An almost-RESTCONF server

Usage

One day, this might become a RESTCONF server on top of sysrepo. Before that happens, it will, hopefully, be a small HTTP wrapper around sysrepo which publishes some data in a RESTCONF format.

Since this service only talks cleartext HTTP/2, it's recommended to run it behind a reverse proxy.

Access control model

Rousette implements RFC 8341 (NACM). The access rights for users (and groups) are configurable via ietf-netconf-acm YANG model.

The reverse proxy must pass the authorization header as-is and delegate authentication/authorization to the RESTCONF server. The server currently supports two authentication/authorization methods:

a systemwide PAM setup through the Basic HTTP authentication, i.e., via the authorization header, which is checked against the system's PAM configuration
a special anonymous access.

When the request does not contain the authorization header, and anonymous access is enabled (see below), the server will perform extra safety checks. When certain conditions are met, the anonymous access will be mapped to a NACM account named in the ANONYMOUS_USER CMake option. Such user must be in group ANONYMOUS_USER_GROUP (CMake option) and there must be some specific access rights set up in ietf-netconf-acm model (these are currently very opinionated for our use-case):

The first entry of rule-list list must be configured for ANONYMOUS_USER_GROUP.
All the rules except the last one in this rule-list entry must enable only "read" access operation.
The last rule in the first rule-set must be a wildcard rule that disables all operations over all modules.

The anonymous user access is disabled whenever these rules are not met.

Dependencies

nghttp2-asio - asynchronous C++ library for HTTP/2
sysrepo-cpp - object-oriented bindings of the sysrepo library
libyang-cpp - C++ bindings for libyang
systemd - the shared library for logging to sd-journal
PAM - for authentication
spdlog - Very fast, header-only/compiled, C++ logging library
Boost's system and thread
C++20 compiler (e.g., GCC 10.x+, clang 10+)
CMake 3.19+
optionally for built-in tests, Doctest as a C++ unit test framework
optionally for built-in tests, trompeloeil for mock objects in C++
optionally for built-in tests, pam_matrix and pam_wrapper for PAM mocking

Building

The standard way of building rousette looks like this:

mkdir build
cd build
cmake ..
make
make install

Contributing