{"action":"created","issue":{"url":"https://api.github.com/repos/CESNET/libnetconf2/issues/123","repository_url":"https://api.github.com/repos/CESNET/libnetconf2","labels_url":"https://api.github.com/repos/CESNET/libnetconf2/issues/123/labels{/name}","comments_url":"https://api.github.com/repos/CESNET/libnetconf2/issues/123/comments","events_url":"https://api.github.com/repos/CESNET/libnetconf2/issues/123/events","html_url":"https://github.com/CESNET/libnetconf2/pull/123","id":389742617,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM3NjYyMDI3","number":123,"title":"add support for unix socket transport","user":{"login":"olivier-matz-6wind","id":8417324,"node_id":"MDQ6VXNlcjg0MTczMjQ=","avatar_url":"https://avatars0.githubusercontent.com/u/8417324?v=4","gravatar_id":"","url":"https://api.github.com/users/olivier-matz-6wind","html_url":"https://github.com/olivier-matz-6wind","followers_url":"https://api.github.com/users/olivier-matz-6wind/followers","following_url":"https://api.github.com/users/olivier-matz-6wind/following{/other_user}","gists_url":"https://api.github.com/users/olivier-matz-6wind/gists{/gist_id}","starred_url":"https://api.github.com/users/olivier-matz-6wind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olivier-matz-6wind/subscriptions","organizations_url":"https://api.github.com/users/olivier-matz-6wind/orgs","repos_url":"https://api.github.com/users/olivier-matz-6wind/repos","events_url":"https://api.github.com/users/olivier-matz-6wind/events{/privacy}","received_events_url":"https://api.github.com/users/olivier-matz-6wind/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-12-11T12:31:48Z","updated_at":"2018-12-11T13:55:24Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/CESNET/libnetconf2/pulls/123","html_url":"https://github.com/CESNET/libnetconf2/pull/123","diff_url":"https://github.com/CESNET/libnetconf2/pull/123.diff","patch_url":"https://github.com/CESNET/libnetconf2/pull/123.patch"},"body":"In addition to SSH and TLS transport, add the support for UNIX\r\nsocket. Despite it's not in NETCONF standard, using a UNIX socket has\r\nseveral advantages:\r\n\r\n- no need of password, keys, or certificate. The connection is allowed\r\n  for a local user authenticated on the system, and having the proper\r\n  permissions to connect to the netopeer socket.\r\n\r\n- the connection to netopeer is possible even if the firewall is\r\n  enabled. This is an advantage when configuring a firewall equipment\r\n  through netconf.\r\n\r\n- the connection to netopeer is possible from another netns.\r\n\r\nSigned-off-by: Olivier Matz <olivier.matz@6wind.com>"},"comment":{"url":"https://api.github.com/repos/CESNET/libnetconf2/issues/comments/446210299","html_url":"https://github.com/CESNET/libnetconf2/pull/123#issuecomment-446210299","issue_url":"https://api.github.com/repos/CESNET/libnetconf2/issues/123","id":446210299,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NjIxMDI5OQ==","user":{"login":"olivier-matz-6wind","id":8417324,"node_id":"MDQ6VXNlcjg0MTczMjQ=","avatar_url":"https://avatars0.githubusercontent.com/u/8417324?v=4","gravatar_id":"","url":"https://api.github.com/users/olivier-matz-6wind","html_url":"https://github.com/olivier-matz-6wind","followers_url":"https://api.github.com/users/olivier-matz-6wind/followers","following_url":"https://api.github.com/users/olivier-matz-6wind/following{/other_user}","gists_url":"https://api.github.com/users/olivier-matz-6wind/gists{/gist_id}","starred_url":"https://api.github.com/users/olivier-matz-6wind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olivier-matz-6wind/subscriptions","organizations_url":"https://api.github.com/users/olivier-matz-6wind/orgs","repos_url":"https://api.github.com/users/olivier-matz-6wind/repos","events_url":"https://api.github.com/users/olivier-matz-6wind/events{/privacy}","received_events_url":"https://api.github.com/users/olivier-matz-6wind/received_events","type":"User","site_admin":false},"created_at":"2018-12-11T13:55:24Z","updated_at":"2018-12-11T13:55:24Z","author_association":"NONE","body":"Thank you for the feedback.\r\n\r\nAbout security requirements, my understanding is that it they are fulfilled because there is an authentication mechanism:\r\n- the client must be authenticated on the system\r\n- the server can set permissions to the unix socket so that only some uid or gid can connect\r\n- the server gets the netconf username from the unix socket with getsockopt(..., SO_PEERCRED)\r\n\r\nAs supposed by @jktjkt, we are able use a local cli on our equipment. It can connect to Netopeer with ssh or unix socket. We use a unix socket by default to bypass local firewall rules (our equipment is also a firewall, and it can have a DROP policy by default) and to ensure that the connection can work from another netns.\r\n\r\nI'd be happy if it gets merged, and not only because it is easier for us ;) I think it can be useful for other people that have the same use case than us. It guess it is also faster to setup than other transports, for testing purposes.\r\n"}}
{"actor":{"display_login":"olivier-matz-6wind"}}