diff --git a/board/common/rootfs/etc/finit.d/available/restconf.conf b/board/common/rootfs/etc/finit.d/available/restconf.conf new file mode 100644 index 00000000..282dfae0 --- /dev/null +++ b/board/common/rootfs/etc/finit.d/available/restconf.conf @@ -0,0 +1,3 @@ +service name:rousette notify:none log \ + [12345] rousette \ + -- RESTCONF server diff --git a/board/common/rootfs/etc/nginx/app/.empty b/board/common/rootfs/etc/nginx/app/.empty new file mode 100644 index 00000000..e69de29b diff --git a/board/common/rootfs/etc/nginx/available/default.conf b/board/common/rootfs/etc/nginx/available/default.conf index ae759950..76a2552e 100644 --- a/board/common/rootfs/etc/nginx/available/default.conf +++ b/board/common/rootfs/etc/nginx/available/default.conf @@ -24,4 +24,6 @@ server { root html; index index.html index.htm; } + + include /etc/nginx/app/*.conf; } diff --git a/board/common/rootfs/etc/nginx/available/netbrowse.conf b/board/common/rootfs/etc/nginx/available/netbrowse.conf index 3c729d8e..49b4945b 100644 --- a/board/common/rootfs/etc/nginx/available/netbrowse.conf +++ b/board/common/rootfs/etc/nginx/available/netbrowse.conf @@ -5,14 +5,6 @@ server { include ssl.conf; location / { - proxy_pass http://127.0.0.1:8000; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection 'upgrade'; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_redirect off; + include /etc/nginx/netbrowse.conf; } } diff --git a/board/common/rootfs/etc/nginx/netbrowse.app b/board/common/rootfs/etc/nginx/netbrowse.app new file mode 100644 index 00000000..77c2f064 --- /dev/null +++ b/board/common/rootfs/etc/nginx/netbrowse.app @@ -0,0 +1,6 @@ +location /netbrowse/ { + return 301 /netbrowse; +} +location /netbrowse { + include /etc/nginx/netbrowse.conf; +} diff --git a/board/common/rootfs/etc/nginx/netbrowse.conf b/board/common/rootfs/etc/nginx/netbrowse.conf new file mode 100644 index 00000000..b7528575 --- /dev/null +++ b/board/common/rootfs/etc/nginx/netbrowse.conf @@ -0,0 +1,9 @@ +proxy_pass http://127.0.0.1:8000; +proxy_http_version 1.1; +proxy_set_header Upgrade $http_upgrade; +proxy_set_header Connection 'upgrade'; +proxy_set_header Host $host; +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +proxy_set_header X-Forwarded-Proto $scheme; +proxy_redirect off; diff --git a/board/common/rootfs/etc/nginx/restconf.app b/board/common/rootfs/etc/nginx/restconf.app new file mode 100644 index 00000000..a7e337ea --- /dev/null +++ b/board/common/rootfs/etc/nginx/restconf.app @@ -0,0 +1,7 @@ +location /restconf/ { + grpc_pass grpc://[::1]:10080; + grpc_set_header Host $host; + grpc_set_header X-Real-IP $remote_addr; + grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + grpc_set_header X-Forwarded-Proto $scheme; +} diff --git a/src/confd/scripts/setup.sh b/src/confd/scripts/setup.sh index 4c55cc31..9c3cfa4e 100755 --- a/src/confd/scripts/setup.sh +++ b/src/confd/scripts/setup.sh @@ -52,7 +52,7 @@ MODULES=( "infix-dhcp-client@2024-04-12.yang" "infix-shell-type@2023-08-21.yang" "infix-system@2024-04-12.yang" - "infix-services@2024-04-08.yang" + "infix-services@2024-05-30.yang" "ieee802-ethernet-interface@2019-06-21.yang" "infix-ethernet-interface@2024-02-27.yang" "infix-factory-default@2023-06-28.yang" diff --git a/src/confd/share/factory.d/10-infix-services.json b/src/confd/share/factory.d/10-infix-services.json index fbeb5155..d8784dd3 100644 --- a/src/confd/share/factory.d/10-infix-services.json +++ b/src/confd/share/factory.d/10-infix-services.json @@ -12,6 +12,9 @@ }, "netbrowse": { "enabled": true + }, + "restconf": { + "enabled": true } } } diff --git a/src/confd/src/infix-services.c b/src/confd/src/infix-services.c index 356766ca..cccd473f 100644 --- a/src/confd/src/infix-services.c +++ b/src/confd/src/infix-services.c @@ -21,6 +21,7 @@ SVC(none) \ SVC(ssh) \ SVC(netconf) \ + SVC(restconf) \ SVC(web) \ SVC(ttyd) \ SVC(netbrowse) \ @@ -42,12 +43,13 @@ struct mdns_svc { char *desc; char *text; } services[] = { - { web, "https", "_https._tcp", 443, "Web Management Interface", "adminurl=https://%s.local" }, - { ttyd, "ttyd", "_https._tcp", 443, "Web Console Interface", "adminurl=https://%s.local:7681" }, - { web, "http", "_http._tcp", 80, "Web Management Interface", "adminurl=http://%s.local" }, - { netconf, "netconf", "_netconf-ssh._tcp", 830, "NETCONF (XML/SSH)", NULL }, - { ssh, "sftp-ssh", "_sftp-ssh._tcp", 22, "Secure file transfer (FTP/SSH)", NULL }, - { ssh, "ssh", "_ssh._tcp", 22, "Secure shell command line interface (CLI)", NULL }, + { web, "https", "_https._tcp", 443, "Web Management Interface", "adminurl=https://%s.local" }, + { ttyd, "ttyd", "_https._tcp", 443, "Web Console Interface", "adminurl=https://%s.local:7681" }, + { web, "http", "_http._tcp", 80, "Web Management Interface", "adminurl=http://%s.local" }, + { netconf, "netconf", "_netconf-ssh._tcp", 830, "NETCONF (XML/SSH)", NULL }, + { restconf, "restconf", "_restconf-tls._tcp", 443, "RESTCONF (JSON/HTTP)", NULL }, + { ssh, "sftp-ssh", "_sftp-ssh._tcp", 22, "Secure file transfer (FTP/SSH)", NULL }, + { ssh, "ssh", "_ssh._tcp", 22, "Secure shell command line interface (CLI)", NULL }, }; /* @@ -139,20 +141,25 @@ static int svc_change(sr_session_ctx_t *session, sr_event_t event, const char *x static void svc_enadis(int ena, svc type, const char *svc) { - int isweb; + int isweb, isapp; if (!svc) svc = name[type]; isweb = fexistf("/etc/nginx/available/%s.conf", svc); + isapp = fexistf("/etc/nginx/%s.app", svc); if (ena) { if (isweb) systemf("ln -sf ../available/%s.conf /etc/nginx/enabled/", svc); + if (isapp) + systemf("ln -sf ../%s.app /etc/nginx/app/%s.conf", svc, svc); systemf("initctl -nbq enable %s", svc); systemf("initctl -nbq touch %s", svc); /* in case already enabled */ } else { if (isweb) systemf("rm -f /etc/nginx/enabled/%s.conf", svc); + if (isapp) + systemf("rm -f /etc/nginx/app/%s.conf", svc); systemf("initctl -nbq disable %s", svc); } @@ -257,6 +264,21 @@ static int netbrowse_change(sr_session_ctx_t *session, uint32_t sub_id, const ch return put(cfg, srv); } +static int restconf_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, + const char *xpath, sr_event_t event, unsigned request_id, void *_confd) +{ + struct lyd_node *srv = NULL; + sr_data_t *cfg; + + cfg = get(session, event, xpath, &srv, "web", "restconf", NULL); + if (!cfg) + return SR_ERR_OK; + + svc_enadis(lydx_is_enabled(srv, "enabled"), netbrowse, NULL); + + return put(cfg, srv); +} + static int web_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, const char *xpath, sr_event_t event, unsigned request_id, void *_confd) { @@ -272,9 +294,11 @@ static int web_change(sr_session_ctx_t *session, uint32_t sub_id, const char *mo if (ena) { svc_enadis(srx_enabled(session, "%s/console/enabled", xpath), ttyd, "ttyd"); svc_enadis(srx_enabled(session, "%s/netbrowse/enabled", xpath), netbrowse, "netbrowse"); + svc_enadis(srx_enabled(session, "%s/restconf/enabled", xpath), restconf, "restconf"); } else { svc_enadis(0, ttyd, NULL); svc_enadis(0, netbrowse, NULL); + svc_enadis(0, restconf, NULL); } svc_enadis(ena, web, "nginx"); @@ -298,6 +322,8 @@ int infix_services_init(struct confd *confd) 0, ttyd_change, confd, &confd->sub); REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:web/infix-services:netbrowse", 0, netbrowse_change, confd, &confd->sub); + REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:web/infix-services:restconf", + 0, restconf_change, confd, &confd->sub); REGISTER_CHANGE(confd->session, "ieee802-dot1ab-lldp", "/ieee802-dot1ab-lldp:lldp", 0, lldp_change, confd, &confd->sub); diff --git a/src/confd/yang/infix-services@2024-04-08.yang b/src/confd/yang/infix-services@2024-05-30.yang similarity index 84% rename from src/confd/yang/infix-services@2024-04-08.yang rename to src/confd/yang/infix-services@2024-05-30.yang index a6097489..92dfbf77 100644 --- a/src/confd/yang/infix-services@2024-04-08.yang +++ b/src/confd/yang/infix-services@2024-05-30.yang @@ -7,6 +7,10 @@ module infix-services { contact "kernelkit@googlegroups.com"; description "Infix services, generic."; + revision 2024-05-30 { + description "Add support for RESTCONF enable/disable as a web service."; + reference "internal"; + } revision 2024-04-08 { description "Initial support for web services."; reference "internal"; @@ -65,5 +69,14 @@ module infix-services { type boolean; } } + + container restconf { + description "IETF RESTCONF Server."; + + leaf enabled { + description "Enable or disable https://device.local/resconf API endpoint."; + type boolean; + } + } } }