opensipscli 0.4.1__tar.gz → 0.4.2__tar.gz

{opensipscli-0.4.1 → opensipscli-0.4.2}/.github/workflows/pypi.yml

@@ -69,7 +69,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Sign the dists with Sigstore
-      uses: sigstore/gh-action-sigstore-python@v2.1.1
+      uses: sigstore/gh-action-sigstore-python@v3.5.0
       with:
         inputs: >-
           ./dist/*.tar.gz

{opensipscli-0.4.1 → opensipscli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opensipscli
-Version: 0.4.1
+Version: 0.4.2
 Summary: OpenSIPS Command Line Interface
 Project-URL: Homepage, https://github.com/OpenSIPS/opensips-cli
 Project-URL: Source, https://github.com/OpenSIPS/opensips-cli

{opensipscli-0.4.1 → opensipscli-0.4.2}/docs/modules/mi.md

@@ -7,9 +7,14 @@ commands and display the result in the console.
 
 This module exports all the commands that are exported by the OpenSIPS
 instance that `opensips-cli` points to. It fetches the available commands by
-running the OpenSIPS MI `which` command. When running a command, it returns
+running the OpenSIPS MI `which` command. It also loads MI aliases using the
+`which_aliases` command. When running a command, it returns
 the raw, unprocessed data from OpenSIPS.
 
+Aliases are accepted when executing commands, but are not included in command
+completion suggestions. Ambiguous aliases are ignored and must be invoked by
+their canonical command name.
+
 Commands using this module can be run in two manners:
 * using *positional* parameters: this is similar to the old way the
 `opensipsctl` tool was working: the parameters passed to the function are

opensipscli-0.4.2/docs/modules/tls.md

@@ -0,0 +1,191 @@
+# OpenSIPS CLI - TLS module
+
+Using the `tls` module, you can generate TLS certificates and private keys.
+
+The module has the following subcommands:
+* `rootCA` - generates a CA (certification authority) self signed certificate
+and private key pair.  These are to be used by a TLS server.
+* `userCERT` - generates a certificate signed by a given CA, a private key and
+a CA list (chain of trust) file.  These are to be used by TLS clients (users).
+* `add` - adds a new TLS domain to the `tls_mgm` table.
+* `update` - changes the columns of an existing TLS domain.
+* `list` - lists the TLS domains provisioned in the `tls_mgm` table.
+* `show` - prints the columns of a TLS domain.
+* `delete` - removes a TLS domain from the `tls_mgm` table.
+
+The `add`, `update`, `list`, `show` and `delete` subcommands provision the
+`tls_mgm` module over the database, where the certificate, private key and CA
+list are stored as BLOB values rather than as paths to files.  A TLS domain is
+identified by its name and its type (`server` or `client`), both passed as
+arguments:
+```
+opensips-cli -x tls delete a.example.org server
+```
+The domain and its type may also be given by name, in which case they can
+appear anywhere among the other columns:
+```
+opensips-cli -x tls delete domain=a.example.org type=server
+```
+Giving one of them both ways at once is an error.  The commands addressing a
+single domain ask for whatever is left out; `add` and `show` default the
+type to `server`, while `update` and `delete` have no default and keep
+asking until one is given, so that they cannot change a different domain than
+the intended one.
+
+`add` and `update` take the remaining `tls_mgm` columns as `column=value`
+arguments, in any order and after the domain and the type:
+```
+opensips-cli -x tls add a.example.org server method=TLSv1_2 verify_cert=1
+```
+The settable columns are `match_ip_address`, `match_sip_domain`, `method`,
+`verify_cert`, `require_cert`, `certificate`, `private_key`, `crl_check_all`,
+`crl_dir`, `ca_list`, `ca_dir`, `cipher_list`, `dh_params` and `ec_curve`.  A
+column that is not given is left to its default in the database schema;
+`update` only changes the columns it is given.
+
+The `certificate`, `private_key`, `ca_list` and `dh_params` columns hold PEM
+content, so their value is the path of the file holding it, and that file is
+read and stored in the table:
+```
+opensips-cli -x tls add a.example.org server \
+	certificate=/etc/opensips/tls/user/user-cert.pem \
+	private_key=/etc/opensips/tls/user/user-privkey.pem
+```
+Every other column is stored as the value it is given, paths included: for
+example, `ca_list` reads the file it points to, while `ca_dir` and `crl_dir`
+keep the directory as such, which is what `tls_mgm` expects of them.
+
+After every change, the `tls_reload` MI command is issued so that a running
+OpenSIPS picks up the new domains.  If OpenSIPS cannot be reached, a warning is
+logged and the domains are loaded at the next restart.
+
+## Configuration
+
+Certificates and private keys can be customized using the following settings:
+
+List of `opensips-cli.cfg` settings for configuring self-signed CA certificates:
+
+* tls_ca_dir - output directory where the cert and key will be written to
+* tls_ca_cert_file - output certificate file path, within `tls_ca_dir`
+* tls_ca_key_file - output private key file path, within `tls_ca_dir`
+* tls_ca_overwrite - set this to "y" in order to overwrite existing files
+* tls_ca_common_name - the address of the website (e.g. "opensips.org")
+* tls_ca_country - the initials of the country (e.g. "RO")
+* tls_ca_state - the state (e.g. "Bucharest")
+* tls_ca_locality - the city (e.g. "Bucharest")
+* tls_ca_organisation - the name of the organisation (e.g. "OpenSIPS")
+* tls_ca_organisational_unit - the organisational unit (e.g. "Project")
+* tls_ca_notafter - the validity period, in seconds (e.g. 315360000)
+* tls_ca_key_size - the size of the RSA key, in bits (e.g. 4096)
+* tls_ca_md - the digest algorithm to use for signing (e.g. SHA256)
+
+List of `opensips-cli.cfg` settings for configuring user certificates:
+
+* tls_user_dir - output directory where the cert and key will be written to
+* tls_user_cert_file - output certificate file path, within `tls_user_dir`
+* tls_user_key_file - output private key file path, within `tls_user_dir`
+* tls_user_calist_file - output CA list file path, within `tls_user_dir`
+* tls_user_overwrite - set this to "y" in order to overwrite existing files
+* tls_user_cacert - path to the input CA certificate
+* tls_user_cakey - path to the input CA private key
+* tls_user_common_name - the address of the website (e.g. "www.opensips.org")
+* tls_user_country - the initials of the country (e.g. "RO")
+* tls_user_state - the state (e.g. "Bucharest")
+* tls_user_locality - the city (e.g. "Bucharest")
+* tls_user_organisation - the name of the organisation (e.g. "OpenSIPS")
+* tls_user_organisational_unit - the organisational unit (e.g. "Project")
+* tls_user_notafter - the validity period, in seconds (e.g. 315360000)
+* tls_user_key_size - the size of the RSA key, in bits (e.g. 4096)
+* tls_user_md - the digest algorithm to use for signing (e.g. SHA256)
+
+List of `opensips-cli.cfg` settings for the `tls_mgm` database subcommands:
+
+* database_tls_url - URL of the database holding the `tls_mgm` table; falls
+back to `database_url`
+* database_tls_name - name of the database; falls back to `database_name`
+
+
+## Examples
+
+To create a self-signed certificate and a private key for rootCA, enter this snippet:
+```
+opensips-cli -x tls rootCA
+```
+Configuration file example for rootCA:
+```
+[default]
+tls_ca_dir: /etc/opensips/tls/rootCA
+tls_ca_cert_file: cacert.pem
+tls_ca_key_file: private/cakey.pem
+tls_ca_overwrite: yes
+tls_ca_common_name: opensips.org
+tls_ca_country: RO
+tls_ca_state: Bucharest
+tls_ca_locality: Bucharest
+tls_ca_organisation: OpenSIPS
+tls_ca_organisational_unit: Project
+tls_ca_notafter: 315360000
+tls_ca_key_size: 4096
+tls_ca_md: SHA256
+```
+
+To create a user certificate signed by the above rootCA, along with a private
+key and a CA list (chain of trust) file:
+```
+opensips-cli -x tls userCERT
+```
+Configuration file example for userCERT:
+```
+[default]
+tls_user_dir: /etc/opensips/tls/user
+tls_user_cert_file: user-cert.pem
+tls_user_key_file: user-privkey.pem
+tls_user_calist_file: user-calist.pem
+tls_user_overwrite: yes
+tls_user_cacert: /etc/opensips/tls/rootCA/cacert.pem
+tls_user_cakey: /etc/opensips/tls/rootCA/private/cakey.pem
+tls_user_common_name: www.opensips.org
+tls_user_country: RO
+tls_user_state: Bucharest
+tls_user_locality: Bucharest
+tls_user_organisation: OpenSIPS
+tls_user_organisational_unit: Project
+tls_user_notafter: 315360000
+tls_user_key_size: 4096
+tls_user_md: SHA256
+```
+
+To provision the certificate generated above as a TLS domain in the database:
+```
+opensips-cli -x tls add a.example.org server \
+	certificate=/etc/opensips/tls/user/user-cert.pem \
+	private_key=/etc/opensips/tls/user/user-privkey.pem \
+	ca_list=/etc/opensips/tls/user/user-calist.pem
+```
+Certificates issued by a public CA are provisioned the same way:
+```
+opensips-cli -x tls add a.example.org server \
+	certificate=/etc/letsencrypt/live/a.example.org/fullchain.pem \
+	private_key=/etc/letsencrypt/live/a.example.org/privkey.pem
+```
+Configuration file example for the `tls_mgm` database subcommands:
+```
+[default]
+database_url: mysql://opensips:opensipsrw@localhost
+database_name: opensips
+```
+
+To renew the certificate of a domain, or to change any of its other columns:
+```
+opensips-cli -x tls update a.example.org server \
+	certificate=/etc/letsencrypt/live/a.example.org/fullchain.pem \
+	private_key=/etc/letsencrypt/live/a.example.org/privkey.pem
+opensips-cli -x tls update a.example.org server cipher_list=HIGH
+```
+
+To inspect and remove the provisioned domains:
+```
+opensips-cli -x tls list
+opensips-cli -x tls show a.example.org server
+opensips-cli -x tls delete a.example.org server
+```

{opensipscli-0.4.1 → opensipscli-0.4.2}/opensipscli/cli.py

@@ -29,7 +29,6 @@ from opensipscli import comm
 from opensipscli import defaults
 from opensipscli.config import cfg
 from opensipscli.logger import logger
-from opensipscli.modules import *
 
 class OpenSIPSCLI(cmd.Cmd, object):
     """
@@ -121,6 +120,10 @@ class OpenSIPSCLI(cmd.Cmd, object):
         self.current_instance = instance
         self.update_logger()
 
+        # import the modules only now, so that their import-time messages
+        # honor the logging level
+        importlib.import_module("opensipscli.modules")
+
         # Update the intro and prompt
         self.intro = cfg.get('prompt_intro')
         self.prompt = '(%s): ' % cfg.get('prompt_name')
@@ -175,7 +178,11 @@ class OpenSIPSCLI(cmd.Cmd, object):
                 continue
             logger.debug("Loaded module '{}'".format(name))
             imod = mod()
-            self.modules[name] = (imod, mod.__get_methods__(imod))
+            methods = mod.__get_methods__(imod)
+            aliases = {}
+            if hasattr(imod, '__get_aliases__'):
+                aliases = imod.__get_aliases__() or {}
+            self.modules[name] = (imod, methods, aliases)
 
     def history_write(self):
         """
@@ -419,7 +426,7 @@ class OpenSIPSCLI(cmd.Cmd, object):
             logger.error("module '{}' expects the following commands: {}".
                    format(module, ", ".join(mod[1])))
             return -1
-        elif cmd and not cmd in mod[1]:
+        elif cmd and cmd not in mod[1] and cmd not in mod[2]:
             logger.error("no command '{}' in module '{}'".
                     format(cmd, module))
             return -1

{opensipscli-0.4.1 → opensipscli-0.4.2}/opensipscli/db.py

@@ -36,17 +36,26 @@ try:
     #from sqlalchemy.engine.url import make_url
 
     sqlalchemy_available = True
+    sqlalchemy_import_error = None
     logger.debug("SQLAlchemy version: %s", sqlalchemy.__version__)
     # always use the vendored shim — the system sqlalchemy-utils package
     # varies a lot across distros (0.36.x ships broken database_exists for
     # PostgreSQL on Bullseye; 0.41.x is required for SA 2.0); the shim is
     # tested against SA 1.3–2.0 and behaves consistently
     from opensipscli.libs import sqlalchemy_utils
+except ImportError as e:
+    # keep the cause around so callers can report it when the database
+    # is actually needed
+    logger.info("sqlalchemy not available: %s", e)
+    sqlalchemy_available = False
+    sqlalchemy_import_error = e
+
+try:
     import pymysql
     pymysql.install_as_MySQLdb()
 except ImportError:
-    logger.info("sqlalchemy not available!")
-    sqlalchemy_available = False
+    # only needed for mysql:// URLs; the other backends work without it
+    pass
 
 SUPPORTED_BACKENDS = [
     "mysql",
@@ -767,6 +776,8 @@ class osdb(object):
         check for support of a given database dialect via SQLAlchemy
         """
         # TODO: do this only for SQLAlchemy
+        if not sqlalchemy_available:
+            return False
         try:
             sqlalchemy.create_engine('{}://'.format(dialect))
         except sqlalchemy.exc.NoSuchModuleError:

{opensipscli-0.4.1 → opensipscli-0.4.2}/opensipscli/modules/mi.py

@@ -64,6 +64,9 @@ MI_MODIFIERS = [ "-j" ]
 
 class mi(Module):
 
+    def __init__(self):
+        self.aliases = {}
+
     def print_pretty_print(self, result):
         print(json.dumps(result, indent=4))
 
@@ -150,11 +153,34 @@ class mi(Module):
                 new_params.append(params[MI_ARRAY_PARAMS_COMMANDS[cmd][0]:])
         return new_params
 
+    def __get_aliases__(self):
+        result = comm.execute('which_aliases', silent=True)
+        if not isinstance(result, list):
+            return self.aliases
+
+        aliases = {}
+        for item in result:
+            if not isinstance(item, dict):
+                continue
+            alias = item.get('alias')
+            command = item.get('command')
+            if not isinstance(alias, str) or not isinstance(command, str):
+                continue
+            if alias in aliases and aliases[alias] != command:
+                aliases[alias] = None
+            else:
+                aliases[alias] = command
+
+        self.aliases = {alias: command for alias, command in aliases.items()
+                        if command is not None}
+        return self.aliases
+
     def __invoke__(self, cmd, params=None, modifiers=None):
-        params = self.parse_params(cmd, params, modifiers)
+        command = self.aliases.get(cmd, cmd)
+        params = self.parse_params(command, params, modifiers)
         # Mi Module works with JSON Communication
-        logger.debug("running command '{}' '{}'".format(cmd, params))
-        res = comm.execute(cmd, params)
+        logger.debug("running command '{}' '{}'".format(command, params))
+        res = comm.execute(command, params)
         if res is None:
             return -1
         output_type = cfg.get('output_type')

{opensipscli-0.4.1 → opensipscli-0.4.2}/opensipscli/modules/tls.py

@@ -25,8 +25,38 @@ from time import gmtime, mktime
 from os.path import exists, join, dirname
 from os import makedirs
 from opensipscli.config import cfg, OpenSIPSCLIConfig
+from opensipscli.db import osdb, osdbError, sqlalchemy_import_error
+from opensipscli import comm
 from random import randrange
 
+DEFAULT_DB_NAME = "opensips"
+TLS_MGM_TABLE = "tls_mgm"
+TLS_DOMAIN_COL = "domain"
+TLS_TYPE_COL = "type"
+TLS_CERT_COL = "certificate"
+TLS_PK_COL = "private_key"
+TLS_CALIST_COL = "ca_list"
+TLS_DH_COL = "dh_params"
+
+# the tls_mgm columns that can be provisioned
+TLS_MGM_COLUMNS = ["match_ip_address", "match_sip_domain", "method",
+        "verify_cert", "require_cert", TLS_CERT_COL, TLS_PK_COL,
+        "crl_check_all", "crl_dir", TLS_CALIST_COL, "ca_dir", "cipher_list",
+        TLS_DH_COL, "ec_curve"]
+
+# columns holding PEM content, which is read from the file they point to
+TLS_PEM_COLUMNS = [TLS_CERT_COL, TLS_PK_COL, TLS_CALIST_COL, TLS_DH_COL]
+
+# columns identifying a row, in the order they are accepted as arguments
+TLS_KEY_COLUMNS = [TLS_DOMAIN_COL, TLS_TYPE_COL]
+
+# generated by the database, never provisioned
+TLS_ID_COL = "id"
+
+# as defined by CLIENT_DOMAIN_TYPE/SERVER_DOMAIN_TYPE in tls_mgm/tls_domain.h
+TLS_DOMAIN_TYPES = {"client": 1, "server": 2}
+TLS_TYPE_NAMES = {v: k for k, v in TLS_DOMAIN_TYPES.items()}
+
 openssl_version = None
 
 try:
@@ -207,6 +237,7 @@ class tlsCryptographyKey(tlsKey):
                                                       password=None)
 
 class tls(Module):
+
     def do_rootCA(self, params, modifiers=None):
         global cfg
         logger.info("Preparing to generate CA cert + key...")
@@ -349,6 +380,312 @@ class tls(Module):
         logger.info("user private key created in " + k_f)
         logger.info("user CA list (chain of trust) created in " + ca_f)
 
+    def tls_db_connect(self):
+        """
+        connects to the database holding the tls_mgm table
+        """
+        if not osdb.has_sqlalchemy():
+            logger.error("SQLAlchemy not available (%s): cannot access the database",
+                    sqlalchemy_import_error)
+            return None
+
+        engine = osdb.get_db_engine()
+
+        db_url = cfg.read_param(["database_tls_url", "database_url"],
+                "Please provide us the URL of the database")
+        if db_url is None:
+            print()
+            logger.error("no URL specified: aborting!")
+            return None
+
+        db_url = osdb.set_url_driver(db_url, engine)
+        db_name = cfg.read_param(["database_tls_name", "database_name"],
+                "Please provide the database storing the TLS domains",
+                DEFAULT_DB_NAME)
+
+        try:
+            db = osdb(db_url, db_name)
+        except osdbError:
+            logger.error("failed to connect to database %s", db_name)
+            return None
+
+        if not db.connect():
+            return None
+
+        return db
+
+    def tls_db_reload(self):
+        """
+        makes a running OpenSIPS pick up the tls_mgm changes
+        """
+        if comm.execute('tls_reload') is None:
+            logger.warning("could not reload the TLS domains; "
+                    "OpenSIPS will load them at the next restart")
+
+    def tls_db_params(self, params, require_type=False):
+        """
+        resolves the (domain, type) pair identifying a tls_mgm row, along with
+        the columns to provision.  Everything is given as 'column=value', with
+        the domain and its type also accepted as the first two arguments; what
+        is left out is asked for.  The value of a PEM column is the path of the
+        file holding it
+        """
+        cols = {}
+        for param in [p for p in params if '=' in p]:
+            col, val = param.split('=', 1)
+            if col == TLS_ID_COL:
+                logger.error("column '%s' is generated by the database",
+                        TLS_ID_COL)
+                return None, None, None
+
+            if col not in TLS_MGM_COLUMNS and col not in TLS_KEY_COLUMNS:
+                logger.error("unknown %s column '%s'", TLS_MGM_TABLE, col)
+                return None, None, None
+
+            if col in TLS_PEM_COLUMNS:
+                path = val
+                try:
+                    with open(path, "rt") as f:
+                        val = f.read()
+                except Exception as e:
+                    logger.exception(e)
+                    logger.error("Failed to read %s", path)
+                    return None, None, None
+
+                if "-----BEGIN" not in val:
+                    logger.error("%s is not in PEM format", path)
+                    return None, None, None
+
+            cols[col] = val
+
+        # the domain and its type identify the row, they are not provisioned
+        args = [p for p in params if '=' not in p]
+        if len(args) > len(TLS_KEY_COLUMNS):
+            logger.error("too many arguments: expected at most a domain and "
+                    "its type")
+            return None, None, None
+
+        key = {}
+        for i, col in enumerate(TLS_KEY_COLUMNS):
+            if i < len(args):
+                if col in cols:
+                    logger.error("'%s' given both as an argument and as "
+                            "'%s='", col, col)
+                    return None, None, None
+                key[col] = args[i]
+            else:
+                key[col] = cols.pop(col, None)
+
+        domain = key[TLS_DOMAIN_COL]
+        if not domain:
+            domain = cfg.read_param(None,
+                    "Please provide the name of the TLS domain")
+            if not domain:
+                logger.error("no TLS domain specified!")
+                return None, None, None
+
+        dtype = key[TLS_TYPE_COL]
+        if not dtype:
+            # commands changing an existing row get no default, so that they
+            # cannot pick a different row than the intended one
+            dtype = cfg.read_param(None, "TLS domain type (server/client)",
+                    None if require_type else "server")
+            if not dtype:
+                logger.error("no TLS domain type specified!")
+                return None, None, None
+
+        if dtype.lower() not in TLS_DOMAIN_TYPES:
+            logger.error("invalid TLS domain type '%s': "
+                    "expected 'server' or 'client'", dtype)
+            return None, None, None
+
+        return domain, TLS_DOMAIN_TYPES[dtype.lower()], cols
+
+    def do_add(self, params=None, modifiers=None):
+        """
+        provisions a new TLS domain in the database
+        """
+        domain, dtype, cols = self.tls_db_params(params or [])
+        if not domain:
+            return -1
+
+        db = self.tls_db_connect()
+        if not db:
+            return -1
+
+        row = {TLS_DOMAIN_COL: domain, TLS_TYPE_COL: dtype}
+        if db.entry_exists(TLS_MGM_TABLE, row):
+            logger.error("TLS %s domain '%s' already exists",
+                    TLS_TYPE_NAMES[dtype], domain)
+            db.destroy()
+            return -1
+
+        row.update(cols)
+        if db.insert(TLS_MGM_TABLE, row) is False:
+            db.destroy()
+            return -1
+
+        db.destroy()
+        logger.info("Successfully added TLS %s domain '%s'",
+                TLS_TYPE_NAMES[dtype], domain)
+        self.tls_db_reload()
+        return True
+
+    def do_update(self, params=None, modifiers=None):
+        """
+        changes the given columns of an existing TLS domain
+        """
+        domain, dtype, cols = self.tls_db_params(params or [], True)
+        if not domain:
+            return -1
+
+        if not cols:
+            logger.error("no column to update: expected 'column=value'")
+            return -1
+
+        db = self.tls_db_connect()
+        if not db:
+            return -1
+
+        row = {TLS_DOMAIN_COL: domain, TLS_TYPE_COL: dtype}
+        if not db.entry_exists(TLS_MGM_TABLE, row):
+            logger.error("TLS %s domain '%s' does not exist",
+                    TLS_TYPE_NAMES[dtype], domain)
+            db.destroy()
+            return -1
+
+        if db.update(TLS_MGM_TABLE, cols, row) is False:
+            db.destroy()
+            return -1
+
+        db.destroy()
+        logger.info("Successfully updated TLS %s domain '%s'",
+                TLS_TYPE_NAMES[dtype], domain)
+        self.tls_db_reload()
+        return True
+
+    def do_list(self, params=None, modifiers=None):
+        """
+        lists the TLS domains provisioned in the database
+        """
+        db = self.tls_db_connect()
+        if not db:
+            return -1
+
+        res = db.find(TLS_MGM_TABLE,
+                ["id", TLS_DOMAIN_COL, TLS_TYPE_COL, "method",
+                    "verify_cert", "require_cert"], None)
+        if res is None:
+            db.destroy()
+            return -1
+
+        rows = res.fetchall()
+        db.destroy()
+
+        if not rows:
+            logger.info("no TLS domain provisioned in %s", TLS_MGM_TABLE)
+            return True
+
+        print("{:<5} {:<32} {:<8} {:<8} {:<8} {:<8}".format(
+            "id", "domain", "type", "method", "verify", "require"))
+        for r in rows:
+            print("{:<5} {:<32} {:<8} {:<8} {:<8} {:<8}".format(
+                r[0], r[1], TLS_TYPE_NAMES.get(r[2], r[2]),
+                str(r[3]), str(r[4]), str(r[5])))
+        return True
+
+    def do_show(self, params=None, modifiers=None):
+        """
+        prints the columns of a TLS domain
+        """
+        domain, dtype, cols = self.tls_db_params(params or [])
+        if domain and cols:
+            logger.error("show takes no column: '%s'", list(cols)[0])
+            return -1
+        if not domain:
+            return -1
+
+        db = self.tls_db_connect()
+        if not db:
+            return -1
+
+        res = db.find(TLS_MGM_TABLE, TLS_MGM_COLUMNS,
+                {TLS_DOMAIN_COL: domain, TLS_TYPE_COL: dtype})
+        row = res.first() if res is not None else None
+        db.destroy()
+
+        if not row:
+            logger.error("TLS %s domain '%s' does not exist",
+                    TLS_TYPE_NAMES[dtype], domain)
+            return -1
+
+        def decode(val):
+            return val.decode('utf-8') if isinstance(val, bytes) else val
+
+        values = dict(zip(TLS_MGM_COLUMNS, row))
+
+        print("{} domain: {}".format(TLS_TYPE_NAMES[dtype], domain))
+        for col in TLS_MGM_COLUMNS:
+            if col in TLS_PEM_COLUMNS:
+                continue
+            print("{}: {}".format(col,
+                "<empty>" if values[col] is None else values[col]))
+
+        # the private key is never printed back
+        print("{}: {}".format(TLS_PK_COL,
+            "<hidden>" if values[TLS_PK_COL] else "<empty>"))
+
+        for col in TLS_PEM_COLUMNS:
+            if col == TLS_PK_COL:
+                continue
+            print("\n{}:\n{}".format(col,
+                decode(values[col]) if values[col] else "<empty>"))
+        return True
+
+    def do_delete(self, params=None, modifiers=None):
+        """
+        removes a TLS domain from the database
+        """
+        domain, dtype, cols = self.tls_db_params(params or [], True)
+        if domain and cols:
+            logger.error("delete takes no column: '%s'", list(cols)[0])
+            return -1
+        if not domain:
+            return -1
+
+        db = self.tls_db_connect()
+        if not db:
+            return -1
+
+        row = {TLS_DOMAIN_COL: domain, TLS_TYPE_COL: dtype}
+        if not db.entry_exists(TLS_MGM_TABLE, row):
+            logger.error("TLS %s domain '%s' does not exist",
+                    TLS_TYPE_NAMES[dtype], domain)
+            db.destroy()
+            return -1
+
+        if db.delete(TLS_MGM_TABLE, row) is False:
+            db.destroy()
+            return -1
+
+        db.destroy()
+        logger.info("Successfully deleted TLS %s domain '%s'",
+                TLS_TYPE_NAMES[dtype], domain)
+        self.tls_db_reload()
+        return True
+
+    def __complete__(self, command, text, line, begidx, endidx):
+        """
+        helper for autocompletion in interactive mode
+        """
+        if command not in ('add', 'update'):
+            return ['']
+
+        cols = [c + '=' for c in TLS_MGM_COLUMNS]
+        if not text:
+            return cols
+
+        return [c for c in cols if c.startswith(text)] or ['']
 
     def __exclude__(self):
         return (not openssl_version, None)

{opensipscli-0.4.1 → opensipscli-0.4.2}/opensipscli/version.py

@@ -17,6 +17,6 @@
 ## along with this program. If not, see <http://www.gnu.org/licenses/>.
 ##
 
-__version__ = '0.4.1'
+__version__ = '0.4.2'
 
 # vim: tabstop=8 expandtab shiftwidth=4 softtabstop=4

{opensipscli-0.4.1 → opensipscli-0.4.2}/packaging/debian/changelog

@@ -1,3 +1,9 @@
+opensips-cli (0.4.2-1) stable; urgency=low
+
+  * New public release.
+
+ -- Razvan Crainea <razvan@opensips.org>  Mon, 09 Nov 2026 00:00:00 +0000
+
 opensips-cli (0.4.1-1) stable; urgency=low
 
   * New public release.

{opensipscli-0.4.1 → opensipscli-0.4.2}/packaging/redhat_fedora/opensips-cli.spec

@@ -1,6 +1,6 @@
 Summary:  Interactive command-line tool for OpenSIPS 3.0+
 Name:     opensips-cli
-Version:  0.4.1
+Version:  0.4.2
 Release:  0%{?dist}
 License:  GPL-3+
 Group:    System Environment/Daemons
@@ -68,6 +68,8 @@ rm -rf $RPM_BUILD_ROOT
 %license LICENSE
 
 %changelog
+* Mon Nov 9 2026 Razvan Crainea <razvan@opensips.org> - 0.4.2-0
+- Bump package version to 0.4.2.
 * Thu Sep 3 2026 Stefan Darius <darius.stefan@opensips.org> - 0.4.1-0
 - Bump package version to 0.4.1.
 * Fri May 8 2026 Razvan Crainea <razvan@opensips.org> - 0.4.0-0

{opensipscli-0.4.1 → opensipscli-0.4.2}/test/alltests.py

@@ -1,8 +1,20 @@
 import unittest
+from unittest.mock import patch
 
 from opensipscli.db import make_url
+from opensipscli.modules.mi import mi
 
 class OpenSIPSCLIUnitTests(unittest.TestCase):
+    def testMIAliasUsesCanonicalCommand(self):
+        module = mi()
+        module.aliases = {'alias': 'canonical'}
+
+        with patch('opensipscli.modules.mi.comm.execute', return_value=None) as execute:
+            result = module.__invoke__('alias', ['key=value'], [])
+
+        self.assertEqual(result, -1)
+        execute.assert_called_once_with('canonical', {'key': 'value'})
+
     def testMakeURL(self):
         u = make_url('x://')
         assert repr(u) == 'x://'

opensipscli-0.4.1/docs/modules/tls.md

@@ -1,99 +0,0 @@
-# OpenSIPS CLI - TLS module
-
-Using the `tls` module, you can generate TLS certificates and private keys.
-
-The module has two subcommands:
-* `rootCA` - generates a CA (certification authority) self signed certificate
-and private key pair.  These are to be used by a TLS server.
-* `userCERT` - generates a certificate signed by a given CA, a private key and
-a CA list (chain of trust) file.  These are to be used by TLS clients (users).
-
-## Configuration
-
-Certificates and private keys can be customized using the following settings:
-
-List of `opensips-cli.cfg` settings for configuring self-signed CA certificates:
-
-* tls_ca_dir - output directory where the cert and key will be written to
-* tls_ca_cert_file - output certificate file path, within `tls_ca_dir`
-* tls_ca_key_file - output private key file path, within `tls_ca_dir`
-* tls_ca_overwrite - set this to "y" in order to overwrite existing files
-* tls_ca_common_name - the address of the website (e.g. "opensips.org")
-* tls_ca_country - the initials of the country (e.g. "RO")
-* tls_ca_state - the state (e.g. "Bucharest")
-* tls_ca_locality - the city (e.g. "Bucharest")
-* tls_ca_organisation - the name of the organisation (e.g. "OpenSIPS")
-* tls_ca_organisational_unit - the organisational unit (e.g. "Project")
-* tls_ca_notafter - the validity period, in seconds (e.g. 315360000)
-* tls_ca_key_size - the size of the RSA key, in bits (e.g. 4096)
-* tls_ca_md - the digest algorithm to use for signing (e.g. SHA256)
-
-List of `opensips-cli.cfg` settings for configuring user certificates:
-
-* tls_user_dir - output directory where the cert and key will be written to
-* tls_user_cert_file - output certificate file path, within `tls_user_dir`
-* tls_user_key_file - output private key file path, within `tls_user_dir`
-* tls_user_calist_file - output CA list file path, within `tls_user_dir`
-* tls_user_overwrite - set this to "y" in order to overwrite existing files
-* tls_user_cacert - path to the input CA certificate
-* tls_user_cakey - path to the input CA private key
-* tls_user_common_name - the address of the website (e.g. "www.opensips.org")
-* tls_user_country - the initials of the country (e.g. "RO")
-* tls_user_state - the state (e.g. "Bucharest")
-* tls_user_locality - the city (e.g. "Bucharest")
-* tls_user_organisation - the name of the organisation (e.g. "OpenSIPS")
-* tls_user_organisational_unit - the organisational unit (e.g. "Project")
-* tls_user_notafter - the validity period, in seconds (e.g. 315360000)
-* tls_user_key_size - the size of the RSA key, in bits (e.g. 4096)
-* tls_user_md - the digest algorithm to use for signing (e.g. SHA256)
-
-
-## Examples
-
-To create a self-signed certificate and a private key for rootCA, enter this snippet:
-```
-opensips-cli -x tls rootCA
-```
-Configuration file example for rootCA:
-```
-[default]
-tls_ca_dir: /etc/opensips/tls/rootCA
-tls_ca_cert_file: cacert.pem
-tls_ca_key_file: private/cakey.pem
-tls_ca_overwrite: yes
-tls_ca_common_name: opensips.org
-tls_ca_country: RO
-tls_ca_state: Bucharest
-tls_ca_locality: Bucharest
-tls_ca_organisation: OpenSIPS
-tls_ca_organisational_unit: Project
-tls_ca_notafter: 315360000
-tls_ca_key_size: 4096
-tls_ca_md: SHA256
-```
-
-To create a user certificate signed by the above rootCA, along with a private
-key and a CA list (chain of trust) file:
-```
-opensips-cli -x tls userCERT
-```
-Configuration file example for userCERT:
-```
-[default]
-tls_user_dir: /etc/opensips/tls/user
-tls_user_cert_file: user-cert.pem
-tls_user_key_file: user-privkey.pem
-tls_user_calist_file: user-calist.pem
-tls_user_overwrite: yes
-tls_user_cacert: /etc/opensips/tls/rootCA/cacert.pem
-tls_user_cakey: /etc/opensips/tls/rootCA/private/cakey.pem
-tls_user_common_name: www.opensips.org
-tls_user_country: RO
-tls_user_state: Bucharest
-tls_user_locality: Bucharest
-tls_user_organisation: OpenSIPS
-tls_user_organisational_unit: Project
-tls_user_notafter: 315360000
-tls_user_key_size: 4096
-tls_user_md: SHA256
-```