napalm-opnsense

4 Commits

Include renames

Author	SHA1	Message	Date
Christian Manivong	00172f7a69	feat: report the firewall's CARP addresses as virtual IPs CI / test (3.10) (push) Successful in 30s Details CI / test (3.11) (push) Successful in 29s Details CI / test (3.12) (push) Successful in 30s Details CI / test (3.10) (pull_request) Successful in 29s Details CI / test (3.11) (pull_request) Successful in 28s Details CI / test (3.12) (pull_request) Successful in 30s Details get_virtual_ips() reads every address bound to a CARP VHID -- the CARP address and IP aliases on its VHID alike -- from /api/interfaces/overview/export, with this node's CARP state, so the reading says who holds each address. interfaces/vip_settings would list the same addresses with each VHID's CARP password; it is not read. vip_manager and keepalived are Linux mechanisms and are None here. Needs napalm-device-types 4.10.0 (carp_virtual_ip). netOrk #1121.	2026-10-16 11:07:08 +02:00
Christian Manivong	2fb1226734	feat: report what listens, and which OPNsense service it is CI / test (3.10) (push) Successful in 40s Details CI / test (3.11) (push) Successful in 30s Details CI / test (3.12) (push) Successful in 31s Details CI / test (3.10) (pull_request) Successful in 29s Details CI / test (3.11) (pull_request) Successful in 28s Details CI / test (3.12) (pull_request) Successful in 30s Details get_listening_sockets reads /api/diagnostics/interface/get_socket_statistics: netstat's sockets with sockstat's user, command and PID, collected by configd as root, so no SSH is needed. A listening socket is one without a peer (:); "*" is the any-address of the socket's family. Which service: the socket's unit is a name of the firewall's own service list, so netOrk can match it to the service. The command (cut to ten characters by FreeBSD) matches a service name, the start of one, or one of the daemons whose service is called otherwise (sshd is openssh, the FRR daemons are frr, kea-ctrl-agent is kea-dhcp). lighttpd is the web UI, or the captive portal when it runs as www. WireGuard's sockets belong to the kernel and are told by the listen ports of /api/wireguard/service/show. The fixture is a real OPNsense 26.7.5 firewall's answer, cut down, with documentation addresses. For netOrk#673.	2026-10-07 07:20:27 +02:00
Christian Manivong	f934cc0cfa	feat(ping): implement ping and a batched ping_sweep over the diagnostics API CI / test (3.10) (push) Failing after 19s Details CI / test (3.11) (push) Failing after 8s Details CI / test (3.12) (push) Failing after 11s Details CI / test (3.9) (push) Failing after 8s Details OPNsense has no synchronous ping endpoint. /api/diagnostics/ping is a job API — create, start, read statistics, stop, remove — so a single ping costs five requests and roughly a second of waiting, which makes the generic per-host sweep from napalm-device-types unusable for a whole subnet. The override exploits what the job API does offer instead: jobs are independent and run on the firewall in parallel, and search_jobs reports all of them in one response. A batch (32 by default) is created and started, waited for once, harvested with a single request and then cleaned up, so waiting time per batch is constant rather than linear in hosts. PING_SWEEP_MAX_TARGETS bounds the sweep as a whole — this runs on production firewalls. Two details the API forces: results are polled, because search_jobs signals the running ping with SIGINFO and then parses whatever it has written so far, so the first read of a healthy host can still show zero probes; and the model's root node is read from /get rather than hardcoded, so a rename in a future OPNsense release cannot silently break job creation. Tested against mocked API responses only — no live device is reachable at the moment, so the endpoint shapes come from the OPNsense sources (PingController, scripts/interfaces/ping.py).	2026-08-13 16:51:05 +07:00
Christian Manivong	ae27cd5469	initial commit	2026-05-29 09:22:10 +02:00