experiments/clixon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

* 5.2.0 preparations

Browse source 
* Restconf native openssl - ifdef SSL_get0_next_proto_negotiated
This commit is contained in:
Olof hagsand 2021-07-01 16:34:38 +02:00
parent 89f843f919
commit ef131cf407
3 changed files with 34 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

59
CHANGELOG.md
View file

@ -1,6 +1,6 @@
# Clixon Changelog # Clixon Changelog
* [5.2.0](#520) Expected: July 2021 * [5.2.0](#520) 1 July 2021
* [5.1.0](#510) 15 April 2021 * [5.1.0](#510) 15 April 2021
* [5.0.0](#500) 27 February 2021 * [5.0.0](#500) 27 February 2021
* [5.0.1](#501) 10 March 2021 * [5.0.1](#501) 10 March 2021
@ -30,39 +30,42 @@
* [3.3.1](#331) June 7 2017 * [3.3.1](#331) June 7 2017
## 5.2.0 ## 5.2.0
Expected: July 2021 1 July 2021
### New features ### New features
* New utility: clixon_util_validate for stand-alone application that validates or commits datastores
* Restconf native HTTP/2 support using nghttp2 * Restconf native HTTP/2 support using nghttp2
* Enable using: `--with-restconf=native --enable-nghttp2`
* FCGI/nginx not affected only for `--with-restconf=native` * FCGI/nginx not affected only for `--with-restconf=native`
* HTTP/1 co-exists, unless `--disable-evhtp` which results in http/2 only * HTTP/1 co-exists, unless `--disable-evhtp` which results in http/2 only
* For HTTP/2 only: `--disable-nghttp2`
* Upgrade from HTTP/1.1 to HTTP/2 * Upgrade from HTTP/1.1 to HTTP/2
* https: ALPN upgrade * https: ALPN upgrade
* http: Upgrade header * http: Upgrade header (using: `HTTP/1.1 101 Switching Protocols`)
* YANG when statement in conjunction with grouping/uses/augment * Full support of YANG `when` statement in conjunction with grouping/uses/augment
* Several cases were not implemented fully according to RFC 7950: * SeveralThe following cases are now supported according to RFC 7950:
* Do not extend default values if when statements evaluate to false * Do not extend default values if when statements evaluate to false
* Do not allow edit-config of nodes if when statements evaluate to false (Sec 8.3.2) * Do not allow edit-config of nodes if when statements evaluate to false (Sec 8.3.2)
* If a key leaf is defined in a grouping that is used in a list, the "uses" statement MUST NOT have a "when" statement. (See 7.21.5) * If a key leaf is defined in a grouping that is used in a list, the "uses" statement MUST NOT have a "when" statement. (See 7.21.5)
* See [yang uses's substatement when has no effect #218](https://github.com/clicon/clixon/issues/218) * See [yang uses's substatement when has no effect #218](https://github.com/clicon/clixon/issues/218)
* YANG deviation [deviation statement not yet support #211](https://github.com/clicon/clixon/issues/211) * YANG `deviation`support [deviation statement not yet support #211](https://github.com/clicon/clixon/issues/211)
* See RFC7950 Sec 5.6.3 * See RFC7950 Sec 5.6.3
* Added ordering sanity check for YANG modules and sub-modules * Added ordering sanity check for YANG modules and sub-modules
* If YANG sub-statements are placed in wrong order, clixon fails on error. * If YANG sub-statements are placed in wrong order, clixon fails with error.
* New utility: clixon_util_validate for stand-alone application that validates or commits datastores
### API changes on existing protocol/config features ### API changes on existing protocol/config features
Users may have to change how they access the system Users may have to change how they access the system
* Netconf message-id attribute changed from optional to mandatory * Netconf message-id attribute changed from optional to mandatory
* Made NETCONF message handling more strict according to RFC 6241 * Example:
* Set `CLICON_NETCONF_MESSAGE_ID_OPTIONAL` to true to accept omission of message-id attribute * Correct: `<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="42">`
* Wrong: `<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">`
* Set `CLICON_NETCONF_MESSAGE_ID_OPTIONAL` to `true` to accept omission of message-id attribute
* See also [need make sure message-id exist in rpc validate #240](https://github.com/clicon/clixon/issues/240) * See also [need make sure message-id exist in rpc validate #240](https://github.com/clicon/clixon/issues/240)
* Changed config and install options for Restconf * Changed config and install options for Restconf
* clixon_restconf daemon is installed in /usr/local/sbin (as clixon_backend), instead of /www-data * clixon_restconf daemon is installed in `/usr/local/sbin` (as clixon_backend), instead of /www-data
* `configure --with-wwwdir=<dir>` remains but only applies to fcgi socket and log * `configure --with-wwwdir=<dir>` remains but only applies to fcgi socket and log
* New option `CLICON_RESTCONF_INSTALLDIR` is set to where clixon_restconf is installed, with default `/usr/local/sbin/` * New option `CLICON_RESTCONF_INSTALLDIR` is set to where clixon_restconf is installed, with default `/usr/local/sbin/`
* Restconf drop privileges user is defined by `CLICON_RESTCONF_USER` * Restconf drop privileges user is defined by `CLICON_RESTCONF_USER`
@ -73,10 +76,9 @@ Users may have to change how they access the system
* Added: `CLICON_RESTCONF_PRIVILEGES` * Added: `CLICON_RESTCONF_PRIVILEGES`
* Added: `CLICON_RESTCONF_INSTALLDIR` * Added: `CLICON_RESTCONF_INSTALLDIR`
* Added: `CLICON_RESTCONF_STARTUP_DONTUPDATE` * Added: `CLICON_RESTCONF_STARTUP_DONTUPDATE`
* Added: `CLICON_RESTCONF_STARTUP_DONTUPDATE`
* Added: `CLICON_NETCONF_MESSAGE_ID_OPTIONAL` * Added: `CLICON_NETCONF_MESSAGE_ID_OPTIONAL`
* New clixon-restconf@2020-05-20.yang revision * New clixon-restconf@2020-05-20.yang revision
* Added: restconf `log-destination` * Added: restconf `log-destination` (syslog or file:`/var/log/clixon_restconf.log`)
* RESTCONF error replies have changed * RESTCONF error replies have changed
* Added Restconf-style xml/json message bodies everywhere * Added Restconf-style xml/json message bodies everywhere
* Clixon removed the message body from many errors in the 4.6 version since they used html encoding. * Clixon removed the message body from many errors in the 4.6 version since they used html encoding.
@ -90,41 +92,42 @@ Users may have to change how they access the system
Developers may need to change their code Developers may need to change their code
* Made backend transaction and commit/validate API available to plugin code.
* This enables that RPOC handles can call commit and validate via lib
* The commit/validate API is now: `candidate_validate()` and `candidate_commit()`
* Event exit API changed to a single decrementing counter where 1 means exit. * Event exit API changed to a single decrementing counter where 1 means exit.
* Removed: `clicon_exit_reset()` * Removed: `clicon_exit_reset()`
* Changed: `clicon_exit_set()` --> `clixon_exit_set(int nr)` * Changed: `clicon_exit_set()` --> `clixon_exit_set(int nr)`
* Changed: `clicon_exit_get()` --> `clixon_exit_get()` * Changed: `clicon_exit_get()` --> `clixon_exit_get()`
* Made backend transaction and commit/validate API available to plugin code.
* This enables RPC plugin code can call commit and validate via lib
* The commit/validate API is now: `candidate_validate()` and `candidate_commit()`
### Minor features ### Minor features
* Changed default CI to be restconf=native instead of fcgi * CI testing:
* Moved CI from travis to github actions * Changed default CI to be Ǹative restconf` instead of fcgi using nginx
* Added autotool check for getresuid (+ related functions) necessary for lowering of priviliges for backend and restconf * Moved CI from travis to github actions
* If getresuid is not available, CLICON_RESTCONF_PRIVILEGES must be set to 'none' * Added autotool check for `getresuid` (+ related functions) necessary for lowering of priviliges for backend and restconf
* If `getresuid` is not available, `CLICON_RESTCONF_PRIVILEGES` must be 'none'
* Added new startup-mode: `running-startup`: First try running db, if it is empty try startup db. * Added new startup-mode: `running-startup`: First try running db, if it is empty try startup db.
* See [Can startup mode to be extended to support running-startup mode? #234](https://github.com/clicon/clixon/issues/234) * See [Can startup mode to be extended to support running-startup mode? #234](https://github.com/clicon/clixon/issues/234)
* Restconf: added inline configuration using `-R <xml>` command line as an alternative to making advanced restconf configuration * Restconf: added inline configuration using `-R <xml>` command line as an alternative to making advanced restconf configuration
* [Need an option to disable restconf mandatory action of overwriting startup_db #230](https://github.com/clicon/clixon/issues/230) * New option `CLICON_RESTCONF_STARTUP_DONTUPDATE` added to disable RFC 8040 mandatory copy of running to startup after commit*
* Configure option `CLICON_RESTCONF_STARTUP_DONTUPDATE` added to disable RFC 8040 mandatory copy of running to startup after commit * See [Need an option to disable restconf mandatory action of overwriting startup_db #230](https://github.com/clicon/clixon/issues/230)
* Add default network namespace constant: `RESTCONF_NETNS_DEFAULT` with default value "default". * Add default network namespace constant: `RESTCONF_NETNS_DEFAULT` with default value "default".
* CLI: Two new hide variables added (thanks: shmuelnatan) * CLI: Two new hide variables added (thanks: shmuelnatan)
* hide-database : specifies that a command is not visible in database. This can be useful for setting passwords and not exposing them to users. * hide-database : specifies that a command is not visible in database. This can be useful for setting passwords and not exposing them to users.
* hide-database-auto-completion : specifies that a command is not visible in database and in auto completion. This can be useful for a password that was put in device by super user, not be changed. * hide-database-auto-completion : specifies that a command is not visible in database and in auto completion. This can be useful for a password that was put in device by super user, not be changed.
### Corrected Bugs ### Corrected Bugs
* Fixed: [uses oc-if:interface-ref error with openconfig #233](https://github.com/clicon/clixon/issues/233) * Fixed: [uses oc-if:interface-ref error with openconfig #233](https://github.com/clicon/clixon/issues/233)
* Fixed: [need make sure message-id exist in rpc validate #240](https://github.com/clicon/clixon/issues/240) * Fixed: [need make sure message-id exist in rpc validate #240](https://github.com/clicon/clixon/issues/240)
* Netconf message-id attribute changed from optional to mandatory (see API changes) * Netconf message-id attribute changed from optional to mandatory (see API changes)
* Fixed: [restconf patch method unable to chage value to empty string #229](https://github.com/clicon/clixon/issues/229) * Fixed: [restconf patch method unable to change value to empty string #229](https://github.com/clicon/clixon/issues/229)
* Fixed: [restconf patch method adds redundant namespaces #235](https://github.com/clicon/clixon/issues/235) * Fixed: [restconf patch method adds redundant namespaces #235](https://github.com/clicon/clixon/issues/235)
* Fixed: Restconf HEAD did not work everywhere GET did, such as well-known and exact root. * Fixed: Restconf HEAD did not work everywhere GET did, such as well-known and exact root.
* Fixed: [JSON parsing error for a specific input. #236](https://github.com/clicon/clixon/issues/236) * Fixed: [JSON parsing error for a specific input. #236](https://github.com/clicon/clixon/issues/236)
* JSON empty list parse problems, eg `a:[]` * JSON empty list parse problems, eg `a:[]`
* May also have fixed: [Json parser not work properly with empry array \[\] #228](https://github.com/clicon/clixon/issues/228) * Also fixed: [Json parser not work properly with empty array \[\] #228](https://github.com/clicon/clixon/issues/228)
* Fixed: [restconf patch method unable to chage value to empty string #229](https://github.com/clicon/clixon/issues/229) * Fixed: [restconf patch method unable to chage value to empty string #229](https://github.com/clicon/clixon/issues/229)
* Fixed: [when condition error under augment in restconf #227](https://github.com/clicon/clixon/issues/227) * Fixed: [when condition error under augment in restconf #227](https://github.com/clicon/clixon/issues/227)
* Fixed: [Using YANG union with decimal64 and string leads to regexp match fail #226](https://github.com/clicon/clixon/issues/226) * Fixed: [Using YANG union with decimal64 and string leads to regexp match fail #226](https://github.com/clicon/clixon/issues/226)
@ -134,8 +137,8 @@ Developers may need to change their code
* See [XPATH issues #219](https://github.com/clicon/clixon/issues/219) * See [XPATH issues #219](https://github.com/clicon/clixon/issues/219)
* Fix Union in xpath [XPATH issues #219](https://github.com/clicon/clixon/issues/219) * Fix Union in xpath [XPATH issues #219](https://github.com/clicon/clixon/issues/219)
* Fix: XPath:s used in netconf (eg get-config) did not correctly access default values * Fix: XPath:s used in netconf (eg get-config) did not correctly access default values
* [RESTCONF GET request of single-key list with empty string returns all elements #213](https://github.com/clicon/clixon/issues/213) * Fixed: [RESTCONF GET request of single-key list with empty string returns all elements #213](https://github.com/clicon/clixon/issues/213)
* [RESTCONF GETof lists with empty string keys does not work #214](https://github.com/clicon/clixon/issues/214) * Fixed: [RESTCONF GETof lists with empty string keys does not work #214](https://github.com/clicon/clixon/issues/214)
* Fixed: [Multiple http requests in native restconf yields same reply #212](https://github.com/clicon/clixon/issues/212) * Fixed: [Multiple http requests in native restconf yields same reply #212](https://github.com/clicon/clixon/issues/212)
## 5.1.0 ## 5.1.0

2
README.md
View file

@ -13,7 +13,7 @@ See [documentation](https://clixon-docs.readthedocs.io), [project page](https://
Clixon is open-source and dual licensed. Either Apache License, Version 2.0 or GNU Clixon is open-source and dual licensed. Either Apache License, Version 2.0 or GNU
General Public License Version 2; you choose, see [LICENSE.md](LICENSE.md). General Public License Version 2; you choose, see [LICENSE.md](LICENSE.md).
Latest release is 5.1.0. See [CHANGELOG.md](CHANGELOG.md) release history. Latest release is 5.2.0 released on July 1st 2021. See [CHANGELOG.md](CHANGELOG.md) release history.
Clixon interaction is best done posting issues, pull requests, or joining the Clixon interaction is best done posting issues, pull requests, or joining the
[slack channel](https://clixondev.slack.com). [slack channel](https://clixondev.slack.com).

2
apps/restconf/restconf_main_native.c
View file

@ -1210,7 +1210,9 @@ restconf_accept_client(int fd,
} /* SSL_accept */ } /* SSL_accept */
} /* while(readmore) */ } /* while(readmore) */
/* Sets data and len to point to the client's requested protocol for this connection. */ /* Sets data and len to point to the client's requested protocol for this connection. */
#ifndef OPENSSL_NO_NEXTPROTONEG
SSL_get0_next_proto_negotiated(rc->rc_ssl, &alpn, &alpnlen); SSL_get0_next_proto_negotiated(rc->rc_ssl, &alpn, &alpnlen);
#endif /* !OPENSSL_NO_NEXTPROTONEG */
if (alpn == NULL) { if (alpn == NULL) {
/* Returns a pointer to the selected protocol in data with length len. */ /* Returns a pointer to the selected protocol in data with length len. */
SSL_get0_alpn_selected(rc->rc_ssl, &alpn, &alpnlen); SSL_get0_alpn_selected(rc->rc_ssl, &alpn, &alpnlen);