Christian Manivong
647e058b8a
CI / test (3.10) (push) Successful in 1m2s
CI / test (3.11) (push) Successful in 47s
CI / test (3.12) (push) Successful in 42s
CI / test (3.10) (pull_request) Successful in 43s
CI / test (3.11) (pull_request) Successful in 46s
CI / test (3.12) (pull_request) Successful in 51s
run_command(privileged=True, stdin=data) sent `sudo -S` with stdin = <sudo password>\n + data. A sudo that does not prompt (NOPASSWD, a cached timestamp) leaves the password line on stdin, and the command reads it as the first line of the data - `cat > file` wrote it into the file (NetOrk/netork#1029). run_command now raises ValueError for that combination before opening a channel. Stdin still reaches the command under `sudo -n` (no password set), for a root login, and for unprivileged commands. Callers stage the data without privilege and have root install the file. open_stream documents the same caveat.
3.2 KiB
3.2 KiB
Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
Unreleased
Security
run_command(privileged=True, stdin=...)raisesValueErrorwhile a sudo password is set.sudo -Sreads the password from stdin, and a sudo that does not prompt (NOPASSWD, a cached timestamp) left it for the command, which read it as the first line of the data: netOrk wrote it into a file that way (NetOrk/netork#1029). Stage the data without privilege and have root install that file. Without a sudo password (sudo -n) or for a root login, stdin still goes to the command.
[0.4.0] – 2026-10-08
Added
get_virtual_ips()through napalm-device-types'VirtualIpsMixin(4.2.0): the addresses vip-manager and keepalived configuration lets float onto this host, whether or not it holds them right now (NetOrk/netork#829). The command goes on the exec channel (run_command): with its awk filter it is about 4 kB, past the line the PTY reliably takes. Root first, then without it.
[0.3.0] – 2026-10-08
Removed
get_docker_info(),get_docker_outdated(),reconstruct_docker_run()and the_docker_bin()hook, with the image-ID helpers they used. netOrk reads and handles containers itself over the Engine API, throughopen_container_engine()(NetOrk/netork#765), and no longer calls them.run_device_action("fix_docker_permissions")stays: letting the login user use Docker is an OS action.
[0.2.0] – 2026-10-07
Added
run_command()andopen_stream(), the public command channel from napalm-device-types 2.6.0: an exec channel on the existing SSH transport, so no PTY, separate stderr and a real exit code.privileged=Trueruns as root directly, throughsudo -Swith the password on stdin (never on the command line), or throughsudo -n, which fails instead of prompting.ContainerEngineMixin:container_engines()andopen_container_engine(), whoseopen_api()streams the Docker Engine API overdocker system dial-stdio(NetOrk/netork#765). The existing Docker methods are unchanged.
Changed
- Requires napalm-device-types >= 2.6.0.
0.1.0 – 2026-05-29
Added
- Initial release
LinuxDriverinheriting fromnapalm_device_types.OSDriver- SSH transport via Netmiko
linuxdevice type - Auto-detection of package manager:
apt,dnf,yum,apk,pacman - Standard NAPALM methods:
get_facts(),get_interfaces(),get_interfaces_ip(),get_arp_table(),get_config(),ping() - OS-specific methods:
get_packages(),get_pending_updates(),apply_updates(),get_services(),get_users(),get_processes(),get_cron_jobs() apply_updates()validates all package names against^[a-zA-Z0-9_\-\+\.]+$to prevent shell injection before passing them to the package manager- SysV fallback for
get_services()on non-systemd systems - Unit tests with mocked SSH connections