Optional curl

.github/workflows/ci.yml

@@ -107,7 +107,20 @@ jobs:
             build-type: "Debug",
             dep-build-type: "Release",
             cc: "gcc",
-            options: "-DENABLE_DNSSEC=ON -DENABLE_SSH=OFF -DENABLE_TLS=ON",
+            options: "-DENABLE_SSH=OFF -DENABLE_TLS=ON",
+            tls-lib: "OpenSSL",
+            packages: "valgrind",
+            snaps: "",
+            make-prepend: "",
+            make-target: ""
+          }
+          - {
+            name: "Debug, gcc, OpenSSL, TLS only, no CRL",
+            os: "ubuntu-24.04",
+            build-type: "Debug",
+            dep-build-type: "Release",
+            cc: "gcc",
+            options: "-DENABLE_SSH=OFF -DENABLE_TLS=ON -DENABLE_CRL=OFF",
             tls-lib: "OpenSSL",
             packages: "valgrind",
             snaps: "",

CMakeLists.txt

@@ -59,7 +59,7 @@ set(CMAKE_MACOSX_RPATH TRUE)
 # micro version is changed with a set of small changes or bugfixes anywhere in the project.
 set(LIBNETCONF2_MAJOR_VERSION 4)
 set(LIBNETCONF2_MINOR_VERSION 7)
-set(LIBNETCONF2_MICRO_VERSION 2)
+set(LIBNETCONF2_MICRO_VERSION 3)
 set(LIBNETCONF2_VERSION ${LIBNETCONF2_MAJOR_VERSION}.${LIBNETCONF2_MINOR_VERSION}.${LIBNETCONF2_MICRO_VERSION})
 
 # Version of the library
@@ -93,8 +93,9 @@ option(ENABLE_EXAMPLES "Build examples" ON)
 option(ENABLE_COVERAGE "Build code coverage report from tests" OFF)
 option(ENABLE_SSH "Enable NETCONF over SSH support (requires libssh)" ON)
 option(ENABLE_TLS "Enable NETCONF over TLS support (requires OpenSSL or MbedTLS)" ON)
+option(ENABLE_CRL "Enable TLS certificate CRL check (requires libcurl)" ON)
 option(ENABLE_DNSSEC "Enable support for SSHFP retrieval using DNSSEC for SSH (requires libval and OpenSSL)" OFF)
-option(ENABLE_PAM "Detect and use PAM" ON)
+option(ENABLE_PAM "Detect and use PAM (requires libpam)" ON)
 option(ENABLE_COMMON_TARGETS "Define common custom target names such as 'doc' or 'uninstall', may cause conflicts when using add_subdirectory() to build this project" ON)
 option(ENABLE_IP_FREEBIND "Enable the IP_FREEBIND/IPV6_FREEBIND options on the listening TCP socket" OFF)
 option(ENABLE_COMPLY_WITH_ORAN_WG11 "Comply with the O-RAN WG11 security spec (e.g. enforce the clientAuth Extended Key Usage and the digitalSignature Key Usage on client certificates)" OFF)
@@ -308,16 +309,6 @@ if(ENABLE_SSH OR ENABLE_TLS)
         target_link_libraries(netconf2 ${OPENSSL_LIBRARIES})
         list(APPEND CMAKE_REQUIRED_LIBRARIES ${OPENSSL_LIBRARIES})
     endif()
-
-    # dependencies - libcurl
-    find_package(CURL 7.30.0 REQUIRED)
-    if(TARGET CURL::libcurl)
-        target_link_libraries(netconf2 CURL::libcurl)
-    else()
-        target_link_libraries(netconf2 ${CURL_LIBRARIES})
-        list(APPEND CMAKE_REQUIRED_LIBRARIES ${CURL_LIBRARY})
-        include_directories(${CURL_INCLUDE_DIRS})
-    endif()
 endif()
 
 if(ENABLE_SSH)
@@ -368,6 +359,23 @@ if(ENABLE_SSH)
     endif()
 endif()
 
+if(ENABLE_TLS AND ENABLE_CRL)
+    # dependencies - libcurl
+    find_package(CURL 7.30.0)
+    if(CURL_FOUND)
+        set(HAVE_CURL TRUE)
+        if(TARGET CURL::libcurl)
+            target_link_libraries(netconf2 CURL::libcurl)
+        else()
+            target_link_libraries(netconf2 ${CURL_LIBRARIES})
+            list(APPEND CMAKE_REQUIRED_LIBRARIES ${CURL_LIBRARY})
+            include_directories(${CURL_INCLUDE_DIRS})
+        endif()
+    else()
+        message(WARNING "CRL certificate verification disabled (LibCURL not found)")
+    endif()
+endif()
+
 # dependencies - libyang
 find_package(LibYANG ${LIBYANG_DEP_SOVERSION} REQUIRED)
 target_link_libraries(netconf2 ${LIBYANG_LIBRARIES})

README.md

@@ -65,10 +65,10 @@ the `distro` directory.
 * [libyang](https://github.com/CESNET/libyang)
 * libssh >= 0.9.5 (for SSH support)
 * OpenSSL >= 3.0.0 or MbedTLS >= 3.5.0 (for TLS support)
-* curl >= 7.30.0
 
 #### Optional
 
+* curl >= 7.30.0 (for TLS CRL check support)
 * libpam (for PAM-based SSH `keyboard-interactive` authentication method)
 * libval (only for DNSSEC SSHFP retrieval)
   * [DNSSEC-Tools/dnssec-tools/validator](https://github.com/DNSSEC-Tools/DNSSEC-Tools/tree/master/dnssec-tools/validator)
@@ -119,7 +119,7 @@ $ cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr ..
 
 The NETCONF protocol specification allows to use the protocol on top of
 several transport protocols. **libnetconf2** provides support for SSH and
-TLS transport. By default, both SSH and TLS transport is enabled. Disabling
+TLS transport. By default, both SSH and TLS transports are enabled. Disabling
 and enabling each of the transport protocols can be made
 in the same way. The following command has actually the same effect as
 specifying no option since it specifies the default settings.

src/config.h.in

@@ -39,6 +39,11 @@
  */
 #cmakedefine HAVE_TERMIOS
 
+/*
+ * Support for URL
+ */
+#cmakedefine HAVE_CURL
+
 /*
  * Support for keyboard-interactive SSH authentication method
  */

src/session.c

@@ -45,9 +45,9 @@
 # include "session_server_ssh_wrapper.h"
 #endif /* NC_SSH */
 
-#ifdef NC_TLS
+#ifdef HAVE_CURL
 # include <curl/curl.h>
-#endif /* NC_TLS */
+#endif /* HAVE_CURL */
 
 /* in seconds */
 #define NC_CLIENT_HELLO_TIMEOUT 60
@@ -1939,7 +1939,7 @@ nc_ch_handshake_io(struct nc_session *session)
     return type;
 }
 
-#ifdef NC_TLS
+#ifdef HAVE_CURL
 
 /**
  * @brief CURL callback for downloading data.
@@ -2548,7 +2548,15 @@ nc_session_tls_crl_verify_post_handshake(void *tls_session, void *cert_store)
     return ret;
 }
 
-#endif /* NC_TLS */
+#else /* HAVE_CURL */
+
+int
+nc_session_tls_crl_verify_post_handshake(void *UNUSED(tls_session), void *UNUSED(cert_store))
+{
+    return 0;
+}
+
+#endif /* HAVE_CURL */
 
 /**
  * @brief Initialize or destroy the global state of the libraries used by libnetconf2.
@@ -2564,9 +2572,9 @@ nc_global_init_destroy(NC_SIDE side, int destroy)
     static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER; /* lock protecting the init flags and the init functions */
     static int init_client = 0, init_server = 0; /* whether the client/server side has the libraries initialized */
 
-#ifdef NC_TLS
+#ifdef HAVE_CURL
     int curl_inited = 0;
-#endif /* NC_TLS */
+#endif /* HAVE_CURL */
 #if defined (NC_SSH) || defined (NC_TLS)
     int tls_inited = 0;
 #endif /* NC_SSH or NC_TLS */
@@ -2594,9 +2602,9 @@ nc_global_init_destroy(NC_SIDE side, int destroy)
 #if defined (NC_SSH) || defined (NC_TLS)
             nc_tls_backend_destroy_wrap();
 #endif /* NC_SSH or NC_TLS */
-#ifdef NC_TLS
+#ifdef HAVE_CURL
             curl_global_cleanup();
-#endif /* NC_TLS */
+#endif /* HAVE_CURL */
         }
         goto cleanup;
     }
@@ -2607,14 +2615,14 @@ nc_global_init_destroy(NC_SIDE side, int destroy)
         goto cleanup;
     }
 
-#ifdef NC_TLS
+#ifdef HAVE_CURL
     if (curl_global_init(CURL_GLOBAL_SSL | CURL_GLOBAL_ACK_EINTR)) {
         ERR(NULL, "%s: failed to init CURL.", __func__);
         rc = -1;
         goto cleanup;
     }
     curl_inited = 1;
-#endif /* NC_TLS */
+#endif /* HAVE_CURL */
 
 #if defined (NC_SSH) || defined (NC_TLS)
     if (nc_tls_backend_init_wrap()) {
@@ -2649,11 +2657,11 @@ nc_global_init_destroy(NC_SIDE side, int destroy)
             nc_tls_backend_destroy_wrap();
         }
 #endif /* NC_SSH or NC_TLS */
-#ifdef NC_TLS
+#ifdef HAVE_CURL
         if (curl_inited) {
             curl_global_cleanup();
         }
-#endif /* NC_TLS */
+#endif /* HAVE_CURL */
     }
 
     /* GLOBAL INIT UNLOCK */