Skip to content

Commit

Permalink
config UPDATE CH TLS keystore and truststore
Browse files Browse the repository at this point in the history
  • Loading branch information
Roytak committed Jul 27, 2023
1 parent 8ea70d6 commit a178470
Show file tree
Hide file tree
Showing 2 changed files with 201 additions and 9 deletions.
124 changes: 117 additions & 7 deletions src/config_new_tls.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -181,26 +181,52 @@ nc_server_config_new_ch_tls_del_server_certificate(const char *client_name, cons
"certificate/inline-definition", client_name, endpt_name);
}

static int
_nc_server_config_new_tls_keystore_reference(const struct ly_ctx *ctx, const char *tree_path, const char *asym_key_ref,
const char *cert_ref, struct lyd_node **config)
{
int ret = 0;

/* create asymmetric key pair reference */
ret = nc_config_new_create_append(ctx, tree_path, "asymmetric-key", asym_key_ref, config);
if (ret) {
goto cleanup;
}

/* create cert reference, this cert has to belong to the asym key */
ret = nc_config_new_create_append(ctx, tree_path, "certificate", cert_ref, config);
if (ret) {
goto cleanup;
}

cleanup:
return ret;
}

API int
nc_server_config_new_tls_keystore_reference(const struct ly_ctx *ctx, const char *endpt_name, const char *asym_key_ref,
const char *cert_ref, struct lyd_node **config)
{
int ret = 0;
char *path = NULL;

NC_CHECK_ARG_RET(NULL, ctx, endpt_name, asym_key_ref, cert_ref, config, 1);

/* create asymmetric key pair reference */
ret = nc_config_new_create(ctx, config, asym_key_ref, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/"
"tls/tls-server-parameters/server-identity/certificate/keystore-reference/asymmetric-key", endpt_name);
if (ret) {
if (asprintf(&path, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/"
"tls/tls-server-parameters/server-identity/certificate/keystore-reference", endpt_name) == -1) {
ERRMEM;
path = NULL;
ret = 1;
goto cleanup;
}

/* create cert reference, this cert has to belong to the asym key */
ret = nc_config_new_create(ctx, config, cert_ref, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/"
"tls/tls-server-parameters/server-identity/certificate/keystore-reference/certificate", endpt_name);
ret = _nc_server_config_new_tls_keystore_reference(ctx, path, asym_key_ref, cert_ref, config);
if (ret) {
goto cleanup;
}

cleanup:
free(path);
return ret;
}

Expand All @@ -213,6 +239,46 @@ nc_server_config_new_tls_del_keystore_reference(const char *endpt_name, struct l
"tls/tls-server-parameters/server-identity/certificate/keystore-reference", endpt_name);
}

API int
nc_server_config_new_ch_tls_keystore_reference(const struct ly_ctx *ctx, const char *client_name,
const char *endpt_name, const char *asym_key_ref, const char *cert_ref, struct lyd_node **config)
{
int ret = 0;
char *path = NULL;

NC_CHECK_ARG_RET(NULL, ctx, client_name, endpt_name, asym_key_ref, cert_ref, 1);
NC_CHECK_ARG_RET(NULL, config, 1);

if (asprintf(&path, "/ietf-netconf-server:netconf-server/call-home/netconf-client[name='%s']/endpoints/"
"endpoint[name='%s']/tls/tls-server-parameters/server-identity/certificate/"
"keystore-reference", client_name, endpt_name) == -1) {
ERRMEM;
path = NULL;
ret = 1;
goto cleanup;
}

ret = _nc_server_config_new_tls_keystore_reference(ctx, path, asym_key_ref, cert_ref, config);
if (ret) {
goto cleanup;
}

cleanup:
free(path);
return ret;
}

API int
nc_server_config_new_ch_tls_del_keystore_reference(const char *client_name, const char *endpt_name,
struct lyd_node **config)
{
NC_CHECK_ARG_RET(NULL, client_name, endpt_name, config, 1);

return nc_config_new_delete(config, "/ietf-netconf-server:netconf-server/call-home/netconf-client[name='%s']/"
"endpoints/endpoint[name='%s']/tls/tls-server-parameters/server-identity/certificate/"
"keystore-reference", client_name, endpt_name);
}

static int
_nc_server_config_new_tls_client_certificate(const struct ly_ctx *ctx, const char *tree_path,
const char *cert_path, struct lyd_node **config)
Expand Down Expand Up @@ -346,6 +412,28 @@ nc_server_config_new_tls_del_client_cert_truststore_ref(const char *endpt_name,
"tls-server-parameters/client-authentication/ee-certs/truststore-reference", endpt_name);
}

API int
nc_server_config_new_ch_tls_client_cert_truststore_ref(const struct ly_ctx *ctx, const char *client_name,
const char *endpt_name, const char *cert_bag_ref, struct lyd_node **config)
{
NC_CHECK_ARG_RET(NULL, ctx, client_name, endpt_name, cert_bag_ref, config, 1);

return nc_config_new_create(ctx, config, cert_bag_ref, "/ietf-netconf-server:netconf-server/call-home/"
"netconf-client[name='%s']/endpoints/endpoint[name='%s']/tls/tls-server-parameters/"
"client-authentication/ee-certs/truststore-reference", client_name, endpt_name);
}

API int
nc_server_config_new_ch_tls_del_client_cert_truststore_ref(const char *client_name, const char *endpt_name,
struct lyd_node **config)
{
NC_CHECK_ARG_RET(NULL, client_name, endpt_name, config, 1);

return nc_config_new_delete(config, "/ietf-netconf-server:netconf-server/call-home/"
"netconf-client[name='%s']/endpoints/endpoint[name='%s']/tls/tls-server-parameters/"
"client-authentication/ee-certs/truststore-reference", client_name, endpt_name);
}

API int
nc_server_config_new_tls_client_ca(const struct ly_ctx *ctx, const char *endpt_name, const char *cert_name,
const char *cert_path, struct lyd_node **config)
Expand Down Expand Up @@ -456,6 +544,28 @@ nc_server_config_new_tls_del_client_ca_truststore_ref(const char *endpt_name, st
"tls-server-parameters/client-authentication/ca-certs/truststore-reference", endpt_name);
}

API int
nc_server_config_new_ch_tls_client_ca_truststore_ref(const struct ly_ctx *ctx, const char *client_name,
const char *endpt_name, const char *cert_bag_ref, struct lyd_node **config)
{
NC_CHECK_ARG_RET(NULL, ctx, client_name, endpt_name, cert_bag_ref, config, 1);

return nc_config_new_create(ctx, config, cert_bag_ref, "/ietf-netconf-server:netconf-server/call-home/"
"netconf-client[name='%s']/endpoints/endpoint[name='%s']/tls/tls-server-parameters/"
"client-authentication/ca-certs/truststore-reference", client_name, endpt_name);
}

API int
nc_server_config_new_ch_tls_del_client_ca_truststore_ref(const char *client_name, const char *endpt_name,
struct lyd_node **config)
{
NC_CHECK_ARG_RET(NULL, client_name, endpt_name, config, 1);

return nc_config_new_delete(config, "/ietf-netconf-server:netconf-server/call-home/"
"netconf-client[name='%s']/endpoints/endpoint[name='%s']/tls/tls-server-parameters/"
"client-authentication/ca-certs/truststore-reference", client_name, endpt_name);
}

static const char *
nc_config_new_tls_maptype2str(NC_TLS_CTN_MAPTYPE map_type)
{
Expand Down
86 changes: 84 additions & 2 deletions src/server_config.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1587,7 +1587,7 @@ int nc_server_config_new_ch_ssh_del_mac_alg(const char *client_name, const char
* it will be generated from the private key.
* @param[in] privkey_path Path to the server's private key file.
* @param[in] certificate_path Path to the server's certificate file.
* @param config Configuration YANG data tree. If *config is NULL, it will be created.
* @param[in,out] config Configuration YANG data tree. If *config is NULL, it will be created.
* Otherwise the new YANG data will be added to the previous data and may override it.
* @return 0 on success, non-zero otherwise.
*/
Expand All @@ -1605,6 +1605,34 @@ int nc_server_config_new_ch_tls_server_certificate(const struct ly_ctx *ctx, con
int nc_server_config_new_ch_tls_del_server_certificate(const char *client_name, const char *endpt_name,
struct lyd_node **config);

/**
* @brief Creates new YANG configuration data nodes for a keystore reference to the Call Home TLS server's certificate.
*
* @param[in] ctx libyang context.
* @param[in] client_name Arbitrary identifier of the call-home client.
* If a call-home client with this identifier already exists, its contents will be changed.
* @param[in] endpt_name Arbitrary identifier of the call-home client's endpoint.
* If a call-home client's endpoint with this identifier already exists, its contents will be changed.
* @param[in] asym_key_ref Name of the asymmetric key pair in the keystore to be referenced.
* @param[in] cert_ref Name of the certificate, which must belong to the given asymmetric key pair, to be referenced.
* @param[in,out] config Configuration YANG data tree. If *config is NULL, it will be created.
* Otherwise the new YANG data will be added to the previous data and may override it.
* @return 0 on success, non-zero otherwise.
*/
int nc_server_config_new_ch_tls_keystore_reference(const struct ly_ctx *ctx, const char *client_name,
const char *endpt_name, const char *asym_key_ref, const char *cert_ref, struct lyd_node **config);

/**
* @brief Deletes a TLS server certificate keystore reference from the YANG data.
*
* @param[in] client_name Identifier of an existing Call-Home client.
* @param[in] endpt_name Identifier of an existing Call-Home endpoint that belongs to the given client.
* @param[in,out] config Modified configuration YANG data tree.
* @return 0 on success, non-zero otherwise.
*/
int nc_server_config_new_ch_tls_del_keystore_reference(const char *client_name, const char *endpt_name,
struct lyd_node **config);

/**
* @brief Creates new YANG configuration data nodes for a call-home client's (end-entity) certificate.
*
Expand All @@ -1616,7 +1644,7 @@ int nc_server_config_new_ch_tls_del_server_certificate(const char *client_name,
* @param[in] cert_name Arbitrary identifier of the call-home endpoint's end-entity certificate.
* If an call-home endpoint's end-entity certificate with this identifier already exists, its contents will be changed.
* @param[in] cert_path Path to the certificate file.
* @param config Configuration YANG data tree. If *config is NULL, it will be created.
* @param[in,out] config Configuration YANG data tree. If *config is NULL, it will be created.
* Otherwise the new YANG data will be added to the previous data and may override it.
* @return 0 on success, non-zero otherwise.
*/
Expand All @@ -1636,6 +1664,33 @@ int nc_server_config_new_ch_tls_client_certificate(const struct ly_ctx *ctx, con
int nc_server_config_new_ch_tls_del_client_certificate(const char *client_name, const char *endpt_name,
const char *cert_name, struct lyd_node **config);

/**
* @brief Creates new YANG configuration data nodes for a Call Home truststore reference to a set of client (end-entity) certificates.
*
* @param[in] ctx libyang context.
* @param[in] client_name Arbitrary identifier of the call-home client.
* If a call-home client with this identifier already exists, its contents will be changed.
* @param[in] endpt_name Arbitrary identifier of the call-home client's endpoint.
* If a call-home client's endpoint with this identifier already exists, its contents will be changed.
* @param[in] cert_bag_ref Identifier of the certificate bag in the truststore to be referenced.
* @param[in,out] config Configuration YANG data tree. If *config is NULL, it will be created.
* Otherwise the new YANG data will be added to the previous data and may override it.
* @return 0 on success, non-zero otherwise.
*/
int nc_server_config_new_ch_tls_client_cert_truststore_ref(const struct ly_ctx *ctx, const char *client_name,
const char *endpt_name, const char *cert_bag_ref, struct lyd_node **config);

/**
* @brief Deletes a Call Home client (end-entity) certificates truststore reference from the YANG data.
*
* @param[in] client_name Identifier of an existing Call-Home client.
* @param[in] endpt_name Identifier of an existing Call-Home endpoint that belongs to the given client.
* @param[in,out] config Modified configuration YANG data tree.
* @return 0 on success, non-zero otherwise.
*/
int nc_server_config_new_ch_tls_del_client_cert_truststore_ref(const char *client_name, const char *endpt_name,
struct lyd_node **config);

/**
* @brief Creates new YANG configuration data nodes for a client certificate authority (trust-anchor) certificate.
*
Expand Down Expand Up @@ -1667,6 +1722,33 @@ int nc_server_config_new_ch_tls_client_ca(const struct ly_ctx *ctx, const char *
int nc_server_config_new_ch_tls_del_client_ca(const char *client_name, const char *endpt_name,
const char *cert_name, struct lyd_node **config);

/**
* @brief Creates new YANG configuration data nodes for a Call Home truststore reference to a set of client certificate authority (trust-anchor) certificates.
*
* @param[in] ctx libyang context.
* @param[in] client_name Arbitrary identifier of the call-home client.
* If a call-home client with this identifier already exists, its contents will be changed.
* @param[in] endpt_name Arbitrary identifier of the call-home client's endpoint.
* If a call-home client's endpoint with this identifier already exists, its contents will be changed.
* @param[in] cert_bag_ref Identifier of the certificate bag in the truststore to be referenced.
* @param[in,out] config Configuration YANG data tree. If *config is NULL, it will be created.
* Otherwise the new YANG data will be added to the previous data and may override it.
* @return 0 on success, non-zero otherwise.
*/
int nc_server_config_new_ch_tls_client_ca_truststore_ref(const struct ly_ctx *ctx, const char *client_name,
const char *endpt_name, const char *cert_bag_ref, struct lyd_node **config);

/**
* @brief Deletes a Call Home client certificate authority (trust-anchor) certificates truststore reference from the YANG data.
*
* @param[in] client_name Identifier of an existing Call-Home client.
* @param[in] endpt_name Identifier of an existing Call-Home endpoint that belongs to the given client.
* @param[in,out] config Modified configuration YANG data tree.
* @return 0 on success, non-zero otherwise.
*/
int nc_server_config_new_ch_tls_del_client_ca_truststore_ref(const char *client_name, const char *endpt_name,
struct lyd_node **config);

/**
* @brief Creates new YANG configuration data nodes for a call-home cert-to-name entry.
*
Expand Down

0 comments on commit a178470

Please sign in to comment.