From 8815c4a58494cad66d78f4e01c7c2521e67a1738 Mon Sep 17 00:00:00 2001 From: Christian Manivong Date: Fri, 23 Oct 2026 08:33:21 +0200 Subject: [PATCH] fix: what bandit and the remaining lint rules found - The module logger and the refresh constants of opnsense.py move below the imports (E402). - Two long result messages are wrapped in parentheses (E501). - nosec for the two wildcard addresses (B104): one is the address sockstat reports for "*", the other a route's gateway compared with 0.0.0.0. Neither binds a socket; both are false positives. --- napalm_opnsense/listening.py | 3 ++- napalm_opnsense/opnsense.py | 23 ++++++++++++++--------- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/napalm_opnsense/listening.py b/napalm_opnsense/listening.py index a20c306..463ce31 100644 --- a/napalm_opnsense/listening.py +++ b/napalm_opnsense/listening.py @@ -65,7 +65,8 @@ def _service_of(command: str, user: str, services: set[str]) -> str | None: def _address(protocol: str, address: str) -> tuple: """``(address, interface)``: ``*`` is every address of the socket's family.""" if address == "*": - return ("::" if protocol.endswith("6") else "0.0.0.0"), None + # A reported wildcard address (data from sockstat), not a bind. + return ("::" if protocol.endswith("6") else "0.0.0.0"), None # nosec B104 host, _, zone = address.partition("%") return host, zone or None diff --git a/napalm_opnsense/opnsense.py b/napalm_opnsense/opnsense.py index 5722eba..5d2eb0a 100644 --- a/napalm_opnsense/opnsense.py +++ b/napalm_opnsense/opnsense.py @@ -44,12 +44,6 @@ import time from ipaddress import ip_address, ip_network from typing import Any -logger = logging.getLogger(__name__) - -#: How long refresh_available_updates waits for the firewall's update check. -_REFRESH_POLLS = 20 -_REFRESH_INTERVAL = 3 - import requests from napalm.base.exceptions import ( ConnectionClosedException, @@ -76,6 +70,12 @@ from napalm_opnsense.port_forwards import alias_index, port_forwards, wan_interf from napalm_opnsense.resolver_mixin import OPNsenseResolverMixin from napalm_opnsense.virtual_ips import carp_addresses +logger = logging.getLogger(__name__) + +#: How long refresh_available_updates waits for the firewall's update check. +_REFRESH_POLLS = 20 +_REFRESH_INTERVAL = 3 + _ARCHITECTURE_SUFFIX = re.compile(r"-(amd64|aarch64|arm64|i386|armv7)$") @@ -636,7 +636,8 @@ class OPNsenseDriver( # Clean up BSD link-layer gateway references clean_gateway = ( "" - if (not gateway or gateway.startswith("link#") or gateway == "0.0.0.0") + # A route's reported gateway compared with the wildcard, not a bind. + if (not gateway or gateway.startswith("link#") or gateway == "0.0.0.0") # nosec B104 else gateway ) @@ -2261,7 +2262,9 @@ class OPNsenseDriver( return {"success": True, "output": status.get("status_msg", "")} return { "success": False, - "output": f"The update check did not finish within {_REFRESH_POLLS * _REFRESH_INTERVAL} s", + "output": ( + f"The update check did not finish within {_REFRESH_POLLS * _REFRESH_INTERVAL} s" + ), } def reboot_host(self) -> None: @@ -2464,7 +2467,9 @@ class OPNsenseDriver( # empty {} response at HTTP 200 — no error_msg to surface. return { "success": False, - "output": "OPNsense rejected the request (check interface identifier and MAC format)", + "output": ( + "OPNsense rejected the request (check interface identifier and MAC format)" + ), } return {"success": True, "output": f"Magic packet sent to {mac_address} via {interface}"}