Misc cleanups, remove old yangs, typos, etc

example/main/Makefile.in

@@ -101,6 +101,7 @@ BE_SRC   = $(APPNAME)_backend.c
 BE_OBJ   = $(BE_SRC:%.c=%.o)
 $(BE_PLUGIN): $(BE_OBJ)
 ifeq ($(LINKAGE),static)
+# can include -L in LDFLAGS?
 	$(CC) -Wall -shared $(LDFLAGS) -o $@ -lc $< -lclixon -L ../../apps/backend/ -lclixon_backend 
 else
 	$(CC) -Wall -shared $(LDFLAGS) -o $@ -lc $< -lclixon -lclixon_backend

example/main/example_backend.c

@@ -1012,6 +1012,7 @@ example_exit(clicon_handle h)
     return 0;
 }
 
+/* Forward declaration */
 clixon_plugin_api *clixon_plugin_init(clicon_handle h);
 
 static clixon_plugin_api api = {

lib/src/clixon_yang_module.c

@@ -112,6 +112,7 @@ modstate_diff_free(modstate_diff_t *md)
  *
  * Load RFC7895 yang spec, module-set-id, etc.
  * @param[in]     h       Clicon handle
+ * @see netconf_module_load
  */
 int
 yang_modules_init(clicon_handle h)

yang/clixon/Makefile.in

@@ -41,7 +41,7 @@ datarootdir     = @datarootdir@
 # See also OPT_YANG_INSTALLDIR for the standard yang files
 YANG_INSTALLDIR   = @YANG_INSTALLDIR@
 
-YANGSPECS	 = clixon-config@2021-05-20.yang   # 5.2
+YANGSPECS	 = clixon-config@2021-07-11.yang   # 5.3
 YANGSPECS	+= clixon-lib@2021-03-08.yang      # 5.1
 YANGSPECS	+= clixon-rfc5277@2008-07-01.yang
 YANGSPECS	+= clixon-xml-changelog@2019-03-21.yang

yang/clixon/clixon-config.yang

@@ -1 +0,0 @@
-clixon-config@2021-03-08.yang

yang/clixon/clixon-config@2021-07-11.yang

@@ -43,12 +43,28 @@ module clixon-config {
 
        ***** END LICENSE BLOCK *****";
 
+    revision 2021-07-11 {
+	description
+	    "Added option
+                    CLICON_SYSTEM_CAPABILITIES";
+    }
+    revision 2021-05-20 {
+	description
+	    "Added option:
+	            CLICON_RESTCONF_USER
+	            CLICON_RESTCONF_PRIVILEGES
+	            CLICON_RESTCONF_INSTALLDIR
+	            CLICON_RESTCONF_STARTUP_DONTUPDATE
+                    CLICON_NETCONF_MESSAGE_ID_OPTIONAL
+             Released in Clixon 5.2";
+    }
     revision 2021-03-08 {
 	description
 	    "Added option:
                    CLICON_NETCONF_HELLO_OPTIONAL
 		   CLICON_CLI_AUTOCLI_EXCLUDE
-	           CLICON_XMLDB_UPGRADE_CHECKOLD";
+	           CLICON_XMLDB_UPGRADE_CHECKOLD
+	     Released in Clixon 5.1";
     }
     revision 2020-12-30 {
 	description
@@ -171,6 +187,10 @@ module clixon-config {
 		"Commit startup configuration into running state
                  After reboot when no persistent running db exists";
 	    }
+	    enum running-startup{
+		description
+		    "First try running db, if it is empty try startup db.";
+	    }
 	}
     }
     typedef datastore_format{
@@ -406,7 +426,11 @@ module clixon-config {
 		"If false, skip Yang list check sanity checks from RFC 7950, Sec 7.8.2: 
                  The 'key' statement, which MUST be present if the list represents configuration.
                  Some yang specs seem not to fulfil this. However, if you reset this, there may
-                 be follow-up errors due to code that assumes a configuration list has keys";
+                 be follow-up errors due to code that assumes a configuration list has keys
+                 Marked as obsolete since the observation above seemed to be related to the
+                 yang-data extension in RFC8040 allows non-key lists. This has been implemented
+                 by a YANG_FLAG_NOKEY yang flag mechanism";
+	    status obsolete;
 	}
 	leaf CLICON_YANG_UNKNOWN_ANYDATA{
 	    type boolean;
@@ -421,6 +445,18 @@ module clixon-config {
                  only loading from startup but may occur in other circumstances as well. This
                  means that sanity checks of erroneous XML/JSON may not be properly signalled.";
 	}
+	leaf CLICON_SYSTEM_CAPABILITIES {
+	    type boolean;
+	    default false;
+	    description
+		"Enable module ietf-system-capabilities and ietf-notification-capabilities
+                 Note: There are several dependencies:
+                 - ietf-yang-library revision 2019-01-04 is REQUIRED 
+                 - nacm
+                 - ietf-yang-structure-ext.yang, 
+                 - ietf-yang-instance-data
+                 see draft-ietf-netconf-notification-capabilities-17";
+	}
 	leaf CLICON_BACKEND_DIR {
 	    type string;
 	    description
@@ -451,6 +487,16 @@ module clixon-config {
                  is returned, which conforms to the RFC.
                  Note this applies only to external NETCONF, not the internal (IPC) netconf";
 	}
+	leaf CLICON_NETCONF_MESSAGE_ID_OPTIONAL {
+	    type boolean;
+	    default false;
+	    description
+		"This option relates to RFC 6241 Sec 4.1 <rpc> Element
+                 The <rpc> element has a mandatory attribute 'message-id', which is a
+                 string chosen by the sender of the RPC.
+                 If true, an RPC can be sent without a message-id.
+                 This applies to both  external NETCONF and internal (IPC) netconf";
+	}
 	leaf CLICON_RESTCONF_DIR {
 	    type string;
 	    description
@@ -470,7 +516,28 @@ module clixon-config {
                  Note: Obsolete, use fcgi-socket in clixon-restconf.yang instead";
 	    status obsolete;
 	}
-
+	leaf CLICON_RESTCONF_INSTALLDIR {
+	    type string;
+	    default "/usr/local/sbin";
+	    description
+		"Path to dir of clixon-restconf daemon binary as used by backend if started internally
+                 Discussion: Somewhat problematic to have it as run time option. It may think it
+                 should be known at configure or install time, but for example the main docker
+                 installation moves the binaries, and this may be true elsewehere too.
+                 Maybe one could locate it via PATHs search";
+	}
+	leaf CLICON_RESTCONF_STARTUP_DONTUPDATE {
+	    type boolean;
+	    default false;
+	    description
+		"According to RFC 8040 Sec 1.4:
+                    If the NETCONF server supports :startup, the RESTCONF server MUST automatically
+                    update the [...] startup configuration [...] as a consequence of a RESTCONF
+                    edit operation.
+                 Setting this option disables this behaviour, ie the startup configuration is NOT
+                 automatically updated.
+                 If this option is false, the startup is autoamtically updated following the RFC";
+	}
 	leaf CLICON_RESTCONF_PRETTY {
 	    type boolean;
 	    default true;
@@ -486,6 +553,26 @@ module clixon-config {
                  Note: Obsolete, use pretty in clixon-restconf.yang instead";
 	    status obsolete;
 	}
+	leaf CLICON_RESTCONF_USER {
+	    type string;
+	    description 
+		"Run clixon_daemon as this user
+                 When drop privileges is used, the daemon will drop privileges to this user.
+                 In pre-5.2 code this was configured as compile-time constant WWWUSER with
+                 default value www-data
+                 See also CLICON_PRIVILEGES setting";
+	    default www-data;
+	}
+	leaf CLICON_RESTCONF_PRIVILEGES {
+	    type priv_mode;
+	    default drop_perm;
+	    description 
+		"Restconf privileges mode. 
+                 If drop_perm or drop_temp then drop privileges to CLICON_RESTCONF_USER.
+                 If the platform does not support getresuid and accompanying functions, the mode
+                 must be set to 'none'.
+                 ";
+	}
 	leaf CLICON_CLI_DIR {
 	    type string;
 	    description
@@ -706,7 +793,7 @@ module clixon-config {
                  user (eg datastores).
                  It also sets the backend unix socket owner to this user, but its group
                  is set by CLICON_SOCK_GROUP.
-                 See also CLICON_PRIVILEGES setting";
+                 See also CLICON_BACKEND_PRIVILEGES setting";
 	}
 	leaf CLICON_BACKEND_PRIVILEGES {
 	    type priv_mode;

yang/clixon/clixon-lib@2020-12-30.yang

@@ -1,180 +0,0 @@
-module clixon-lib {
-    yang-version 1.1;
-    namespace "http://clicon.org/lib";
-    prefix cl;
-
-    organization
-	"Clicon / Clixon";
-
-    contact
-	"Olof Hagsand <olof@hagsand.se>";
-
-    description
-      "Clixon Netconf extensions for communication between clients and backend.
-      
-       ***** BEGIN LICENSE BLOCK *****
-       Copyright (C) 2009-2019 Olof Hagsand
-       Copyright (C) 2020-2021 Olof Hagsand and Rubicon Communications, LLC(Netgate)
-       
-       This file is part of CLIXON
-
-       Licensed under the Apache License, Version 2.0 (the \"License\");
-       you may not use this file except in compliance with the License.
-       You may obtain a copy of the License at
-            http://www.apache.org/licenses/LICENSE-2.0
-       Unless required by applicable law or agreed to in writing, software
-       distributed under the License is distributed on an \"AS IS\" BASIS,
-       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-       See the License for the specific language governing permissions and
-       limitations under the License.
-
-       Alternatively, the contents of this file may be used under the terms of
-       the GNU General Public License Version 3 or later (the \"GPL\"),
-       in which case the provisions of the GPL are applicable instead
-       of those above. If you wish to allow use of your version of this file only
-       under the terms of the GPL, and not to allow others to
-       use your version of this file under the terms of Apache License version 2, 
-       indicate your decision by deleting the provisions above and replace them with
-       the notice and other provisions required by the GPL. If you do not delete
-       the provisions above, a recipient may use your version of this file under
-       the terms of any one of the Apache License version 2 or the GPL.
-
-       ***** END LICENSE BLOCK *****";
-
-    revision 2020-12-30 {
-	description
-	    "Changed: RPC process-control output parameter status to pid";
-    }
-    revision 2020-12-08 {
-	description
-	    "Added: autocli-op extension.
-                    rpc process-control for process/daemon management
-             Released in clixon 4.9";
-    }
-    revision 2020-04-23 {
-	description
-	    "Added: stats RPC for clixon XML and memory statistics.
-             Added: restart-plugin RPC for restarting individual plugins without restarting backend.";
-    }
-    revision 2019-08-13 {
-	description
-	    "No changes (reverted change)";
-    }
-    revision 2019-06-05 {
-	description
-	    "ping rpc added for liveness";
-    }
-    revision 2019-01-02 {
-	description
-	    "Released in Clixon 3.9";
-    }
-    typedef service-operation {
-        type enumeration {
-            enum start {
-                description
-                    "Start if not already running";
-            }
-            enum stop {
-                description
-                    "Stop if running";
-            }
-            enum restart {
-                description
-                    "Stop if running, then start";
-            }
-            enum status {
-                description
-                    "Check status";
-            }
-        }
-        description
-            "Common operations that can be performed on a service";
-    }
-    extension autocli-op {
-      description 
-        "Takes an argument an operation defing how to modify the clispec at 
-         this point in the YANG tree for the automated generated CLI.
-         Note that this extension is only used in clixon_cli.
-         Operations is expected to be extended, but the following operations are defined:
-         - hide  This command is active but not shown by ? or TAB";
-      argument cliop;
-   }
-   rpc debug {
-	description "Set debug level of backend.";
-	input {
-	    leaf level {
-		type uint32;
-	    }
-	}
-    }
-    rpc ping {
-        description "Check aliveness of backend daemon.";
-    }
-    rpc stats {
-        description "Clixon XML statistics.";
-	output {
-	    container global{
-		description "Clixon global statistics";
-		leaf xmlnr{
-		    description "Number of XML objects: number of residing xml/json objects
-                             in the internal 'cxobj' representation.";
-		    type uint64;
-		}
-	    }
-	    list datastore{
-		description "Datastore statistics";
-		key "name";
-		leaf name{
-		    description "name of datastore (eg running).";
-		    type string;
-		}
-		leaf nr{
-		    description "Number of XML objects. That is number of residing xml/json objects
-                             in the internal 'cxobj' representation.";
-		    type uint64;
-		}
-		leaf size{
-		    description "Size in bytes of internal datastore cache of datastore tree.";
-		    type uint64;
-		}
-	    }
-
-	}
-    }
-    rpc restart-plugin {
-	description "Restart specific backend plugins.";
-	input {
-	    leaf-list plugin {
-		description "Name of plugin to restart";
-		type string;
-	    }
-	}
-    }
-
-    rpc process-control {
-	description
-	    "Control a specific process or daemon: start/stop, etc.
-             This is for direct managing of a process by the backend. 
-             Alternatively one can manage a daemon via systemd, containerd, kubernetes, etc.";
-	input {
-	    leaf name {
-		description "Name of process";
-		type string;
-		mandatory true;
-	    }
-	    leaf operation {
-		type service-operation;
-		mandatory true;
-		description
-		    "One of the strings 'start', 'stop', 'restart', or 'status'.";
-	    }
-	}
-	output {
-	    leaf pid {
-		description "Process-id of running process or 0 if not running
-                             Value is only valid for operation status";
-		type uint32;
-	    }
-	}
-    }
-}

yang/clixon/clixon-restconf@2021-03-15.yang

@@ -1,221 +0,0 @@
-module clixon-restconf {
-    yang-version 1.1;
-    namespace "http://clicon.org/restconf";
-    prefix "clrc";
-
-    import ietf-inet-types {
-	prefix inet;
-    }
-
-    organization
-	"Clixon";
-
-    contact
-	"Olof Hagsand <olof@hagsand.se>";
-
-    description
-	"This YANG module provides a data-model for the Clixon RESTCONF daemon.
-       ***** BEGIN LICENSE BLOCK *****
-       Copyright (C) 2020 Olof Hagsand and Rubicon Communications, LLC(Netgate)
-
-       This file is part of CLIXON
-
-       Licensed under the Apache License, Version 2.0 (the \"License\");
-       you may not use this file except in compliance with the License.
-       You may obtain a copy of the License at
-            http://www.apache.org/licenses/LICENSE-2.0
-       Unless required by applicable law or agreed to in writing, software
-       distributed under the License is distributed on an \"AS IS\" BASIS,
-       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-       See the License for the specific language governing permissions and
-       limitations under the License.
-
-       Alternatively, the contents of this file may be used under the terms of
-       the GNU General Public License Version 3 or later (the \"GPL\"),
-       in which case the provisions of the GPL are applicable instead
-       of those above. If you wish to allow use of your version of this file only
-       under the terms of the GPL, and not to allow others to
-       use your version of this file under the terms of Apache License version 2,
-       indicate your decision by deleting the provisions above and replace them with
-       the notice and other provisions required by the GPL. If you do not delete
-       the provisions above, a recipient may use your version of this file under
-       the terms of any one of the Apache License version 2 or the GPL.
-
-       ***** END LICENSE BLOCK *****";
-
-    revision 2021-03-15 {
-	description
-	    "make authentication-type none a feature
-	     Added flag to enable core dumps";
-    }
-    revision 2020-12-30 {
-	description
-	    "Added: debug field
-             Added 'none' as default value for auth-type
-             Changed http-auth-type enum from 'password' to 'user'";
-    }
-    revision 2020-10-30 {
-	description
-	    "Initial release";
-    }
-
-    feature fcgi {
-	description
-	    "This feature indicates that the restconf server supports the fast-cgi reverse
-             proxy solution.
-             That is, a reverse proxy is the HTTP front-end and the restconf daemon listens
-             to a fcgi socket.
-             The alternative is the internal HTTP solution using evhtp.";
-    }
-
-    feature allow-auth-none {
-        description
-	  "This feature allows the use of authentication-type none.";
-    }
-
-    typedef http-auth-type {
-	type enumeration {
-	    enum none {
-		if-feature "allow-auth-none";
-		description
-		    "Incoming message are set to authenticated by default. No ca-auth callback is called,
-                     Authenticated user is set to special user 'none'.
-                     Typically assumes NACM is not enabled.";
-	    }
-	    enum client-certificate {
-		description
-		    "TLS client certificate validation is made on each incoming message. If it passes
-                    the authenticated user is extracted from the SSL_CN parameter
-                     The ca-auth callback can be used to revise this behavior.";
-	    }
-	    enum user {
-		description
-		    "User-defined authentication as defined by the ca-auth callback.
-                     One example is some form of password authentication, such as basic auth.";
-	    }
-	}
-	description
-	    "Enumeration of HTTP authorization types.";
-    }
-    grouping clixon-restconf{
-	description
-	    "HTTP RESTCONF configuration.";
-	leaf enable {
-	    type boolean;
-	    default "false";
-	    description
-		"Enables RESTCONF functionality.
-                 Note that starting/stopping of a restconf daemon is different from it being
-                 enabled or not.
-                 For example, if the restconf daemon is under systemd management, the restconf
-                 daemon will only start if enable=true.";
-	}
-	leaf auth-type {
-	    type http-auth-type;
-	    description
-		"The authentication type.
-                 Note client-certificate applies only if ssl-enable is true and socket has ssl";
-	    default user;
-	}
-	leaf debug {
-	    description
-		"Set debug level of restconf daemon.
-                 0 is no debug, 1 is debugging, more is detailed debug.
-                 Debug logs will be directed to syslog with
-                    ident: clixon_restconf and PID
-                    facility: LOG_USER
-                    level: LOG_DEBUG";
-	    type uint32;
-	    default 0;
-	}
-	leaf enable-core-dump {
-	    description
-	        "enable core dumps.
-                 this is a no-op on systems that don't support it.";
-	    type boolean;
-	    default false;
-	}
-	leaf pretty {
-	    type boolean;
-	    default true;
-	    description
-		"Restconf return value pretty print.
-                 Restconf clients may add HTTP header:
-                      Accept: application/yang-data+json, or
-                      Accept: application/yang-data+xml
-                 to get return value in XML or JSON.
-                 RFC 8040 examples print XML and JSON in pretty-printed form.
-                 Setting this value to false makes restconf return not pretty-printed
-                 which may be desirable for performance or tests
-                 This replaces the CLICON_RESTCONF_PRETTY option in clixon-config.yang";
-	}
-	/* From this point only specific options
-	 * First fcgi-specific options
-	 */
-	leaf fcgi-socket {
-	    if-feature fcgi; /* Set by default by fcgi clixon_restconf daemon */
-	    type string;
-	    default "/www-data/fastcgi_restconf.sock";
-	    description
-		"Path to FastCGI unix socket. Should be specified in webserver
-         	 Eg in nginx: fastcgi_pass unix:/www-data/clicon_restconf.sock
-                 Only if with-restconf=fcgi, NOT evhtp
-                 This replaces CLICON_RESTCONF_PATH option in clixon-config.yang";
-	}
-	/* Second, evhtp-specific options */
-	leaf server-cert-path {
-	    type string;
-	    description
-		"Path to server certificate file.
-                 Note only applies if socket has ssl enabled";
-	}
-	leaf server-key-path {
-	    type string;
-	    description
-		"Path to server key file
-                 Note only applies if socket has ssl enabled";
-	}
-	leaf server-ca-cert-path {
-	    type string;
-	    description
-		"Path to server CA cert file
-	         Note only applies if socket has ssl enabled";
-	}
-	list socket {
-	    description
-		"List of server sockets that the restconf daemon listens to";
-	    key "namespace address port";
-	    leaf namespace {
-		type string;
-		description
-		    "Network namespace.
-                     On platforms where namespaces are not suppported, 'default'
-                     Default value can be changed by RESTCONF_NETNS_DEFAULT";
-	    }
-	    leaf address {
-		type inet:ip-address;
-		description "IP address to bind to";
-	    }
-	    leaf port {
-		type inet:port-number;
-		description "TCP port to bind to";
-	    }
-	    leaf ssl {
-		type boolean;
-		default true;
-		description "Enable for HTTPS otherwise HTTP protocol";
-	    }
-	}
-    }
-    container restconf {
-	description
-	    "This presence is strictly not necessary since the enable flag
-             in clixon-restconf is the flag bearing the actual semantics.
-             However, removing the presence leads to default config in all
-             clixon installations, even those which do not use backend-started restconf.
-             One could see this as mostly cosmetically annoying.
-             Alternative would be to make the inclusion of this yang conditional.";
-	presence "Enables RESTCONF";
-	uses clixon-restconf;
-    }
-}