diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml new file mode 100644 index 0000000..7530c79 --- /dev/null +++ b/.gitea/workflows/ci.yml @@ -0,0 +1,15 @@ +name: CI + +on: + push: + branches: [main] + tags: ["v*"] + pull_request: + +jobs: + driver: + uses: NAPALM/driver-standard/.gitea/workflows/driver.yml@main + with: + standard-ref: main + secrets: + PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index a7bc4d4..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,48 +0,0 @@ -name: CI - -on: - push: - branches: ["**"] - pull_request: - branches: ["**"] - -jobs: - test: - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - python-version: ["3.10", "3.11", "3.12"] - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Setup Python - uses: actions/setup-python@v5 - with: - python-version: ${{ matrix.python-version }} - cache: pip - - - name: Install package with dev extras - run: | - python -m pip install --upgrade pip - # napalm-device-types lives in git.netork.io/NAPALM, not on PyPI: without this - # pip looks there, finds an unrelated 0.1.0 and the job dies before any test. - python -m pip install "napalm-device-types @ git+https://git.netork.io/NAPALM/napalm-device-types.git" - python -m pip install -e ".[dev]" - - - name: Run unit tests - run: | - python -m pytest -q --tb=short - - - name: Build wheel and sdist - run: | - python -m pip install build - python -m build - - - name: Upload dist artifacts - # v4 refuses to run on Gitea ("not currently supported on GHES"). - uses: actions/upload-artifact@v3 - with: - name: dist-${{ matrix.python-version }} - path: dist/* \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..22fafef --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,43 @@ +# Changelog + +All notable changes to this driver. The format follows +[Keep a Changelog](https://keepachangelog.com/), versions follow +[Semantic Versioning](https://semver.org/). + +## [Unreleased] + +### Changed +- The driver follows the NAPALM driver standard + (https://git.netork.io/NAPALM/driver-standard): CI on Gitea runs ruff, mypy, the + tests on Python 3.10–3.13 and at the lowest declared versions, bandit, pip-audit and + a build check, and a release tag publishes to PyPI. The package now ships `py.typed` + and a LICENSE file. Python 3.10 remains the floor. Requires napalm-device-types + 4.21.1. + +### Fixed +- `get_dhcp_leases()` raises when Kea, ISC DHCP and the ARP fallback all failed, + instead of returning an empty list that looks like a server without leases (#27). +- `create_dhcp_reservation()` leaves a reservation that already holds what was asked + alone, and does not reconfigure (restart) Kea for it. + +## [0.4.0] - 2026-10-18 + +### Added +- napalm-device-types 4.17's public contracts: `apply_updates()` passes the packages it + is given and `get_update_progress()` reports the upgrade's state and log; + `get_dns_forwards()`, `set_dns_forward()` and `remove_dns_forward()` for Unbound; + `get_ospf()`. Requires napalm-device-types 4.17.0. + +## [0.3.0] - 2026-10-17 + +### Removed +- **Breaking:** `get_device_warnings()`. The pending updates are in + `get_available_updates()`. + +## [0.2.0] - 2026-10-17 + +### Changed +- **Breaking:** `run_device_action` is removed. The SNMP agent is set up through + napalm-device-types 4.13's `configure_snmp_agent` with the caller's community, + contact, location and listen address, and the firewall opens UDP/161 only to the + allowed sources (#13). diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..68d39ec --- /dev/null +++ b/LICENSE @@ -0,0 +1,191 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship made available under + the License, as indicated by a copyright notice that is included in + or attached to the work (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other transformations + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean, as submitted to the Licensor for inclusion + in the Work by the copyright owner or by an individual or Legal Entity + authorized to submit on behalf of the copyright owner. For the purposes + of this definition, "submitted" means any form of electronic, verbal, + or written communication sent to the Licensor or its representatives, + including but not limited to communication on electronic mailing lists, + source code control systems, and issue tracking systems that are managed + by, or on behalf of, the Licensor for the purpose of discussing and + improving the Work, but excluding communication that is conspicuously + marked or designated in writing by the copyright owner as "Not a + Contribution." + + "Contributor" shall mean Licensor and any Legal Entity on behalf of + whom a Contribution has been received by the Licensor and incorporated + within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by the combined Contribution(s) and the Work + to which such Contribution(s) was submitted. If You institute patent + litigation against any entity (including a cross-claim or counterclaim + in a lawsuit) alleging that the Work or any Contribution embodied + within the Work constitutes direct or contributory patent infringement, + then any patent licenses granted to You under this License for that + Work shall terminate as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or Derivative + Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, You must include a readable copy of the + attribution notices contained within such NOTICE file, in + at least one of the following places: within a NOTICE text file + distributed as part of the Derivative Works; within the Source + form or documentation, if provided along with the Derivative + Works; or, within a display generated by the Derivative Works, + if and wherever such third-party notices normally appear. The + contents of the NOTICE file are for informational purposes only + and do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own license statement for Your modifications and + may provide additional grant of rights to use, copy, modify, merge, + publish, distribute, sublicense, and/or sell copies of the Work, + and to permit persons to whom the Work is furnished to do so, + subject to the following conditions: + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any conditions of TITLE, + MERCHANTIBILITY, or FITNESS FOR A PARTICULAR PURPOSE. + See the License for the specific language governing permissions and + limitations under the License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or exemplary damages of any character arising as a + result of this License or out of the use or inability to use the + Work (even if such Contributor has been advised of the possibility + of such damages). + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may offer only + conditions consistent with this License, subject to the following + additional conditions: + + (a) You may offer additional warranty, indemnity, or other liability + terms and conditions; and + + (b) You may offer support for the Work in return for a fee. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format in question. It may also be + possible to make it available with a creative commons license. + + Copyright 2026 Christian Manivong + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/README.md b/README.md index 6496f1f..2b52992 100644 --- a/README.md +++ b/README.md @@ -14,8 +14,9 @@ NAPALM community driver for **OPNsense** firewalls (read-only, via REST API). | Dependency | Minimum version | |---|---| -| Python | 3.9 | +| Python | 3.10 | | NAPALM | 4.0 | +| napalm-device-types | 4.21.1 | | requests | 2.28 | ## Installation @@ -27,7 +28,7 @@ pip install napalm-opnsense Or from source: ```bash -git clone https://github.com/napalm-automation-community/napalm-opnsense +git clone https://git.netork.io/NAPALM/napalm-opnsense cd napalm-opnsense pip install -e . ``` @@ -201,19 +202,18 @@ d.close() ## Development +The rules are in [STANDARDS.md](https://git.netork.io/NAPALM/driver-standard/src/branch/main/STANDARDS.md). + ```bash -pip install -e ".[dev]" -pytest tests/ +python -m venv .venv && .venv/bin/pip install -e ".[dev]" +.venv/bin/pytest --cov ``` ## CI -This project includes a GitHub Actions workflow that: -- Runs unit tests across Python 3.9–3.12 -- Builds sdist and wheel -- Uploads build artifacts - -See [.github/workflows/ci.yml](.github/workflows/ci.yml). +[.gitea/workflows/ci.yml](.gitea/workflows/ci.yml) calls the shared workflow of the +driver standard: ruff, mypy, the tests on Python 3.10–3.13 and at the lowest declared +versions, bandit, pip-audit and a build check. A release tag publishes to PyPI. ## License diff --git a/napalm_opnsense/py.typed b/napalm_opnsense/py.typed new file mode 100644 index 0000000..e69de29 diff --git a/pyproject.toml b/pyproject.toml index 2cc1d7a..77a8bb9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,5 +1,5 @@ [build-system] -requires = ["setuptools>=68", "wheel"] +requires = ["setuptools>=77"] build-backend = "setuptools.build_meta" [project] @@ -7,45 +7,51 @@ name = "napalm-opnsense" version = "0.4.0" description = "NAPALM driver for OPNsense (read-only via REST API)." readme = "README.md" -license = { text = "Apache-2.0" } +license = "Apache-2.0" requires-python = ">=3.10" authors = [ { name = "Christian Manivong" }, ] classifiers = [ "Topic :: Utilities", - "License :: OSI Approved :: Apache Software License", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", + "Programming Language :: Python :: 3.13", "Operating System :: POSIX :: Linux", "Operating System :: MacOS", + "Typing :: Typed", ] dependencies = [ "napalm>=4.0.0", - "napalm_device_types>=4.17.0", + "napalm-device-types>=4.21.1", "requests>=2.28.0", ] [project.optional-dependencies] dev = [ - "pytest", - "pytest-cov", - "black", - "ruff", + "pytest>=8", + "pytest-cov>=5", + "mypy>=1.11", + "ruff>=0.6", ] [project.entry-points."napalm.drivers"] opnsense = "napalm_opnsense.opnsense:OPNsenseDriver" [project.urls] -Repository = "https://github.com/napalm-automation-community/napalm-opnsense" +Repository = "https://git.netork.io/NAPALM/napalm-opnsense" +Issues = "https://git.netork.io/NAPALM/napalm-opnsense/issues" +Changelog = "https://git.netork.io/NAPALM/napalm-opnsense/src/branch/main/CHANGELOG.md" [tool.setuptools.packages.find] where = ["."] include = ["napalm_opnsense*"] +[tool.setuptools.package-data] +napalm_opnsense = ["py.typed"] + [tool.ruff] line-length = 100 target-version = "py310" @@ -57,5 +63,34 @@ select = ["E", "F", "I", "UP", "B"] # Recorded device output keeps its lines. "tests/**" = ["E501"] +[tool.mypy] +python_version = "3.10" +strict = true +# napalm itself is untyped, so every driver subclasses Any. +disallow_subclassing_any = false + +[[tool.mypy.overrides]] +module = ["napalm.*", "requests.*"] +ignore_missing_imports = true + +[[tool.mypy.overrides]] +# Not yet under strict mypy (quality baseline); may only shrink. +module = [ + "napalm_opnsense.ha", + "napalm_opnsense.listening", + "napalm_opnsense.opnsense", + "napalm_opnsense.ospf_mixin", + "napalm_opnsense.ping_mixin", + "napalm_opnsense.port_forwards", + "napalm_opnsense.resolver_mixin", +] +ignore_errors = true + [tool.pytest.ini_options] testpaths = ["tests"] + +[tool.coverage.run] +source = ["napalm_opnsense"] + +[tool.coverage.report] +fail_under = 79 diff --git a/tests/quality_baseline.json b/tests/quality_baseline.json new file mode 100644 index 0000000..79a77f6 --- /dev/null +++ b/tests/quality_baseline.json @@ -0,0 +1,65 @@ +{ + "coverage_floor": 79.0, + "function_complexity": { + "napalm_opnsense/ha.py::config_sync": 12, + "napalm_opnsense/ha.py::dhcp_ha": 11, + "napalm_opnsense/listening.py::_service_of": 12, + "napalm_opnsense/listening.py::_socket": 19, + "napalm_opnsense/opnsense.py::OPNsenseDriver._allow_snmp_sources": 11, + "napalm_opnsense/opnsense.py::OPNsenseDriver._get_unbound_host_overrides": 17, + "napalm_opnsense/opnsense.py::OPNsenseDriver._kea_read_list": 11, + "napalm_opnsense/opnsense.py::OPNsenseDriver.apply_dhcp_subnet": 21, + "napalm_opnsense/opnsense.py::OPNsenseDriver.apply_firewall_rule": 11, + "napalm_opnsense/opnsense.py::OPNsenseDriver.create_dhcp_reservation": 16, + "napalm_opnsense/opnsense.py::OPNsenseDriver.delete_dhcp_reservation_and_lease": 14, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_bgp_neighbors": 16, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_dhcp_leases": 15, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_dhcp_leases._parse_kea": 14, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_dhcp_reservations": 15, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_dhcp_subnets": 17, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_facts": 12, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_firewall_rules": 30, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_interfaces": 13, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_interfaces_ip": 34, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_lldp_neighbors_detail": 12, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_networks": 25, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_route_to": 23, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_vpn_tunnels": 60, + "napalm_opnsense/opnsense.py::OPNsenseDriver.load_merge_candidate": 13, + "napalm_opnsense/opnsense.py::OPNsenseDriver.sync_dns_zone": 20, + "napalm_opnsense/port_forwards.py::_forwards_of": 12, + "napalm_opnsense/virtual_ips.py::carp_addresses": 14 + }, + "function_lines": { + "napalm_opnsense/opnsense.py::OPNsenseDriver._get_unbound_host_overrides": 51, + "napalm_opnsense/opnsense.py::OPNsenseDriver._regenerate_web_cert": 51, + "napalm_opnsense/opnsense.py::OPNsenseDriver.apply_dhcp_subnet": 60, + "napalm_opnsense/opnsense.py::OPNsenseDriver.create_dhcp_reservation": 85, + "napalm_opnsense/opnsense.py::OPNsenseDriver.delete_dhcp_reservation_and_lease": 79, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_bgp_neighbors": 86, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_dhcp_leases": 106, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_dhcp_subnets": 60, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_firewall_rules": 84, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_interfaces_ip": 68, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_networks": 85, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_route_to": 85, + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_vpn_tunnels": 189, + "napalm_opnsense/opnsense.py::OPNsenseDriver.load_merge_candidate": 56, + "napalm_opnsense/opnsense.py::OPNsenseDriver.sync_dns_zone": 112 + }, + "mypy_relaxed": [ + "napalm_opnsense.ha", + "napalm_opnsense.listening", + "napalm_opnsense.opnsense", + "napalm_opnsense.ospf_mixin", + "napalm_opnsense.ping_mixin", + "napalm_opnsense.port_forwards", + "napalm_opnsense.resolver_mixin" + ], + "python_file_lines": { + "napalm_opnsense/opnsense.py": 3125 + }, + "untyped_public": [ + "napalm_opnsense/opnsense.py::OPNsenseDriver.get_snmp_config" + ] +}