Gitiles
Code Review Sign In
gerrit.cesnet.cz / github / CESNET / libnetconf2 / 78df0fa085fe1483f6fe32f39e4d187d915c8c46 / . / src / session_p.h
blob: 2b3524d1a3f968b19f2b0db3b150f212c88d9ba7 [file] [log] [blame]
/**
* @file session_p.h
* @author Radek Krejci <rkrejci@cesnet.cz>
* @author Michal Vasko <mvasko@cesnet.cz>
* @brief libnetconf2 session manipulation
*
* @copyright
* Copyright (c) 2017 - 2023 CESNET, z.s.p.o.
*
* This source code is licensed under BSD 3-Clause License (the "License").
* You may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://opensource.org/licenses/BSD-3-Clause
*/
#ifndef NC_SESSION_PRIVATE_H_
#define NC_SESSION_PRIVATE_H_
#define _GNU_SOURCE
#include <pthread.h>
#include <stdint.h>
#include <libyang/libyang.h>
#include "compat.h"
#include "config.h"
#include "session_client.h"
#include "session_server_ch.h"
/**
* Enumeration of diff operation types.
*/
typedef enum {
NC_OP_UNKNOWN = 0,
NC_OP_NONE,
NC_OP_CREATE,
NC_OP_DELETE,
NC_OP_REPLACE
} NC_OPERATION;
/**
* Enumeration of key or certificate store type.
*/
typedef enum {
NC_STORE_LOCAL, /**< key/certificate is stored locally in the ietf-netconf-server YANG data */
NC_STORE_KEYSTORE, /**< key/certificate is stored externally in a keystore module YANG data */
NC_STORE_TRUSTSTORE /**< key/certificate is stored externally in a truststore module YANG data */
} NC_STORE_TYPE;
#ifdef NC_ENABLED_SSH_TLS
#include <libssh/libssh.h>
#include <openssl/ssl.h>
/* seconds */
#define NC_SSH_TIMEOUT 10
/* number of all supported authentication methods */
#define NC_SSH_AUTH_COUNT 3
/**
* Enumeration of SSH public key formats.
*/
typedef enum {
NC_PUBKEY_FORMAT_SSH, /**< see RFC 4253, section 6.6 */
NC_PUBKEY_FORMAT_X509 /**< see RFC 5280 sec. 4.1.2.7 */
} NC_PUBKEY_FORMAT;
/**
* Enumeration of private key file formats.
*/
typedef enum {
NC_PRIVKEY_FORMAT_RSA, /**< PKCS1 RSA format */
NC_PRIVKEY_FORMAT_EC, /**< SEC1 EC format */
NC_PRIVKEY_FORMAT_X509, /**< X509 (PKCS8) format */
NC_PRIVKEY_FORMAT_OPENSSH, /**< OpenSSH format */
NC_PRIVKEY_FORMAT_UNKNOWN /**< Unknown format */
} NC_PRIVKEY_FORMAT;
/**
* @brief A basic certificate.
*/
struct nc_certificate {
char *name; /**< Arbitrary name of the certificate. */
char *data; /**< Base-64 encoded certificate. */
};
struct nc_certificate_bag {
char *name;
struct nc_certificate *certs;
uint16_t cert_count;
};
/**
* @brief An asymmetric key.
*/
struct nc_asymmetric_key {
char *name; /**< Arbitrary name of the key. */
NC_PUBKEY_FORMAT pubkey_type; /**< Type of the public key. */
char *pubkey_data; /**< Base-64 encoded public key. */
NC_PRIVKEY_FORMAT privkey_type; /**< Type of the private key. */
char *privkey_data; /**< Base-64 encoded private key. */
struct nc_certificate *certs; /**< The certificates associated with this key. */
uint16_t cert_count; /**< Number of certificates associated with this key. */
};
/**
* @brief A symmetric key.
*/
struct nc_symmetric_key {
char *name; /**< Arbitrary name of the key. */
char *data; /**< Base-64 encoded key. */
};
/**
* @brief A public key.
*/
struct nc_public_key {
char *name; /**< Arbitrary name of the public key. */
NC_PUBKEY_FORMAT type; /**< Type of the public key. */
char *data; /**< Base-64 encoded public key. */
};
struct nc_public_key_bag {
char *name;
struct nc_public_key *pubkeys;
uint16_t pubkey_count;
};
struct nc_truststore {
struct nc_certificate_bag *cert_bags;
uint16_t cert_bag_count;
struct nc_public_key_bag *pub_bags;
uint16_t pub_bag_count;
};
/**
* @brief Keystore YANG module representation.
*/
struct nc_keystore {
struct nc_asymmetric_key *asym_keys; /**< Stored asymmetric keys. */
uint16_t asym_key_count; /**< Count of stored asymmetric keys. */
struct nc_symmetric_key *sym_keys; /**< Stored symmetric keys. */
uint16_t sym_key_count; /**< Count of stored symmetric keys. */
};
/**
* @brief Tracks the state of a client's authentication.
*/
struct nc_auth_state {
int auth_method_count; /**< The number of auth. methods that the user supports. */
int auth_success_count; /**< The number of auth. methods that ended successfully. */
};
/**
* @brief A server's authorized client.
*/
struct nc_auth_client {
char *username; /**< Arbitrary username. */
NC_STORE_TYPE store; /**< Specifies how/where the client's public key is stored. */
union {
struct {
struct nc_public_key *pubkeys; /**< The client's public keys. */
uint16_t pubkey_count; /**< The number of client's public keys. */
};
char *ts_ref; /**< Name of the referenced truststore key. */
};
char *password; /**< Client's password */
char *pam_config_name; /**< Client's PAM configuration file name. */
char *pam_config_dir; /**< Client's PAM configuration file directory. */
int supports_none; /**< Implies that the client supports the none authentication method. */
};
/**
* @brief The server's hostkey.
*/
struct nc_hostkey {
char *name; /**< Arbitrary name of the host key. */
NC_STORE_TYPE store; /**< Specifies how/where the key is stored. */
union {
struct nc_asymmetric_key key; /**< The server's hostkey. */
char *ks_ref; /**< Name of the referenced key. */
};
};
/**
* @brief Server options for configuring the SSH transport protocol.
*/
struct nc_server_ssh_opts {
struct nc_hostkey *hostkeys; /**< Server's hostkeys. */
uint16_t hostkey_count; /**< Number of server's hostkeys. */
struct nc_auth_client *auth_clients; /**< Server's authorized clients. */
uint16_t client_count; /**< Number of server's authorized clients. */
char *referenced_endpt_name; /**< Reference to another endpoint (used for client authentication). */
char *hostkey_algs; /**< Hostkey algorithms supported by the server. */
char *encryption_algs; /**< Encryption algorithms supported by the server. */
char *kex_algs; /**< Key exchange algorithms supported by the server. */
char *mac_algs; /**< MAC algorithms supported by the server. */
uint16_t auth_attempts; /**< Number of allowed authentication attempts. */
uint16_t auth_timeout; /**< Authentication timeout. */
};
/**
* @brief Certificate grouping (either local-definition or truststore reference).
*/
struct nc_cert_grouping {
NC_STORE_TYPE store; /**< Specifies how/where the certificates are stored. */
union {
struct {
struct nc_certificate *certs; /**< Local-defined certificates. */
uint16_t cert_count; /**< Certificate count. */
};
char *ts_ref; /**< Name of the referenced truststore certificate bag. */
};
};
/**
* @brief Storing downloaded data via CURL.
*/
struct nc_curl_data {
unsigned char *data; /**< Downloaded data */
size_t size; /**< Size of downloaded data */
};
/**
* @brief Cert-to-name entries.
*/
struct nc_ctn {
uint32_t id; /**< ID of the entry, the lower the higher priority */
char *fingerprint; /**< Fingerprint of the entry */
NC_TLS_CTN_MAPTYPE map_type; /**< Specifies how to get the username from the certificate */
char *name; /**< Username for this entry */
struct nc_ctn *next; /**< Linked-list reference to the next entry */
};
/**
* @brief Server options for configuring the TLS transport protocol.
*/
struct nc_server_tls_opts {
NC_STORE_TYPE store; /**< Specifies how/where the server identity is stored. */
union {
struct {
NC_PUBKEY_FORMAT pubkey_type; /**< Server public key type */
char *pubkey_data; /**< Server's public key */
NC_PRIVKEY_FORMAT privkey_type; /**< Server private key type */
char *privkey_data; /**< Server's private key */
char *cert_data; /**< Server's certificate */
};
struct {
char *key_ref; /**< Reference to the server's key */
char *cert_ref; /**< Reference to the concrete server's certificate */
};
};
struct nc_cert_grouping ca_certs; /**< Client certificate authorities */
struct nc_cert_grouping ee_certs; /**< Client end-entity certificates */
char *crl_url; /**< URI to download the CRL from */
char *crl_path; /**< Path to a CRL file */
int crl_cert_ext; /**< Indicates to use CA's distribution points to obtain CRLs */
X509_STORE *crl_store; /**< Stores all the CRLs */
char *referenced_endpt_name; /**< Reference to another endpoint (used for client authentication). */
unsigned int tls_versions; /**< TLS versions */
char *ciphers; /**< TLS ciphers */
struct nc_ctn *ctn; /**< Cert-to-name entries */
};
#endif /* NC_ENABLED_SSH_TLS */
/**
* @brief Keepalives configuration data.
*/
struct nc_keepalives {
int enabled; /**< Indicates that keepalives are enabled. */
uint16_t idle_time; /**< Idle timeout. */
uint16_t max_probes; /**< Maximum number of probes. */
uint16_t probe_interval; /**< Probe interval. */
};
/**
* @brief UNIX socket connection configuration.
*/
struct nc_server_unix_opts {
char *address; /**< Address of the socket. */
mode_t mode; /**< Socket's mode. */
uid_t uid; /**< Socket's uid. */
gid_t gid; /**< Socket's gid. */
};
/**
* @brief Stores information about a bind.
*/
struct nc_bind {
char *address; /**< Bind's address. */
uint16_t port; /**< Bind's port. */
int sock; /**< Bind's socket. */
int pollin; /**< Specifies, which sockets to poll on. */
};
#ifdef NC_ENABLED_SSH_TLS
struct nc_client_ssh_opts {
char *knownhosts_path; /**< path to known_hosts file */
NC_SSH_KNOWNHOSTS_MODE knownhosts_mode; /**< implies whether to check known_hosts or not */
/* SSH authentication method preferences */
struct {
NC_SSH_AUTH_TYPE type;
int16_t value;
} auth_pref[NC_SSH_AUTH_COUNT];
/* SSH key pairs */
struct {
char *pubkey_path;
char *privkey_path;
int8_t privkey_crypt;
} *keys;
uint16_t key_count;
/* SSH authentication callbacks */
char *(*auth_password)(const char *, const char *, void *);
char *(*auth_interactive)(const char *, const char *, const char *, int, void *);
char *(*auth_privkey_passphrase)(const char *, void *);
/* private data for the callbacks */
void *auth_password_priv;
void *auth_interactive_priv;
void *auth_privkey_passphrase_priv;
char *username;
};
struct nc_client_tls_opts {
char *cert_path;
char *key_path;
char *ca_file;
char *ca_dir;
int8_t tls_ctx_change;
SSL_CTX *tls_ctx;
char *crl_file;
char *crl_dir;
int8_t crl_store_change;
X509_STORE *crl_store;
};
#endif /* NC_ENABLED_SSH_TLS */
/* ACCESS unlocked */
struct nc_client_opts {
char *schema_searchpath;
int auto_context_fill_disabled;
ly_module_imp_clb schema_clb;
void *schema_clb_data;
struct nc_keepalives ka;
struct nc_bind *ch_binds;
pthread_mutex_t ch_bind_lock; /**< To avoid concurrent calls of poll and accept on the bound sockets **/
struct {
NC_TRANSPORT_IMPL ti;
char *hostname;
} *ch_binds_aux;
uint16_t ch_bind_count;
};
/* ACCESS unlocked */
struct nc_client_context {
unsigned int refcount;
struct nc_client_opts opts;
#ifdef NC_ENABLED_SSH_TLS
struct nc_client_ssh_opts ssh_opts;
struct nc_client_ssh_opts ssh_ch_opts;
struct nc_client_tls_opts tls_opts;
struct nc_client_tls_opts tls_ch_opts;
#endif /* NC_ENABLED_SSH_TLS */
};
/**
* @brief Call Home client thread data.
*/
struct nc_ch_client_thread_arg {
char *client_name;
const struct ly_ctx *(*acquire_ctx_cb)(void *cb_data); /**< acquiring libyang context cb */
void (*release_ctx_cb)(void *cb_data); /**< releasing libyang context cb */
void *ctx_cb_data; /**< acq/rel cb data */
int (*new_session_cb)(const char *client_name, struct nc_session *new_session, void *user_data); /**< creating new session cb */
void *new_session_cb_data; /**< new session cb data */
int thread_running; /**< A boolean value that is truthy while the underlying Call Home thread is running */
pthread_mutex_t cond_lock; /**< Condition's lock used for signalling the thread to terminate */
pthread_cond_t cond; /**< Condition used for signalling the thread to terminate */
};
struct nc_server_opts {
/* ACCESS unlocked */
ATOMIC_T wd_basic_mode;
ATOMIC_T wd_also_supported;
uint32_t capabilities_count;
char **capabilities;
char *(*content_id_clb)(void *user_data);
void *content_id_data;
void (*content_id_data_free)(void *data);
uint16_t hello_timeout;
uint16_t idle_timeout;
#ifdef NC_ENABLED_SSH_TLS
int (*passwd_auth_clb)(const struct nc_session *session, const char *password, void *user_data);
void *passwd_auth_data;
void (*passwd_auth_data_free)(void *data);
int (*pubkey_auth_clb)(const struct nc_session *session, ssh_key key, void *user_data);
void *pubkey_auth_data;
void (*pubkey_auth_data_free)(void *data);
int (*interactive_auth_clb)(const struct nc_session *session, ssh_session ssh_sess, ssh_message msg, void *user_data);
void *interactive_auth_data;
void (*interactive_auth_data_free)(void *data);
int (*user_verify_clb)(const struct nc_session *session);
#endif /* NC_ENABLED_SSH_TLS */
pthread_rwlock_t config_lock;
#ifdef NC_ENABLED_SSH_TLS
struct nc_keystore keystore; /**< store for server's keys/certificates */
struct nc_truststore truststore; /**< store for server client's keys/certificates */
#endif /* NC_ENABLED_SSH_TLS */
struct nc_bind *binds;
pthread_mutex_t bind_lock; /**< To avoid concurrent calls of poll and accept on the bound sockets **/
struct nc_endpt {
char *name;
#ifdef NC_ENABLED_SSH_TLS
char *referenced_endpt_name;
#endif /* NC_ENABLED_SSH_TLS */
NC_TRANSPORT_IMPL ti;
struct nc_keepalives ka;
union {
#ifdef NC_ENABLED_SSH_TLS
struct nc_server_ssh_opts *ssh;
struct nc_server_tls_opts *tls;
#endif /* NC_ENABLED_SSH_TLS */
struct nc_server_unix_opts *unixsock;
} opts;
} *endpts;
uint16_t endpt_count;
/* ACCESS locked, add/remove CH clients - WRITE lock ch_client_lock
* modify CH clients - READ lock ch_client_lock + ch_client_lock */
struct nc_ch_client {
char *name;
pthread_t tid; /**< Call Home client's thread ID */
struct nc_ch_client_thread_arg *thread_data; /**< Data of the Call Home client's thread */
struct nc_ch_endpt {
char *name;
#ifdef NC_ENABLED_SSH_TLS
char *referenced_endpt_name;
#endif /* NC_ENABLED_SSH_TLS */
NC_TRANSPORT_IMPL ti;
char *address;
uint16_t port;
int sock_pending;
struct nc_keepalives ka;
union {
#ifdef NC_ENABLED_SSH_TLS
struct nc_server_ssh_opts *ssh;
struct nc_server_tls_opts *tls;
#endif /* NC_ENABLED_SSH_TLS */
} opts;
} *ch_endpts;
uint16_t ch_endpt_count;
NC_CH_CONN_TYPE conn_type;
struct {
uint16_t period;
time_t anchor_time;
uint16_t idle_timeout;
};
NC_CH_START_WITH start_with;
uint8_t max_attempts;
uint16_t max_wait;
uint32_t id;
pthread_mutex_t lock;
} *ch_clients;
uint16_t ch_client_count;
pthread_rwlock_t ch_client_lock;
struct nc_ch_dispatch_data {
nc_server_ch_session_acquire_ctx_cb acquire_ctx_cb;
nc_server_ch_session_release_ctx_cb release_ctx_cb;
void *ctx_cb_data;
nc_server_ch_new_session_cb new_session_cb;
void *new_session_cb_data;
} ch_dispatch_data;
/* Atomic IDs */
ATOMIC_T new_session_id;
ATOMIC_T new_client_id;
};
/**
* Sleep time in usec to wait between nc_recv_notif() calls.
*/
#define NC_CLIENT_NOTIF_THREAD_SLEEP 10000
/**
* Timeout in msec for transport-related data to arrive (ssh_handle_key_exchange(), SSL_accept(), SSL_connect()).
* It can be quite a lot on slow machines (waiting for TLS cert-to-name resolution, ...).
*/
#define NC_TRANSPORT_TIMEOUT 10000
/**
* Timeout in msec for acquiring a lock of a session (used with a condition, so higher numbers could be required
* only in case of extreme concurrency).
*/
#define NC_SESSION_LOCK_TIMEOUT 500
/**
* Timeout in msec for acquiring a lock of a session that is supposed to be freed.
*/
#define NC_SESSION_FREE_LOCK_TIMEOUT 1000
/**
* Timeout in msec for a thread to wait for its turn to work with a pollsession structure.
*/
#define NC_PS_QUEUE_TIMEOUT 5000
/**
* Time slept in msec if no endpoint was created for a running Call Home client.
*/
#define NC_CH_NO_ENDPT_WAIT 1000
/**
* Time slept in msec between Call Home thread session idle timeout checks.
*/
#define NC_CH_THREAD_IDLE_TIMEOUT_SLEEP 1000
/**
* Timeout in msec for a Call Home socket to establish its connection.
*/
#define NC_CH_CONNECT_TIMEOUT 500
/**
* Number of sockets kept waiting to be accepted.
*/
#define NC_REVERSE_QUEUE 5
/**
* @brief Type of the session
*/
typedef enum {
NC_CLIENT, /**< client side */
NC_SERVER /**< server side */
} NC_SIDE;
/**
* @brief Enumeration of the supported NETCONF protocol versions
*/
typedef enum {
NC_VERSION_10 = 0, /**< NETCONF 1.0 - RFC 4741, 4742 */
NC_VERSION_11 = 1 /**< NETCONF 1.1 - RFC 6241, 6242 */
} NC_VERSION;
#define NC_VERSION_10_ENDTAG "]]>]]>"
#define NC_VERSION_10_ENDTAG_LEN 6
/**
* @brief Container to serialize RPC messages
*/
struct nc_msg_cont {
struct ly_in *msg;
NC_MSG_TYPE type; /**< can be either NC_MSG_REPLY or NC_MSG_NOTIF */
struct nc_msg_cont *next;
};
/**
* @brief NETCONF session structure
*/
struct nc_session {
NC_STATUS status; /**< status of the session */
NC_SESSION_TERM_REASON term_reason; /**< reason of termination, if status is NC_STATUS_INVALID */
uint32_t killed_by; /**< session responsible for termination, if term_reason is NC_SESSION_TERM_KILLED */
NC_SIDE side; /**< side of the session: client or server */
/* NETCONF data */
uint32_t id; /**< NETCONF session ID (session-id-type) */
NC_VERSION version; /**< NETCONF protocol version */
/* Transport implementation */
NC_TRANSPORT_IMPL ti_type; /**< transport implementation type to select items from ti union */
pthread_mutex_t *io_lock; /**< input/output lock, note that in case of libssh TI, it will be shared with
other NETCONF sessions on the same SSH session (but different SSH channel) */
union {
struct {
int in; /**< input file descriptor */
int out; /**< output file descriptor */
} fd; /**< NC_TI_FD transport implementation structure */
struct {
int sock; /**< socket file descriptor */
} unixsock; /**< NC_TI_UNIX transport implementation structure */
#ifdef NC_ENABLED_SSH_TLS
struct {
ssh_channel channel;
ssh_session session;
struct nc_session *next; /**< pointer to the next NETCONF session on the same
SSH session, but different SSH channel. If no such session exists, it is NULL.
otherwise there is a ring list of the NETCONF sessions */
} libssh;
SSL *tls;
#endif /* NC_ENABLED_SSH_TLS */
} ti; /**< transport implementation data */
char *username;
char *host;
uint16_t port;
char *path; /**< socket path in case of unix socket */
/* other */
struct ly_ctx *ctx; /**< libyang context of the session */
void *data; /**< arbitrary user data */
uint8_t flags; /**< various flags of the session */
#define NC_SESSION_SHAREDCTX 0x01
#define NC_SESSION_CALLHOME 0x02 /**< session is Call Home and ch_lock is initialized */
#define NC_SESSION_CH_THREAD 0x04 /**< protected by ch_lock */
union {
struct {
/* client side only data */
uint64_t msgid;
char **cpblts; /**< list of server's capabilities on client side */
pthread_mutex_t msgs_lock; /**< lock for the msgs buffer */
struct nc_msg_cont *msgs; /**< queue for messages received of different type than expected */
ATOMIC_T ntf_thread_count; /**< number of running notification threads */
ATOMIC_T ntf_thread_running; /**< flag whether there are notification threads for this session running or not */
struct lyd_node *ext_data; /**< LY ext data used in the context callback */
/* client flags */
/* some server modules failed to load so the data from them will be ignored - not use strict flag for parsing */
# define NC_SESSION_CLIENT_NOT_STRICT 0x08
} client;
struct {
/* server side only data */
time_t session_start; /**< real time the session was created */
time_t last_rpc; /**< monotonic time (seconds) the last RPC was received on this session */
pthread_mutex_t ntf_status_lock; /**< lock for ntf_status */
uint32_t ntf_status; /**< flag (count) whether the session is subscribed to notifications */
pthread_mutex_t rpc_lock; /**< lock indicating RPC processing, this lock is always locked before io_lock!! */
pthread_cond_t rpc_cond; /**< RPC condition (tied with rpc_lock and rpc_inuse) */
int rpc_inuse; /**< variable indicating whether there is RPC being processed or not (tied with
rpc_cond and rpc_lock) */
pthread_mutex_t ch_lock; /**< Call Home thread lock */
pthread_cond_t ch_cond; /**< Call Home thread condition */
/* server flags */
#ifdef NC_ENABLED_SSH_TLS
/* SSH session authenticated */
# define NC_SESSION_SSH_AUTHENTICATED 0x10
/* netconf subsystem requested */
# define NC_SESSION_SSH_SUBSYS_NETCONF 0x20
uint16_t ssh_auth_attempts; /**< number of failed SSH authentication attempts */
X509 *client_cert; /**< TLS client certificate if used for authentication */
#endif /* NC_ENABLED_SSH_TLS */
} server;
} opts;
};
enum nc_ps_session_state {
NC_PS_STATE_NONE = 0, /**< session is not being worked with */
NC_PS_STATE_BUSY, /**< session is being polled or communicated on (and locked) */
NC_PS_STATE_INVALID /**< session is invalid and was already returned by another poll */
};
struct nc_ps_session {
struct nc_session *session;
enum nc_ps_session_state state;
};
/* ACCESS locked */
struct nc_pollsession {
struct nc_ps_session **sessions;
uint16_t session_count;
uint16_t last_event_session;
pthread_cond_t cond;
pthread_mutex_t lock;
uint8_t queue[NC_PS_QUEUE_SIZE]; /**< round buffer, queue is empty when queue_len == 0 */
uint8_t queue_begin; /**< queue starts on queue[queue_begin] */
uint8_t queue_len; /**< queue ends on queue[(queue_begin + queue_len - 1) % NC_PS_QUEUE_SIZE] */
};
struct nc_ntf_thread_arg {
struct nc_session *session;
nc_notif_dispatch_clb notif_clb;
void *user_data;
void (*free_data)(void *);
};
#ifdef NC_ENABLED_SSH_TLS
/**
* @brief PAM callback arguments.
*/
struct nc_pam_thread_arg {
ssh_message msg; /**< libssh message */
struct nc_session *session; /**< NETCONF session */
struct nc_server_ssh_opts *opts; /**< SSH server opts */
};
/**
* @brief Converts private key format to a string.
* This string is the same, as in a PKCS#1 Private key format, meaning
* ---- BEGIN (string) PRIVATE KEY ----. The string can be empty for some types.
*
* @param[in] format Private key format.
* @return String representing the private key or NULL.
*/
const char *nc_privkey_format_to_str(NC_PRIVKEY_FORMAT format);
/**
* @brief Decodes base64 to binary.
*
* @param[in] base64 Base64 string.
* @param[out] bin Binary result, memory managed by the caller.
* @return Length of the binary data on success, -1 on error.
*/
int nc_base64_to_bin(const char *base64, char **bin);
/**
* @brief Checks if the given base64 belongs to a public key in the SubjectPublicKeyInfo format.
*
* @param[in] b64 Base64 encoded data.
*
* @return -1 on error, 0 if it is not SPKI public key, 1 if it is a public key in the SPKI format.
*/
int nc_is_pk_subject_public_key_info(const char *b64);
#endif /* NC_ENABLED_SSH_TLS */
void *nc_realloc(void *ptr, size_t size);
struct passwd *nc_getpw(uid_t uid, const char *username, struct passwd *pwd_buf, char **buf, size_t *buf_size);
NC_MSG_TYPE nc_send_msg_io(struct nc_session *session, int io_timeout, struct lyd_node *op);
/**
* @brief Get current clock (uses COMPAT_CLOCK_ID) time with an offset.
*
* @param[out] ts Current time offset by @p add_ms.
* @param[in] add_ms Number of milliseconds to add.
*/
void nc_timeouttime_get(struct timespec *ts, uint32_t add_ms);
/**
* @brief Get time difference based on the current time (uses COMPAT_CLOCK_ID).
*
* @param[in] ts Timespec structure holding real time from which the current time is going to be subtracted.
* @return Time difference in milliseconds.
*/
int32_t nc_timeouttime_cur_diff(const struct timespec *ts);
/**
* @brief Get current CLOCK_REALTIME time.
*
* @param[out] ts Current real time.
*/
void nc_realtime_get(struct timespec *ts);
int nc_sock_configure_keepalive(int sock, struct nc_keepalives *ka);
struct nc_session *nc_new_session(NC_SIDE side, int shared_ti);
int nc_session_rpc_lock(struct nc_session *session, int timeout, const char *func);
int nc_session_rpc_unlock(struct nc_session *session, int timeout, const char *func);
/**
* @brief Lock IO lock on a session.
*
* @param[in] session Session to lock.
* @param[in] timeout Timeout in msec to use.
* @param[in] func Caller function for logging.
* @return 1 on success;
* @return 0 on timeout;
* @return -1 on error.
*/
int nc_session_io_lock(struct nc_session *session, int timeout, const char *func);
/**
* @brief Unlock IO lock on a session.
*
* @param[in] session Session to unlock.
* @param[in] func Caller function for logging.
* @return 1 on success;
* @return -1 on error.
*/
int nc_session_io_unlock(struct nc_session *session, const char *func);
/**
* @brief Lock MSGS lock on a session.
*
* @param[in] session Session to lock.
* @param[in,out] timeout Timeout in msec to use. If positive and on successful lock, is updated based on what was elapsed.
* @param[in] func Caller function for logging.
* @return 1 on success;
* @return 0 on timeout;
* @return -1 on error.
*/
int nc_session_client_msgs_lock(struct nc_session *session, int *timeout, const char *func);
/**
* @brief Unlock MSGS lock on a session.
*
* @param[in] session Session to unlock.
* @param[in] func Caller function for logging.
* @return 1 on success;
* @return -1 on error.
*/
int nc_session_client_msgs_unlock(struct nc_session *session, const char *func);
int nc_ps_lock(struct nc_pollsession *ps, uint8_t *id, const char *func);
int nc_ps_unlock(struct nc_pollsession *ps, uint8_t id, const char *func);
int nc_client_session_new_ctx(struct nc_session *session, struct ly_ctx *ctx);
/**
* @brief Fill libyang context in @p session. Context models are based on the stored session
* capabilities. If the server does not support \<get-schema\>, the models are searched
* for in the directory set using nc_client_schema_searchpath().
*
* @param[in] session Session to create the context for.
* @return 0 on success, 1 on some missing schemas, -1 on error.
*/
int nc_ctx_check_and_fill(struct nc_session *session);
/**
* @brief Perform NETCONF handshake on @p session.
*
* @param[in] session NETCONF session to use.
* @return NC_MSG_HELLO on success, NC_MSG_BAD_HELLO on client \<hello\> message parsing fail
* (server-side only), NC_MSG_WOULDBLOCK on timeout, NC_MSG_ERROR on other error.
*/
NC_MSG_TYPE nc_handshake_io(struct nc_session *session);
/**
* @brief Create a socket connection.
*
* @param[in] host Hostname to connect to.
* @param[in] port Port to connect on.
* @param[in] timeout_ms Timeout in ms for blocking the connect + select call (-1 for infinite).
* @param[in] ka Keepalives parameters.
* @param[in,out] sock_pending Previous pending socket. If set, equal to -1, and the connection is still in progress
* after @p timeout, it is set to the pending socket but -1 is returned. If NULL, the socket is closed on timeout.
* @param[out] ip_host Optional parameter with string IP address of the connected host.
* @return Connected socket or -1 on error.
*/
int nc_sock_connect(const char *host, uint16_t port, int timeout_ms, struct nc_keepalives *ka, int *sock_pending,
char **ip_host);
/**
* @brief Accept a new socket connection.
*
* @param[in] sock Listening socket.
* @param[in] timeout Timeout in milliseconds.
* @param[out] peer_host Host the new connection was initiated from. Can be NULL.
* @param[out] peer_port Port the new connection is connected on. Can be NULL.
* @return Connected socket with the new connection, -1 on error.
*/
int nc_sock_accept(int sock, int timeout, char **peer_host, uint16_t *peer_port);
/**
* @brief Create a listening socket (AF_INET or AF_INET6).
*
* @param[in] address IP address to listen on.
* @param[in] port Port to listen on.
* @param[in] ka Keepalives parameters.
* @return Listening socket, -1 on error.
*/
int nc_sock_listen_inet(const char *address, uint16_t port, struct nc_keepalives *ka);
/**
* @brief Create a listening socket (AF_UNIX).
*
* @param[in] opts The server options (unix permissions and address of the socket).
* @return Listening socket, -1 on error.
*/
int nc_sock_listen_unix(const struct nc_server_unix_opts *opts);
/**
* @brief Accept a new connection on a listening socket.
*
* @param[in] binds Structure with the listening sockets.
* @param[in] bind_count Number of @p binds.
* @param[in] bind_lock Lock for avoiding concurrent poll/accept on a single bind.
* @param[in] timeout Timeout for accepting.
* @param[out] host Host of the remote peer. Can be NULL.
* @param[out] port Port of the new connection. Can be NULL.
* @param[out] idx Index of the bind that was accepted. Can be NULL.
* @return Accepted socket of the new connection, -1 on error.
*/
int nc_sock_accept_binds(struct nc_bind *binds, uint16_t bind_count, pthread_mutex_t *bind_lock, int timeout, char **host, uint16_t *port, uint16_t *idx);
/**
* @brief Lock endpoint structures for reading and the specific endpoint.
*
* @param[in] name Name of the endpoint.
* @param[in] ti Expected transport.
* @param[out] idx Index of the endpoint. Optional.
* @return Endpoint structure.
*/
struct nc_endpt *nc_server_endpt_lock_get(const char *name, NC_TRANSPORT_IMPL ti, uint16_t *idx);
/**
* @brief Lock CH client structures for reading and lock the specific client.
*
* @param[in] name Name of the CH client.
* @param[in] endpt_name Endpoint of the CH client.
* @param[in] ti Expected transport.
* @param[out] client_p Pointer to the CH client.
* @return CH endpoint structure.
*/
struct nc_ch_endpt *nc_server_ch_client_lock(const char *name, const char *endpt_name, NC_TRANSPORT_IMPL ti,
struct nc_ch_client **client_p);
/**
* @brief Unlock CH client strcutures and the specific client.
*
* @param[in] endpt Locked CH client structure.
*/
void nc_server_ch_client_unlock(struct nc_ch_client *client);
/**
* @brief Gets an endpoint structure based on its name.
*
* @param[in] name The name of the endpoint.
* @param[out] endpt Pointer to the endpoint structure.
* @return 0 on success, 1 on failure.
*/
int nc_server_get_referenced_endpt(const char *name, struct nc_endpt **endpt);
/**
* @brief Add a client Call Home bind, listen on it.
*
* @param[in] address Address to bind to.
* @param[in] port Port to bind to.
* @param[in] hostname Expected server hostname, may be NULL.
* @param[in] ti Transport to use.
* @return 0 on success, -1 on error.
*/
int nc_client_ch_add_bind_listen(const char *address, uint16_t port, const char *hostname, NC_TRANSPORT_IMPL ti);
/**
* @brief Remove a client Call Home bind, stop listening on it.
*
* @param[in] address Address of the bind. NULL matches any address.
* @param[in] port Port of the bind. 0 matches all ports.
* @param[in] ti Transport of the bind. 0 matches all transports.
* @return 0 on success, -1 on no matches found.
*/
int nc_client_ch_del_bind(const char *address, uint16_t port, NC_TRANSPORT_IMPL ti);
/**
* @brief Connect to a listening NETCONF client using Call Home.
*
* @param[in] host Hostname to connect to.
* @param[in] port Port to connect to.
* @param[in] ti Transport fo the connection.
* @param[out] session New Call Home session.
* @return NC_MSG_HELLO on success, NC_MSG_BAD_HELLO on client \<hello\> message
* parsing fail, NC_MSG_WOULDBLOCK on timeout, NC_MSG_ERROR on other errors.
*/
NC_MSG_TYPE nc_connect_callhome(const char *host, uint16_t port, NC_TRANSPORT_IMPL ti, struct nc_session **session);
#ifdef NC_ENABLED_SSH_TLS
/**
* @brief Accept a server Call Home connection on a socket.
*
* @param[in] sock Socket with a new connection.
* @param[in] host Hostname of the server.
* @param[in] port Port of the server.
* @param[in] ctx Context for the session. Can be NULL.
* @param[in] timeout Transport operations timeout in msec.
* @return New session, NULL on error.
*/
struct nc_session *nc_accept_callhome_ssh_sock(int sock, const char *host, uint16_t port, struct ly_ctx *ctx, int timeout);
/**
* @brief Establish SSH transport on a socket.
*
* @param[in] session Session structure of the new connection.
* @param[in] sock Socket of the new connection.
* @param[in] timeout Transport operations timeout in msec (not SSH authentication one).
* @return 1 on success, 0 on timeout, -1 on error.
*/
int nc_accept_ssh_session(struct nc_session *session, struct nc_server_ssh_opts *opts, int sock, int timeout);
/**
* @brief Process a SSH message.
*
* @param[in] session Session structure of the connection.
* @param[in] opts Endpoint SSH options on which the session was created.
* @param[in] msg SSH message itself.
* @param[in] state State of the authentication.
* @return 0 if the message was handled, 1 if it is left up to libssh.
*/
int nc_session_ssh_msg(struct nc_session *session, struct nc_server_ssh_opts *opts, ssh_message msg, struct nc_auth_state *state);
void nc_server_ssh_clear_opts(struct nc_server_ssh_opts *opts);
void nc_client_ssh_destroy_opts(void);
void _nc_client_ssh_destroy_opts(struct nc_client_ssh_opts *opts);
struct nc_session *nc_accept_callhome_tls_sock(int sock, const char *host, uint16_t port, struct ly_ctx *ctx,
int timeout, const char *peername);
/**
* @brief Establish TLS transport on a socket.
*
* @param[in] session Session structure of the new connection.
* @param[in] sock Socket of the new connection.
* @param[in] timeout Transport operations timeout in msec.
* @return 1 on success, 0 on timeout, -1 on error.
*/
int nc_accept_tls_session(struct nc_session *session, struct nc_server_tls_opts *opts, int sock, int timeout);
void nc_server_tls_clear_opts(struct nc_server_tls_opts *opts);
void nc_client_tls_destroy_opts(void);
void _nc_client_tls_destroy_opts(struct nc_client_tls_opts *opts);
#endif /* NC_ENABLED_SSH_TLS */
/**
* Functions
* - io.c
*/
/**
* @brief Read message from the wire.
*
* Accepts hello, rpc, rpc-reply and notification. Received string is transformed into
* libyang XML tree and the message type is detected from the top level element.
*
* @param[in] session NETCONF session from which the message is being read.
* @param[in] io_timeout Timeout in milliseconds. Negative value means infinite timeout,
* zero value causes to return immediately.
* @param[out] msg Input handled with the NETCONF message (application layer data).
* @return 1 on success.
* @return 0 on timeout.
* @return -1 on error.
* @return -2 on malformed message error.
*/
int nc_read_msg_poll_io(struct nc_session *session, int io_timeout, struct ly_in **msg);
/**
* @brief Read a message from the wire.
*
* @param[in] session NETCONF session from which the message is being read.
* @param[in] io_timeout Timeout in milliseconds. Negative value means infinite timeout,
* zero value causes to return immediately.
* @param[out] msg Input handled with the NETCONF message (application layer data).
* @param[in] passing_io_lock True if @p session IO lock is already held. This function always unlocks
* it before returning!
* @return 1 on success.
* @return 0 on timeout.
* @return -1 on error.
* @return -2 on malformed message error.
*/
int nc_read_msg_io(struct nc_session *session, int io_timeout, struct ly_in **msg, int passing_io_lock);
/**
* @brief Write message into wire.
*
* @param[in] session NETCONF session to which the message will be written.
* @param[in] io_timeout Timeout in milliseconds. Negative value means infinite timeout,
* zero value causes to return immediately.
* @param[in] type The type of the message to write, specified as #NC_MSG_TYPE value. According to the type, the
* specific additional parameters are required or accepted:
* - #NC_MSG_RPC
* - `struct lyd_node *op;` - operation (content of the \<rpc/\> to be sent. Required parameter.
* - `const char *attrs;` - additional attributes to be added into the \<rpc/\> element. Required parameter.
* - #NC_MSG_REPLY
* - `struct lyd_node_opaq *rpc_envp;` - parsed envelopes of the RPC to reply to. Required parameter.
* - `struct nc_server_reply *reply;` - RPC reply. Required parameter.
* - #NC_MSG_NOTIF
* - `struct nc_server_notif *notif;` - notification object. Required parameter.
* - #NC_MSG_HELLO
* - `const char **capabs;` - capabilities array ended with NULL. Required parameter.
* - `uint32_t *sid;` - session ID to be included in the hello message. Optional parameter.
*
* @return Type of the written message. #NC_MSG_WOULDBLOCK is returned if timeout is positive
* (or zero) value and IO lock could not be acquired in that time. #NC_MSG_ERROR is
* returned on error and #NC_MSG_NONE is never returned by this function.
*/
NC_MSG_TYPE nc_write_msg_io(struct nc_session *session, int io_timeout, int type, ...);
/**
* @brief Check whether a session is still connected (on transport layer).
*
* @param[in] session Session to check.
* @return 1 if connected, 0 if not.
*/
int nc_session_is_connected(struct nc_session *session);
#endif /* NC_SESSION_PRIVATE_H_ */