From 2afc9b786253b9794946bbdaf30285facd723b6b Mon Sep 17 00:00:00 2001 From: Michal Vasko Date: Wed, 11 Nov 2026 15:43:58 +0100 Subject: [PATCH 1/3] cmake UPDATE optional curl support with TLS support --- CMakeLists.txt | 30 +++++++++++++++++++----------- README.md | 4 ++-- src/config.h.in | 5 +++++ src/session.c | 32 ++++++++++++++++++++------------ 4 files changed, 46 insertions(+), 25 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4301585e..21e3811d 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -93,8 +93,9 @@ option(ENABLE_EXAMPLES "Build examples" ON) option(ENABLE_COVERAGE "Build code coverage report from tests" OFF) option(ENABLE_SSH "Enable NETCONF over SSH support (requires libssh)" ON) option(ENABLE_TLS "Enable NETCONF over TLS support (requires OpenSSL or MbedTLS)" ON) +option(ENABLE_CRL "Enable TLS certificate CRL check (requires libcurl)" ON) option(ENABLE_DNSSEC "Enable support for SSHFP retrieval using DNSSEC for SSH (requires libval and OpenSSL)" OFF) -option(ENABLE_PAM "Detect and use PAM" ON) +option(ENABLE_PAM "Detect and use PAM (requires libpam)" ON) option(ENABLE_COMMON_TARGETS "Define common custom target names such as 'doc' or 'uninstall', may cause conflicts when using add_subdirectory() to build this project" ON) option(ENABLE_IP_FREEBIND "Enable the IP_FREEBIND/IPV6_FREEBIND options on the listening TCP socket" OFF) option(ENABLE_COMPLY_WITH_ORAN_WG11 "Comply with the O-RAN WG11 security spec (e.g. enforce the clientAuth Extended Key Usage and the digitalSignature Key Usage on client certificates)" OFF) @@ -308,16 +309,6 @@ if(ENABLE_SSH OR ENABLE_TLS) target_link_libraries(netconf2 ${OPENSSL_LIBRARIES}) list(APPEND CMAKE_REQUIRED_LIBRARIES ${OPENSSL_LIBRARIES}) endif() - - # dependencies - libcurl - find_package(CURL 7.30.0 REQUIRED) - if(TARGET CURL::libcurl) - target_link_libraries(netconf2 CURL::libcurl) - else() - target_link_libraries(netconf2 ${CURL_LIBRARIES}) - list(APPEND CMAKE_REQUIRED_LIBRARIES ${CURL_LIBRARY}) - include_directories(${CURL_INCLUDE_DIRS}) - endif() endif() if(ENABLE_SSH) @@ -368,6 +359,23 @@ if(ENABLE_SSH) endif() endif() +if(ENABLE_TLS AND ENABLE_CRL) + # dependencies - libcurl + find_package(CURL 7.30.0) + if(CURL_FOUND) + set(HAVE_CURL TRUE) + if(TARGET CURL::libcurl) + target_link_libraries(netconf2 CURL::libcurl) + else() + target_link_libraries(netconf2 ${CURL_LIBRARIES}) + list(APPEND CMAKE_REQUIRED_LIBRARIES ${CURL_LIBRARY}) + include_directories(${CURL_INCLUDE_DIRS}) + endif() + else() + message(WARNING "CRL certificate verification disabled (LibCURL not found)") + endif() +endif() + # dependencies - libyang find_package(LibYANG ${LIBYANG_DEP_SOVERSION} REQUIRED) target_link_libraries(netconf2 ${LIBYANG_LIBRARIES}) diff --git a/README.md b/README.md index 47f2e053..8652259d 100644 --- a/README.md +++ b/README.md @@ -65,10 +65,10 @@ the `distro` directory. * [libyang](https://github.com/CESNET/libyang) * libssh >= 0.9.5 (for SSH support) * OpenSSL >= 3.0.0 or MbedTLS >= 3.5.0 (for TLS support) -* curl >= 7.30.0 #### Optional +* curl >= 7.30.0 (for TLS CRL check support) * libpam (for PAM-based SSH `keyboard-interactive` authentication method) * libval (only for DNSSEC SSHFP retrieval) * [DNSSEC-Tools/dnssec-tools/validator](https://github.com/DNSSEC-Tools/DNSSEC-Tools/tree/master/dnssec-tools/validator) @@ -119,7 +119,7 @@ $ cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr .. The NETCONF protocol specification allows to use the protocol on top of several transport protocols. **libnetconf2** provides support for SSH and -TLS transport. By default, both SSH and TLS transport is enabled. Disabling +TLS transport. By default, both SSH and TLS transports are enabled. Disabling and enabling each of the transport protocols can be made in the same way. The following command has actually the same effect as specifying no option since it specifies the default settings. diff --git a/src/config.h.in b/src/config.h.in index 90a4356a..28f6e26d 100644 --- a/src/config.h.in +++ b/src/config.h.in @@ -39,6 +39,11 @@ */ #cmakedefine HAVE_TERMIOS +/* + * Support for URL + */ +#cmakedefine HAVE_CURL + /* * Support for keyboard-interactive SSH authentication method */ diff --git a/src/session.c b/src/session.c index 170fb78f..7b9c4df6 100644 --- a/src/session.c +++ b/src/session.c @@ -45,9 +45,9 @@ # include "session_server_ssh_wrapper.h" #endif /* NC_SSH */ -#ifdef NC_TLS +#ifdef HAVE_CURL # include -#endif /* NC_TLS */ +#endif /* HAVE_CURL */ /* in seconds */ #define NC_CLIENT_HELLO_TIMEOUT 60 @@ -1939,7 +1939,7 @@ nc_ch_handshake_io(struct nc_session *session) return type; } -#ifdef NC_TLS +#ifdef HAVE_CURL /** * @brief CURL callback for downloading data. @@ -2548,7 +2548,15 @@ nc_session_tls_crl_verify_post_handshake(void *tls_session, void *cert_store) return ret; } -#endif /* NC_TLS */ +#else /* HAVE_CURL */ + +int +nc_session_tls_crl_verify_post_handshake(void *UNUSED(tls_session), void *UNUSED(cert_store)) +{ + return 0; +} + +#endif /* HAVE_CURL */ /** * @brief Initialize or destroy the global state of the libraries used by libnetconf2. @@ -2564,9 +2572,9 @@ nc_global_init_destroy(NC_SIDE side, int destroy) static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER; /* lock protecting the init flags and the init functions */ static int init_client = 0, init_server = 0; /* whether the client/server side has the libraries initialized */ -#ifdef NC_TLS +#ifdef HAVE_CURL int curl_inited = 0; -#endif /* NC_TLS */ +#endif /* HAVE_CURL */ #if defined (NC_SSH) || defined (NC_TLS) int tls_inited = 0; #endif /* NC_SSH or NC_TLS */ @@ -2594,9 +2602,9 @@ nc_global_init_destroy(NC_SIDE side, int destroy) #if defined (NC_SSH) || defined (NC_TLS) nc_tls_backend_destroy_wrap(); #endif /* NC_SSH or NC_TLS */ -#ifdef NC_TLS +#ifdef HAVE_CURL curl_global_cleanup(); -#endif /* NC_TLS */ +#endif /* HAVE_CURL */ } goto cleanup; } @@ -2607,14 +2615,14 @@ nc_global_init_destroy(NC_SIDE side, int destroy) goto cleanup; } -#ifdef NC_TLS +#ifdef HAVE_CURL if (curl_global_init(CURL_GLOBAL_SSL | CURL_GLOBAL_ACK_EINTR)) { ERR(NULL, "%s: failed to init CURL.", __func__); rc = -1; goto cleanup; } curl_inited = 1; -#endif /* NC_TLS */ +#endif /* HAVE_CURL */ #if defined (NC_SSH) || defined (NC_TLS) if (nc_tls_backend_init_wrap()) { @@ -2649,11 +2657,11 @@ nc_global_init_destroy(NC_SIDE side, int destroy) nc_tls_backend_destroy_wrap(); } #endif /* NC_SSH or NC_TLS */ -#ifdef NC_TLS +#ifdef HAVE_CURL if (curl_inited) { curl_global_cleanup(); } -#endif /* NC_TLS */ +#endif /* HAVE_CURL */ } /* GLOBAL INIT UNLOCK */ From dbe5a774d2ed348c3e2aab23f9c970c0bfd61ba2 Mon Sep 17 00:00:00 2001 From: Michal Vasko Date: Wed, 11 Nov 2026 15:44:25 +0100 Subject: [PATCH 2/3] actions UPDATE new no-curl job --- .github/workflows/ci.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 584ebdc9..b55374e2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -107,7 +107,20 @@ jobs: build-type: "Debug", dep-build-type: "Release", cc: "gcc", - options: "-DENABLE_DNSSEC=ON -DENABLE_SSH=OFF -DENABLE_TLS=ON", + options: "-DENABLE_SSH=OFF -DENABLE_TLS=ON", + tls-lib: "OpenSSL", + packages: "valgrind", + snaps: "", + make-prepend: "", + make-target: "" + } + - { + name: "Debug, gcc, OpenSSL, TLS only, no CRL", + os: "ubuntu-24.04", + build-type: "Debug", + dep-build-type: "Release", + cc: "gcc", + options: "-DENABLE_SSH=OFF -DENABLE_TLS=ON -DENABLE_CRL=OFF", tls-lib: "OpenSSL", packages: "valgrind", snaps: "", From 342710e2b38e49883f118e74ec139131aaa0a864 Mon Sep 17 00:00:00 2001 From: Michal Vasko Date: Wed, 11 Nov 2026 15:44:52 +0100 Subject: [PATCH 3/3] VERSION bump to version 4.7.3 --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 21e3811d..4edac88f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -59,7 +59,7 @@ set(CMAKE_MACOSX_RPATH TRUE) # micro version is changed with a set of small changes or bugfixes anywhere in the project. set(LIBNETCONF2_MAJOR_VERSION 4) set(LIBNETCONF2_MINOR_VERSION 7) -set(LIBNETCONF2_MICRO_VERSION 2) +set(LIBNETCONF2_MICRO_VERSION 3) set(LIBNETCONF2_VERSION ${LIBNETCONF2_MAJOR_VERSION}.${LIBNETCONF2_MINOR_VERSION}.${LIBNETCONF2_MICRO_VERSION}) # Version of the library