Christian Manivong
968d6583ba
CI / test (3.10) (push) Successful in 26s
CI / test (3.11) (push) Successful in 24s
CI / test (3.12) (push) Successful in 26s
CI / test (3.10) (pull_request) Successful in 25s
CI / test (3.11) (pull_request) Successful in 23s
CI / test (3.12) (pull_request) Successful in 25s
fix_snmp set no community at all and opened the management zone's udp/161 to every source, with a rule named after an application; a second fix_snmp in the system mixin was shadowed and never ran (#5). install_lldpd, install_auc and install_coreutils_base64 were actions of their own. The driver implements napalm-device-types 4.13's templates instead: - configure_snmp_agent(settings): snmpd installed when missing; community, contact and location in UCI with one com2sec (com2sec6) per allowed source; the zone-resolving firewall step of the old fix, now limited to the sources (src_ip) and named Allow-SNMP; snmpd enabled, restarted and listening; - get_management_peer() from SSH_CONNECTION; - ensure_package(name) from the base package, over install_package. A community, contact or location that would break UCI is refused. BREAKING CHANGE: run_device_action is removed. Requires napalm-device-types 4.13. Closes #5. Part of #13.
97 lines
2.9 KiB
Python
97 lines
2.9 KiB
Python
"""configure_snmp_agent's values: community, sources, contact, location (netOrk #1105).
|
|
|
|
The old fix_snmp set no community at all and opened the management zone to every
|
|
source; the rule was named after an application. Every value is the caller's now.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from napalm_openwrt import OpenWrtDriver
|
|
from tests.unit.test_driver import UCI_FIREWALL_HEALTHY, UCI_NETWORK_STATIC, _FakeShell
|
|
|
|
SETTINGS = {
|
|
"community": "c0mm",
|
|
"allowed_sources": ["10.7.224.20", "fd00::20"],
|
|
"contact": "ops",
|
|
"location": "rack 1",
|
|
}
|
|
|
|
|
|
@pytest.fixture
|
|
def shell():
|
|
return _FakeShell(
|
|
firewall=UCI_FIREWALL_HEALTHY,
|
|
network=UCI_NETWORK_STATIC,
|
|
ssh_connection="10.7.224.20 51234 192.168.1.1 22",
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def owrt(shell):
|
|
d = OpenWrtDriver("ap", "root", "pw")
|
|
d._send_command = shell
|
|
return d
|
|
|
|
|
|
def _joined(shell):
|
|
return " ".join(shell.issued)
|
|
|
|
|
|
def test_the_steps_run_in_order_and_succeed(owrt):
|
|
result = owrt.configure_snmp_agent(SETTINGS)
|
|
|
|
assert result["success"] is True
|
|
assert [s["step"] for s in result["steps"]] == ["install", "configure", "firewall", "start"]
|
|
|
|
|
|
def test_community_per_source_in_uci(owrt, shell):
|
|
owrt.configure_snmp_agent(SETTINGS)
|
|
|
|
uci = _joined(shell)
|
|
assert "uci set snmpd.public.source='10.7.224.20/32'" in uci
|
|
assert "uci set snmpd.public.community='c0mm'" in uci
|
|
assert "uci set snmpd.public6.source='fd00::20/128'" in uci
|
|
assert "snmpd.@system[0].sysLocation='rack 1'" in uci
|
|
assert "uci commit snmpd" in uci
|
|
|
|
|
|
def test_without_sources_every_address_may_ask(owrt, shell):
|
|
owrt.configure_snmp_agent({"community": "c0mm", "allowed_sources": []})
|
|
|
|
assert "uci set snmpd.public.source='default'" in _joined(shell)
|
|
|
|
|
|
def test_ipv4_sources_only_keep_ipv6_to_localhost(owrt, shell):
|
|
owrt.configure_snmp_agent({"community": "c0mm", "allowed_sources": ["10.7.224.20"]})
|
|
|
|
assert "uci set snmpd.public6.source='::1/128'" in _joined(shell)
|
|
|
|
|
|
def test_the_firewall_rule_is_limited_to_the_sources_and_neutrally_named(owrt, shell):
|
|
owrt.configure_snmp_agent(SETTINGS)
|
|
|
|
uci = _joined(shell)
|
|
assert "uci add_list firewall.allow_snmp_from_lan.src_ip='10.7.224.20/32'" in uci
|
|
assert "firewall.allow_snmp_from_lan.name='Allow-SNMP'" in uci
|
|
assert "netork" not in uci.lower()
|
|
|
|
|
|
def test_the_management_peer_is_the_ssh_client(owrt):
|
|
assert owrt.get_management_peer() == "10.7.224.20"
|
|
|
|
|
|
@pytest.mark.parametrize("community", ["two words", "it's", ""])
|
|
def test_a_community_that_would_break_uci_is_refused(owrt, shell, community):
|
|
result = owrt.configure_snmp_agent({"community": community, "allowed_sources": []})
|
|
|
|
assert result["success"] is False
|
|
assert "uci commit snmpd" not in _joined(shell)
|
|
|
|
|
|
def test_the_old_actions_are_gone():
|
|
gone = ("run_device_action", "_action_fix_snmp", "_action_install_lldpd", "_action_install_auc")
|
|
for name in gone:
|
|
assert not hasattr(OpenWrtDriver, name), name
|