build REFACTOR separate SSH and TLS support

.github/workflows/ci.yml

@@ -55,15 +55,15 @@ jobs:
             build-type: "Release",
             dep-build-type: "Release",
             cc: "gcc",
-            options: "-DENABLE_TESTS=ON -DENABLE_DNSSEC=ON",
+            options: "-DENABLE_TESTS=ON",
             tls-lib: "MbedTLS",
             packages: "",
             snaps: "",
             make-prepend: "",
             make-target: ""
           }
           - {
-            name: "Release, clang",
+            name: "Release, clang, OpenSSL",
             os: "ubuntu-24.04",
             build-type: "Release",
             dep-build-type: "Release",
@@ -88,13 +88,65 @@ jobs:
             make-prepend: "",
             make-target: ""
           }
+          - {
+            name: "Debug, gcc, OpenSSL, SSH only",
+            os: "ubuntu-24.04",
+            build-type: "Debug",
+            dep-build-type: "Release",
+            cc: "gcc",
+            options: "-DENABLE_DNSSEC=ON -DENABLE_SSH=ON -DENABLE_TLS=OFF",
+            tls-lib: "OpenSSL",
+            packages: "valgrind",
+            snaps: "",
+            make-prepend: "",
+            make-target: ""
+          }
+          - {
+            name: "Debug, gcc, OpenSSL, TLS only",
+            os: "ubuntu-24.04",
+            build-type: "Debug",
+            dep-build-type: "Release",
+            cc: "gcc",
+            options: "-DENABLE_DNSSEC=ON -DENABLE_SSH=OFF -DENABLE_TLS=ON",
+            tls-lib: "OpenSSL",
+            packages: "valgrind",
+            snaps: "",
+            make-prepend: "",
+            make-target: ""
+          }
           - {
             name: "Debug, gcc, MbedTLS",
             os: "ubuntu-24.04",
             build-type: "Debug",
             dep-build-type: "Release",
             cc: "gcc",
-            options: "-DENABLE_DNSSEC=ON",
+            options: "",
+            tls-lib: "MbedTLS",
+            packages: "valgrind",
+            snaps: "",
+            make-prepend: "",
+            make-target: ""
+          }
+          - {
+            name: "Debug, gcc, MbedTLS, SSH only",
+            os: "ubuntu-24.04",
+            build-type: "Debug",
+            dep-build-type: "Release",
+            cc: "gcc",
+            options: "-DENABLE_SSH=ON -DENABLE_TLS=OFF",
+            tls-lib: "MbedTLS",
+            packages: "valgrind",
+            snaps: "",
+            make-prepend: "",
+            make-target: ""
+          }
+          - {
+            name: "Debug, gcc, MbedTLS, TLS only",
+            os: "ubuntu-24.04",
+            build-type: "Debug",
+            dep-build-type: "Release",
+            cc: "gcc",
+            options: "-DENABLE_SSH=OFF -DENABLE_TLS=ON",
             tls-lib: "MbedTLS",
             packages: "valgrind",
             snaps: "",
@@ -121,7 +173,7 @@ jobs:
             build-type: "Debug",
             dep-build-type: "Release",
             cc: "gcc",
-            options: "-DENABLE_SSH_TLS=OFF",
+            options: "-DENABLE_SSH=OFF -DENABLE_TLS=OFF",
             tls-lib: "",
             packages: "valgrind",
             snaps: "",

CMakeLists.txt

@@ -91,8 +91,9 @@ else()
 endif()
 option(ENABLE_EXAMPLES "Build examples" ON)
 option(ENABLE_COVERAGE "Build code coverage report from tests" OFF)
-option(ENABLE_SSH_TLS "Enable NETCONF over SSH and TLS support (via libssh and OpenSSL)" ON)
-option(ENABLE_DNSSEC "Enable support for SSHFP retrieval using DNSSEC for SSH (requires OpenSSL and libval)" OFF)
+option(ENABLE_SSH "Enable NETCONF over SSH support (requires libssh)" ON)
+option(ENABLE_TLS "Enable NETCONF over TLS support (requires OpenSSL or MbedTLS)" ON)
+option(ENABLE_DNSSEC "Enable support for SSHFP retrieval using DNSSEC for SSH (requires libval and OpenSSL)" OFF)
 option(ENABLE_PAM "Detect and use PAM" ON)
 option(ENABLE_COMMON_TARGETS "Define common custom target names such as 'doc' or 'uninstall', may cause conflicts when using add_subdirectory() to build this project" ON)
 option(ENABLE_IP_FREEBIND "Enable the IP_FREEBIND/IPV6_FREEBIND options on the listening TCP socket" OFF)
@@ -121,31 +122,14 @@ set(libsrc
     src/server_config_util.c
     src/proxy_unix.c)
 
-if(ENABLE_SSH_TLS)
-    list(APPEND libsrc
-        src/session_client_ssh.c
-        src/session_server_ssh.c
-        src/server_config_util_ssh.c
-        src/session_client_tls.c
-        src/session_server_tls.c
-        src/server_config_util_tls.c)
-    set(SSH_TLS_MACRO "#ifndef NC_ENABLED_SSH_TLS\n#define NC_ENABLED_SSH_TLS\n#endif")
-endif()
-
-if(ENABLE_IP_FREEBIND)
-    check_symbol_exists(IP_FREEBIND "netinet/in.h" NC_ENABLE_IP_FREEBIND)
-endif()
-
 set(headers
     src/log.h
     src/netconf.h
     src/session.h
     src/messages_client.h
     src/messages_server.h
     src/session_client.h
-    src/session_client_ch.h
     src/session_server.h
-    src/session_server_ch.h
     src/server_config.h
     src/proxy_unix.h)
 
@@ -158,12 +142,47 @@ set(doxy_files
     src/messages_client.h
     src/messages_server.h
     src/session_client.h
-    src/session_client_ch.h
     src/session_server.h
-    src/session_server_ch.h
     src/server_config.h
     src/proxy_unix.h)
 
+if(ENABLE_SSH)
+    list(APPEND libsrc
+        src/session_client_ssh.c
+        src/session_server_ssh.c
+        src/server_config_util_ssh.c)
+    list(APPEND headers
+        src/server_config_ssh.h)
+    list(APPEND doxy_files
+        src/server_config_ssh.h)
+    set(SSH_MACRO "#ifndef NC_SSH\n# define NC_SSH\n#endif")
+    set(SSH_SERVER_INCLUDE_MACRO "#include <libnetconf2/server_config_ssh.h>")
+endif()
+
+if(ENABLE_TLS)
+    list(APPEND libsrc
+        src/session_client_tls.c
+        src/session_server_tls.c
+        src/server_config_util_tls.c)
+    list(APPEND headers
+        src/server_config_tls.h)
+    list(APPEND doxy_files
+        src/server_config_tls.h)
+    set(TLS_MACRO "#ifndef NC_TLS\n# define NC_TLS\n#endif")
+    set(TLS_SERVER_INCLUDE_MACRO "#include <libnetconf2/server_config_tls.h>")
+endif()
+
+if(ENABLE_SSH OR ENABLE_TLS)
+    list(APPEND headers
+        src/session_server_ch.h
+        src/session_client_ch.h)
+    list(APPEND doxy_files
+        src/session_server_ch.h
+        src/session_client_ch.h)
+    set(CH_SERVER_INCLUDE_MACRO "#include <libnetconf2/session_server_ch.h>")
+    set(CH_CLIENT_INCLUDE_MACRO "#include <libnetconf2/session_client_ch.h>")
+endif()
+
 # source files to be covered by the 'format' target
 set(format_sources
     compat/*.c
@@ -177,15 +196,24 @@ set(format_sources
 #
 # checks
 #
-if(ENABLE_DNSSEC AND NOT ENABLE_SSH_TLS)
+if(ENABLE_DNSSEC AND NOT ENABLE_SSH)
     message(WARNING "DNSSEC SSHFP retrieval cannot be used without SSH support.")
     set(ENABLE_DNSSEC OFF)
 endif()
 
-if(ENABLE_COMPLY_WITH_ORAN_WG11 AND NOT ENABLE_SSH_TLS)
+if(ENABLE_COMPLY_WITH_ORAN_WG11 AND NOT ENABLE_TLS)
     message(WARNING "O-RAN WG11 compliance cannot be used without TLS support.")
     set(ENABLE_COMPLY_WITH_ORAN_WG11 OFF)
 endif()
+if(ENABLE_COMPLY_WITH_ORAN_WG11)
+    # comply with the O-RAN WG11 security spec (e.g. client cert Extended Key Usage and Key Usage checks)
+    set(NC_COMPLY_WITH_ORAN_WG11 ON)
+endif()
+
+if(ENABLE_EXAMPLES AND NOT ENABLE_SSH)
+    message(WARNING "Examples will not be compiled because SSH is disabled.")
+    set(ENABLE_EXAMPLES OFF)
+endif()
 
 if(ENABLE_VALGRIND_TESTS)
     find_program(VALGRIND_FOUND valgrind)
@@ -209,7 +237,7 @@ if(ENABLE_COVERAGE)
     gen_coverage_enable(${ENABLE_TESTS})
 endif()
 
-if ("${BUILD_TYPE_UPPER}" STREQUAL "DEBUG")
+if("${BUILD_TYPE_UPPER}" STREQUAL "DEBUG")
     source_format_enable(0.77)
 endif()
 
@@ -248,26 +276,51 @@ check_function_exists(pthread_timedjoin_np HAVE_PTHREAD_TIMEDJOIN_NP)
 # header file compatibility
 check_include_file("shadow.h" HAVE_SHADOW)
 check_include_file("termios.h" HAVE_TERMIOS)
+if(ENABLE_IP_FREEBIND)
+    check_symbol_exists(IP_FREEBIND "netinet/in.h" NC_ENABLE_IP_FREEBIND)
+endif()
 
-if(ENABLE_SSH_TLS)
-    # dependencies - mbedTLS (higher preference) or OpenSSL
-    find_package(MbedTLS 3.5.0)
-    if (MBEDTLS_FOUND)
+# dependencies - libval
+if(ENABLE_DNSSEC)
+    find_package(LibVAL REQUIRED)
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DENABLE_DNSSEC")
+    target_link_libraries(netconf2 ${LIBVAL_LIBRARIES})
+    include_directories(${LIBVAL_INCLUDE_DIRS})
+endif()
+
+if(ENABLE_SSH OR ENABLE_TLS)
+    # dependencies - mbedTLS (preferred normally) or OpenSSL (preferred and required with DNSSEC)
+    if(NOT ENABLE_DNSSEC)
+        find_package(MbedTLS 3.5.0)
+    endif()
+    if(MBEDTLS_FOUND)
         # dependencies - mbedtls
         set(HAVE_MBEDTLS TRUE)
-        list(APPEND libsrc src/session_mbedtls.c)
+        list(APPEND libsrc src/session_crypto_mbedtls.c)
         include_directories(${MBEDTLS_INCLUDE_DIRS})
         target_link_libraries(netconf2 ${MBEDTLS_LIBRARIES})
         list(APPEND CMAKE_REQUIRED_LIBRARIES ${MBEDTLS_LIBRARIES})
     else()
         # dependencies - openssl
         find_package(OpenSSL 3.0.0 REQUIRED)
-        list(APPEND libsrc src/session_openssl.c)
+        list(APPEND libsrc src/session_crypto_openssl.c)
         include_directories(${OPENSSL_INCLUDE_DIR})
         target_link_libraries(netconf2 ${OPENSSL_LIBRARIES})
         list(APPEND CMAKE_REQUIRED_LIBRARIES ${OPENSSL_LIBRARIES})
     endif()
 
+    # dependencies - libcurl
+    find_package(CURL 7.30.0 REQUIRED)
+    if(TARGET CURL::libcurl)
+        target_link_libraries(netconf2 CURL::libcurl)
+    else()
+        target_link_libraries(netconf2 ${CURL_LIBRARIES})
+        list(APPEND CMAKE_REQUIRED_LIBRARIES ${CURL_LIBRARY})
+        include_directories(${CURL_INCLUDE_DIRS})
+    endif()
+endif()
+
+if(ENABLE_SSH)
     # dependencies - libssh
     find_package(LibSSH 0.9.5 REQUIRED)
     target_link_libraries(netconf2 ${LIBSSH_LIBRARIES})
@@ -280,29 +333,23 @@ if(ENABLE_SSH_TLS)
         list(APPEND libsrc src/session_server_ssh_auth_message.c)
     endif()
 
-    # dependencies - libcurl
-    find_package(CURL 7.30.0 REQUIRED)
-    if(TARGET CURL::libcurl)
-        target_link_libraries(netconf2 CURL::libcurl)
-    else()
-        target_link_libraries(netconf2 ${CURL_LIBRARIES})
-        list(APPEND CMAKE_REQUIRED_LIBRARIES ${CURL_LIBRARY})
-        include_directories(${CURL_INCLUDE_DIRS})
-    endif()
-
-    # crypt (if not found, assume no library needs to be linked)
-    if(${CMAKE_SYSTEM_NAME} MATCHES "QNX")
-        set(LIBCRYPT login)
-    else()
-        set(LIBCRYPT crypt)
-    endif()
-    check_library_exists(${LIBCRYPT} crypt "" HAVE_CRYPT)
-    if(HAVE_CRYPT)
+    # dependencies - crypt
+    check_function_exists(crypt HAVE_CRYPT)
+    if(NOT HAVE_CRYPT)
+        if(${CMAKE_SYSTEM_NAME} MATCHES "QNX")
+            set(LIBCRYPT login)
+        else()
+            set(LIBCRYPT crypt)
+        endif()
+        check_library_exists(${LIBCRYPT} crypt "" HAVE_LIBCRYPT)
+        if(NOT HAVE_LIBCRYPT)
+            message(FATAL_ERROR "Could NOT find Lib${LIBCRYPT} (library implementing crypt(3))")
+        endif()
         target_link_libraries(netconf2 ${LIBCRYPT})
         list(APPEND CMAKE_REQUIRED_LIBRARIES ${LIBCRYPT})
     endif()
 
-    # libpam
+    # dependencies - libpam
     if(ENABLE_PAM)
         find_package(LibPAM)
     endif()
@@ -319,29 +366,21 @@ if(ENABLE_SSH_TLS)
     else()
         message(WARNING "SSH Keyboard Interactive system method: disabled")
     endif()
-
-    # set compiler flag
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DNC_ENABLED_SSH_TLS")
-
-    # comply with the O-RAN WG11 security spec (e.g. client cert Extended Key Usage and Key Usage checks)
-    if(ENABLE_COMPLY_WITH_ORAN_WG11)
-        set(NC_COMPLY_WITH_ORAN_WG11 ON)
-    endif()
-endif()
-
-# dependencies - libval
-if(ENABLE_DNSSEC)
-    find_package(LibVAL REQUIRED)
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DENABLE_DNSSEC")
-    target_link_libraries(netconf2 ${LIBVAL_LIBRARIES})
-    include_directories(${LIBVAL_INCLUDE_DIRS})
 endif()
 
 # dependencies - libyang
 find_package(LibYANG ${LIBYANG_DEP_SOVERSION} REQUIRED)
 target_link_libraries(netconf2 ${LIBYANG_LIBRARIES})
 include_directories(${LIBYANG_INCLUDE_DIRS})
 
+# set compiler flags
+if(ENABLE_SSH)
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DNC_SSH")
+endif()
+if(ENABLE_TLS)
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DNC_TLS")
+endif()
+
 # set sources
 target_sources(netconf2 PRIVATE ${libsrc} ${compatsrc})
 
@@ -384,11 +423,7 @@ endif()
 
 # examples
 if(ENABLE_EXAMPLES)
-    if(NOT ENABLE_SSH_TLS)
-        message(WARNING "Examples will not be compiled because SSH and TLS are disabled.")
-    else()
-        add_subdirectory(examples)
-    endif()
+    add_subdirectory(examples)
 endif()
 
 # tests

Doxyfile.in

@@ -2069,7 +2069,7 @@ INCLUDE_FILE_PATTERNS  =
 # recursively expanded use the := operator instead of the = operator.
 # This tag requires that the tag ENABLE_PREPROCESSING is set to YES.
 
-PREDEFINED             = NC_ENABLED_SSH_TLS
+PREDEFINED             = NC_SSH NC_TLS
 
 # If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then this
 # tag can be used to specify a list of macro names that should be expanded. The

README.md

@@ -120,11 +120,11 @@ $ cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr ..
 The NETCONF protocol specification allows to use the protocol on top of
 several transport protocols. **libnetconf2** provides support for SSH and
 TLS transport. By default, both SSH and TLS transport is enabled. Disabling
-and enabling both the transport protocols can be made
+and enabling each of the transport protocols can be made
 in the same way. The following command has actually the same effect as
 specifying no option since it specifies the default settings.
 ```
-$ cmake -DENABLE_SSH_TLS=ON ..
+$ cmake -DENABLE_SSH=ON -DENABLE_TLS=ON ..
 ```
 
 ### DNSSEC SSHFP Retrieval