feat!: fix templates with the caller's values replace run_device_action (0.2.0)
CI / test (3.10) (push) Successful in 26s
CI / test (3.11) (push) Successful in 24s
CI / test (3.12) (push) Successful in 26s
CI / test (3.10) (pull_request) Successful in 25s
CI / test (3.11) (pull_request) Successful in 23s
CI / test (3.12) (pull_request) Successful in 25s
CI / test (3.10) (push) Successful in 26s
CI / test (3.11) (push) Successful in 24s
CI / test (3.12) (push) Successful in 26s
CI / test (3.10) (pull_request) Successful in 25s
CI / test (3.11) (pull_request) Successful in 23s
CI / test (3.12) (pull_request) Successful in 25s
fix_snmp set no community at all and opened the management zone's udp/161 to every source, with a rule named after an application; a second fix_snmp in the system mixin was shadowed and never ran (#5). install_lldpd, install_auc and install_coreutils_base64 were actions of their own. The driver implements napalm-device-types 4.13's templates instead: - configure_snmp_agent(settings): snmpd installed when missing; community, contact and location in UCI with one com2sec (com2sec6) per allowed source; the zone-resolving firewall step of the old fix, now limited to the sources (src_ip) and named Allow-SNMP; snmpd enabled, restarted and listening; - get_management_peer() from SSH_CONNECTION; - ensure_package(name) from the base package, over install_package. A community, contact or location that would break UCI is refused. BREAKING CHANGE: run_device_action is removed. Requires napalm-device-types 4.13. Closes #5. Part of #13.
This commit is contained in:
1 parent
d569a289ba
commit
968d6583ba
5 files changed
+244
-300
No files matched your search
+24
-15
@@ -1488,6 +1488,12 @@ class _FakeShell:
|
||||
|
||||
def __call__(self, cmd, **kw):
|
||||
self.issued.append(cmd)
|
||||
if "/usr/sbin/snmpd" in cmd:
|
||||
return "present"
|
||||
if "__OWRT_RC" in cmd:
|
||||
return "ok\n__OWRT_RC=0"
|
||||
if cmd.startswith("uci show snmpd"):
|
||||
return ""
|
||||
if cmd.startswith("uci show firewall"):
|
||||
return self.firewall
|
||||
if cmd.startswith("uci show network"):
|
||||
@@ -1507,8 +1513,11 @@ class _FakeShell:
|
||||
return ""
|
||||
|
||||
|
||||
_SETTINGS = {"community": "c0mm", "allowed_sources": []}
|
||||
|
||||
|
||||
class TestFixSnmpZoneDetection:
|
||||
"""_action_fix_snmp() must resolve the real zone that owns the mgmt address."""
|
||||
"""The firewall step must resolve the real zone that owns the mgmt address."""
|
||||
|
||||
def test_static_mgmt_address_selects_owning_zone(self, driver):
|
||||
"""10.10.0.5 lives on network 'mgmt' → zone 'mgmt', not the 'lan' fallback."""
|
||||
@@ -1518,7 +1527,7 @@ class TestFixSnmpZoneDetection:
|
||||
ssh_connection="10.10.0.1 51234 10.10.0.5 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert "Management zone: 'mgmt'" in result["output"]
|
||||
assert any("firewall.allow_snmp_from_mgmt.src='mgmt'" in c for c in shell.issued)
|
||||
|
||||
@@ -1530,7 +1539,7 @@ class TestFixSnmpZoneDetection:
|
||||
ssh_connection="192.168.1.50 5000 192.168.1.1 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert "Management zone: 'lan'" in result["output"]
|
||||
|
||||
def test_dhcp_mgmt_address_resolved_via_l3_device(self, driver):
|
||||
@@ -1542,7 +1551,7 @@ class TestFixSnmpZoneDetection:
|
||||
ssh_connection="10.10.0.1 51234 10.10.0.5 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert "Management zone: 'lan'" in result["output"]
|
||||
|
||||
def test_nameless_zone_is_reported_and_action_fails(self, driver):
|
||||
@@ -1553,7 +1562,7 @@ class TestFixSnmpZoneDetection:
|
||||
ssh_connection="192.168.1.50 5000 192.168.1.1 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert result["success"] is False
|
||||
assert "@zone[0]" in result["output"]
|
||||
assert "name" in result["output"]
|
||||
@@ -1566,7 +1575,7 @@ class TestFixSnmpZoneDetection:
|
||||
ssh_connection="192.168.1.50 5000 192.168.1.1 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
driver._action_fix_snmp()
|
||||
driver.configure_snmp_agent(_SETTINGS)
|
||||
assert not any("allow_snmp" in c for c in shell.issued)
|
||||
|
||||
|
||||
@@ -1586,7 +1595,7 @@ class TestFixSnmpRuleWriting:
|
||||
ssh_connection="192.168.1.50 5000 192.168.1.1 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
driver._action_fix_snmp()
|
||||
driver.configure_snmp_agent(_SETTINGS)
|
||||
assert any("firewall.allow_snmp_from_lan.src='lan'" in c for c in shell.issued)
|
||||
|
||||
def test_stale_rules_are_deleted_highest_index_first(self, driver):
|
||||
@@ -1605,7 +1614,7 @@ class TestFixSnmpRuleWriting:
|
||||
ssh_connection="192.168.1.50 5000 192.168.1.1 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
driver._action_fix_snmp()
|
||||
driver.configure_snmp_agent(_SETTINGS)
|
||||
deletes = [c for c in shell.issued if "delete" in c and "@rule" in c]
|
||||
joined = " ".join(deletes)
|
||||
assert joined.index("@rule[2]") < joined.index("@rule[1]")
|
||||
@@ -1623,7 +1632,7 @@ class TestFixSnmpRuleWriting:
|
||||
ssh_connection="192.168.1.50 5000 192.168.1.1 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
driver._action_fix_snmp()
|
||||
driver.configure_snmp_agent(_SETTINGS)
|
||||
delete_idx = next(i for i, c in enumerate(shell.issued) if "snmp_netork" in c and "delete" in c)
|
||||
assert any("uci commit firewall" in c for c in shell.issued[delete_idx:])
|
||||
|
||||
@@ -1641,7 +1650,7 @@ class TestFixSnmpRuleWriting:
|
||||
ssh_connection="192.168.1.50 5000 192.168.1.1 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
driver._action_fix_snmp()
|
||||
driver.configure_snmp_agent(_SETTINGS)
|
||||
assert any("snmp_netork" in c and "delete" in c for c in shell.issued)
|
||||
|
||||
|
||||
@@ -1663,7 +1672,7 @@ class TestFixSnmpReloadVerification:
|
||||
reload_out=self.FW4_ZONE_ERROR,
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert result["success"] is False
|
||||
|
||||
def test_reload_output_is_not_truncated(self, driver):
|
||||
@@ -1675,7 +1684,7 @@ class TestFixSnmpReloadVerification:
|
||||
reload_out=self.FW4_ZONE_ERROR,
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert "references unknown zone" in result["output"]
|
||||
|
||||
def test_missing_live_rule_fails_the_action(self, driver):
|
||||
@@ -1687,7 +1696,7 @@ class TestFixSnmpReloadVerification:
|
||||
nft_hits="0",
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert result["success"] is False
|
||||
|
||||
def test_snmpd_not_listening_fails_the_action(self, driver):
|
||||
@@ -1698,7 +1707,7 @@ class TestFixSnmpReloadVerification:
|
||||
listen_hits="0",
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert result["success"] is False
|
||||
|
||||
def test_fully_healthy_run_succeeds(self, driver):
|
||||
@@ -1708,7 +1717,7 @@ class TestFixSnmpReloadVerification:
|
||||
ssh_connection="192.168.1.50 5000 192.168.1.1 22",
|
||||
)
|
||||
driver._send_command = shell
|
||||
result = driver._action_fix_snmp()
|
||||
result = driver.configure_snmp_agent(_SETTINGS)
|
||||
assert result["success"] is True
|
||||
|
||||
|
||||
|
||||
Reference in new issue
Block a user