
"ietf-restconf@2017-01-26.yang"
src/confd/yang/infix-crypto-types.yang
+27
View File
@@ -0,0 +1,27 @@
module infix-crypto-types {
yang-version 1.1;
namespace "urn:infix:crypto-types:ns:yang:1.0";
prefix infix-ct;
import ietf-crypto-types {
prefix ct;
}
revision 2025-02-04 {
description "Initial";
}
identity private-key-format {
description
"Base key-format identity for private keys.";
}
identity public-key-format {
description
"Base key-format identity for public keys.";
}
identity rsa-private-key-format {
base private-key-format;
base ct:rsa-private-key-format;
}
identity ssh-public-key-format {
base public-key-format;
base ct:ssh-public-key-format;
}
}
src/confd/yang/infix-crypto-types@2025-02-04.yang
Symlink
+1
View File
@@ -0,0 +1 @@
infix-crypto-types.yang
src/confd/yang/infix-keystore.yang
+28
View File
@@ -0,0 +1,28 @@
module infix-keystore {
yang-version 1.1;
namespace "urn:infix:keystore:ns:yang:1.0";
prefix infix-ks;
import ietf-keystore {
prefix ks;
}
import infix-crypto-types {
prefix infix-ct;
}
revision 2025-02-04 {
description "Initial";
}
deviation "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:public-key-format" {
deviate replace {
type identityref {
base infix-ct:public-key-format;
}
}
}
deviation "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:private-key-format" {
deviate replace {
type identityref {
base infix-ct:private-key-format;
}
}
}
}
src/confd/yang/infix-keystore@2025-02-04.yang
Symlink
+1
View File
@@ -0,0 +1 @@
infix-keystore.yang
src/confd/yang/infix-services.yang
+4 -4
View File
@@ -11,8 +11,8 @@ module infix-services {
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-crypto-types {
prefix ct;
import infix-crypto-types {
prefix infix-ct;
reference
"RFC 9640: YANG Data Types and Groupings for Cryptography";
}
@@ -139,8 +139,8 @@ module infix-services {
The hostkey can be shared with NETCONF, by default 'genkey' is used.";
must "not(deref(.)/../ks:public-key-format) or "
+ "(derived-from-or-self(deref(.)/../ks:public-key-format, 'ct:ssh-public-key-format') and"
+ "derived-from-or-self(deref(.)/../ks:private-key-format, 'ct:rsa-private-key-format'))" {
+ "(derived-from-or-self(deref(.)/../ks:public-key-format, 'infix-ct:ssh-public-key-format') and"
+ "derived-from-or-self(deref(.)/../ks:private-key-format, 'infix-ct:rsa-private-key-format'))" {
error-message "Only RSA hostkeys are supported.";
}
type ks:asymmetric-key-ref;
test/case/infix_services/ssh_server_config/test.py
+2 -2
View File
@@ -47,9 +47,9 @@ with infamy.Test() as test:
"asymmetric-key": [
{
"name": "test-host-key",
"public-key-format": "ietf-crypto-types:ssh-public-key-format",
"public-key-format": "infix-crypto-types:ssh-public-key-format",
"public-key": PUBLIC_KEY,
"private-key-format": "ietf-crypto-types:rsa-private-key-format",
"private-key-format": "infix-crypto-types:rsa-private-key-format",
"cleartext-private-key": PRIVATE_KEY
}
]