- CI moves to .gitea/workflows/ci.yml and calls the shared driver workflow
of NAPALM/driver-standard; .github/ is gone.
- napalm-device-types >=4.21.1 from PyPI (the README no longer installs
it from git), py.typed, SPDX license string, setuptools>=77, version
floors on the dev extra, Issues and Changelog links on git.netork.io.
- mypy strict for the package; napalm_bsd.base, napalm_bsd.freebsd and
napalm_bsd.openbsd are exempt for now (28 errors, mostly getters typed
as plain dicts rather than the device-types TypedDicts), recorded in the
quality baseline with three complex parsers. parse.py is strict after a
one-line annotation.
- Coverage floor 94 % (measured 94.63 %).
Mechanical: ruff format, and ruff check --fix with the rule set every NAPALM
driver uses (E, F, I, UP, B at line length 100, Python 3.10). What ruff
cannot fix comes in the next commit.
The driver accepted any SSH host key. It now verifies through
napalm-device-types' HostKeyCheck (>= 4.19.0): with a known key in
optional_args["ssh_host_keys"] any other key is refused before login, and
every key seen is reported to optional_args["ssh_host_key_observer"].
Without either argument it connects as before (first use).
fix_snmp wrote an application's snmpd.conf (community public, Managed
by netOrk, netork@localhost) and judged itself by a local snmpget.
The drivers implement napalm-device-types 4.13's SnmpAgentMixin steps
instead: net-snmp installed, snmpd.conf with one rocommunity line per
allowed source (staged without privilege, installed by root), snmpd
enabled and restarted. pf and ipfw rules stay the operator's. A
community or text that would break the file is refused. The caller
verifies with its own SNMP client.
Also get_management_peer() from SSH_CONNECTION, ensure_package from
the base package, and get_snmp_config no longer assumes "public".
BREAKING CHANGE: run_device_action is removed. Requires
napalm-device-types 4.13.
Part of #12 (the OpenBSD new_version text is still open).
run_command prepended the sudo password to the caller's stdin. A sudo
that does not prompt left it for the command, and fix_snmp's
'cat > snmpd.conf' wrote it as the configuration's first line before
making the file world-readable.
run_command now refuses stdin to a privileged command while a sudo
password is set. fix_snmp stages the configuration in a mktemp file
without privilege, and root installs it next to the target and renames
it over, so nothing root runs follows a symlink.
Closes#8
napalm-device-types 4.7 renamed OSDriver.get_users to get_os_users:
NAPALM's own get_users has another shape and a stub on every driver, so
hasattr could not tell the two apart. BsdDriver now implements
get_os_users with the same return shape and leaves NAPALM's get_users
alone.
Require napalm-device-types>=4.7.1 and bump the version to 0.2.0.
first_boot_pending() is true while /firstboot exists on FreeBSD. A FreeBSD
cloud image upgrades its base system on its first boot, starts sshd only
after that and restarts right away, and /etc/rc removes /firstboot just
before that restart. netOrk waits for this before it sets up a new VM
(NetOrk/netork#795).
OpenBSD has no such marker to ask yet, so it returns False there.
netOrk reads an empty update list as "no updates" and closes every patch
clock on the host. A refused sudo, a failing pkg, syspatch or freebsd-update,
or a pkg database pkg cannot read used to come back as that empty list. Each
of these now raises. Only pkg's "is not installed" still means no packages.
BsdDriver takes on napalm-device-types' HostStatusMixin. On FreeBSD it
reports a host whose installed kernel differs from the running one as
needing a reboot (device-types 4.1). OpenBSD stays unknown.
Closes#4
run_device_action("fix_snmp") and get_snmp_config for both drivers, as
decided in NetOrk/netork#800: net-snmp from packages rather than the base
daemons, because it answers UCD-SNMP-MIB, which netOrk's health metrics
read.
- fix_snmp installs net-snmp, writes the configuration netOrk uses on
Linux (v2c, community "public", agentAddress udp:161) through stdin as
root, enables and restarts the agent (FreeBSD `service snmpd`, OpenBSD
`rcctl ... netsnmpd`, as `snmpd` is OpenBSD's own daemon) and asks it
for sysDescr. It stops at the first step that fails and says why.
- get_snmp_config reports a running net-snmp's community and port.
- FreeBSD's install_package bootstraps pkg on a classic system that never
had it instead of waiting for an answer that never comes.
Checked live: FreeBSD from a bare system, OpenBSD again over an existing
setup. Memory, swap and load answer on both; FreeBSD's ssCpuIdle about a
minute after start; OpenBSD's CPU figures from net-snmp are wrong (#800).
The write side NetOrk/netork#799 needs, on both drivers.
- Packages: get_packages (FreeBSD `pkg query` with the repository as
source, nothing on a classic system without pkg; OpenBSD `pkg_info`),
install_package / uninstall_package as root (`pkg install`/`pkg
delete`, `pkg_add -I`/`pkg_delete`), names checked before anything is
sent, a failure raised with what the tool printed.
- Updates: get_available_updates. FreeBSD `pkg upgrade -n`, with
`security` from VuXML (`pkg audit`: True for a listed package, False for
any other, None when the audit could not run); OpenBSD `pkg_add -u -n
-v` (no security verdict). Base-system patches are one `base-system`
entry, as decided in #799: OpenBSD's `syspatch -c`, and on a classic
FreeBSD what `freebsd-update` has fetched; on pkgbase the base system is
packages from FreeBSD-base.
- Services: get_services lists the enabled ones (FreeBSD `service ...
status` as root, as root-only pidfiles hide daemons otherwise, without
root when sudo refuses; OpenBSD `rcctl check`), manage_service runs
start/stop/restart/enable/disable as root and returns success and
output.
Fixtures recorded on the FreeBSD 15.1 and OpenBSD 7.9 VMs with genuinely
outdated packages (FreeBSD pointed at the latest branch, an OpenBSD
package taken back to its release build). Checked live on both, including
a service restart and installing and removing a package.
get_listening_sockets() in the shape of napalm-device-types'
ListeningSocketsMixin, whose ss/cgroup reading is Linux's, and with its
rule: read as root first, and without root when that brings nothing back,
which the reading reports as `attributed: False`.
- FreeBSD: `sockstat -46lq -P tcp,udp`, which sees every socket either way.
- OpenBSD: `fstat -n` as root (the sockets nothing is connected to; port 0
is unbound), `netstat -an` without root, as fstat shows a user only
their own processes; those sockets come without a process.
- Addresses as ss prints them: `*` becomes 0.0.0.0 or :: by family, IPv6
without brackets, a zone (`fe80::1%lo0`) becomes the interface. One entry
per socket, the first process holding it.
No get_kernel_facts on purpose: KernelFactsMixin reports a Linux kernel's
modules and CONFIG_ options, which a BSD kernel does not have.
Fixtures recorded on the FreeBSD 15.1 and OpenBSD 7.9 VMs with test
listeners on 127.0.0.1 and ::1 (NetOrk/netork#798).
FreeBSDDriver (`freebsd`) and OpenBSDDriver (`openbsd`) on a shared
BsdDriver, for the BSD VMs netOrk provisions and BSD hosts added by hand
(NetOrk/netork#798).
- SSH over exec channels (napalm-device-types' run_on_transport): no PTY,
stdout and stderr apart, real exit codes; run_command()/open_stream()
are public. Root through `sudo -S` with the password on stdin, or
`sudo -n` without one.
- Facts: hostname, release and running kernel (freebsd-version / uname),
hardware from SMBIOS (kenv) or hw.* sysctls, uptime from kern.boottime.
- Interfaces and addresses (ifconfig -a: ether/lladdr, hex netmasks,
scoped IPv6), routes (netstat -rn, OpenBSD's abbreviated networks
written out, host/broadcast/loopback entries left out), ARP (FreeBSD's
sentences, OpenBSD's table), users and groups, processes (lstart read as
one five-word field), cron jobs (system crontab and the login user's).
- Parsers are pure functions, tested on output recorded from FreeBSD 15.1
(hand-installed and cloud image) and OpenBSD 7.9 (NetOrk/netork#793),
with internal addresses replaced by documentation ranges.
Christian Manivong
christianmanivong