From efec5f57cd42e57b03a1c1f7a27c297e85a4f365 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Mon, 8 Apr 2024 23:41:42 +0200 Subject: [PATCH] confd: make web server and web console interface configurable This commit adds an initial YANG model for Infix web services under the infix-services.yang umbrella. For now the nginx server statements in /etc/nginx/nginx.conf are always on, but the backend ttyd, and the entire nginx server can be disabled. The default in the YANG model for both is disabled, the factory-config has been updated to enable these services by default. The Web Console Interface mDNS service has been updated to advertise on port 7681, which nginx is set to forward to ttyd. Signed-off-by: Joachim Wiberg --- board/common/nginx.conf | 38 ++++++++---- board/common/post-build.sh | 1 - .../rootfs/etc/finit.d/available/ttyd.conf | 2 +- .../rootfs/etc/finit.d/enabled/ttyd.conf | 1 - board/common/ssl.conf | 3 - package/netbrowse/netbrowse.mk | 1 - src/confd/bin/bootstrap | 2 +- .../share/factory.d/10-infix-system.json | 14 +++++ src/confd/share/factory.d/10-system.json | 6 -- src/confd/share/factory.d/Makefile.am | 4 +- src/confd/src/ietf-system.c | 2 +- src/confd/src/infix-services.c | 37 +++++++++--- src/confd/yang/infix-services@2023-10-16.yang | 32 ---------- src/confd/yang/infix-services@2024-04-08.yang | 60 +++++++++++++++++++ 14 files changed, 135 insertions(+), 68 deletions(-) delete mode 120000 board/common/rootfs/etc/finit.d/enabled/ttyd.conf create mode 100644 src/confd/share/factory.d/10-infix-system.json delete mode 100644 src/confd/yang/infix-services@2023-10-16.yang create mode 100644 src/confd/yang/infix-services@2024-04-08.yang diff --git a/board/common/nginx.conf b/board/common/nginx.conf index c2759be5..5227e600 100644 --- a/board/common/nginx.conf +++ b/board/common/nginx.conf @@ -25,8 +25,10 @@ http { } server { - include ssl.conf; + listen 443 ssl; + listen [::]:443 ssl; server_name _; + include ssl.conf; #error_page 404 /404.html; @@ -41,25 +43,37 @@ http { root html; index index.html index.htm; } - - location ~ ^/console(.*)$ { - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_pass http://127.0.0.1:7681/$1; - } } server { + listen 7681 ssl; + listen [::]:7681 ssl; + server_name _; + include ssl.conf; + + location / { + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_pass http://127.0.0.1:7681; + proxy_redirect off; + } + } + + server { + listen 443 ssl; + listen [::]:443 ssl; server_name network.local; + include ssl.conf; location / { include netbrowse.conf; - } + } } access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info; diff --git a/board/common/post-build.sh b/board/common/post-build.sh index b28c377a..70941714 100755 --- a/board/common/post-build.sh +++ b/board/common/post-build.sh @@ -90,5 +90,4 @@ if [ -n "$BR2_PACKAGE_NGINX" ]; then cp "$common/netbrowse.conf" "$TARGET_DIR/etc/nginx/" cp "$common/nginx.conf" "$TARGET_DIR/etc/nginx/" cp "$common/ssl.conf" "$TARGET_DIR/etc/nginx/" - ln -sf ../available/nginx.conf "$TARGET_DIR/etc/finit.d/enabled/nginx.conf" fi diff --git a/board/common/rootfs/etc/finit.d/available/ttyd.conf b/board/common/rootfs/etc/finit.d/available/ttyd.conf index da12f0ed..72d7fffe 100644 --- a/board/common/rootfs/etc/finit.d/available/ttyd.conf +++ b/board/common/rootfs/etc/finit.d/available/ttyd.conf @@ -1 +1 @@ -service [2345] ttyd login -- Web terminal daemon (ttyd) +service [2345] ttyd -i lo -p 7681 login -- Web terminal daemon (ttyd) diff --git a/board/common/rootfs/etc/finit.d/enabled/ttyd.conf b/board/common/rootfs/etc/finit.d/enabled/ttyd.conf deleted file mode 120000 index 9d29291b..00000000 --- a/board/common/rootfs/etc/finit.d/enabled/ttyd.conf +++ /dev/null @@ -1 +0,0 @@ -../available/ttyd.conf \ No newline at end of file diff --git a/board/common/ssl.conf b/board/common/ssl.conf index b518e087..a9b06df9 100644 --- a/board/common/ssl.conf +++ b/board/common/ssl.conf @@ -1,6 +1,3 @@ -listen 443 ssl; -listen [::]:443 ssl; - ssl_certificate /etc/ssl/certs/self-signed.crt; ssl_certificate_key /etc/ssl/private/self-signed.key; diff --git a/package/netbrowse/netbrowse.mk b/package/netbrowse/netbrowse.mk index c2900c27..a5dd30db 100644 --- a/package/netbrowse/netbrowse.mk +++ b/package/netbrowse/netbrowse.mk @@ -15,7 +15,6 @@ NETBROWSE_REDISTRIBUTE = NO define NETBROWSE_INSTALL_EXTRA $(INSTALL) -D -m 0644 $(NETBROWSE_PKGDIR)/netbrowse.svc \ $(FINIT_D)/available/netbrowse.conf - ln -sf ../available/netbrowse.conf $(FINIT_D)/enabled/netbrowse.conf $(INSTALL) -d -m 755 $(TARGET_DIR)/etc/default echo "NETBROWSE_ARGS=\"network.local $(BR2_TARGET_GENERIC_HOSTNAME).local\"" \ > $(TARGET_DIR)/etc/default/netbrowse diff --git a/src/confd/bin/bootstrap b/src/confd/bin/bootstrap index ef51c056..d96dd2a9 100755 --- a/src/confd/bin/bootstrap +++ b/src/confd/bin/bootstrap @@ -226,7 +226,7 @@ sysrepoctl -s $SEARCH \ -i infix-dhcp-client@2024-01-30.yang -g wheel -p 0660 \ -i infix-shell-type@2023-08-21.yang -g wheel -p 0660 \ -i infix-system@2024-02-29.yang -g wheel -p 0660 \ - -i infix-services@2023-10-16.yang -g wheel -p 0660 \ + -i infix-services@2024-04-08.yang -g wheel -p 0660 \ -i ieee802-ethernet-interface@2019-06-21.yang -g wheel -p 0660 \ -i infix-ethernet-interface@2024-02-27.yang -g wheel -p 0660 \ -I "${INIT_DATA}" diff --git a/src/confd/share/factory.d/10-infix-system.json b/src/confd/share/factory.d/10-infix-system.json new file mode 100644 index 00000000..96fc917f --- /dev/null +++ b/src/confd/share/factory.d/10-infix-system.json @@ -0,0 +1,14 @@ +{ + "ieee802-dot1ab-lldp:lldp": { + "infix-lldp:enabled": true + }, + "infix-services:mdns": { + "enabled": true + }, + "infix-services:web": { + "enabled": true, + "console": { + "enabled": true + } + } +} diff --git a/src/confd/share/factory.d/10-system.json b/src/confd/share/factory.d/10-system.json index 0291145c..71796301 100644 --- a/src/confd/share/factory.d/10-system.json +++ b/src/confd/share/factory.d/10-system.json @@ -1,11 +1,5 @@ { "ietf-system:system": { "hostname": "infix" - }, - "ieee802-dot1ab-lldp:lldp": { - "infix-lldp:enabled": true - }, - "infix-services:mdns": { - "enabled": true } } diff --git a/src/confd/share/factory.d/Makefile.am b/src/confd/share/factory.d/Makefile.am index 84bcf82c..8c42d8f1 100644 --- a/src/confd/share/factory.d/Makefile.am +++ b/src/confd/share/factory.d/Makefile.am @@ -1,3 +1,3 @@ factorydir = $(pkgdatadir)/factory.d -dist_factory_DATA = 10-nacm.json \ - 10-netconf-server.json 10-system.json +dist_factory_DATA = 10-nacm.json 10-netconf-server.json \ + 10-infix-system.json 10-system.json diff --git a/src/confd/src/ietf-system.c b/src/confd/src/ietf-system.c index 5dea1a35..f99f81c3 100644 --- a/src/confd/src/ietf-system.c +++ b/src/confd/src/ietf-system.c @@ -1158,7 +1158,7 @@ static void mdns_records(const char *hostname) { struct mdns_svc svc[] = { { "https", "_https._tcp", 443, "Web Management Interface", "adminurl=https://%s.local" }, - { "ttyd", "_https._tcp", 443, "Web Console Interface", "adminurl=https://%s.local/console" }, + { "ttyd", "_https._tcp", 443, "Web Console Interface", "adminurl=https://%s.local:7681" }, { "http", "_http._tcp", 80, "Web Management Interface", "adminurl=http://%s.local" }, { "netconf", "_netconf-ssh._tcp", 830, "NETCONF (XML/SSH)", NULL }, { "sftp-ssh","_sftp-ssh._tcp", 22, "Secure file transfer (FTP/SSH)", NULL }, diff --git a/src/confd/src/infix-services.c b/src/confd/src/infix-services.c index ea2cc8d4..189193fa 100644 --- a/src/confd/src/infix-services.c +++ b/src/confd/src/infix-services.c @@ -3,6 +3,7 @@ #include #include #include +#include #include #include #include @@ -16,19 +17,21 @@ static const struct srx_module_requirement reqs[] = { - { .dir = YANG_PATH_, .name = "infix-services", .rev = "2023-10-16" }, + { .dir = YANG_PATH_, .name = "infix-services", .rev = "2024-04-08" }, { .dir = YANG_PATH_, .name = "ieee802-dot1ab-lldp", .rev = "2022-03-15" }, { .dir = YANG_PATH_, .name = "infix-lldp", .rev = "2023-08-23" }, { NULL } }; static int svc_change(sr_session_ctx_t *session, sr_event_t event, const char *xpath, - const char *name, const char *svc) + const char *name, const char *sub, ...) { char path[strlen(xpath) + 10]; struct lyd_node *diff, *srv; sr_error_t err = 0; + const char *svc; sr_data_t *cfg; + va_list ap; int ena; switch (event) { @@ -51,15 +54,19 @@ static int svc_change(sr_session_ctx_t *session, sr_event_t event, const char *x if (err) goto err_release_data; - srv = lydx_get_descendant(cfg->tree, name, NULL); + srv = lydx_get_descendant(cfg->tree, name, sub, NULL); if (!srv) { ERROR("Cannot find %s subtree", name); return -1; } ena = lydx_is_enabled(srv, "enabled"); - if (systemf("initctl -nbq %s %s", ena ? "enable" : "disable", svc)) - ERROR("Failed %s %s", ena ? "enabling" : "disabling", name); + va_start(ap, sub); + while ((svc = va_arg(ap, const char *))) { + if (systemf("initctl -nbq %s %s", ena ? "enable" : "disable", svc)) + ERROR("Failed %s %s", ena ? "enabling" : "disabling", name); + } + va_end(ap); lyd_free_tree(diff); err_release_data: @@ -72,13 +79,25 @@ err_abandon: static int mdns_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, const char *xpath, sr_event_t event, unsigned request_id, void *_confd) { - return svc_change(session, event, xpath, "mdns", "avahi"); + return svc_change(session, event, xpath, "mdns", NULL, "avahi", NULL); +} + +static int ttyd_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, + const char *xpath, sr_event_t event, unsigned request_id, void *_confd) +{ + return svc_change(session, event, xpath, "web", "console", "ttyd", NULL); } static int lldp_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, const char *xpath, sr_event_t event, unsigned request_id, void *_confd) { - return svc_change(session, event, xpath, "lldp", "lldpd"); + return svc_change(session, event, xpath, "lldp", NULL, "lldpd", NULL); +} + +static int web_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, + const char *xpath, sr_event_t event, unsigned request_id, void *_confd) +{ + return svc_change(session, event, xpath, "web", NULL, "nginx", "ttyd", "netbrowse", NULL); } int infix_services_init(struct confd *confd) @@ -91,6 +110,10 @@ int infix_services_init(struct confd *confd) REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:mdns", 0, mdns_change, confd, &confd->sub); + REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:web", + 0, web_change, confd, &confd->sub); + REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:web/infix-services:console", + 0, ttyd_change, confd, &confd->sub); REGISTER_CHANGE(confd->session, "ieee802-dot1ab-lldp", "/ieee802-dot1ab-lldp:lldp", 0, lldp_change, confd, &confd->sub); diff --git a/src/confd/yang/infix-services@2023-10-16.yang b/src/confd/yang/infix-services@2023-10-16.yang deleted file mode 100644 index 7f681f38..00000000 --- a/src/confd/yang/infix-services@2023-10-16.yang +++ /dev/null @@ -1,32 +0,0 @@ -module infix-services { - yang-version 1.1; - namespace "urn:ietf:params:xml:ns:yang:infix-services"; - prefix infix-svc; - - organization "KernelKit"; - contact "kernelkit@googlegroups.com"; - description "Infix services, generic."; - - revision 2023-10-16 { - description "Drop SSDP support, mDNS-SD is now available in Windows 10."; - reference "internal"; - } - - revision 2023-08-22 { - description "Initial revision, add SSDP and mDNS-SD enable/disable only."; - reference "internal"; - } - - /* - * Data nodes - */ - - container mdns { - description "Advertise system and services over mDNS-SD, IPv4 and IPv6."; - - leaf enabled { - type boolean; - description "Globally enable or disable mDNS/SD on all interfaces."; - } - } -} diff --git a/src/confd/yang/infix-services@2024-04-08.yang b/src/confd/yang/infix-services@2024-04-08.yang new file mode 100644 index 00000000..c8640a02 --- /dev/null +++ b/src/confd/yang/infix-services@2024-04-08.yang @@ -0,0 +1,60 @@ +module infix-services { + yang-version 1.1; + namespace "urn:ietf:params:xml:ns:yang:infix-services"; + prefix infix-svc; + + organization "KernelKit"; + contact "kernelkit@googlegroups.com"; + description "Infix services, generic."; + + revision 2024-04-08 { + description "Initial support for web services."; + reference "internal"; + } + revision 2023-10-16 { + description "Drop SSDP support, mDNS-SD is now available in Windows 10."; + reference "internal"; + } + revision 2023-08-22 { + description "Initial revision, add SSDP and mDNS-SD enable/disable only."; + reference "internal"; + } + + /* + * Data nodes + */ + + container mdns { + description "Advertise system and services over mDNS-SD, IPv4 and IPv6."; + + leaf enabled { + description "Globally enable or disable mDNS/SD on all interfaces."; + type boolean; + } + } + + container web { + description "Web services"; + + leaf enabled { + description "Enable or disable on all web services. + + Enabling this setting activates a web proxy server reponsible + for routing requests to other web applications, as well as it + redirecting all insecure HTTP requests to HTTPS. + + Disabling this setting disables the web proxy server and all + other services/applications that run behind it."; + type boolean; + } + + container console { + description "Web console interface."; + + leaf enabled { + description "Enable or disable web console interface on port 7681."; + type boolean; + } + } + } +}