Tags: chepazzo/trigger
Tags
Release 1.3.1 - Palo Alto support, and more better SSH!
+ General changes
- New contrib package for optional extensions to core Trigger
features, `~trigger.contrib.commando.CommandoApplication` being
the first.
- Remove legacy mtsync check from bin/fe.
- Conditionally import MySQLdb so we can still do testing without
it.
+ The following changes have been madw within `~trigger.acl.parser`,
which provides Trigger's support for parsing network access control
lists (ACLs) and firewall policies:
- 🐛`72` Bugfix in `~trigger.acl.parser.TIP` where an invalid
network preifx (e.g. '1.2.3.1/31' would throw an
``AttributeError`` when checking the ``negated`` attribute and
shadowing the original ``ValueError``.
+ The following changes have been made within `~trigger.cmds`, which
provides an extensible, developer-friendly interface to writing
command exeuction adapters:
- Added ``with_errors`` argument to `~trigger.cmds.Commando`
constructor to toggle whether errors are raised as exceptions or
returned as strings.
- Allow timeout to be set as a class variable in
`~trigger.cmds.Commando` subclasses, preferrring timeout passed to
constructor in `~trigger.cmds.Commando` subclasses.
+ The following changes have been made within `~trigger.netdevices`:
- Refactor how we id Brocade switches for startup/commit (fix trigger#75)
* It's assumed that all Brocade devices all act the same;
* Except in the case of the VDX, which is treated specially.
- Simplified how ``startup_commands`` are calculated
- Disable SQLite loader if sqlite3 isn't available for some reason.
- Prompt patterns are now bound to `~trigger.netdevices.Vendor`
objects object when `~trigger.netdevices.NetDevices` is populated.
- `~trigger.netdevices.Vendor` objects now have a ``prompt_pattern``
attribute.
- All prompt patterns are now defined in ``settings.py``:
* Vendor-specific: :setting:`PROMPT_PATTERNS`
* IOS-like: :setting:`IOSLIKE_PROMPT_PAT`
* Fallback: :setting:`DEFAULT_PROMPT_PAT`
+ The following changes have been made within `~trigger.twister`,
which provides Trigger's remote execution functionality:
- Added CLI support for Palo Alto Networks firewalls!
- SSH Async now enabled by default for Arista, Brocade.
- :feature:`54` Moved static definition of commands permitted to be
executed when specified in a users' ``~/.gorc`` file into a new
configuration setting :setting:`GORC_ALLOWED_COMMANDS`. The file
location may now also be customized using :setting:`GORC_FILE`.
- 🐛`68` Fix host lookup bug in `~trigger.twister.TriggerTelnet`
causing telnet channels to crash.
- 🐛`74` Fix error-detection for NetScaler devices.
- Enhanced logging within `~trigger.twister` to include the device
name where applicable and useful (such as in SSH channel
debugging).
- All ``execute_`` functions have been simplified to eliminate
hard-coding of vendor checking wherever possible.
- Beginnings of reworking of Generic vs. AsyncPTY SSH channels:
* Most vendors support async/pty with little problems.
* This will become the new default.
* New execute helper: `~trigger.twister.execute_async_pty_ssh`
* New error helper: `~trigger.twister.has_juniper_error`
* Arista now uses `~trigger.twister.execute_async_pty_ssh`
* A ``NetScalerCommandFailure`` will now just be a
`~trigger.exceptions.CommandFailure`
+ Documentation
- Updated README to callout CSV support.
- Updated README to reflect branching model.
- Updated supported vendors, and no longer promising NETCONF
support.
Release 1.3 - OMG WTF have we done!!
+ General changes
- All references to psyco have been removed as it doesn't support
64-bit and was causing problems in Python 2.7.3.
- A new document, :doc:`new_vendors`, has been added to use as
checklist for adding new vendor support to Trigger.
- Added `Allan Feid <https://github.com/crazed>`_ as contributor for
his *crazed* ideas.
+ :feature:`10` The following changes have been made within
`~trigger.changemgmt`, which provides Trigger's support for bounce
windows and timezones, to move the bounce window settings into
configurable data vs. static module.
- The Bounce window API totally overhauled. Bounce windows are no
longer hard-coded in `~trigger.changemgmt` and are now configured
using ``bounce.py`` and specified using :setting:`BOUNCE_FILE`.
The interface for creating `~trigger.changemgmt.BounceWindow`
objects was greatly simplified to improve readability and usage.
- Added sample ``bounce.py`` to ``conf/bounce.py`` in source
distribution
- New setting variables in ``settings.py``:
- :setting:`BOUNCE_FILE` - The location of the bounce window
mapping definitions. Defaults to ``/etc/trigger/bounce.py``.
- :setting:`BOUNCE_DEFAULT_TZ` - Default timezone for bounce
windows. Defaults to ``'US/Eastern'``.
- :setting:`BOUNCE_DEFAULT_COLOR` - The default bounce risk-level
status color. Defaults to ``'red'``.
+ :feature:`55` The following changes have been made within
`~trigger.netdevices` to make it easier to populate
`~trigger.netdevices.NetDevices` from arbitrary sources by
implementing pluggable loaders.
- The module has been converted into a package.
- All hard-coded metadata parsing functions and associated imports
have been replaced with loader plugin classes. Filesystem loaders
provided by default for JSON, XML, Sqlite, Rancid, and *new*:
CSV!). The bare minimum config for CSV is a newline-separated CSV
file populated with "hostname,vendor" - New configuration setting:
:setting:`NETDEVICES_LOADERS` used to define a list of custom
loader classes to try in turn. The first one to return data wins.
- The configuration settings :setting:`SUPPORTED_FORMATS` and
:setting:`NETDEVICES_FORMAT` have been deprecated.
- The configuration setting :setting:`NETDEVICES_SOURCE` has
replaced :setting:`NETDEVICES_FILE`.
- The sample ``settings.py`` (found at ``conf/trigger_settings.py``
in the source distribution) is illustrates how one may use
:setting:`NETDEVICES_SOURCE` and :setting:`NETDEVICES_LOADERS` to
replace the deprecated settings :setting:`NETDEVICES_FORMAT` and
:setting:`NETDEVICES_FILE`.
+ The following changes have been made within `~trigger.twister`,
which provides Trigger's remote execution functionality:
- :feature:`22` Add Aruba wireless controller and Brocade ADX/VDX
support for execute/pty in trigger.twister and any device that
requires pty-req and shell without actualling using a pty. The
channel class for this functionality is called
`~trigger.twister.TriggerSSHAsyncPtyChannel` - Added a new
``requires_async_pty`` attribute to
`~trigger.netdevices.NetDevice` objects to help identify devices
that require such channels.
- Added a ``force_cli`` flag to `~trigger.twister.execute()` to
force CLI execution on Juniper devices instead of Junoscript.
- The default client factory
(`~trigger.twister.TriggerClientFactory`) now calls
`~trigger.tacacsrc.validate_credentials()` instead of directly
instantiating `~tacacsrc.Tacacsrc` anytime credentials are
populated automatically, resulting in only a single call to
`~tacacsrc.Tacacsrc()`, when creds aren't provided.
- Added error-detection for Brocade MLX.
+ The following changes have been made within `~trigger.cmds`, which
provides an extensible, developer-friendly interface to writing
command exeuction adapters.
- Added a ``force_cli`` flag to `~trigger.cmds.Commando` constructor
to force CLI execution on Juniper devices instead of Junoscript.
- The ``timeout`` value may now be to be set as a class variable in
`~trigger.cmds.Commando` subclasses.
- `~trigger.cmds.Commando` now step through ``commands`` as
iterables instead of assuming they are lists. The iterable is also
now explicitly cast to a list when we need them it be one.
- A minor bugfix in ~trigger.cmds.Commando` causing results from
multiple Commando instances to collide with each other because
they were inheriting an empty results ``{}`` from the class
object.
- `~trigger.cmds.Commando` now accepts ``creds`` as an optional
argument. If not set, it will default to reading user credentials
from ``.tacacsrc``.
+ The following changes have been madw within `~trigger.acl.parser`,
which provides Trigger's support for parsing network access control
lists (ACLs) and firewall policies.
- :feature:`12` Support has been added for parsing IPv6 addresses in
Juniper firewall filters.
- 🐛`26` Parsing of "{ip} except;" in Junos ACLs doesn't seem to
be functioning. Parser modifications to support negation of
address in Junos ACLs.
- Always display the prefix on /32 and /128 IPs in Juniper ACLs.
+ The following changes have been made within `~trigger.tacacsrc`,
which provides functionality to cache and retrieve user credentials:
- Added a new function `~trigger.tacacsrc.validate_credentials()`
validate credentials in the form of supports 2-tuples (username,
password), 3-tuples (username, password, realm), and dictionaries
of the same and returns a `~trigger.tacacsrc.Credentials` object.
+ The following changes have been made to Trigger's command-line
utilities:
- :feature:`60` ``bin/load_acl`` will now shutdown gracefully if
initial MySQL connection doesn't work, using a try..except to
display some information about the connection failure without a
traceback. For other MySQL issues, we will leave as is (dumping
the traceback) because they would represent coding or transient
issues, and we should present as much information as we have.
- :feature:`20` ``bin/gnng`` (get_nets) now supports not only
support Juniper 'sp' interfaces, but we've added flags to include
un-numbered (``-u``) or disabled (``-d``) interfaces.
Release 1.2.4 + The commands required to commit/save the configuration on a device are now attached to NetDevice objects under the commit_commands attribute, to make it easier to execute these commands without having to determine them for yourself. + Added a way to optionally perform a "commit full" operation on Juniper devices by defining a dictionary of attributes and values for matching devices using settings.JUNIPER_FULL_COMMIT_FIELDS. This modifies the commit_commands that are assigned when the NetDevice object is created. + Console paging is now disabled by default for async SSH channels.
Release 1.2.3 + Minor bugfix when checking device names and printing warning within trigger.cmds.Commando + Fix typo that was causing Cisco parsing to generate an unhandled exception within trigger.cmds.NetACLInfo + Changed ACL parser to omit src/dst ports if port range is 0-65535 + Added parsing of ranges for 'fragment-offset' statements in Juniper ACLs + Updated docs to say we're using a interactive Python interpreter and added OpenHatch profile to contact info
Release 1.2.2
- Arista support was added to bin/load_acl
- Added "SSH-1.99" as a valid SSHv2 version in
trigger.utils.network.test_ssh() to fix a bug in which devices
presenting this banner were errantly falling back to telnet and
causing weird behavior during interactive sessions.
- Changed trigger.twister.connect() to pass the vendor name to
trigger.gorc.get_init_commands() so that it is more explicit when
debugging.
- Added an extensible event notification system
- A new pluggable notification system has been added in
trigger.utils.notifications, which defaults to email notifications.
New event handlers and event types can be easily added and specified
with the configuration using settings.NOTIFICATION_HANDLERS.
- The following changes have been made to bin/load_acl:
- All alerts are now using the new notification system
- email_users() moved to trigger.utils.notifications.send_email()
- All calls to send failures now call
trigger.utils.notifications.send_notification()
- All calls to send successes now calls
trigger.utils.notifications.send_email()
- In support of the new notification system, the following config
settings have been added:
- settings.EMAIL_SENDER - The default email sender
- settings.NOTIFICATION_SENDER - The default notification sender
- settings.SUCCESS_RECIPIENTS - Hosts/addresses to send successes
- settings.FAILURE_RECIPIENTS - Hosts/addresses to send failures
- settings.NOTIFICATION_HANDLERS - A list of handler functions to
process in order
- A new utility module has been added to import modules in
trigger.utils.importlib, and trigger.conf.import_path() was moved to
trigger.utils.importlib.import_module_from_path() to bring these
import tools under one roof.
Release 1.2.1
- 🐛`30` Bugfix in ``bin/acl`` where tftproot was hard-coded. It now
reads from :setting:`TFTPROOT_DIR`.
- :feature:`37` Fixed misleading "make discard" output from
``bin/check_access``, to use the ``Term.extra`` attribute to store a
user-friendly comment to make it clear that the term's action has been
modified by the "make discard" keyword. - :feature:`39` Call
``create_cm_ticket()`` in a ``try..commit`` block so it can't crash
``bin/load_acl``.
- 🐛`40` Update dot_gorc.example with ``[init_commands]``.
- 🐛`43` Bugfix in bin/acl to address incorrect exception reference
from when exceptions were cleaned up in release 1.2.
- Simplified basic `~trigger.cmds.Commando` example in ``docs/index.rst``.
- Simplified activity output in `~trigger.cmds.Commando` base to/from
methods.
- Replaced all calls to ``time.sleep()`` with ``reactor.callLater()``
within `~trigger.twister` support of the ``command_interval`` argument
to Twisted state machine constructors.
- Added a way to do SSH version detection within `~trigger.utils.network`
- Enhanced `~trigger.utils.networktest_tcp_port` to support optional
``check_result`` and ``expected_result`` arguments. If
``check_result`` is set, the first line of output is retreived from
the connection and the starting characters must match
``expected_result``.
- Added a `~trigger.utils.network.test_ssh` function to shortcut to
check port 22 for a banner. Defaults to SSHv2.
- SSH auto-detection in `~trigger.netdevices.NetDevices` objects now
uses `~trigger.utils.network.test_ssh`.
- Added a new `~trigger.utils.crypt_md5` password-hashing function.
- Added proper argument signature to `~trigger.acl.db.get_netdevices`.
- Updated misnamed ``BadPolicerNameError`` to
`~trigger.exceptions.BadPolicerName`
- More and better documentation improvements, including new
documentation for ``bin/acl_script``.
Release 1.1 - Fixed missing imports from bin/acl_script and removed a bunch of duplicated code already within the Trigger libs. - Some new utilities added to trigger.acl.tools for merging new access into an existing ACL object - Fixed a bug in bin/netdev with the budget code option (-b) - trigger.acl.parser.RangeList now sorts port range tuples when parsing access-lists. - trigger.tacacsrc.get_device_password() user-friendly message moved to trigger.twister.pty_connect() so it no longer bleeds into non-interactive usage. - trigger.acl.parser.Term.output_ios() updated to support optional `acl_name` argument for cases when you need to output a Term separately from an ACL object. trigger.acl.tools.check_access(), bin/check_access, & bin/find_access also had to be updated to utilize this new argument. - trigger.acl.tools.check_access updated to support 'complicated' checks against Juniper firewall terms with a 'port' statement defined.