experiments/clixon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

* To configure native mode use: configure --with-restconf=native, changed from: configure --with-restconf=evhtp

Browse source
This commit is contained in:
Olof hagsand 2021-04-06 08:48:45 +02:00
parent d874a696f7
commit d8be601606
22 changed files with 76 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

5
CHANGELOG.md
View file

@ -34,10 +34,11 @@ Expected: April
### New features
### API changes on existing protocol/config features
* Restconf "evhtp" mode MUST use libevhtp from https://github.com/clixon/clixon-libevhtp.git instead from criticalstack
* Native RESTCONF mode
* Restconf "evhtp" mode MUST use libevhtp from https://github.com/clixon/clixon-libevhtp.git instead from criticalstack
* To configure native mode use: `configure --with-restconf=native`, changed from: `configure --with-restconf=evhtp`
* NETCONF Hello message semantics has been made stricter according to RFC 6241 Sec 8.1, for example:
* A client MUST send a <hello> element.
* Each peer MUST send at least the base NETCONF capability, "urn:ietf:params:netconf:base:1.1" (or 1.0 for RFC 4741)

2
apps/cli/Makefile.in
View file

@ -78,7 +78,7 @@ endif
# even though it may exist in $(libdir). But the new version may not have been installed yet.
LIBDEPS = $(top_srcdir)/lib/src/$(CLIXON_LIB)
LIBS = -L$(top_srcdir)/lib/src $(top_srcdir)/lib/src/$(CLIXON_LIB) @LIBS@ #-lpthread
LIBS = -L$(top_srcdir)/lib/src $(top_srcdir)/lib/src/$(CLIXON_LIB) @LIBS@
INCLUDES = -I. -I$(top_srcdir)/lib -I$(top_srcdir)/include -I$(top_srcdir) @INCLUDES@

6
apps/restconf/Makefile.in
View file

@ -59,7 +59,7 @@ HOST_VENDOR = @host_vendor@
# XXX why is not wwwdir under prefix?
wwwdir = @wwwdir@
wwwuser = @wwwuser@
# one of fcgi or evhtp:
# one of fcgi or native:
with_restconf = @with_restconf@
SH_SUFFIX = @SH_SUFFIX@
@ -89,10 +89,10 @@ INCLUDES = -I. -I$(top_srcdir)/lib/src -I$(top_srcdir)/lib -I$(top_srcdir)/inclu
# Application
APPL = clixon_restconf
# Common source - not accessible from plugin - independent of restconf package (fcgi|evhtp)
# Common source - not accessible from plugin - independent of restconf package (fcgi|native)
APPSRC =
APPSRC += restconf_api.c # maybe empty
APPSRC += restconf_api_$(with_restconf).c # cant be .so since libevhtp is a.
APPSRC += restconf_api_$(with_restconf).c
APPSRC += restconf_err.c
APPSRC += restconf_methods.c
APPSRC += restconf_methods_post.c

10
apps/restconf/README.md
View file

@ -1,6 +1,6 @@
# Clixon Restconf
* [Evhtp](#evhtp)
* [Native](#native)
* [Nginx](#nginx)
* [Streams](#streams)
* [Nchan Streams](#nchan)
@ -8,9 +8,9 @@
There are two installation instructions: for libevhtp and nginx.
## Evhtp
## Native
Download, build and install libevhtp from source. Prereqs: libevent and cmake.
Download, build and install libevhtp from source. Prereqs: libevent and ssl
```
sudo git clone https://github.com/clicon/clixon-libevhtp.git
cd clixon-libevhtp
@ -19,9 +19,9 @@ Download, build and install libevhtp from source. Prereqs: libevent and cmake.
sudo make install
```
Configure clixon with evhtp:
Configure clixon with native restconf:
```
./configure --with-restconf=evhtp
./configure --with-restconf=native
```
Ensure www-data is member of the CLICON_SOCK_GROUP (default clicon). If not, add it:

0
apps/restconf/restconf_api_evhtp.c → apps/restconf/restconf_api_native.c
View file

0
apps/restconf/restconf_main_evhtp.c → apps/restconf/restconf_main_native.c
View file

10
configure vendored
View file

@ -1374,7 +1374,7 @@ Optional Packages:
--with-cligen=dir Use CLIGEN installation in this dir
--with-restconf=fcgi FCGI interface for stand-alone web rev-proxy eg
nginx (default)
--with-restconf=evhtp Integrate restconf with libevhtp server
--with-restconf=native Integrate restconf with embedded http server
--without-restconf Disable restconf altogether
--with-wwwuser=<user> Set www user different from www-data
--with-configfile=FILE Set default path to config file
@ -3352,7 +3352,7 @@ test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644'
# Set to evhtp or fcgi -> compile apps/restconf
# Set to native or fcgi -> compile apps/restconf
# Web user default (ie what RESTCONF daemon runs as).
@ -4983,7 +4983,7 @@ fi
# This is for restconf. There are three options:
# --without-restconf No restconf support
# --with-restconf=fcgi FCGI interface for separate web reverse proxy like nginx
# --with-restconf=evhtp Integration with embedded web server libevhtp
# --with-restconf=native Integration with embedded web server
# Check whether --with-restconf was given.
if test "${with_restconf+set}" = set; then :
@ -5042,7 +5042,7 @@ else
as_fn_error $? "libfcgi-dev missing" "$LINENO" 5
fi
elif test "x${with_restconf}" == xevhtp; then
elif test "x${with_restconf}" == xnative; then
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OPENSSL_init_ssl in -lssl" >&5
$as_echo_n "checking for OPENSSL_init_ssl in -lssl... " >&6; }
if ${ac_cv_lib_ssl_OPENSSL_init_ssl_+:} false; then :
@ -5208,7 +5208,7 @@ if ${ac_cv_lib_evhtp_evhtp_new+:} false; then :
$as_echo_n "(cached) " >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-levhtp -lpthread -levent -levent_openssl -lssl -lcrypto $LIBS"
LIBS="-levhtp -levent -lssl -lcrypto $LIBS"
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */

10
configure.ac
View file

@ -95,7 +95,7 @@ AC_SUBST(CLIXON_DEFAULT_CONFIG)
AC_SUBST(LIBS)
AC_SUBST(SH_SUFFIX)
AC_SUBST(LINKAGE)
AC_SUBST(with_restconf) # Set to evhtp or fcgi -> compile apps/restconf
AC_SUBST(with_restconf) # Set to native or fcgi -> compile apps/restconf
AC_SUBST(with_libxml2)
AC_SUBST(enable_optyangs)
# Web user default (ie what RESTCONF daemon runs as).
@ -200,7 +200,7 @@ AC_CHECK_LIB(cligen, cligen_init,, AC_MSG_ERROR([CLIgen missing. Try: git clone
# This is for restconf. There are three options:
# --without-restconf No restconf support
# --with-restconf=fcgi FCGI interface for separate web reverse proxy like nginx
# --with-restconf=evhtp Integration with embedded web server libevhtp
# --with-restconf=native Integration with embedded web server
AC_ARG_WITH([restconf],
AS_HELP_STRING([--with-restconf=fcgi],[FCGI interface for stand-alone web rev-proxy eg nginx (default)]),
,
@ -209,7 +209,7 @@ AC_ARG_WITH([restconf],
if test "x${with_restconf}" == xfcgi; then
# Lives in libfcgi-dev
AC_CHECK_LIB(fcgi, FCGX_Init,, AC_MSG_ERROR([libfcgi-dev missing]))
elif test "x${with_restconf}" == xevhtp; then
elif test "x${with_restconf}" == xnative; then
AC_CHECK_LIB(ssl, OPENSSL_init_ssl ,, AC_MSG_ERROR([libssl missing]))
AC_CHECK_LIB(crypto, CRYPTO_new_ex_data, , AC_MSG_ERROR([libcrypto missing]))
AC_CHECK_LIB(event, event_init,, AC_MSG_ERROR([libevent missing]))
@ -220,7 +220,7 @@ elif test "x${with_restconf}" == xevhtp; then
#define EVHTP_DISABLE_REGEX
#define EVHTP_DISABLE_EVTHR
]])
AC_CHECK_LIB(evhtp, evhtp_new,, AC_MSG_ERROR([libevhtp missing]),[-lpthread -levent -levent_openssl -lssl -lcrypto])
AC_CHECK_LIB(evhtp, evhtp_new,, AC_MSG_ERROR([libevhtp missing]),[-levent -lssl -lcrypto])
elif test "x${with_restconf}" == xno; then
# Cant get around "no" as an answer for --without-restconf that is reset here to undefined
with_restconf=
@ -237,7 +237,7 @@ fi
AC_ARG_WITH([restconf],
AS_HELP_STRING([--with-restconf=fcgi],[FCGI interface for stand-alone web rev-proxy eg nginx (default)]))
AC_ARG_WITH([restconf],
AS_HELP_STRING([--with-restconf=evhtp],[Integrate restconf with libevhtp server]))
AS_HELP_STRING([--with-restconf=native],[Integrate restconf with embedded http server]))
AC_ARG_WITH([restconf],
AS_HELP_STRING([--without-restconf],[Disable restconf altogether]))

0
docker/main/Dockerfile.evhtp → docker/main/Dockerfile.internal
View file

4
test/certs.sh
View file

@ -19,7 +19,7 @@ default_crl_days = 9999
default_md = md5
[ req ]
default_bits = 1024
default_bits = ${CERTKEYLEN}
days = 1
distinguished_name = req_distinguished_name
attributes = req_attributes
@ -58,7 +58,7 @@ subjectAltName = DNS:clicon.org
EOF
# Generate server key
openssl genrsa -out $srvkey 1024
openssl genrsa -out $srvkey ${CERTKEYLEN}
# Generate CSR (signing request)
openssl req -new -config $dir/srv.cnf -key $srvkey -out $certdir/srv_csr.pem

2
test/cicd/cicd.sh
View file

@ -23,7 +23,7 @@ set -eux # x
if [ $# -ne 2 ]; then
echo "usage: $0 <host> <restconf>"
echo " where <restconf> is fcgi or evhtp"
echo " where <restconf> is fcgi or native"
exit -1
fi

2
test/cicd/clixon-config.sh
View file

@ -4,7 +4,7 @@ set -eux
if [ $# -ne 1 ]; then
echo "usage: $0 <restconf>"
echo " where <restconf> is fcgi or evhtp"
echo " where <restconf> is fcgi or native"
exit -1
fi
restconf=$1

4
test/config.sh.in
View file

@ -36,8 +36,8 @@
# This is for RESTCONF. There are three options:
# --without-restconf No restconf support
# --with-restconf=fcgi FCGI interface for separate web reverse proxy like nginx
# --with-restconf=evhtp Integration with embedded web server libevhtp
WITH_RESTCONF=@with_restconf@ # evhtp, fcgi or ""
# --with-restconf=native Integration with embedded web server libevhtp
WITH_RESTCONF=@with_restconf@ # native, fcgi or ""
# This is for libxml2 XSD regex engine
# Note this only enables the compiling of the code. In order to actually

2
test/lib.sh
View file

@ -339,7 +339,7 @@ function stop_restconf(){
# Wait for restconf to stop sending 502 Bad Gateway
# @see start_restconf
# Reasons for not working: if you run evhtp is nginx running?
# Reasons for not working: if you run native is nginx running?
# @note assumes port=80 if RCPROTO=http and port=443 if RCPROTO=https
function wait_restconf(){
# echo "curl $CURLOPTS $* $RCPROTO://localhost/restconf"

5
test/site.sh
View file

@ -28,3 +28,8 @@ IPv6=true
# This check is optional because some installs, such as vagrant make a non-systemd/direct
# start
NGINXCHECK=true
# Lenght of TSL RSA key
# Problem with small key such as 1024 not allowed in centos8 for example (why is this)
# Problem with long keys are they take time to generate, eg on ARM
CERTKEYLEN=2048

22
test/test_restconf.sh
View file

@ -1,18 +1,18 @@
#!/usr/bin/env bash
# Restconf basic functionality also uri encoding using eth/0/0
# Note there are many variants: (1)fcgi/evhtp, (2) http/https, (3) IPv4/IPv6, (4)local or backend-config
# (1) fcgi/evhtp
# This is compile-time --with-restconf=fcgi or evhtp, so either or
# Note there are many variants: (1)fcgi/native, (2) http/https, (3) IPv4/IPv6, (4)local or backend-config
# (1) fcgi/native
# This is compile-time --with-restconf=fcgi or native, so either or
# - fcgi: Assume http server setup, such as nginx described in apps/restconf/README.md
# - evhtp: test both local config and get config from backend
# - native: test both local config and get config from backend
# (2) http/https
# - fcgi: relies on nginx has https setup
# - evhtp: generate self-signed server certs
# - native: generate self-signed server certs
# (3) IPv4/IPv6 (only loopback 127.0.0.1 / ::1)
# - The tests runs through both
# - IPv6 by default disabled since docker does not support it out-of-the box
# (4) local/backend config. Evhtp only
# - The tests runs through both (if compiled with evhtp)
# (4) local/backend config. Native only
# - The tests runs through both (if compiled with native)
# See also test_restconf2.sh
# See test_restconf_rpc.sh for cases when CLICON_BACKEND_RESTCONF_PROCESS is set
@ -40,7 +40,7 @@ else
cp /usr/local/share/clixon/$y $dir/
fi
if [ "${WITH_RESTCONF}" = "evhtp" ]; then
if [ "${WITH_RESTCONF}" = "native" ]; then
# Create server certs
certdir=$dir/certs
srvkey=$certdir/srv_key.pem
@ -402,12 +402,12 @@ function testrun()
# Go thru all combinations of IPv4/IPv6, http/https, local/backend config
protos="http"
if [ "${WITH_RESTCONF}" = "evhtp" ]; then
# http only relevant for evhtp (for fcgi: need nginx config)
if [ "${WITH_RESTCONF}" = "native" ]; then
# http only relevant for internal (for fcgi: need nginx config)
protos="$protos https"
fi
for proto in $protos; do
addrs="127.0.0.1"
# addrs="127.0.0.1"
if $IPv6 ; then
addrs="$addrs \[::1\]"
fi

8
test/test_restconf_basic_auth.sh
View file

@ -3,7 +3,7 @@
# Note this is not supported by core clixon: you need ca-auth callback implemented a la the example
# For auth-type=none and auth-type=user,
# For auth-type=ssl-certs, See test_restconf.sh test_restconf_ssl_certs.sh
# evhtp? and http only
# native? and http only
# Use the following user settings:
# 1. none (eg no -u to curl)
# 2. anonymous - the registered anonymous user
@ -29,7 +29,7 @@ fyang=$dir/myexample.yang
# No ssl
RCPROTO=http
# Start with common config, then append fcgi/evhtp specific config
# Start with common config, then append fcgi/native specific config
cat <<EOF > $cfg
<clixon-config xmlns="http://clicon.org/config">
<CLICON_CONFIGFILE>$cfg</CLICON_CONFIGFILE>
@ -52,7 +52,7 @@ cat <<EOF > $cfg
</clixon-config>
EOF
# Start with common config, then append fcgi/evhtp specific config
# Start with common config, then append fcgi/native specific config
cat <<EOF > $cfg
<clixon-config xmlns="http://clicon.org/config">
<CLICON_CONFIGFILE>$cfg</CLICON_CONFIGFILE>
@ -195,7 +195,7 @@ function testrun()
# Change restconf configuration before start restconf daemon
restconf_config $auth false
# Start with common config, then append fcgi/evhtp specific config
# Start with common config, then append fcgi/native specific config
cat <<EOF > $cfg
<clixon-config xmlns="http://clicon.org/config">
<CLICON_CONFIGFILE>$cfg</CLICON_CONFIGFILE>

6
test/test_restconf_netns.sh
View file

@ -1,5 +1,5 @@
#!/usr/bin/env bash
# Restconf evhtp using socket network namespace (netns) support
# Restconf native using socket network namespace (netns) support
# Listen to a default and a separate netns
# Init running with a=42
# Get the config from default and netns namespace with/without SSL
@ -8,8 +8,8 @@
# Magic line must be first in script (see README.md)
s="$_" ; . ./lib.sh || if [ "$s" = $0 ]; then exit 0; else return 0; fi
# Skip if other than evhtp
if [ "${WITH_RESTCONF}" != "evhtp" ]; then
# Skip if other than native
if [ "${WITH_RESTCONF}" != "native" ]; then
if [ "$s" = $0 ]; then exit 0; else return 0; fi # skip
fi

4
test/test_restconf_ssl_certs.sh
View file

@ -7,8 +7,8 @@
# Magic line must be first in script (see README.md)
s="$_" ; . ./lib.sh || if [ "$s" = $0 ]; then exit 0; else return 0; fi
# Only works with evhtp and https
if [ "${WITH_RESTCONF}" != "evhtp" ]; then
# Only works with native and https
if [ "${WITH_RESTCONF}" != "native" ]; then
if [ "$s" = $0 ]; then exit 0; else return 0; fi # skip
fi

4
test/vagrant/Makefile.in
View file

@ -47,8 +47,8 @@ SHELL = /bin/sh
# VAGRANTS += freebsd/FreeBSD-12.1-STABLE
VAGRANTS =
# evhtp or fcgi
RESTCONF=evhtp
# internal or fcgi
RESTCONF=internal
-include site.mk

20
test/vagrant/vagrant.sh
View file

@ -5,7 +5,7 @@
# 3. Compile and install clixon
# 4. Run tests
# Example run: ./vagrant.sh generic/centos8 2>&1 | tee cilog
# Default runs evhtp (not fcgi)
# Default runs native (not fcgi)
set -eux #
@ -17,7 +17,7 @@ fi
box=$1 # As defined in https://vagrantcloud.com/search
#with_restconf=fcgi
: ${with_restconf:=evhtp}
: ${with_restconf:=native}
echo "with-restconf:${with_restconf}"
VCPUS=1
@ -111,7 +111,7 @@ case $release in
fcgi)
$sshcmd sudo pkg install -y fcgi-devkit nginx
;;
evhtp)
native)
;;
esac
;;
@ -128,7 +128,7 @@ case $release in
fcgi)
$sshcmd sudo pkg install -y fcgi-devkit nginx
;;
evhtp)
native)
$sshcmd sudo pkg install -y libevent
;;
esac
@ -154,7 +154,7 @@ case $release in
# $sshcmd sudo yum update
$sshcmd sudo yum install -y nginx
;;
evhtp)
native)
$sshcmd sudo yum install -y libevent openssl
$sshcmd sudo yum install -y libevent-devel openssl-devel
;;
@ -177,7 +177,7 @@ case $release in
$sshcmd sudo zypper install -y nginx
buildfcgi=true # build fcgi from source
;;
evhtp)
native)
;;
esac
;;
@ -199,7 +199,7 @@ case $release in
buildfcgi=true # some ubuntu dont have fcgi-dev
$sshcmd sudo apt install -y nginx
;;
evhtp)
native)
# $sshcmd sudo apt install -y libevent-2.1
$sshcmd sudo apt install -y libevent-dev libssl-dev
;;
@ -215,7 +215,7 @@ case $release in
fcgi)
$sshcmd sudo apk add --update nginx fcgi-dev
;;
evhtp)
native)
;;
esac
;;
@ -230,7 +230,7 @@ case $release in
fcgi)
$sshcmd sudo pacman -Syu --noconfirm nginx fcgi
;;
evhtp)
native)
$sshcmd sudo pacman -Syu --noconfirm libevent
;;
esac
@ -253,7 +253,7 @@ case ${with_restconf} in
# Hide all complex nginx config in sub-script
. ./nginx.sh $dir $idfile $port $wwwuser
;;
evhtp)
native)
$sshcmd << EOF
test -d src || mkdir src
cd src

2
yang/clixon/clixon-config@2021-03-08.yang
View file

@ -465,7 +465,7 @@ module clixon-config {
description
"FastCGI unix socket. Should be specified in webserver
Eg in nginx: fastcgi_pass unix:/www-data/clicon_restconf.sock
Only if with-restconf=fcgi, NOT evhtp
Only if with-restconf=fcgi, NOT native
Note: Obsolete, use fcgi-socket in clixon-restconf.yang instead";
status obsolete;
}