christianmanivong
aef58ca161
CI / test (3.10) (pull_request) Successful in 30s
CI / test (3.11) (pull_request) Successful in 32s
CI / test (3.12) (pull_request) Successful in 36s
CI / test (3.10) (push) Successful in 45s
CI / test (3.11) (push) Successful in 30s
CI / test (3.12) (push) Successful in 29s
run_device_action("fix_snmp") and get_snmp_config for both drivers, as
decided in NetOrk/netork#800: net-snmp from packages rather than the base
daemons, because it answers UCD-SNMP-MIB, which netOrk's health metrics
read.
- fix_snmp installs net-snmp, writes the configuration netOrk uses on
Linux (v2c, community "public", agentAddress udp:161) through stdin as
root, enables and restarts the agent (FreeBSD `service snmpd`, OpenBSD
`rcctl ... netsnmpd`, as `snmpd` is OpenBSD's own daemon) and asks it
for sysDescr. It stops at the first step that fails and says why.
- get_snmp_config reports a running net-snmp's community and port.
- FreeBSD's install_package bootstraps pkg on a classic system that never
had it instead of waiting for an answer that never comes.
Checked live: FreeBSD from a bare system, OpenBSD again over an existing
setup. Memory, swap and load answer on both; FreeBSD's ssCpuIdle about a
minute after start; OpenBSD's CPU figures from net-snmp are wrong (#800).
84 lines
4.5 KiB
Markdown
84 lines
4.5 KiB
Markdown
# napalm-bsd
|
|
|
|
NAPALM drivers for **FreeBSD** (`freebsd`) and **OpenBSD** (`openbsd`) hosts,
|
|
over SSH, built on [napalm-device-types](https://git.netork.io/NAPALM/napalm-device-types)'
|
|
`OSDriver`. Written for netOrk, which provisions and manages BSD VMs
|
|
(NetOrk/netork#792).
|
|
|
|
## Design
|
|
|
|
- One shared `BsdDriver` (`napalm_bsd/base.py`) holds the SSH layer and every
|
|
reader whose tools agree between the BSDs. `FreeBSDDriver` and
|
|
`OpenBSDDriver` name only the commands that differ (hostname, release,
|
|
kernel, hardware, `netstat -rnW` vs `-rn`).
|
|
- Every command runs on its own SSH **exec channel** (`run_on_transport` from
|
|
napalm-device-types): no PTY to parse a prompt from, stdout and stderr apart,
|
|
a real exit status. `run_command()` / `open_stream()` are public
|
|
(`CommandChannelMixin`).
|
|
- Root comes from `sudo -S` with the sudo password on stdin (never on a command
|
|
line), or `sudo -n` without one, as in napalm-linux. netOrk provisions `sudo`
|
|
on BSD VMs for that reason; `doas` cannot read a password from stdin.
|
|
- Parsing is in `napalm_bsd/parse.py`, pure functions tested on output recorded
|
|
from real systems (`tests/fixtures/`, each directory's `COMMANDS.txt` lists
|
|
what produced it).
|
|
|
|
## Supported getters
|
|
|
|
| Getter | FreeBSD | OpenBSD | Source |
|
|
|---|---|---|---|
|
|
| `get_facts` | ✓ | ✓ | `kern.hostname`/`hostname`, `freebsd-version`/`uname`, `kenv smbios.*`/`hw.*`, `kern.boottime` |
|
|
| `get_interfaces`, `get_interfaces_ip` | ✓ | ✓ | `ifconfig -a` |
|
|
| `get_route_to` | ✓ | ✓ | `netstat -rnW` / `netstat -rn` |
|
|
| `get_arp_table` | ✓ | ✓ | `arp -an` |
|
|
| `get_lldp_neighbors` | `{}` | `{}` | no LLDP daemon in either base system |
|
|
| `get_users`, `get_processes`, `get_cron_jobs` | ✓ | ✓ | `/etc/passwd`+`/etc/group`, `ps … lstart`, system crontab + `crontab -l` |
|
|
| `get_listening_sockets` | ✓ | ✓ | `sockstat -46lq` / `fstat -n` as root, `netstat -an` without |
|
|
| `get_packages`, `install_package`, `uninstall_package` | ✓ | ✓ | `pkg query` / `pkg install`, `pkg delete`; `pkg_info` / `pkg_add -I`, `pkg_delete` |
|
|
| `get_available_updates` | ✓ | ✓ | `pkg upgrade -n` + `pkg audit` (VuXML); `pkg_add -u -n -v` + `syspatch -c` |
|
|
| `get_services`, `manage_service` | ✓ | ✓ | `service -e` + `service … status` / `service … <action>`; `rcctl ls on` + `rcctl check` / `rcctl <action>` |
|
|
| `run_device_action("fix_snmp")`, `get_snmp_config` | ✓ | ✓ | net-snmp from packages: `/usr/local/etc/snmp/snmpd.conf` + `service snmpd`; `/etc/snmp/snmpd.conf` + `rcctl … netsnmpd` |
|
|
|
|
`get_listening_sockets` has the shape of napalm-device-types'
|
|
`ListeningSocketsMixin` (whose `ss`/cgroup reading is Linux's) and its rule:
|
|
read as root first, without root when that brings nothing back
|
|
(`attributed: False`). FreeBSD's `sockstat` sees every socket either way;
|
|
OpenBSD's `fstat` shows a user only their own processes, so without root the
|
|
sockets come from `netstat -an`, unnamed.
|
|
|
|
There is deliberately no `get_kernel_facts`: `KernelFactsMixin` reports a
|
|
Linux kernel's modules and `CONFIG_*` options, which a BSD kernel does not
|
|
have, and `hasattr(driver, "get_kernel_facts")` has to stay truthful.
|
|
|
|
**Updates.** `security` on FreeBSD comes from VuXML (`pkg audit`): True for a
|
|
package it lists as vulnerable, False for one it does not, None when the audit
|
|
could not run. OpenBSD's tools do not say, so it is None there. Base-system
|
|
patches are one entry, `base-system` (NetOrk/netork#799): OpenBSD's
|
|
`syspatch` applies its patches together and in order; a classic FreeBSD base
|
|
reports what `freebsd-update` has fetched (`updatesready`). On FreeBSD with
|
|
pkgbase the base system is packages from the `FreeBSD-base` repository and
|
|
needs no extra entry.
|
|
|
|
**Services** are the enabled ones. FreeBSD reads their status as root, as
|
|
root-only pidfiles hide a daemon from anyone else, and without root when sudo
|
|
refuses; OpenBSD's `rcctl check` needs no root. Actions run as root.
|
|
|
|
**SNMP** is net-snmp from packages (NetOrk/netork#800), configured as netOrk does
|
|
on Linux (v2c, community `public`, every address), so the agent answers
|
|
UCD-SNMP-MIB for netOrk's health metrics. Memory, swap and load are right on
|
|
both systems. CPU: FreeBSD reports `ssCpuIdle` about a minute after the
|
|
agent starts; on OpenBSD net-snmp's CPU figures are wrong (0 % idle on an idle
|
|
machine, also in `hrProcessorLoad`).
|
|
|
|
## Connection arguments
|
|
|
|
`optional_args`: `port` (22), `key_file`, `sudo_password`, `allow_agent`,
|
|
`look_for_keys` (both off by default).
|
|
|
|
## Development
|
|
|
|
```bash
|
|
pip install "napalm-device-types @ git+https://git.netork.io/NAPALM/napalm-device-types.git"
|
|
pip install -e ".[dev]"
|
|
pytest
|
|
```
|