Christian Manivong
647e058b8a
CI / test (3.10) (push) Successful in 1m2s
CI / test (3.11) (push) Successful in 47s
CI / test (3.12) (push) Successful in 42s
CI / test (3.10) (pull_request) Successful in 43s
CI / test (3.11) (pull_request) Successful in 46s
CI / test (3.12) (pull_request) Successful in 51s
run_command(privileged=True, stdin=data) sent `sudo -S` with stdin = <sudo password>\n + data. A sudo that does not prompt (NOPASSWD, a cached timestamp) leaves the password line on stdin, and the command reads it as the first line of the data - `cat > file` wrote it into the file (NetOrk/netork#1029). run_command now raises ValueError for that combination before opening a channel. Stdin still reaches the command under `sudo -n` (no password set), for a root login, and for unprivileged commands. Callers stage the data without privilege and have root install the file. open_stream documents the same caveat.
77 lines
3.2 KiB
Markdown
77 lines
3.2 KiB
Markdown
# Changelog
|
||
|
||
All notable changes to this project will be documented in this file.
|
||
|
||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||
|
||
## [Unreleased]
|
||
|
||
### Security
|
||
|
||
- `run_command(privileged=True, stdin=...)` raises `ValueError` while a sudo
|
||
password is set. `sudo -S` reads the password from stdin, and a sudo that does
|
||
not prompt (NOPASSWD, a cached timestamp) left it for the command, which read
|
||
it as the first line of the data: netOrk wrote it into a file that way
|
||
(NetOrk/netork#1029). Stage the data without privilege and have root install
|
||
that file. Without a sudo password (`sudo -n`) or for a root login, stdin
|
||
still goes to the command.
|
||
|
||
## [0.4.0] – 2026-10-08
|
||
|
||
### Added
|
||
|
||
- `get_virtual_ips()` through napalm-device-types' `VirtualIpsMixin` (4.2.0): the
|
||
addresses vip-manager and keepalived configuration lets float onto this host,
|
||
whether or not it holds them right now (NetOrk/netork#829). The command goes on
|
||
the exec channel (`run_command`): with its awk filter it is about 4 kB, past the
|
||
line the PTY reliably takes. Root first, then without it.
|
||
|
||
## [0.3.0] – 2026-10-08
|
||
|
||
### Removed
|
||
|
||
- `get_docker_info()`, `get_docker_outdated()`, `reconstruct_docker_run()` and
|
||
the `_docker_bin()` hook, with the image-ID helpers they used. netOrk reads
|
||
and handles containers itself over the Engine API, through
|
||
`open_container_engine()` (NetOrk/netork#765), and no longer calls them.
|
||
`run_device_action("fix_docker_permissions")` stays: letting the login user
|
||
use Docker is an OS action.
|
||
|
||
## [0.2.0] – 2026-10-07
|
||
|
||
### Added
|
||
|
||
- `run_command()` and `open_stream()`, the public command channel from
|
||
napalm-device-types 2.6.0: an exec channel on the existing SSH transport, so
|
||
no PTY, separate stderr and a real exit code. `privileged=True` runs as root
|
||
directly, through `sudo -S` with the password on stdin (never on the command
|
||
line), or through `sudo -n`, which fails instead of prompting.
|
||
- `ContainerEngineMixin`: `container_engines()` and `open_container_engine()`,
|
||
whose `open_api()` streams the Docker Engine API over `docker system
|
||
dial-stdio` (NetOrk/netork#765). The existing Docker methods are unchanged.
|
||
|
||
### Changed
|
||
|
||
- Requires napalm-device-types >= 2.6.0.
|
||
|
||
## [0.1.0] – 2026-05-29
|
||
|
||
### Added
|
||
|
||
- Initial release
|
||
- `LinuxDriver` inheriting from `napalm_device_types.OSDriver`
|
||
- SSH transport via Netmiko `linux` device type
|
||
- Auto-detection of package manager: `apt`, `dnf`, `yum`, `apk`, `pacman`
|
||
- Standard NAPALM methods: `get_facts()`, `get_interfaces()`, `get_interfaces_ip()`,
|
||
`get_arp_table()`, `get_config()`, `ping()`
|
||
- OS-specific methods: `get_packages()`, `get_pending_updates()`, `apply_updates()`,
|
||
`get_services()`, `get_users()`, `get_processes()`, `get_cron_jobs()`
|
||
- `apply_updates()` validates all package names against `^[a-zA-Z0-9_\-\+\.]+$`
|
||
to prevent shell injection before passing them to the package manager
|
||
- SysV fallback for `get_services()` on non-systemd systems
|
||
- Unit tests with mocked SSH connections
|
||
|
||
[Unreleased]: https://github.com/chrismanivong/napalm-linux/compare/v0.1.0...HEAD
|
||
[0.1.0]: https://github.com/chrismanivong/napalm-linux/releases/tag/v0.1.0
|