session server UPDATE add unixsock dir getter

Author: Roytak

doc/libnetconf.doc

@@ -493,27 +493,32 @@
  * - ::nc_server_config_add_tls_ctn()
  * - ::nc_server_config_del_tls_ctn()
  *
-* UNIX Socket
+ * UNIX Socket
  * ===========
  *
  * A UNIX socket endpoint can be established using one of two mechanisms:
  *
- * 1) **Cleartext Path**: The filesystem path is explicitly stored in the configuration.
+ * 1) **Standard Filesystem Path**: The filesystem path is explicitly stored in the configuration.
  * To use this, pass a valid path string to ::nc_server_config_add_unix_socket().
  *
  * 2) **Hidden Path**: The filesystem path is managed via the API and is not visible
  * in the YANG configuration. To use this, pass NULL as the path argument to
  * ::nc_server_config_add_unix_socket(). The actual runtime path must then be set
  * using ::nc_server_set_unix_socket_path().
  *
+ * All UNIX sockets require a designated base directory for their creation.
+ * This directory must be set using ::nc_server_set_unix_socket_dir().
+ * A base directory must be set to create any UNIX socket.
+ * All socket paths will be relative to this base directory.
+ *
  * Security Recommendation
  * -----------------------
  * The **Hidden Path** (Option 2) is strongly recommended.
  *
- * If Cleartext paths are enabled, any user with permission to modify the server
+ * If standard paths are enabled, any user with permission to modify the server
  * configuration can change the UNIX socket path via YANG. This allows them to
- * force the server to create or overwrite arbitrary files on the filesystem
- * with the privileges of the server process.
+ * force the server to create or overwrite arbitrary files in a subdirectory
+ * set by ::nc_server_set_unix_socket_dir() with the privileges of the server process.
  *
  * FD
  * ==

modules/libnetconf2-netconf-server@2025-11-11.yang

@@ -330,6 +330,7 @@ module libnetconf2-netconf-server {
               description
                 "Relative filesystem path where the UNIX socket will be bound.
                  The parent directory must be set by an internal server API setting.
+                 The final resolved path must be within the configured parent directory.
 
                  Example: netconf.sock";
             }
@@ -339,7 +340,10 @@ module libnetconf2-netconf-server {
               type empty;
               description
                 "Indicates that the UNIX socket path is not configured via YANG, but is instead
-                 determined by internal server API settings.";
+                 determined by internal server API settings.
+
+                 The parent directory must be set by an internal server API setting.
+                 The final resolved path must be within the configured parent directory.";
             }
           }
         }

src/session_server.c

@@ -4469,28 +4469,39 @@ nc_server_set_unix_socket_path(const char *endpoint_name, const char *socket_pat
     return rc;
 }
 
-API const char *
-nc_server_get_unix_socket_path(const char *endpoint_name)
+API int
+nc_server_get_unix_socket_path(const char *endpoint_name, char **socket_path)
 {
-    const char *socket_path = NULL;
+    int rc = 0;
+    char *p = NULL;
     LY_ARRAY_COUNT_TYPE i;
 
-    NC_CHECK_ARG_RET(NULL, endpoint_name, NULL);
+    NC_CHECK_ARG_RET(NULL, endpoint_name, socket_path, 1);
+
+    *socket_path = NULL;
 
     /* CONFIG READ LOCK */
     pthread_rwlock_rdlock(&server_opts.config_lock);
 
     /* try to find the path for this endpoint */
     LY_ARRAY_FOR(server_opts.unix_paths, i) {
         if (!strcmp(server_opts.unix_paths[i].endpt_name, endpoint_name)) {
-            socket_path = server_opts.unix_paths[i].path;
+            p = server_opts.unix_paths[i].path;
             break;
         }
     }
 
+    if (!p) {
+        goto cleanup;
+    }
+
+    *socket_path = strdup(p);
+    NC_CHECK_ERRMEM_GOTO(!*socket_path, rc = 1, cleanup);
+
+cleanup:
     /* CONFIG READ UNLOCK */
     pthread_rwlock_unlock(&server_opts.config_lock);
-    return socket_path;
+    return rc;
 }
 
 API int
@@ -4510,3 +4521,24 @@ nc_server_set_unix_socket_dir(const char *dir)
     pthread_rwlock_unlock(&server_opts.config_lock);
     return rc;
 }
+
+API int
+nc_server_get_unix_socket_dir(char **dir)
+{
+    int rc = 0;
+
+    *dir = NULL;
+
+    /* CONFIG READ LOCK */
+    pthread_rwlock_rdlock(&server_opts.config_lock);
+
+    if (server_opts.unix_socket_dir) {
+        *dir = strdup(server_opts.unix_socket_dir);
+        NC_CHECK_ERRMEM_GOTO(!*dir, rc = 1, cleanup);
+    }
+
+cleanup:
+    /* CONFIG READ UNLOCK */
+    pthread_rwlock_unlock(&server_opts.config_lock);
+    return rc;
+}

src/session_server.h

@@ -463,9 +463,10 @@ int nc_server_set_unix_socket_path(const char *endpoint_name, const char *socket
  * @brief Get the UNIX socket path for a given endpoint name.
  *
  * @param[in] endpoint_name Name of the endpoint.
- * @return UNIX socket path, NULL if not found.
+ * @param[out] socket_path Found UNIX socket path.
+ * @return 0 on success, 1 on error.
  */
-const char *nc_server_get_unix_socket_path(const char *endpoint_name);
+int nc_server_get_unix_socket_path(const char *endpoint_name, char **socket_path);
 
 /**
  * @brief Set the base directory for UNIX socket paths.
@@ -478,6 +479,14 @@ const char *nc_server_get_unix_socket_path(const char *endpoint_name);
  */
 int nc_server_set_unix_socket_dir(const char *dir);
 
+/**
+ * @brief Get the base directory for UNIX socket paths.
+ *
+ * @param[out] dir Base directory for UNIX socket paths.
+ * @return 0 on success, 1 on error.
+ */
+int nc_server_get_unix_socket_dir(char **dir);
+
 /** @} Server Session */
 
 /**