Server Configuration Functions

Server-side configuration functions. More...

Collaboration diagram for Server Configuration Functions:

Functions
int	nc_server_config_add_address_port (const struct ly_ctx *ctx, const char *endpt_name, NC_TRANSPORT_IMPL transport, const char *address, uint16_t port, struct lyd_node **config)
	Creates new YANG configuration data nodes for address and port.
int	nc_server_config_add_keystore_asym_key (const struct ly_ctx *ctx, NC_TRANSPORT_IMPL ti, const char *asym_key_name, const char *privkey_path, const char *pubkey_path, struct lyd_node **config)
	Creates new YANG data nodes for an asymmetric key in the keystore.
int	nc_server_config_add_keystore_cert (const struct ly_ctx *ctx, const char *asym_key_name, const char *cert_name, const char *cert_path, struct lyd_node **config)
	Creates new YANG data nodes for a certificate in the keystore.
int	nc_server_config_add_truststore_cert (const struct ly_ctx *ctx, const char *cert_bag_name, const char *cert_name, const char *cert_path, struct lyd_node **config)
	Creates new YANG data nodes for a certificate in the truststore.
int	nc_server_config_add_truststore_pubkey (const struct ly_ctx *ctx, const char *pub_bag_name, const char *pubkey_name, const char *pubkey_path, struct lyd_node **config)
	Creates new YANG data nodes for a public key in the truststore.
int	nc_server_config_add_unix_socket (const struct ly_ctx *ctx, const char *endpt_name, const char *path, const char *mode, const char *owner, const char *group, struct lyd_node **config)
	Creates new YANG data nodes for a UNIX socket endpoint.
int	nc_server_config_add_unix_user_mapping (const struct ly_ctx *ctx, const char *endpt_name, const char *system_user, const char *netconf_user, struct lyd_node **config)
	Creates new YANG data nodes for a UNIX username mapping.
int	nc_server_config_del_endpt (const char *endpt_name, struct lyd_node **config)
	Deletes an endpoint from the YANG data.
int	nc_server_config_del_keystore_asym_key (const char *asym_key_name, struct lyd_node **config)
	Deletes a keystore's asymmetric key from the YANG data.
int	nc_server_config_del_keystore_cert (const char *asym_key_name, const char *cert_name, struct lyd_node **config)
	Deletes a keystore's certificate from the YANG data.
int	nc_server_config_del_truststore_cert (const char *cert_bag_name, const char *cert_name, struct lyd_node **config)
	Deletes a truststore's certificate from the YANG data.
int	nc_server_config_del_truststore_pubkey (const char *pub_bag_name, const char *pubkey_name, struct lyd_node **config)
	Deletes a truststore's public key from the YANG data.
int	nc_server_config_del_unix_user_mapping (const char *endpt_name, const char *system_user, struct lyd_node **config)
	Deletes a UNIX username mapping from the YANG data.
int	nc_server_config_load_modules (struct ly_ctx **ctx)
	Implements all the required modules and their features in the context. Needs to be called before any other configuration functions.
int	nc_server_config_oper_get_supported_ssh_algs (const struct ly_ctx *ctx, struct lyd_node **supported_algs)
	Gets all the SSH transport algorithms supported by the server.
int	nc_server_config_oper_get_supported_tls_algs (const struct ly_ctx *ctx, struct lyd_node **supported_algs)
	Gets all the TLS transport cipher suites supported by the server.
int	nc_server_config_oper_get_user_password_last_modified (const char *ch_client, const char *endpoint, const char *username, time_t *last_modified)
	Gets the last modified time of an SSH user's password.
int	nc_server_config_setup_data (const struct lyd_node *data)
	Configure server based on the given data.
int	nc_server_config_setup_diff (const struct lyd_node *diff)
	Configure server based on the given diff.
int	nc_server_config_setup_path (const struct ly_ctx *ctx, const char *path)
	Configure server based on the given data stored in a file.

Detailed Description

Server-side configuration functions.

Server Configuration

Function Documentation

nc_server_config_load_modules()

int nc_server_config_load_modules

(

struct ly_ctx **

ctx

)

Implements all the required modules and their features in the context. Needs to be called before any other configuration functions.

If ctx is :

• NULL: a new context will be created and if the call is successful you have to free it,
• non NULL: modules will simply be implemented.

Implemented modules: ietf-netconf-server, ietf-x509-cert-to-name, ietf-crypto-types, ietf-tcp-common, ietf-ssh-common, iana-ssh-encryption-algs, iana-ssh-key-exchange-algs, iana-ssh-mac-algs, iana-ssh-public-key-algs, ietf-keystore, ietf-ssh-server, ietf-truststore, ietf-tls-server and libnetconf2-netconf-server.

Note that the SSH authentication depends on the value of the 'local-users-supported' feature in the ietf-ssh-server module. If the feature, and its dependent if-features, are disabled, the SSH authentication will use the system users. Otherwise, the SSH authentication will use the local users from the configuration (the default).

Parameters

[in,out]

ctx

Optional context in which the modules will be implemented. Created if *ctx is null.

Returns

0 on success, 1 on error.

nc_server_config_setup_diff()

int nc_server_config_setup_diff

(

const struct lyd_node *

diff

)

Configure server based on the given diff.

Context must already have implemented the required modules, see nc_server_config_load_modules().

Note

All the implicit nodes, such as non-presence containers and leafs with default values, must be present in the diff.

Parameters

[in]

diff

YANG diff belonging to either ietf-netconf-server, ietf-keystore or ietf-truststore modules. The top level node HAS to have an operation (create, replace, delete or none).

Returns

0 on success, 1 on error.

nc_server_config_setup_data()

int nc_server_config_setup_data

(

const struct lyd_node *

data

)

Configure server based on the given data.

The current configuration will be completely replaced by the given data.

Context must already have implemented the required modules, see nc_server_config_load_modules().

Note

All the implicit nodes, such as non-presence containers and leafs with default values, must be present in the data.

Parameters

[in]

data

YANG data belonging to either ietf-netconf-server, ietf-keystore or ietf-truststore modules. This data must be valid. No node can have an operation attribute.

Returns

0 on success, 1 on error.

nc_server_config_setup_path()

int nc_server_config_setup_path	(	const struct ly_ctx *	ctx,
		const char *	path
	)

Configure server based on the given data stored in a file.

Wrapper around nc_server_config_setup_data() hiding work with parsing the data. Context must already have implemented the required modules, see nc_server_config_load_modules().

Parameters

[in]	ctx	libyang context.
[in]	path	Path to a file with ietf-netconf-server, ietf-keystore or ietf-truststore YANG data. This data must be valid. No node can have an operation attribute.

Returns

0 on success, 1 on error.

nc_server_config_add_address_port()

int nc_server_config_add_address_port	(	const struct ly_ctx *	ctx,
		const char *	endpt_name,
		NC_TRANSPORT_IMPL	transport,
		const char *	address,
		uint16_t	port,
		struct lyd_node **	config
	)

Creates new YANG configuration data nodes for address and port.

Parameters

[in]	ctx	libyang context.
[in]	endpt_name	Arbitrary identifier of the endpoint. If an endpoint with this identifier already exists, its contents might be changed.
[in]	transport	Either SSH or TLS transport for the given endpoint.
[in]	address	New listening address.
[in]	port	New listening port.
[in,out]	config	Configuration YANG data tree. If *config is NULL, it will be created. Otherwise the new YANG data will be added to the previous data and may override it.

Returns

0 on success, non-zero otherwise.

nc_server_config_del_endpt()

int nc_server_config_del_endpt	(	const char *	endpt_name,
		struct lyd_node **	config
	)

Deletes an endpoint from the YANG data.

Parameters

[in]	endpt_name	Optional identifier of an endpoint to be deleted. If NULL, all of the endpoints will be deleted.
[in,out]	config	Modified configuration YANG data tree.

Returns

0 on success, non-zero otherwise.

nc_server_config_add_unix_socket()

int nc_server_config_add_unix_socket	(	const struct ly_ctx *	ctx,
		const char *	endpt_name,
		const char *	path,
		const char *	mode,
		const char *	owner,
		const char *	group,
		struct lyd_node **	config
	)

Creates new YANG data nodes for a UNIX socket endpoint.

To learn how authentication works, look at nc_server_config_add_unix_user_mapping().

Parameters

[in]	ctx	libyang context.
[in]	endpt_name	Arbitrary identifier of the endpoint. If an endpoint with this identifier already exists, its contents might be changed.
[in]	path	Path to the UNIX socket. The parent directory must be writable by the server process.
[in]	mode	Optional UNIX socket file mode in octal format (e.g., "0777"). If NULL, the default value ("0660") will be used.
[in]	owner	Optional owner of the UNIX socket file. If NULL, the owner will be set to the user running the server process.
[in]	group	Optional group of the UNIX socket file. If NULL, the group will be set to the group of the user running the server process.
[in,out]	config	Configuration YANG data tree. If *config is NULL, it will be created. Otherwise the new YANG data will be added to the previous data and may override it.

Returns

0 on success, non-zero otherwise.

nc_server_config_add_unix_user_mapping()

int nc_server_config_add_unix_user_mapping	(	const struct ly_ctx *	ctx,
		const char *	endpt_name,
		const char *	system_user,
		const char *	netconf_user,
		struct lyd_node **	config
	)

Creates new YANG data nodes for a UNIX username mapping.

Specifies who can connect to a UNIX socket endpoint. There are 3 following scenarios:

1) If no mappings are configured for the client system_user, then the client can only connect if its username matches netconf_user.

2) If a mapping for the client system_user is configured, but no netconf_user s are specified, then the client cannot connect with any username.

3) If a mapping for the client system_user is configured, and at least one netconf_user is specified, then the client can connect only with one of the specified usernames. If a wildcard value "*" is configured for netconf_user, then the client can connect with any NETCONF username.

Parameters

[in]	ctx	libyang context.
[in]	endpt_name	Arbitrary identifier of the endpoint. If an endpoint with this identifier already exists, its contents might be changed.
[in]	system_user	System user name, who the mapping will be created for.
[in]	netconf_user	Username that the system_user can use to connect to the endpoint. Special value "*" can be used to allow any username. If NULL, empty mapping will be created, which means that the system_user can not connect to the endpoint with any username.
[in,out]	config	Configuration YANG data tree. If *config is NULL, it will be created. Otherwise the new YANG data will be added to the previous data and may override it.

Returns

0 on success, non-zero otherwise.

nc_server_config_del_unix_user_mapping()

int nc_server_config_del_unix_user_mapping	(	const char *	endpt_name,
		const char *	system_user,
		struct lyd_node **	config
	)

Deletes a UNIX username mapping from the YANG data.

Parameters

[in]	endpt_name	Identifier of an existing endpoint.
[in]	system_user	Optional identifier of a system user whose mapping will be deleted. If NULL, all of the mappings for the endpoint will be deleted.
[in,out]	config	Configuration YANG data tree.

Returns

0 on success, non-zero otherwise.

nc_server_config_add_keystore_asym_key()

int nc_server_config_add_keystore_asym_key	(	const struct ly_ctx *	ctx,
		NC_TRANSPORT_IMPL	ti,
		const char *	asym_key_name,
		const char *	privkey_path,
		const char *	pubkey_path,
		struct lyd_node **	config
	)

Creates new YANG data nodes for an asymmetric key in the keystore.

Parameters

[in]	ctx	libyang context.
[in]	ti	Transport in which the key pair will be used. Either SSH or TLS.
[in]	asym_key_name	Identifier of the asymmetric key pair. This identifier is used to reference the key pair.
[in]	privkey_path	Path to a private key file.
[in]	pubkey_path	Optional path a public key file. If not supplied, it will be generated from the private key.
[in,out]	config	Configuration YANG data tree. If *config is NULL, it will be created. Otherwise the new YANG data will be added to the previous data and may override it.

Returns

0 on success, non-zero otherwise.

nc_server_config_del_keystore_asym_key()

int nc_server_config_del_keystore_asym_key	(	const char *	asym_key_name,
		struct lyd_node **	config
	)

Deletes a keystore's asymmetric key from the YANG data.

Parameters

[in]	asym_key_name	Optional identifier of the asymmetric key to be deleted. If NULL, all of the asymmetric keys in the keystore will be deleted.
[in,out]	config	Configuration YANG data tree.

Returns

0 on success, non-zero otherwise.

nc_server_config_add_keystore_cert()

int nc_server_config_add_keystore_cert	(	const struct ly_ctx *	ctx,
		const char *	asym_key_name,
		const char *	cert_name,
		const char *	cert_path,
		struct lyd_node **	config
	)

Creates new YANG data nodes for a certificate in the keystore.

A certificate can not exist without its asymmetric key, so you must create an asymmetric key with the same identifier you pass to this function.

Parameters

[in]	ctx	libyang context.
[in]	asym_key_name	Arbitrary identifier of the asymmetric key. If an asymmetric key pair with this name already exists, its contents will be changed.
[in]	cert_name	Arbitrary identifier of the key pair's certificate. If a certificate with this name already exists, its contents will be changed.
[in]	cert_path	Path to the PEM encoded certificate file.
[in,out]	config	Configuration YANG data tree. If *config is NULL, it will be created. Otherwise the new YANG data will be added to the previous data and may override it.

Returns

0 on success, non-zero otherwise.

nc_server_config_del_keystore_cert()

int nc_server_config_del_keystore_cert	(	const char *	asym_key_name,
		const char *	cert_name,
		struct lyd_node **	config
	)

Deletes a keystore's certificate from the YANG data.

Parameters

[in]	asym_key_name	Identifier of an existing asymmetric key pair.
[in]	cert_name	Optional identifier of a certificate to be deleted. If NULL, all of the certificates belonging to the asymmetric key pair will be deleted.
[in,out]	config	Configuration YANG data tree. If *config is NULL, it will be created. Otherwise the new YANG data will be added to the previous data and may override it.

Returns

0 on success, non-zero otherwise.

nc_server_config_add_truststore_pubkey()

int nc_server_config_add_truststore_pubkey	(	const struct ly_ctx *	ctx,
		const char *	pub_bag_name,
		const char *	pubkey_name,
		const char *	pubkey_path,
		struct lyd_node **	config
	)

Creates new YANG data nodes for a public key in the truststore.

Parameters

[in]	ctx	libyang context.
[in]	pub_bag_name	Arbitrary identifier of the public key bag. This name is used to reference the public keys in the bag. If a public key bag with this name already exists, its contents will be changed.
[in]	pubkey_name	Arbitrary identifier of the public key. If a public key with this name already exists in the given bag, its contents will be changed.
[in]	pubkey_path	Path to a file containing a public key.
[in,out]	config	Configuration YANG data tree. If *config is NULL, it will be created. Otherwise the new YANG data will be added to the previous data and may override it.

Returns

0 on success, non-zero otherwise.

nc_server_config_del_truststore_pubkey()

int nc_server_config_del_truststore_pubkey	(	const char *	pub_bag_name,
		const char *	pubkey_name,
		struct lyd_node **	config
	)

Deletes a truststore's public key from the YANG data.

Parameters

[in]	pub_bag_name	Identifier of an existing public key bag.
[in]	pubkey_name	Optional identifier of a public key to be deleted. If NULL, all of the public keys in the given bag will be deleted.
[in,out]	config	Configuration YANG data tree.

Returns

0 on success, non-zero otherwise.

nc_server_config_add_truststore_cert()

int nc_server_config_add_truststore_cert	(	const struct ly_ctx *	ctx,
		const char *	cert_bag_name,
		const char *	cert_name,
		const char *	cert_path,
		struct lyd_node **	config
	)

Creates new YANG data nodes for a certificate in the truststore.

Parameters

[in]	ctx	libyang context.
[in]	cert_bag_name	Arbitrary identifier of the certificate bag. This name is used to reference the certificates in the bag. If a certificate bag with this name already exists, its contents will be changed.
[in]	cert_name	Arbitrary identifier of the certificate. If a certificate with this name already exists in the given bag, its contents will be changed.
[in]	cert_path	Path to a file containing a PEM encoded certificate.
[in,out]	config	Configuration YANG data tree. If *config is NULL, it will be created. Otherwise the new YANG data will be added to the previous data and may override it.

Returns

0 on success, non-zero otherwise.

nc_server_config_del_truststore_cert()

int nc_server_config_del_truststore_cert	(	const char *	cert_bag_name,
		const char *	cert_name,
		struct lyd_node **	config
	)

Deletes a truststore's certificate from the YANG data.

Parameters

[in]	cert_bag_name	Identifier of an existing certificate bag.
[in]	cert_name	Optional identifier of a certificate to be deleted. If NULL, all of the certificates in the given bag will be deleted.
[in,out]	config	Configuration YANG data tree.

Returns

0 on success, non-zero otherwise.

nc_server_config_oper_get_supported_ssh_algs()

int nc_server_config_oper_get_supported_ssh_algs	(	const struct ly_ctx *	ctx,
		struct lyd_node **	supported_algs
	)

Gets all the SSH transport algorithms supported by the server.

Note

Actual usable algorithms depend on the underlying libssh library version, the returned list is based on libssh v0.11.0.

Parameters

[in]	ctx	libyang context.
[out]	supported_algs	Supported SSH transport algorithms.

Returns

0 on success, non-zero otherwise.

nc_server_config_oper_get_supported_tls_algs()

int nc_server_config_oper_get_supported_tls_algs	(	const struct ly_ctx *	ctx,
		struct lyd_node **	supported_algs
	)

Gets all the TLS transport cipher suites supported by the server.

Note

Actual usable cipher suites depend on the underlying TLS library and its version.

Parameters

[in]	ctx	libyang context.
[out]	supported_algs	Supported cipher suites.

Returns

0 on success, non-zero otherwise.

nc_server_config_oper_get_user_password_last_modified()

int nc_server_config_oper_get_user_password_last_modified	(	const char *	ch_client,
		const char *	endpoint,
		const char *	username,
		time_t *	last_modified
	)

Gets the last modified time of an SSH user's password.

Parameters

[in]	ch_client	Name of the call-home client the user is configured on. NULL if the user is on a listening endpoint.
[in]	endpoint	Name of the endpoint the user is configured on. Can be either a listening or call-home endpoint.
[in]	username	Name of the SSH user.
[out]	last_modified	Time of the last password modification.

Returns

0 on success, non-zero otherwise.