Skip to content

Add GNMI client cert cname check support. #18709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qiluo-msft merged 14 commits into from
Aug 22, 2024
Merged

Add GNMI client cert cname check support. #18709

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
559180f
Add GNMI client cert cname list to yang model
liuh-80 Apr 18, 2024
f61f54c
Merge remote-tracking branch 'origin/master' into dev/liuh/add_gnmi_c…
liuh-80 May 28, 2024
ebea874
Update stubmodule
liuh-80 May 28, 2024
50e1f5f
Improve start script
liuh-80 May 29, 2024
26efc7d
Update submodule
liuh-80 May 29, 2024
7320df7
Fix yang model issue
liuh-80 Jun 3, 2024
9fcdb1f
Update submodule
liuh-80 Jun 3, 2024
00403b7
Update submodule
liuh-80 Jun 4, 2024
4216eb3
Merge remote-tracking branch 'origin/master' into dev/liuh/add_gnmi_c…
liuh-80 Jun 18, 2024
26ce0ed
change gnmi submodule reference back
liuh-80 Jun 18, 2024
8a73426
Merge remote-tracking branch 'origin/master' into dev/liuh/add_gnmi_c…
liuh-80 Jul 1, 2024
1e20d9a
Add test case
liuh-80 Jul 2, 2024
fbb629f
Fix yang mgmt test issue
liuh-80 Jul 3, 2024
ad1900b
Reuse cert list table in GNMI and TELEMETRY
liuh-80 Jul 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions dockers/docker-sonic-gnmi/gnmi-native.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@ if [ -n "$CERTS" ]; then
if [ ! -z $CA_CRT ]; then
TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
fi

TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
elif [ -n "$X509" ]; then
SERVER_CRT=$(echo $X509 | jq -r '.server_crt')
SERVER_KEY=$(echo $X509 | jq -r '.server_key')
Expand Down
2 changes: 2 additions & 0 deletions dockers/docker-sonic-telemetry/telemetry.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ if [ -n "$CERTS" ]; then
if [ ! -z $CA_CRT ]; then
TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
fi

TELEMETRY_ARGS+=" --config_table_name TELEMETRY_CLIENT_CERT"
elif [ -n "$X509" ]; then
SERVER_CRT=$(echo $X509 | jq -r '.server_crt')
SERVER_KEY=$(echo $X509 | jq -r '.server_key')
Expand Down
20 changes: 20 additions & 0 deletions src/sonic-yang-models/yang-models/sonic-gnmi.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,27 @@ module sonic-gnmi {
}

}
}

container GNMI_CLIENT_CERT {
description "GNMI client cert list";

list GNMI_CLIENT_CERT_LIST {
max-elements 8;
key "cert_cname";

leaf cert_cname {
type string;
description
"client cert common name";
}

leaf role {
type string;
description
"role of client cert common name";
}
}
}
}
}
21 changes: 21 additions & 0 deletions src/sonic-yang-models/yang-models/sonic-telemetry.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,5 +74,26 @@ module sonic-telemetry {
}

}

container TELEMETRY_CLIENT_CERT {
description "TELEMETRY client cert list";

list TELEMETRY_CLIENT_CERT_LIST {
max-elements 8;
key "cert_cname";

leaf cert_cname {
type string;
description
"client cert common name";
}

leaf role {
type string;
description
"role of client cert common name";
}
}
}
}
}