feat: read the sockets of a host without ss from netstat, and procd's services

OpenWrt has no ss: the listening-socket command fell through to [no-ss]
and the reading raised ListeningSocketsUnavailable. Without ss it now runs
netstat -lntup (busybox and net-tools both), and the cgroups are read for
its PIDs alike.

- netstat names a socket's process as PID/Program; a UDP line has no
  state column, "-" is a socket without a process, and net-tools prints
  tcp6/udp6 and program names with a space ("sshd: /usr/sbin").
- On OpenWrt the cgroup is /services/<name>/<instance>, so the unit is
  the procd service -- a jailed one too, whose PID is not the one procd
  reports (dnsmasq under ujail).
- A host with neither tool still raises ListeningSocketsUnavailable.

Checked against a real OpenWrt 25.12.2 access point, and that a Linux and
a Proxmox host still read the same sockets with the longer command.

2.5.0. For netOrk#673.

napalm_device_types/listening.py

@@ -21,8 +21,13 @@ the reading says it is not ``attributed``.
 
 **No ``-H``.** iproute2 before 4.10 has no option to leave out the header and
 fails on it, which would read as nothing listening. The parse skips the header
-instead. A host without ``ss`` at all (busybox, QNAP) raises
-:class:`ListeningSocketsUnavailable`.
+instead.
+
+**Without ``ss``, ``netstat``.** OpenWrt's busybox and old net-tools hosts have
+no ``ss``; ``netstat -lntup`` lists the same sockets with ``PID/Program``, and
+the cgroups are read for its PIDs alike. On OpenWrt the cgroup names the procd
+service (``/services/<name>/<instance>``), a jailed one too, whose PID is not the
+one procd reports. A host with neither raises :class:`ListeningSocketsUnavailable`.
 """
 
 from __future__ import annotations
@@ -42,23 +47,37 @@ _RC_RE = re.compile(r"^__SS_RC=(\d+)$")
 #: One line, POSIX ``sh``, read-only. The frame markers are printed in two
 #: halves so that a transport which echoes the command does not show them early.
 #: ``ss`` is in ``/usr/sbin`` on some systems, outside a login user's ``PATH``.
+#: ``netstat`` names a socket's process as ``PID/Program``, ``ss`` as ``pid=PID``.
 LISTENING_SOCKETS_COMMAND = (
     "PATH=$PATH:/usr/sbin:/sbin; "
     "printf '%s%s\\n' SOCK_ BEGIN; "
     "if command -v ss >/dev/null 2>&1; then "
-    "s=$(ss -lntup 2>&1); r=$?; echo '[ss]'; printf '%s\\n' \"$s\"; echo \"__SS_RC=$r\"; "
+    "t=ss; s=$(ss -lntup 2>&1); r=$?; "
+    "pids=$(printf '%s\\n' \"$s\" | grep -o 'pid=[0-9]*' | cut -d= -f2); "
+    "elif command -v netstat >/dev/null 2>&1; then "
+    "t=netstat; s=$(netstat -lntup 2>&1); r=$?; "
+    "pids=$(printf '%s\\n' \"$s\" | grep -o ' [0-9][0-9]*/' | tr -d ' /'); "
+    "else t=; fi; "
+    "if [ -n \"$t\" ]; then "
+    "echo \"[$t]\"; printf '%s\\n' \"$s\"; echo \"__SS_RC=$r\"; "
     "echo '[cgroups]'; "
-    "for p in $(printf '%s\\n' \"$s\" | grep -o 'pid=[0-9]*' | cut -d= -f2 | sort -u); do "
+    "for p in $(printf '%s\\n' \"$pids\" | sort -u); do "
     "sed \"s|^|$p |\" /proc/$p/cgroup 2>/dev/null; done; "
     "else echo '[no-ss]'; fi; "
     "printf '%s%s\\n' SOCK_ END"
 )
 
 _PROTOCOLS = frozenset({"tcp", "udp"})
+#: netstat names the IPv6 sockets of net-tools ``tcp6``/``udp6``; busybox does not.
+_NETSTAT_PROTOCOLS = {"tcp": "tcp", "tcp6": "tcp", "udp": "udp", "udp6": "udp"}
+#: ``1604/dropbear``; net-tools prints ``700/sshd: /usr/sbin``.
+_PROGRAM_RE = re.compile(r"^(\d+)/(\S*)")
 #: ``users:(("nginx",pid=901,fd=6),("nginx",pid=900,fd=6))``
 _USER_RE = re.compile(r'\("((?:[^"\\]|\\.)*)",pid=(\d+),fd=\d+\)')
 #: The service a cgroup path runs in: its deepest ``*.service`` component.
 _SERVICE_RE = re.compile(r"/([^/]+)\.service(?=/|$)")
+#: OpenWrt's procd: ``/services/<name>/<instance>``.
+_PROCD_RE = re.compile(r"^/services/([^/]+)(?:/|$)")
 #: A container's cgroup: ``docker-<id>.scope`` (systemd driver), ``/docker/<id>`` (cgroupfs).
 _CONTAINER_RE = re.compile(
     r"(?:docker|libpod)-([0-9a-f]{64})\.scope|/(?:docker|libpod)/([0-9a-f]{64})(?=/|$)"
@@ -66,7 +85,7 @@ _CONTAINER_RE = re.compile(
 
 
 class ListeningSocketsUnavailable(NotImplementedError):
-    """The host has no ``ss``; there is nothing to read and nothing to retry."""
+    """The host has neither ``ss`` nor ``netstat``; nothing to read, nothing to retry."""
 
 
 def _frame(output: str) -> List[str]:
@@ -117,7 +136,10 @@ def _cgroup_paths(lines: List[str]) -> Dict[int, str]:
 
 def _unit(path: Optional[str]) -> Optional[str]:
     services = _SERVICE_RE.findall(path or "")
-    return services[-1] if services else None
+    if services:
+        return str(services[-1])
+    procd = _PROCD_RE.match(path or "")
+    return str(procd.group(1)) if procd else None
 
 
 def _container(path: Optional[str]) -> Optional[str]:
@@ -125,19 +147,17 @@ def _container(path: Optional[str]) -> Optional[str]:
     return (match.group(1) or match.group(2)) if match else None
 
 
-def _socket(line: str, paths: Dict[int, str]) -> Optional[ListeningSocketDict]:
-    parts = line.split()
-    if len(parts) < 5 or parts[0] not in _PROTOCOLS:
-        return None
-    local = _split_local(parts[4])
-    if local is None:
-        return None
+def _entry(
+    proto: str,
+    local: Tuple[str, Optional[str], int],
+    process: Optional[str],
+    pid: Optional[int],
+    paths: Dict[int, str],
+) -> ListeningSocketDict:
     address, interface, port = local
-    users = _USER_RE.findall(line)
-    process, pid = (users[0][0], int(users[0][1])) if users else (None, None)
     path = paths.get(pid) if pid is not None else None
     return {
-        "proto": parts[0],
+        "proto": proto,
         "address": address,
         "port": port,
         "interface": interface,
@@ -148,29 +168,67 @@ def _socket(line: str, paths: Dict[int, str]) -> Optional[ListeningSocketDict]:
     }
 
 
+def _ss_socket(line: str, paths: Dict[int, str]) -> Optional[ListeningSocketDict]:
+    parts = line.split()
+    if len(parts) < 5 or parts[0] not in _PROTOCOLS:
+        return None
+    local = _split_local(parts[4])
+    if local is None:
+        return None
+    users = _USER_RE.findall(line)
+    process, pid = (users[0][0], int(users[0][1])) if users else (None, None)
+    return _entry(parts[0], local, process, pid, paths)
+
+
+def _netstat_socket(line: str, paths: Dict[int, str]) -> Optional[ListeningSocketDict]:
+    """``Proto Recv-Q Send-Q Local Foreign [State] PID/Program`` -- a UDP line
+    has no state, and ``-`` is a socket without a process."""
+    parts = line.split()
+    proto = _NETSTAT_PROTOCOLS.get(parts[0]) if parts else None
+    if proto is None or len(parts) < 6:
+        return None
+    local = _split_local(parts[3])
+    if local is None:
+        return None
+    process, pid = None, None
+    for token in parts[5:7]:
+        program = _PROGRAM_RE.match(token)
+        if program:
+            pid, process = int(program.group(1)), program.group(2).rstrip(":") or None
+            break
+    return _entry(proto, local, process, pid, paths)
+
+
+_PARSERS = {"ss": _ss_socket, "netstat": _netstat_socket}
+
+
 def parse_listening_sockets(output: str) -> List[ListeningSocketDict]:
     """Parse what :data:`LISTENING_SOCKETS_COMMAND` printed, sorted by protocol,
     port and address.
 
-    :raises ListeningSocketsUnavailable: when the host has no ``ss``.
-    :raises ValueError: when the output carries no intact report, or ``ss`` failed.
+    :raises ListeningSocketsUnavailable: when the host has neither ``ss`` nor ``netstat``.
+    :raises ValueError: when the output carries no intact report, or the tool failed.
     """
     sections = _sections(_frame(output))
     if _NO_SS in sections:
-        raise ListeningSocketsUnavailable("the host has no ss")
-    ss_lines = sections.get("ss", [])
-    statuses = [m.group(1) for m in map(_RC_RE.match, ss_lines) if m]
+        raise ListeningSocketsUnavailable("the host has neither ss nor netstat")
+    tool = "netstat" if "netstat" in sections else "ss"
+    lines = sections.get(tool, [])
+    statuses = [m.group(1) for m in map(_RC_RE.match, lines) if m]
     if not statuses or statuses[-1] != "0":
-        detail = " ".join(line for line in ss_lines if not _RC_RE.match(line))[:200]
-        raise ValueError(f"ss did not list the sockets: {detail or 'no exit status'}")
+        detail = " ".join(line for line in lines if not _RC_RE.match(line))[:200]
+        raise ValueError(f"{tool} did not list the sockets: {detail or 'no exit status'}")
     paths = _cgroup_paths(sections.get("cgroups", []))
-    sockets = [s for s in (_socket(line, paths) for line in ss_lines) if s is not None]
+    parse = _PARSERS[tool]
+    sockets = [s for s in (parse(line, paths) for line in lines) if s is not None]
     return sorted(sockets, key=lambda s: (s["proto"], s["port"], s["address"], s["interface"] or ""))
 
 
 class ListeningSocketsMixin:
     """Adds :meth:`get_listening_sockets` to a driver that can run a command on a Linux host.
 
+    With ``ss``, or ``netstat`` where there is none (OpenWrt's busybox).
+
     The template form (README, "Function classes"): the command and its parse
     are the same everywhere, so they are concrete here, and a driver supplies
     only :meth:`_run_listening_sockets_command` -- how a command reaches its
@@ -205,7 +263,7 @@ class ListeningSocketsMixin:
                 ],
             }
 
-        :raises ListeningSocketsUnavailable: if the host has no ``ss``.
+        :raises ListeningSocketsUnavailable: if the host has neither ``ss`` nor ``netstat``.
         :raises ValueError: if neither reading carried an intact report.
         """
         command = f"sh -c {quote(LISTENING_SOCKETS_COMMAND)}"