o

�N�g�=�@s:
dZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlmZm	Z	
d
dl
mZ
d
dlm
Z

d
dlmZ
e�e�
Zdg
ZdZdii
Zd	ad
d�Zd6dd
�
Zdd�Zdd�Zdd�Zdd�Zdd�Zd7dd�
Zd6dd�
Zd6dd�
Z dd �Z!d!d"�Z"d#d$�Z#d6d%d&�
Z$d6d'd(�
Z%d)d*�Z&d+d,�Z'd-d.�Z(d/d0�Z)d1d2�Z*d8d4d5�
Z+dS)9a
Proxy Minion for Cisco NX-OS Switches

.. versionadded:: 2016.11.0

The Cisco NX-OS Proxy Minion is supported on NX-OS devices for the following connection types:
1) Connection Type SSH
2) Connection Type NX-API (If Supported By The Device and Image Version).

:maturity:   new
:platform:   nxos

SSH uses the built in SSHConnection module in :mod:`salt.utils.vt_helper <salt.utils.vt_helper>`

To configure the proxy minion for ssh:

.. code-block:: yaml

    proxy:
      proxytype: nxos
      connection: ssh
      host: 192.168.187.100
      username: admin
      password: admin
      prompt_name: nxos-switch
      ssh_args: '-o PubkeyAuthentication=no'
      key_accept: True

To configure the proxy minion for nxapi:

.. code-block:: yaml

    proxy:
      proxytype: nxos
      connection: nxapi
      host: 192.168.187.100
      username: admin
      password: admin
      transport: http
      port: 80
      verify: False
      save_config: False

proxytype:
    (REQUIRED) Use this proxy minion `nxos`

connection:
    (REQUIRED) connection transport type.
    Choices: `ssh, nxapi`
    Default: `ssh`

host:
    (REQUIRED) login ip address or dns hostname.

username:
    (REQUIRED) login username.

password:
    (REQUIRED) login password.

save_config:
    If True, 'copy running-config starting-config' is issues for every
    configuration command.
    If False, Running config is not saved to startup config
    Default: True

    The recommended approach is to use the `save_running_config` function
    instead of this option to improve performance.  The default behavior
    controlled by this option is preserved for backwards compatibility.

Connection SSH Args:

    prompt_name:
        (REQUIRED when `connection` is `ssh`)
        (REQUIRED, this or `prompt_regex` below, but not both)
        The name in the prompt on the switch.  Recommended to use your
        device's hostname.

    prompt_regex:
        (REQUIRED when `connection` is `ssh`)
        (REQUIRED, this or `prompt_name` above, but not both)
        A regular expression that matches the prompt on the switch
        and any other possible prompt at which you need the proxy minion
        to continue sending input.  This feature was specifically developed
        for situations where the switch may ask for confirmation.  `prompt_name`
        above would not match these, and so the session would timeout.

        Example:

        .. code-block:: yaml

            nxos-switch#.*|\(y\/n\)\?.*

        This should match

        .. code-block:: shell

            nxos-switch#

        or

        .. code-block:: shell

            Flash complete.  Reboot this switch (y/n)? [n]


        If neither `prompt_name` nor `prompt_regex` is specified the prompt will be
        defaulted to

        .. code-block:: shell

            .+#$

        which should match any number of characters followed by a `#` at the end
        of the line.  This may be far too liberal for most installations.

    ssh_args:
        Extra optional arguments used for connecting to switch.

    key_accept:
        Whether or not to accept the host key of the switch on initial login.
        Default: `False`

Connection NXAPI Args:

    transport:
        (REQUIRED) when `connection` is `nxapi`.
        Choices: `http, https`
        Default: `https`

    port:
        (REQUIRED) when `connection` is `nxapi`.
        Default: `80`

    verify:
        (REQUIRED) when `connection` is `nxapi`.
        Either a boolean, in which case it controls whether we verify the NX-API
        TLS certificate, or a string, in which case it must be a path to a CA bundle
        to use.
        Default: `True`

        When there is no certificate configuration on the device and this option is
        set as ``True`` (default), the commands will fail with the following error:
        ``SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)``.
        In this case, you either need to configure a proper certificate on the
        device (*recommended*), or bypass the checks setting this argument as ``False``
        with all the security risks considered.

        Check https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/programmability/6_x/b_Cisco_Nexus_3000_Series_NX-OS_Programmability_Guide/b_Cisco_Nexus_3000_Series_NX-OS_Programmability_Guide_chapter_01.html
        to see how to properly configure the certificate.


The functions from the proxy minion can be run from the salt commandline using
the :mod:`salt.modules.nxos<salt.modules.nxos>` execution module.

.. note:
    If `multiprocessing: True` is set for the proxy minion config, each forked
    worker will open up a new connection to the Cisco NX OS Switch.  If you
    only want one consistent connection used for everything, use
    `multiprocessing: False`

�N)�CommandExecutionError�NxosCliError)
�clean_kwargs)
�TerminalException)
�
SSHConnection�nxos�grains_cache�sshcCst�
d
�

tS)z6
    Only return if all the modules are available
    z"nxos proxy __virtual__() called...)�log�info�__virtualname__�r
r
�C/opt/saltstack/salt/lib/python3.10/site-packages/salt/proxy/nxos.py�__virtual__�s
rc

Csht�
d
�
�
d�
du
rt�
d
�
�
d�
atdkrt�d�

t|�
Stdkr,t�d�

t|�
St�dt�
d	S)
zX
    Required.
    Initialize device connection using ssh or nxapi connection type.
    �proxy�
connectionNr	z+NXOS PROXY: Initialize ssh proxy connection�nxapiz-NXOS PROXY: Initialize nxapi proxy connectionzUnknown Connection Type: %sF)�__opts__�get�
CONNECTIONr
r�	_init_ssh�_init_nxapi�error)
�optsr
r
r�init�s








rcC� td
krt
�Stdkrt�SdS)z�
    Since grains are loaded in many different places and some of those
    places occur before the proxy can be initialized, return whether the
    init() function has been called.
    r	rN)r�_initialized_ssh�_initialized_nxapir
r
r
r�initialized�s



�rcCr)z{
    Helper function for nxos execution module functions that need to
    ping the nxos device using the proxy minion.
    r	rN)r�	_ping_ssh�_ping_nxapir
r
r
r�ping��



�r!cCsXtd
s&t
d�
}tdkr|d}tjj�|�
}
t�d|
�
td
�	|
d�

dtd
i
S)z{
    Helper function for nxos execution module functions that need to
    retrieve nxos grains using the proxy minion.
    rzshow versionrr
zSystem Info: %sr)
�DEVICE_DETAILS�sendliner�salt�utilsrZsystem_infor
�debug�update)�data�retr
r
r�grains�s






r+cCsitd
<t
�S)zz
    Helper function for nxos execution module functions that need to
    refresh nxos grains using the proxy minion.
    r)r#r+r
r
r
r�grains_refresh�s
r,cCr)zc
    Not supported.  Only used as a place holder to satisfy shutdown function
    requirement.
    r	rN)r�
_shutdown_ssh�_shutdown_nxapir
r
r
r�shutdown
r"r/�cli_show_asciic
Ksnz"td
krt
|f
i|�
�
}W|Stdkr t||
fi|�
�
}W|SW|Sttfy6
}
zt�|�

�d}~w
w)z�
    Helper function for nxos execution module functions that need to
    send commands to an nxos device using the proxy minion.
    r	rN)r�
_sendline_ssh�_nxapi_requestrrr
r)�commands�method�kwargs�result�
er
r
rr$
s

�
��


��r$c
Cs�d
}|
durt�
dd�}
t|t�s|g
}zQtdkr;td�

g}|D]}|�|�

t|�
}q!|
r3t|�

|r:t�|�

n!tdkrWt	|�
}|
rIt	|�

|D]}d|vrVt�|�

qKW||gSW||gSW||gSt
yw
}
zt�|�

�d}~w
w)	z
    Helper function for nxos execution module functions that need to
    configure an nxos device using the proxy minion.
    z"copy running-config startup-configN�save_configTr	zconfig terminalrZFailure)r#r�
isinstance�listrr1�appendr
rr2r)r3r8ZCOPY_RSZ	prev_cmds�cmdr*Zeachr7r
r
r�proxy_config#
sH

















�







��
���


��r=c

CsL
|d
urt}z^d
}
d|dvr|dd}
nd|dvr&d�
|dd�
}
nt�d�

d}
t|dd|dd	|dd
|d�dd�|d�d
d�|
d�tt�<tt��d�
\}}t�	dt��
Wn1t
y�
}
z%t�d|dd�
t�d�

t�d|dd�
t�d|�
t�|�

�d
}~w
wdtd<|d�dd�td<d
S)z9
    Open a connection to the NX-OS switch over SSH.
    NZprompt_regexrZprompt_namez{}.*#z9nxos proxy configuration does not specify a prompt match.z.+#$�host�username�password�
key_acceptF�ssh_args�)r>r?r@rArB�promptzterminal length 0z%SSH session establised for process %s�Unable to connect to %s�Please check the following:
z@-- Verify that "feature ssh" is enabled on your NX-OS device: %s�-- Exception Generated: %sTrr8)r�formatr
�warningrrr#�_worker_namer$r�	Exceptionr)rZthis_prompt�out�err�exr
r
rrI
sD

















�








�


��

rcC�t�
d
d�S�NrF�r#rr
r
r
rrq
�
rc

Csnt�t
v
rzt�
Wn
ty


Yd
Swz	t
t�j��WSty6
}
zt�|�

WYd}~d
Sd}~w
w)NF)	rJr#rrK�connZisaliverr
r)
r7r
r
rru
s






�




��rc
C�d
S)Nz-Shutdown of ssh proxy minion is not supportedr
r
r
r
rr-�
�
r-cKs�t|t
�r|g
}d
�|�
}t�durt�
tt��|�
\}}|�dd�\}}|�	d�
\}}}t
di|�
�
}t||fi|�
�

|S)Nz ; F�

�
r
)r9�str�joinrrr#rJr$�split�
rpartitionr�_parse_output_for_errors)r3�timeoutr5�commandrLrM�
_r
r
rr1�
s













r1cCsjt�
d
|�rt|
dd|��d��
�
|r1t|t�r|g
}|D]}t�
||�r0t|
dd|��d��
�
qdSdS)zE
    Helper method to parse command output for error information
    z	% InvalidzCLI excution errorZ400)Zrejected_input�message�codeZ	cli_errorN)�re�searchr�lstripr9rX)r)r^Z
error_patternZre_liner
r
rr\�
s.



��








����r\cCs
t�
�jS�
N)�multiprocessing�current_process�namer
r
r
rrJ�
s

rJc

Cs�|�d
i�}
t
�|
�
}|�dd�
z!tddi|�
�
}|td<dtd<dtd	<|d
�d
d�td
<Wn-ty_
}
z!t�d|d�
t�d
�

t�d|d�
t�d�

t�d|�
�d}~w
wt�	dt�
dS)a�

    Open a connection to the NX-OS switch over NX-API.

    As the communication is HTTP(S) based, there is no connection to maintain,
    however, in order to test the connectivity and make sure we are able to
    bring up this Minion, we are executing a very simple command (``show clock``)
    which doesn't come with much overhead and it's sufficient to confirm we are
    indeed able to connect to the NX-API endpoint as configured.
    rZ	proxytypeN�nxos.nxapi_request�
show clock�	conn_argsTr�upr8rEr>rFzB-- Verify that "feature nxapi" is enabled on your NX-OS device: %szT-- Verify that nxapi settings on the NX-OS device and proxy minion config file matchrGznxapi DEVICE_DETAILS info: %s)
rj)
r�copy�deepcopy�pop�	__utils__r#rKr
rr)rZ
proxy_dictrkZ	rpc_replyrNr
r
rr�
s2















�
�
��

rcCrOrPrQr
r
r
rr�
rRrcCrO)NrlFrQr
r
r
rr �
rRr c
CrT)Nz/Shutdown of nxapi proxy minion is not supportedr
r
r
r
rr.�
rUr.�cli_confcKs:td
krdSt
d}|�|�

td|f
d|
i
|�
�
}|S)ag

    Executes an nxapi_request request over NX-API.

    commands
        The exec or config commands to be sent.

    method: ``cli_show``
        ``cli_show_ascii``: Return raw test or unstructured output.
        ``cli_show``: Return structured output.
        ``cli_conf``: Send configuration commands to the device.
        Defaults to ``cli_conf``.
    r	z-_nxapi_request is not available for ssh proxyrkrir4)rr#r(rp)r3r4r5rkr)r
r
rr2�
s






r2re)
r0)
rq),�__doc__rm�loggingrfrbZsalt.utils.nxosr%Zsalt.exceptionsrrZsalt.utils.argsrZ
salt.utils.vtrZsalt.utils.vt_helperr�	getLogger�__file__r
Z__proxyenabled__rr#rrrrr!r+r,r/r$r=rrrr-r1r\rJrrr r.r2r
r
r
r�<module>
sJ$










	


&(

%