Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add GNMI client cert cname check support. #18709

Merged
merged 14 commits into from
Aug 22, 2024
2 changes: 2 additions & 0 deletions dockers/docker-sonic-gnmi/gnmi-native.sh
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@ if [ -n "$CERTS" ]; then
if [ ! -z $CA_CRT ]; then
TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
fi

TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
elif [ -n "$X509" ]; then
SERVER_CRT=$(echo $X509 | jq -r '.server_crt')
SERVER_KEY=$(echo $X509 | jq -r '.server_key')
Expand Down
2 changes: 2 additions & 0 deletions dockers/docker-sonic-telemetry/telemetry.sh
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ if [ -n "$CERTS" ]; then
if [ ! -z $CA_CRT ]; then
TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
fi

TELEMETRY_ARGS+=" --config_table_name TELEMETRY_CLIENT_CERT"
elif [ -n "$X509" ]; then
SERVER_CRT=$(echo $X509 | jq -r '.server_crt')
SERVER_KEY=$(echo $X509 | jq -r '.server_key')
Expand Down
10 changes: 10 additions & 0 deletions src/sonic-yang-models/tests/files/sample_config_db.json
Original file line number Diff line number Diff line change
Expand Up @@ -1323,6 +1323,16 @@
"port": "50052"
}
},
"GNMI_CLIENT_CERT": {
"testcert1": {
"cert_cname": "testcert1",
"role": "RW"
},
"testcert2": {
"cert_cname": "testcert2",
"role": "RO"
}
},
"TUNNEL": {
"MuxTunnel0": {
"dscp_mode": "uniform",
Expand Down
11 changes: 11 additions & 0 deletions src/sonic-yang-models/tests/yang_model_tests/tests/gnmi.json
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,16 @@
},
"GNMI_TABLE_WITH_VALID_CONFIG": {
"desc": "TABLE WITH VALID CONFIG."
},
"GNMI_CLIENT_CERT_LIST_TABLE_WITH_MISSING_CERT_NAME": {
"desc": "CLIENT_CERT_LIST_TABLE_WITH_MISSING_CERT_NAME failure.",
"eStrKey": "Mandatory"
},
"GNMI_CLIENT_CERT_LIST_TABLE_WITH_MISSING_ROLE": {
"desc": "CLIENT_CERT_LIST_TABLE_WITH_MISSING_ROLE failure.",
"eStrKey": "Mandatory"
},
"GNMI_CLIENT_CERT_LIST_TABLE_WITH_VALID_CONFIG": {
"desc": "TABLE WITH VALID CONFIG."
}
}
11 changes: 11 additions & 0 deletions src/sonic-yang-models/tests/yang_model_tests/tests/telemetry.json
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,16 @@
},
"TELEMETRY_TABLE_WITH_VALID_CONFIG": {
"desc": "TABLE WITH VALID CONFIG."
},
"TELEMETRY_CLIENT_CERT_LIST_TABLE_WITH_MISSING_CERT_NAME": {
"desc": "CLIENT_CERT_TABLE_WITH_MISSING_CERT_NAME failure.",
"eStrKey": "Mandatory"
},
"TELEMETRY_CLIENT_CERT_LIST_TABLE_WITH_MISSING_ROLE": {
"desc": "CLIENT_CERT_TABLE_WITH_MISSING_ROLE failure.",
"eStrKey": "Mandatory"
},
"TELEMETRY_CLIENT_CERT_LIST_TABLE_WITH_VALID_CONFIG": {
"desc": "TABLE WITH VALID CONFIG."
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -62,5 +62,43 @@
}
}
}
},
"GNMI_CLIENT_CERT_LIST_TABLE_WITH_MISSING_CERT_NAME": {
"sonic-gnmi:sonic-gnmi": {
"sonic-gnmi:GNMI_CLIENT_CERT": {
"GNMI_CLIENT_CERT_LIST": [
{
"role": "RW"
}
]
}
}
},
"GNMI_CLIENT_CERT_LIST_TABLE_WITH_MISSING_ROLE": {
"sonic-gnmi:sonic-gnmi": {
"sonic-gnmi:GNMI_CLIENT_CERT": {
"GNMI_CLIENT_CERT_LIST": [
{
"cert_cname": "testcert1"
}
]
}
}
},
"GNMI_CLIENT_CERT_LIST_TABLE_WITH_VALID_CONFIG": {
"sonic-gnmi:sonic-gnmi": {
"sonic-gnmi:GNMI_CLIENT_CERT": {
"GNMI_CLIENT_CERT_LIST": [
{
"cert_cname": "testcert1",
"role": "RW"
},
{
"cert_cname": "testcert2",
"role": "RO"
}
]
}
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -62,5 +62,43 @@
}
}
}
},
"TELEMETRY_CLIENT_CERT_LIST_TABLE_WITH_MISSING_CERT_NAME": {
"sonic-telemetry:sonic-telemetry": {
"sonic-telemetry:TELEMETRY_CLIENT_CERT": {
"TELEMETRY_CLIENT_CERT_LIST": [
{
"role": "RW"
}
]
}
}
},
"TELEMETRY_CLIENT_CERT_LIST_TABLE_WITH_MISSING_ROLE": {
"sonic-telemetry:sonic-telemetry": {
"sonic-telemetry:TELEMETRY_CLIENT_CERT": {
"TELEMETRY_CLIENT_CERT_LIST": [
{
"cert_cname": "testcert1"
}
]
}
}
},
"TELEMETRY_CLIENT_CERT_LIST_TABLE_WITH_VALID_CONFIG": {
"sonic-telemetry:sonic-telemetry": {
"sonic-telemetry:TELEMETRY_CLIENT_CERT": {
"TELEMETRY_CLIENT_CERT_LIST": [
{
"cert_cname": "testcert1",
"role": "RW"
},
{
"cert_cname": "testcert2",
"role": "RO"
}
]
}
}
}
}
22 changes: 22 additions & 0 deletions src/sonic-yang-models/yang-models/sonic-gnmi.yang
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,29 @@ module sonic-gnmi {
}

}
}

container GNMI_CLIENT_CERT {
description "GNMI client cert list";

list GNMI_CLIENT_CERT_LIST {
max-elements 8;
key "cert_cname";

leaf cert_cname {
type string;
mandatory true;
description
"client cert common name";
}

leaf role {
type string;
mandatory true;
description
"role of client cert common name";
}
}
}
}
}
23 changes: 23 additions & 0 deletions src/sonic-yang-models/yang-models/sonic-telemetry.yang
Original file line number Diff line number Diff line change
Expand Up @@ -74,5 +74,28 @@ module sonic-telemetry {
}

}

container TELEMETRY_CLIENT_CERT {
description "TELEMETRY client cert list";

list TELEMETRY_CLIENT_CERT_LIST {
liuh-80 marked this conversation as resolved.
Show resolved Hide resolved
max-elements 8;
key "cert_cname";

leaf cert_cname {
type string;
mandatory true;
description
"client cert common name";
}

leaf role {
type string;
mandatory true;
description
"role of client cert common name";
}
}
}
liuh-80 marked this conversation as resolved.
Show resolved Hide resolved
}
}
Loading