diff --git a/doc/ChangeLog.md b/doc/ChangeLog.md index ed85c07d..30d0799f 100644 --- a/doc/ChangeLog.md +++ b/doc/ChangeLog.md @@ -4,6 +4,16 @@ Change Log All notable changes to the project are documented in this file. +[v25.02.0][UNRELASED] - +------------------------- + +### Changes + - YANG type for SSH private/public keys has changed, from + ietf-crypto-types to infix-crypto-types + +### Fixes + + [v25.01.0][] - 2025-01-31 ------------------------- diff --git a/package/confd/confd.mk b/package/confd/confd.mk index caa806fb..a194fd61 100644 --- a/package/confd/confd.mk +++ b/package/confd/confd.mk @@ -4,7 +4,7 @@ # ################################################################################ -CONFD_VERSION = 1.4 +CONFD_VERSION = 1.5 CONFD_SITE_METHOD = local CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd CONFD_LICENSE = BSD-3-Clause diff --git a/patches/netopeer2/2.2.35/0001-Allow-factory-as-copy-from-only-in-rpc-copy-config.patch b/patches/netopeer2/2.2.35/0001-Allow-factory-as-copy-from-only-in-rpc-copy-config.patch index eeb366c1..97c02332 100644 --- a/patches/netopeer2/2.2.35/0001-Allow-factory-as-copy-from-only-in-rpc-copy-config.patch +++ b/patches/netopeer2/2.2.35/0001-Allow-factory-as-copy-from-only-in-rpc-copy-config.patch @@ -1,11 +1,11 @@ From 2950046cd17bf9296a0b70b8f6b38114f6985864 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Thu, 22 Jun 2023 10:24:57 +0200 -Subject: [PATCH 1/3] Allow 'factory' as copy-from (only) in rpc copy-config +Subject: [PATCH 1/4] Allow 'factory' as copy-from (only) in rpc copy-config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit -Organization: Addiva Elektronik +Organization: Wires Signed-off-by: Joachim Wiberg Signed-off-by: Mattias Walström diff --git a/patches/netopeer2/2.2.35/0002-Disable-local-users-backwards-compat-with-older-mode.patch b/patches/netopeer2/2.2.35/0002-Disable-local-users-backwards-compat-with-older-mode.patch index 8aaf43e8..eb04b2d3 100644 --- a/patches/netopeer2/2.2.35/0002-Disable-local-users-backwards-compat-with-older-mode.patch +++ b/patches/netopeer2/2.2.35/0002-Disable-local-users-backwards-compat-with-older-mode.patch @@ -1,11 +1,11 @@ From d2e4e60838761e2bdd02d651b8e0bea47cc2dcb5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= Date: Tue, 2 Jul 2024 14:56:15 +0200 -Subject: [PATCH 2/3] Disable local users (backwards compat with older model) +Subject: [PATCH 2/4] Disable local users (backwards compat with older model) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit -Organization: Addiva Elektronik +Organization: Wires Drop local-users, because if enabled netopeer require all users that should be allowed to use NETCONF to also be configured in the updated diff --git a/patches/netopeer2/2.2.35/0003-Do-not-generate-data-in-sysrepo.patch b/patches/netopeer2/2.2.35/0003-Do-not-generate-data-in-sysrepo.patch new file mode 100644 index 00000000..81381fa8 --- /dev/null +++ b/patches/netopeer2/2.2.35/0003-Do-not-generate-data-in-sysrepo.patch @@ -0,0 +1,72 @@ +From 2f09813c91def7672c036c7f713302cb3a12cf18 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= +Date: Tue, 4 Feb 2025 20:14:50 +0100 +Subject: [PATCH 4/4] Do not generate data in sysrepo +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Organization: Wires + +We generate the host keys and configuration for netconf on boot, do not generate anything when +building/installing netopeer2 + +Signed-off-by: Mattias Walström +--- + CMakeLists.txt | 40 ---------------------------------------- + 1 file changed, 40 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 4341be1..f1c4ae8 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -383,47 +383,7 @@ if(SYSREPO_SETUP) + message(FATAL_ERROR \" OUTPUT:\\n \${CMD_OUT_F}\\n ERROR:\\n \${CMD_ERR_F}\") + endif() + ") +- +- # generate hostkey +- install(CODE " +- message(STATUS \"Generating a new RSA host key \\\"genkey\\\" if not already added (merge_hostkey.sh)...\") +- set(ENV{SYSREPOCTL_EXECUTABLE} \"${SYSREPOCTL_EXECUTABLE}\") +- set(ENV{SYSREPOCFG_EXECUTABLE} \"${SYSREPOCFG_EXECUTABLE}\") +- execute_process(COMMAND \"\$ENV{DESTDIR}${DATA_DIR}/scripts/merge_hostkey.sh\" +- RESULT_VARIABLE CMD_RES +- OUTPUT_VARIABLE CMD_OUT +- ERROR_VARIABLE CMD_ERR +- OUTPUT_STRIP_TRAILING_WHITESPACE +- ERROR_STRIP_TRAILING_WHITESPACE) +- if(NOT CMD_RES EQUAL 0) +- string(REPLACE \"\\n\" \"\\n \" CMD_OUT_F \"\${CMD_OUT}\") +- string(REPLACE \"\\n\" \"\\n \" CMD_ERR_F \"\${CMD_ERR}\") +- message(FATAL_ERROR \" OUTPUT:\\n \${CMD_OUT_F}\\n ERROR:\\n \${CMD_ERR_F}\") +- endif() +- ") +- +- # merge listen config +- install(CODE " +- message(STATUS \"Merging default server listen configuration if there is none (merge_config.sh)...\") +- set(ENV{SYSREPOCTL_EXECUTABLE} \"${SYSREPOCTL_EXECUTABLE}\") +- set(ENV{SYSREPOCFG_EXECUTABLE} \"${SYSREPOCFG_EXECUTABLE}\") +- set(ENV{NP2_VERSION} \"${NP2SRV_VERSION}\") +- execute_process(COMMAND \"\$ENV{DESTDIR}${DATA_DIR}/scripts/merge_config.sh\" +- RESULT_VARIABLE CMD_RES +- OUTPUT_VARIABLE CMD_OUT +- ERROR_VARIABLE CMD_ERR +- OUTPUT_STRIP_TRAILING_WHITESPACE +- ERROR_STRIP_TRAILING_WHITESPACE) +- if(NOT CMD_RES EQUAL 0) +- string(REPLACE \"\\n\" \"\\n \" CMD_OUT_F \"\${CMD_OUT}\") +- string(REPLACE \"\\n\" \"\\n \" CMD_ERR_F \"\${CMD_ERR}\") +- message(FATAL_ERROR \" OUTPUT:\\n \${CMD_OUT_F}\\n ERROR:\\n \${CMD_ERR_F}\") +- endif() +- ") +-else() +- message(WARNING "Server will refuse to start if the modules are not installed!") + endif() +- + # tests + if(ENABLE_TESTS OR (BUILD_NETOPEER2_LIB AND NETOPEER2_LIB_TESTS)) + if(ENABLE_TESTS) +-- +2.43.0 + diff --git a/src/confd/configure.ac b/src/confd/configure.ac index ec6e01c1..2825e9f6 100644 --- a/src/confd/configure.ac +++ b/src/confd/configure.ac @@ -1,6 +1,6 @@ AC_PREREQ(2.61) # confd version is same as system YANG model version, step on breaking changes -AC_INIT([confd], [1.4], [https://github.com/kernelkit/infix/issues]) +AC_INIT([confd], [1.5], [https://github.com/kernelkit/infix/issues]) AM_INIT_AUTOMAKE(1.11 foreign subdir-objects) AM_SILENT_RULES(yes) @@ -18,6 +18,7 @@ AC_CONFIG_FILES([ share/migrate/1.2/Makefile share/migrate/1.3/Makefile share/migrate/1.4/Makefile + share/migrate/1.5/Makefile src/Makefile yang/Makefile ]) diff --git a/src/confd/share/factory.d/10-netconf-server.json b/src/confd/share/factory.d/10-netconf-server.json index 4816e9ce..4bd392c9 100644 --- a/src/confd/share/factory.d/10-netconf-server.json +++ b/src/confd/share/factory.d/10-netconf-server.json @@ -4,9 +4,9 @@ "asymmetric-key": [ { "name": "genkey", - "public-key-format": "ietf-crypto-types:ssh-public-key-format", + "public-key-format": "infix-crypto-types:ssh-public-key-format", "public-key": "", - "private-key-format": "ietf-crypto-types:rsa-private-key-format", + "private-key-format": "infix-crypto-types:rsa-private-key-format", "cleartext-private-key": "", "certificates": {} } diff --git a/src/confd/share/migrate/1.5/10-change-key-types.sh b/src/confd/share/migrate/1.5/10-change-key-types.sh new file mode 100755 index 00000000..7f802007 --- /dev/null +++ b/src/confd/share/migrate/1.5/10-change-key-types.sh @@ -0,0 +1,12 @@ +#!/bin/sh +# Rename SSH key type in keystore, from ietf-crypto-types to infix-crypto-types +# + +file=$1 +temp=${file}.tmp + +jq '.["ietf-keystore:keystore"]["asymmetric-keys"]["asymmetric-key"][] |= ( + .["public-key-format"] |= sub("ietf-crypto-types";"infix-crypto-types") | + .["private-key-format"] |= sub("ietf-crypto-types";"infix-crypto-types"))' "$file" > "$temp" && + mv "$temp" "$file" + diff --git a/src/confd/share/migrate/1.5/Makefile.am b/src/confd/share/migrate/1.5/Makefile.am new file mode 100644 index 00000000..a9df1512 --- /dev/null +++ b/src/confd/share/migrate/1.5/Makefile.am @@ -0,0 +1,2 @@ +migratedir = $(pkgdatadir)/migrate/1.5 +dist_migrate_DATA = 10-change-key-types.sh diff --git a/src/confd/share/migrate/Makefile.am b/src/confd/share/migrate/Makefile.am index 8c546823..63b1adf7 100644 --- a/src/confd/share/migrate/Makefile.am +++ b/src/confd/share/migrate/Makefile.am @@ -1,2 +1,2 @@ -SUBDIRS = 1.0 1.1 1.2 1.3 1.4 +SUBDIRS = 1.0 1.1 1.2 1.3 1.4 1.5 migratedir = $(pkgdatadir)/migrate diff --git a/src/confd/src/ietf-keystore.c b/src/confd/src/ietf-keystore.c index b0fac62d..f078526b 100644 --- a/src/confd/src/ietf-keystore.c +++ b/src/confd/src/ietf-keystore.c @@ -88,8 +88,8 @@ static int change_cb(sr_session_ctx_t *session, uint32_t sub_id, const char *mod continue; } - if (!strcmp(private_key_format, "ietf-crypto-types:rsa-private-key-format") && - !strcmp(public_key_format, "ietf-crypto-types:ssh-public-key-format")) { + if (!strcmp(private_key_format, "infix-crypto-types:rsa-private-key-format") && + !strcmp(public_key_format, "infix-crypto-types:ssh-public-key-format")) { char *pub_key = NULL, *priv_key = NULL, *name; name = srx_get_str(session, "%s/name", entry->xpath); diff --git a/src/confd/src/infix-services.c b/src/confd/src/infix-services.c index 2c7ab8a1..13046bb1 100644 --- a/src/confd/src/infix-services.c +++ b/src/confd/src/infix-services.c @@ -21,7 +21,7 @@ #define SSH_HOSTKEYS "/etc/ssh/hostkeys" #define SSH_HOSTKEYS_NEXT SSH_HOSTKEYS"+" - + #define LLDP_CONFIG "/etc/lldpd.d/confd.conf" #define LLDP_CONFIG_NEXT LLDP_CONFIG"+" @@ -354,7 +354,7 @@ static int lldp_change(sr_session_ctx_t *session, uint32_t sub_id, const char *m else if (erase(LLDP_CONFIG)) ERRNO("Failed to remove old %s", LLDP_CONFIG); - + svc_change(session, event, xpath, "lldp", "lldpd"); break; @@ -553,12 +553,12 @@ static int change_keystore_cb(sr_session_ctx_t *session, uint32_t sub_id, const private_key_type = lydx_get_cattr(change, "private-key-format"); public_key_type = lydx_get_cattr(change, "public-key-format"); - if (strcmp(private_key_type, "ietf-crypto-types:rsa-private-key-format")) { + if (strcmp(private_key_type, "infix-crypto-types:rsa-private-key-format")) { INFO("Private key %s is not of SSH type", name); continue; } - if (strcmp(public_key_type, "ietf-crypto-types:ssh-public-key-format")) { + if (strcmp(public_key_type, "infix-crypto-types:ssh-public-key-format")) { INFO("Public key %s is not of SSH type", name); continue; } diff --git a/src/confd/yang/confd.inc b/src/confd/yang/confd.inc index 4f07fe71..e48c492f 100644 --- a/src/confd/yang/confd.inc +++ b/src/confd/yang/confd.inc @@ -40,6 +40,8 @@ MODULES=( "infix-ethernet-interface@2024-02-27.yang" "infix-factory-default@2023-06-28.yang" "infix-interfaces@2025-01-08.yang -e vlan-filtering" + "infix-crypto-types@2025-02-04.yang" + "infix-keystore@2025-02-04.yang" # from rousette "ietf-restconf@2017-01-26.yang" diff --git a/src/confd/yang/infix-crypto-types.yang b/src/confd/yang/infix-crypto-types.yang new file mode 100644 index 00000000..4ad7a2d8 --- /dev/null +++ b/src/confd/yang/infix-crypto-types.yang @@ -0,0 +1,27 @@ +module infix-crypto-types { + yang-version 1.1; + namespace "urn:infix:crypto-types:ns:yang:1.0"; + prefix infix-ct; + import ietf-crypto-types { + prefix ct; + } + revision 2025-02-04 { + description "Initial"; + } + identity private-key-format { + description + "Base key-format identity for private keys."; + } + identity public-key-format { + description + "Base key-format identity for public keys."; + } + identity rsa-private-key-format { + base private-key-format; + base ct:rsa-private-key-format; + } + identity ssh-public-key-format { + base public-key-format; + base ct:ssh-public-key-format; + } +} diff --git a/src/confd/yang/infix-crypto-types@2025-02-04.yang b/src/confd/yang/infix-crypto-types@2025-02-04.yang new file mode 120000 index 00000000..b6fa785b --- /dev/null +++ b/src/confd/yang/infix-crypto-types@2025-02-04.yang @@ -0,0 +1 @@ +infix-crypto-types.yang \ No newline at end of file diff --git a/src/confd/yang/infix-keystore.yang b/src/confd/yang/infix-keystore.yang new file mode 100644 index 00000000..6a33633c --- /dev/null +++ b/src/confd/yang/infix-keystore.yang @@ -0,0 +1,28 @@ +module infix-keystore { + yang-version 1.1; + namespace "urn:infix:keystore:ns:yang:1.0"; + prefix infix-ks; + import ietf-keystore { + prefix ks; + } + import infix-crypto-types { + prefix infix-ct; + } + revision 2025-02-04 { + description "Initial"; + } + deviation "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:public-key-format" { + deviate replace { + type identityref { + base infix-ct:public-key-format; + } + } + } + deviation "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:private-key-format" { + deviate replace { + type identityref { + base infix-ct:private-key-format; + } + } + } +} diff --git a/src/confd/yang/infix-keystore@2025-02-04.yang b/src/confd/yang/infix-keystore@2025-02-04.yang new file mode 120000 index 00000000..e0f3afa6 --- /dev/null +++ b/src/confd/yang/infix-keystore@2025-02-04.yang @@ -0,0 +1 @@ +infix-keystore.yang \ No newline at end of file diff --git a/src/confd/yang/infix-services.yang b/src/confd/yang/infix-services.yang index 311f7cc3..86ce2059 100644 --- a/src/confd/yang/infix-services.yang +++ b/src/confd/yang/infix-services.yang @@ -11,8 +11,8 @@ module infix-services { reference "RFC 6991: Common YANG Data Types"; } - import ietf-crypto-types { - prefix ct; + import infix-crypto-types { + prefix infix-ct; reference "RFC 9640: YANG Data Types and Groupings for Cryptography"; } @@ -139,8 +139,8 @@ module infix-services { The hostkey can be shared with NETCONF, by default 'genkey' is used."; must "not(deref(.)/../ks:public-key-format) or " - + "(derived-from-or-self(deref(.)/../ks:public-key-format, 'ct:ssh-public-key-format') and" - + "derived-from-or-self(deref(.)/../ks:private-key-format, 'ct:rsa-private-key-format'))" { + + "(derived-from-or-self(deref(.)/../ks:public-key-format, 'infix-ct:ssh-public-key-format') and" + + "derived-from-or-self(deref(.)/../ks:private-key-format, 'infix-ct:rsa-private-key-format'))" { error-message "Only RSA hostkeys are supported."; } type ks:asymmetric-key-ref; diff --git a/test/case/infix_services/ssh_server_config/test.py b/test/case/infix_services/ssh_server_config/test.py index 72f72da2..d8026135 100755 --- a/test/case/infix_services/ssh_server_config/test.py +++ b/test/case/infix_services/ssh_server_config/test.py @@ -47,9 +47,9 @@ with infamy.Test() as test: "asymmetric-key": [ { "name": "test-host-key", - "public-key-format": "ietf-crypto-types:ssh-public-key-format", + "public-key-format": "infix-crypto-types:ssh-public-key-format", "public-key": PUBLIC_KEY, - "private-key-format": "ietf-crypto-types:rsa-private-key-format", + "private-key-format": "infix-crypto-types:rsa-private-key-format", "cleartext-private-key": PRIVATE_KEY } ]