experiments/clixon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Added error-info to netconf error-msg for duplicate leaf-lists

Browse source 
Test: removed potential duplicate user in nacm.sh
This commit is contained in:
Olof hagsand 2024-03-26 14:32:41 +01:00
parent df2af320c2
commit c9c5d4f813
6 changed files with 38 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/src/clixon_validate_minmax.c
View file

@ -553,6 +553,7 @@ xml_yang_minmax_new_leaf_list(cxobj *x0,
cxobj *xj; cxobj *xj;
char *bi; char *bi;
char *bj; char *bj;
cvec *cvv = NULL;
xi = x0; xi = x0;
do { do {
@ -564,7 +565,12 @@ xml_yang_minmax_new_leaf_list(cxobj *x0,
if ((bj = xml_body(xj)) == NULL) if ((bj = xml_body(xj)) == NULL)
continue; continue;
if (bi && bj && strcmp(bi, bj) == 0){ if (bi && bj && strcmp(bi, bj) == 0){
if (xret && netconf_data_not_unique_xml(xret, xi, NULL) < 0) if ((cvv = cvec_new(0)) == NULL){
clixon_err(OE_UNIX, errno, "cvec_new");
goto done;
}
cvec_add_string(cvv, "name", bi);
if (xret && netconf_data_not_unique_xml(xret, xi, cvv) < 0)
goto done; goto done;
goto fail; goto fail;
} }
@ -574,6 +580,8 @@ xml_yang_minmax_new_leaf_list(cxobj *x0,
xml_spec(xi) == y0); xml_spec(xi) == y0);
retval = 1; retval = 1;
done: done:
if (cvv)
cvec_free(cvv);
return retval; return retval;
fail: fail:
retval = 0; retval = 0;

6
test/nacm.sh
View file

@ -2,7 +2,9 @@
# Authentication and authorization and IETF NACM # Authentication and authorization and IETF NACM
# Library variable and functions # Library variable and functions
USER=$(whoami) if [ $(whoami) != root ]; then
EXTRAUSER="<user-name>$(whoami)</user-name>"
fi
# Three groups from RFC8341 A.1 (admin extended with $USER) # Three groups from RFC8341 A.1 (admin extended with $USER)
NGROUPS=$(cat <<EOF NGROUPS=$(cat <<EOF
@ -12,7 +14,7 @@ NGROUPS=$(cat <<EOF
<user-name>root</user-name> <user-name>root</user-name>
<user-name>admin</user-name> <user-name>admin</user-name>
<user-name>andy</user-name> <user-name>andy</user-name>
<user-name>$USER</user-name> $EXTRAUSER
</group> </group>
<group> <group>
<name>limited</name> <name>limited</name>

16
test/test_nacm_credentials.sh
View file

@ -18,6 +18,8 @@ APPNAME=example
cfg=$dir/conf_yang.xml cfg=$dir/conf_yang.xml
fyang=$dir/nacm-example.yang fyang=$dir/nacm-example.yang
NACMUSER=$(whoami)
cat <<EOF > $fyang cat <<EOF > $fyang
module nacm-example{ module nacm-example{
yang-version 1.1; yang-version 1.1;
@ -182,13 +184,13 @@ testrun except "" UNIX $dir/backend.sock "$OK" ""
# UNIX socket, myuser, loop mode. All should work # UNIX socket, myuser, loop mode. All should work
new "Credentials: mode=none, fam=UNIX user=me" new "Credentials: mode=none, fam=UNIX user=me"
testrun none "$USER" UNIX $dir/backend.sock "$OK" "" testrun none "$NACMUSER" UNIX $dir/backend.sock "$OK" ""
new "Credentials: mode=exact, fam=UNIX user=me" new "Credentials: mode=exact, fam=UNIX user=me"
testrun exact "$USER" UNIX $dir/backend.sock "$OK" "" testrun exact "$NACMUSER" UNIX $dir/backend.sock "$OK" ""
new "Credentials: mode=except, fam=UNIX user=me" new "Credentials: mode=except, fam=UNIX user=me"
testrun except "$USER" UNIX $dir/backend.sock "$OK" "" testrun except "$NACMUSER" UNIX $dir/backend.sock "$OK" ""
# UNIX socket, admin user. First should work # UNIX socket, admin user. First should work
new "Credentials: mode=none, fam=UNIX user=admin" new "Credentials: mode=none, fam=UNIX user=admin"
@ -212,15 +214,17 @@ testrun except admin UNIX $dir/backend.sock "$OK" sudo
# IPv4 socket, admin user. First should work # IPv4 socket, admin user. First should work
new "Credentials: mode=none, fam=UNIX user=admin sudo" new "Credentials: mode=none, fam=UNIX user=admin sudo"
testrun none $USER IPv4 127.0.0.1 "$OK" "" testrun none $NACMUSER IPv4 127.0.0.1 "$OK" ""
new "Credentials: mode=exact, fam=UNIX user=admin sudo" new "Credentials: mode=exact, fam=UNIX user=admin sudo"
testrun exact $USER IPv4 127.0.0.1 "$ERROR" "" testrun exact $NACMUSER IPv4 127.0.0.1 "$ERROR" ""
new "Credentials: mode=except, fam=UNIX user=admin sudo" new "Credentials: mode=except, fam=UNIX user=admin sudo"
testrun except $USER IPv4 127.0.0.1 "$ERROR" "" testrun except $NACMUSER IPv4 127.0.0.1 "$ERROR" ""
rm -rf $dir rm -rf $dir
unset NACMUSER
new "endtest" new "endtest"
endtest endtest

22
test/test_nacm_recovery.sh
View file

@ -18,6 +18,8 @@ APPNAME=example
cfg=$dir/conf_yang.xml cfg=$dir/conf_yang.xml
fyang=$dir/nacm-example.yang fyang=$dir/nacm-example.yang
NACMUSER=$(whoami)
# cred:none, exact, except # cred:none, exact, except
# Define default restconfig config: RESTCONFIG # Define default restconfig config: RESTCONFIG
@ -147,20 +149,20 @@ EOF
} }
#------- CRED: except USER: non-root #------- CRED: except USER: non-root
if [ "$USER" != root ]; then # Skip if USER is root if [ "$NACMUSER" != root ]; then # Skip if USER is root
# This is default, therefore first # This is default, therefore first
CRED=except CRED=except
REALUSER=$USER REALUSER=$NACMUSER
# Recovery as a seperate user does not work # Recovery as a seperate user does not work
PSEUDO=$USER PSEUDO=$NACMUSER
RECOVERY=_recovery RECOVERY=_recovery
new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY" new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY"
testrun $CRED $REALUSER $PSEUDO $RECOVERY true false testrun $CRED $REALUSER $PSEUDO $RECOVERY true false
# Recovery as actual user works # Recovery as actual user works
PSEUDO=$USER PSEUDO=$NACMUSER
RECOVERY=$USER RECOVERY=$NACMUSER
new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY" new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY"
testrun $CRED $REALUSER $PSEUDO $RECOVERY true true testrun $CRED $REALUSER $PSEUDO $RECOVERY true true
@ -171,13 +173,13 @@ new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY"
testrun $CRED $REALUSER $PSEUDO $RECOVERY false false testrun $CRED $REALUSER $PSEUDO $RECOVERY false false
PSEUDO=_recovery PSEUDO=_recovery
RECOVERY=$USER RECOVERY=$NACMUSER
new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY" new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY"
testrun $CRED $REALUSER $PSEUDO $RECOVERY false false testrun $CRED $REALUSER $PSEUDO $RECOVERY false false
fi # skip is USER is root fi # skip is NACMUSER is root
#------- CRED: except USER: root #------- CRED: except NACMUSER: root
CRED=except CRED=except
REALUSER=root REALUSER=root
@ -207,7 +209,7 @@ testrun $CRED $REALUSER $PSEUDO $RECOVERY true false
#------- CRED: none #------- CRED: none
# Check you can use any pseudo user if cred is none # Check you can use any pseudo user if cred is none
CRED=none CRED=none
REALUSER=$USER REALUSER=$NACMUSER
PSEUDO=_recovery PSEUDO=_recovery
RECOVERY=_recovery RECOVERY=_recovery
new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY" new "cred: $CRED realuser:$REALUSER pseudo:$PSEUDO recovery:$RECOVERY"
@ -225,4 +227,6 @@ testrun $CRED $REALUSER $PSEUDO $RECOVERY false false
new "endtest" new "endtest"
endtest endtest
unset NACMUSER
rm -rf $dir rm -rf $dir

4
test/test_netconf_duplicate.sh
View file

@ -66,7 +66,6 @@ fi
new "wait backend" new "wait backend"
wait_backend wait_backend
if false; then
new "Add list with duplicate" new "Add list with duplicate"
expecteof_netconf "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO" "<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>replace</default-operation><config><c xmlns=\"urn:example:clixon\"> expecteof_netconf "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO" "<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>replace</default-operation><config><c xmlns=\"urn:example:clixon\">
<server> <server>
@ -78,14 +77,13 @@ expecteof_netconf "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO" "<rpc $DEFAULTNS>
<value>foo</value> <value>foo</value>
</server> </server>
</c></config></edit-config></rpc>" "" "<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique xmlns=\"urn:ietf:params:xml:ns:yang:1\">/rpc/edit-config/config/c/server[name=\"one\"]/name</non-unique></error-info></rpc-error></rpc-reply>" </c></config></edit-config></rpc>" "" "<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique xmlns=\"urn:ietf:params:xml:ns:yang:1\">/rpc/edit-config/config/c/server[name=\"one\"]/name</non-unique></error-info></rpc-error></rpc-reply>"
fi
new "Add leaf-list with duplicate" new "Add leaf-list with duplicate"
expecteof_netconf "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO" "<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>replace</default-operation><config><c xmlns=\"urn:example:clixon\"> expecteof_netconf "$clixon_netconf -qf $cfg" 0 "$DEFAULTHELLO" "<rpc $DEFAULTNS><edit-config><target><candidate/></target><default-operation>replace</default-operation><config><c xmlns=\"urn:example:clixon\">
<b>one</b> <b>one</b>
<b>two</b> <b>two</b>
<b>one</b> <b>one</b>
</c></config></edit-config></rpc>" "" "<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity></rpc-error></rpc-reply>" </c></config></edit-config></rpc>" "" "<rpc-reply $DEFAULTNS><rpc-error><error-type>application</error-type><error-tag>operation-failed</error-tag><error-app-tag>data-not-unique</error-app-tag><error-severity>error</error-severity><error-info><non-unique xmlns=\"urn:ietf:params:xml:ns:yang:1\">/rpc/edit-config/config/c/b[.=\"one\"]/one</non-unique></error-info></rpc-error></rpc-reply>"
if [ $BE -ne 0 ]; then if [ $BE -ne 0 ]; then
new "Kill backend" new "Kill backend"

2
test/test_restconf_basic_auth.sh
View file

@ -101,7 +101,7 @@ cat <<EOF > $dir/startup_db
<group> <group>
<name>admin</name> <name>admin</name>
<user-name>root</user-name> <user-name>root</user-name>
<user-name>$USER</user-name> $EXTRAUSER
</group> </group>
</groups> </groups>
<rule-list> <rule-list>