Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add buffer clean in Huawei session preparation #5

Open
wants to merge 54 commits into
base: v4.4.0-unyc
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
54 commits
Select commit Hold shift + click to select a range
135a50f
Merge pull request #3456 from ktbyers/master
ktbyers Jul 8, 2024
3d4680e
Add Query Device Code to ANSI Escape Codes for MikroTik (#3457)
ktbyers Jul 8, 2024
e3acedd
Mikrotik free version ssh login fix (with minor updates) (#3458)
ktbyers Jul 10, 2024
dddf3d4
Vertiv MPH Driver (#3460)
ktbyers Jul 10, 2024
be241db
Garderos Driver (#3429)
ktbyers Jul 10, 2024
988892e
Add cisco apic driver (#3461)
ktbyers Jul 10, 2024
ace6062
Alaxala 2600s and 3600s driver (#3462)
ktbyers Jul 10, 2024
6800bc4
Bugfix Graceful exit command (#3468)
Tonygratta Jul 29, 2024
4841ecd
docs: readme 'use' instead of 'us' (#3465)
Kek5chen Aug 6, 2024
f0041bb
Adding support for pysnmp version6 (#3473)
ktbyers Aug 8, 2024
f295c03
Minor changes to the funtionality of Sophos module allowing the user …
dLoProdz Aug 26, 2024
da1b1e8
Add code_disable_bracketed_paste_mode to set of ansi escape codes to …
joshniec Aug 26, 2024
eefa4c4
linux_ssh: fix for 'Invalid output from MD5 command' (#3486)
pestophagous Aug 26, 2024
de986f4
add split-task to possible vdom configs (#3464)
dasTor Aug 28, 2024
92ca035
Fix pkgresources on PY3.13 (#3492)
ktbyers Sep 2, 2024
4599c4d
Add argument to send_command and send_command_timing to support raisi…
ktbyers Sep 4, 2024
5f76376
nokia_sros: Add support for md-cli only mode (#3496)
lub-dub Sep 17, 2024
deaafc4
Update Netmiko Packages; Roll to Version 5.0.0; Retire PY3.8 Support …
ktbyers Sep 19, 2024
78d8c11
Update Netmiko cli_tools to make them more modular and use concurrent…
ktbyers Sep 20, 2024
3e0623e
Overhaul on netmiko cli-tools output formatting behavior
ktbyers Oct 1, 2024
9211005
Adding encryption support to netmiko CLI tools (#3505)
ktbyers Oct 7, 2024
eab1884
Bulk encryption utility for .netmiko.yml (#3506)
ktbyers Oct 7, 2024
8756cc9
fix to support cisco APIC paging function
yone2ks Oct 31, 2024
544e2f5
Remove unused dependencies (#3515)
cjwatson Oct 31, 2024
43da87b
Adding tests for encryption handling used in cli_tools (#3508)
ktbyers Oct 31, 2024
e34b895
Fix --list-devices and --version in Netmiko CLI tools (#3519)
ktbyers Oct 31, 2024
b22e6f0
Merge branch 'ktbyers:develop' into fix_cisco_apic
yone2ks Nov 1, 2024
237a475
Add buffer clean in Huawei session preparation
k-ribot Feb 24, 2023
fe00998
Zyxel: Correction of ANSI characters of next line (#3524)
k-ribot Nov 5, 2024
3330854
fortinet _preferred_kex settings interfering with other devices (#3530)
ktbyers Nov 8, 2024
5e77f23
Nokia srl prompt stripping (#3531)
ktbyers Nov 8, 2024
0697340
Adding working doc explaining the encryption handling process (#3533)
ktbyers Nov 11, 2024
9f53c18
Updates self.write_channel and _test_channel_read got Palo Alto Log C…
Nov 13, 2024
6ec3589
Merge branch 'develop' into fix_cisco_apic
yone2ks Nov 21, 2024
a5309fe
Lower cisco ios priority to eliminate conflicts with Cisco-XE (#3538)
ktbyers Nov 22, 2024
ea5fa52
Minor cleanup (#3539)
ktbyers Nov 25, 2024
b07ae05
Merge branch 'develop' into palo_alto_log_collector_compatibility
opachano Dec 2, 2024
8c3177b
Expand space available setting (#3542)
ktbyers Dec 9, 2024
7ce4f41
Netmiko v4.5.0 Release (#3544)
ktbyers Dec 9, 2024
d762390
Merge pull request #3545 from ktbyers/develop
ktbyers Dec 9, 2024
7ef6eff
Fixing version in pyproject.toml
ktbyers Dec 9, 2024
174259f
Release housekeeping
ktbyers Dec 9, 2024
33788dc
Updating supported device types in PLATFORMS.md
ktbyers Dec 9, 2024
b130913
Merge branch 'develop' into fix_cisco_apic
yone2ks Dec 16, 2024
21684e7
Updating the poetry version backend
evilmonkey19 Dec 18, 2024
60db659
didn't run the poetry update command
evilmonkey19 Dec 24, 2024
31c0e9b
Merge pull request #3550 from evilmonkey19/develop
ktbyers Dec 24, 2024
692bd4a
Merge branch 'develop' into fix_cisco_apic
yone2ks Dec 28, 2024
5a692f2
Merge pull request #3521 from yone2ks/fix_cisco_apic
ktbyers Dec 31, 2024
4ba6fd1
Merge branch 'develop' into palo_alto_log_collector_compatibility
ktbyers Jan 3, 2025
06e8b42
Merge pull request #3535 from opachano/palo_alto_log_collector_compat…
ktbyers Jan 6, 2025
d5fbf98
genexis_solt33_telnet support (#3556)
ktbyers Jan 6, 2025
bb699c1
Optilink eolt devices (#3557)
ktbyers Jan 6, 2025
c83bc82
Merge branch 'develop' into fix-huawei-add-buffer-clean-in-session-pr…
k-ribot Jan 14, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/main_testing.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ jobs:
shell: bash
strategy:
matrix:
python-version: [ '3.8', '3.9', '3.10', '3.11', "3.12", "3.13.0-beta.2" ]
python-version: [ '3.9', '3.10', '3.11', "3.12", "3.13" ]
platform: [ubuntu-24.04, windows-2022]

runs-on: ${{ matrix.platform }}
Expand Down Expand Up @@ -96,7 +96,7 @@ jobs:
shell: bash
strategy:
matrix:
python-version: [ '3.8', '3.9', '3.10', '3.11' ]
python-version: [ '3.9', '3.10', '3.11' ]
platform: [macos-13]

runs-on: ${{ matrix.platform }}
Expand Down
148 changes: 148 additions & 0 deletions ENCRYPTION_HANDLING.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,148 @@
# Netmiko Encryption Handling

This document describes the encryption mechanisms available in Netmiko for handling sensitive data in configuration files. These mechanisms are generally intended for use with `~/.netmiko.yml` and Netmiko Tools.

## Overview

Netmiko provides built-in encryption capabilities to secure sensitive data (like passwords) in your Netmiko Tools YAML configuration files. The encryption system is flexible and supports multiple encryption types.

## Configuration

### Basic Setup

Encryption is configured in the `~/.netmiko.yml` file using the `__meta__` field:

```yaml
__meta__:
encryption: true
encryption_type: fernet # or aes128
```

The two supported encryption types are:
- `fernet` (recommended)
- `aes128`

### Encryption Key

The encryption key is read from the environment variable `NETMIKO_TOOLS_KEY`. This should be a secure, randomly-generated key appropriate for the chosen encryption type.

```bash
# Example of setting the encryption key
export NETMIKO_TOOLS_KEY="your-secure-key-here"
```

## Using Encryption

### Encrypted Values in YAML

When encryption is enabled, Netmiko looks for fields that start with `__encrypt__`. For example:

```yaml
arista1:
device_type: arista_eos
host: arista1.domain.com
username: pyclass
password: >
__encrypt__ifcs7SWOUER4m1K3ZEZYlw==:Z0FBQUFBQm5CQ9lrdV9BVS0xOWxYelF1Yml
zV3hBcnF4am1SWjRYNnVSRGdBb1FPVmJ2Q2EzX1RjTWxYMVVMdlBZSXVqYWVqUVNASXNRO
FBpR1MxRTkxN2J0NWxVeZNKT0E9PQ==
```

### Encryption Functions

#### Encrypting Values

To encrypt a value, use the `encrypt_value` function:

```python
def encrypt_value(value: str, key: bytes, encryption_type: str) -> str:
"""
Encrypt a value using the specified encryption type.

Args:
value: The string to encrypt
key: Encryption key as bytes
encryption_type: Either 'fernet' or 'aes128'

Returns:
Encrypted string with '__encrypt__' prefix
"""
```

#### Decrypting Values

To decrypt a value, use the `decrypt_value` function:

```python
def decrypt_value(encrypted_value: str, key: bytes, encryption_type: str) -> str:
"""
Decrypt a value using the specified encryption type.

Args:
encrypted_value: The encrypted string (including '__encrypt__' prefix)
key: Encryption key as bytes
encryption_type: Either 'fernet' or 'aes128'

Returns:
Decrypted string
"""
```

#### Getting the Encryption Key

To retrieve the encryption key from the environment:

```python
def get_encryption_key() -> bytes:
"""
Retrieve the encryption key from NETMIKO_TOOLS_KEY environment variable.

Returns:
Encryption key as bytes
"""
```

## Example Usage

Here's a complete example of how to use encryption in your code:

```python
from netmiko.encryption_handling import encrypt_value, get_encryption_key
from netmiko.encryption_handling import decrypt_value

# Get the encryption key from environment
key = get_encryption_key()

# Encrypt a password
password = "my_secure_password"
encrypted_password = encrypt_value(password, key, "fernet")

# The encrypted password can now be stored in your YAML file
# It will automatically be decrypted when Netmiko Tools reads the
# file (assuming you have properly set the '__meta__' fields
```

Alternatively, you can decrypt the value by calling

```python
clear_value = decrypt_value(encrypted_value, key, encryption_type="fernet)
```

Or you can create a simple function to decrypt all of the fields in the YAML
file dynamically (by looking for any fields that start with `__encrypt__`).

Netmiko's 'encryption_handling.py' implements this using the 'decrypt_config'
function, but this function is a specific to Netmiko Tools' .netmiko.yml format
(i.e. it will need modified if you want to use it in a more generic context).

## Implementation Notes

1. Encryption is processed transparently when Netmiko Tools reads the YAML file
2. Only fields prefixed with `__encrypt__` are processed for decryption
3. The encryption type is determined by the `__meta__` section

## Security Considerations

1. Store the `NETMIKO_TOOLS_KEY` securely and never commit it to version control
2. Fernet encryption is recommended over AES128 as it includes additional security features
3. Encrypted values in YAML files should still be treated as sensitive data
30 changes: 24 additions & 6 deletions PLATFORMS.md
Original file line number Diff line number Diff line change
Expand Up @@ -73,13 +73,15 @@

- A10
- Accedian
- Alaxala AX2600S and AX3600S
- Allied Telesis AlliedWare Plus
- Aruba OS (Wireless Controllers/WAPs)
- Aruba AOS-CX
- Brocade Fabric OS
- C-DOT CROS
- Ciena SAOS
- Citrix Netscaler
- Cisco APIC (Linux)
- Cisco Telepresence
- Cisco Viptela
- Check Point GAiA
Expand All @@ -96,16 +98,20 @@
- F5 TMSH
- F5 Linux
- Fortinet
- Garderos GRS
- Genexis Saturn SOLT33 (telnet only)
- MRV Communications OptiSwitch
- MRV LX
- Nokia/Alcatel SR-OS
- Nokia SR Linux
- Optilink EOLT 9702 (telnet only)
- QuantaMesh
- Rad ETX
- Raisecom ROAP
- Sophos SFOS
- Ubiquiti Unifi Switch
- Versa Networks FlexVNF
- Vertiv MPH Power Distribution Units
- Watchguard Firebox
- Zyxel NOS
- 6WIND TurboRouter
Expand All @@ -117,12 +123,15 @@
- adtran_os
- adva_fsp150f2
- adva_fsp150f3
- alaxala_ax26s
- alaxala_ax36s
- alcatel_aos
- alcatel_sros
- allied_telesis_awplus
- apresia_aeos
- arista_eos
- arris_cer
- aruba_aoscx
- aruba_os
- aruba_osswitch
- aruba_procurve
Expand All @@ -144,6 +153,7 @@
- centec_os
- checkpoint_gaia
- ciena_saos
- cisco_apic
- cisco_asa
- cisco_ftd
- cisco_ios
Expand All @@ -165,8 +175,8 @@
- dell_os9
- dell_powerconnect
- dell_sonic
- dlink_ds
- digi_transport
- dlink_ds
- eltex
- eltex_esr
- endace
Expand All @@ -187,8 +197,10 @@
- f5_linux
- f5_ltm
- f5_tmsh
- fiberstore_fsos
- flexvnf
- fortinet
- garderos_grs
- generic
- generic_termserver
- hillstone_stoneos
Expand All @@ -206,6 +218,7 @@
- keymile
- keymile_nos
- linux
- maipu
- mellanox
- mellanox_mlnxos
- mikrotik_routeros
Expand Down Expand Up @@ -235,6 +248,7 @@
- ubiquiti_edgerouter
- ubiquiti_edgeswitch
- ubiquiti_unifiswitch
- vertiv_mph
- vyatta_vyos
- vyos
- watchguard_fireware
Expand All @@ -248,34 +262,37 @@
- apresia_aeos_telnet
- arista_eos_telnet
- aruba_procurve_telnet
- audiocode_72_telnet
- audiocode_66_telnet
- audiocode_72_telnet
- audiocode_shell_telnet
- brocade_fastiron_telnet
- brocade_netiron_telnet
- calix_b6_telnet
- centec_os_telnet
- ciena_saos_telnet
- cisco_ios_telnet
- cisco_xr_telnet
- cisco_s200_telnet
- cisco_s300_telnet
- cisco_xr_telnet
- dell_dnos6_telnet
- dell_powerconnect_telnet
- dlink_ds_telnet
- extreme_telnet
- extreme_exos_telnet
- extreme_netiron_telnet
- extreme_telnet
- generic_telnet
- generic_termserver_telnet
- hp_procurve_telnet
- genexis_solt33_telnet
- hp_comware_telnet
- huawei_telnet
- hp_procurve_telnet
- huawei_olt_telnet
- huawei_telnet
- ipinfusion_ocnos_telnet
- juniper_junos_telnet
- maipu_telnet
- nokia_sros_telnet
- oneaccess_oneos_telnet
- optilink_eolt9702_telnet
- paloalto_panos_telnet
- rad_etx_telnet
- raisecom_telnet
Expand All @@ -300,5 +317,6 @@
- extreme_exos
- juniper_junos
- linux
- mikrotik_routeros
- nokia_sros
- ubiquiti_edgerouter
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ Netmiko aims to accomplish both of these operations and to do it across a very b

## Installation

To install netmiko, simply us pip:
To install netmiko, simply use pip:

```
$ pip install netmiko
Expand Down
4 changes: 2 additions & 2 deletions _release.sh
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ if [ -d "netmiko_packaging" ]; then
exit 1
else
echo "Create virtualenv"
/usr/local/bin/python3.9 -m venv netmiko_packaging
/usr/local/bin/python3.12 -m venv netmiko_packaging
echo "Source virtualenv"
source /home/ktbyers/VENV/netmiko_packaging/bin/activate
which python
Expand Down Expand Up @@ -141,7 +141,7 @@ if [ -d "netmiko_packaging" ]; then
exit 1
else
echo "Create virtualenv"
/usr/local/bin/python3.9 -m venv netmiko_packaging
/usr/local/bin/python3.12 -m venv netmiko_packaging
echo "Source virtualenv"
deactivate
source /home/ktbyers/VENV/netmiko_packaging/bin/activate
Expand Down
Loading