o

�N�gm)�@sNdZd
dl
Z
dd�Z					ddd�
Zd	d
�Zdd�Zd
d�Zddd�
ZdS)z�
State module for Cisco NX-OS Switch Proxy and Native minions

.. versionadded:: 2016.11.0

For documentation on setting up the nxos proxy minion look in the documentation
for :mod:`salt.proxy.nxos<salt.proxy.nxos>`.
�NcCsd
tvrdSdS)N�
nxos.get_userT)Fznxos module could not be loaded)
�__salt__�rr�D/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/nxos.py�__virtual__
s


rF�sha256cCsZ|d
idd�}d
}|
du
rtd||
|d�}d
}|du
r+td|�
}	t
|�
t
|	�
k}td|�
}
t|||
g�
sCd	|d
<d|d<|S|d	urWt
|	�
t
|�
}t
|�
t
|	�
}td
d	ur�d|d
<|
s�d|d<|
du
rqd	|dd<|du
r~|gd�|dd<|S|d	ur�d|d<d	|dd<|d	ur�d|d<t|�
t|�
d�|dd<|S|d	ur�td||
||r�|dn
d||d�}
|
|
d�|dd<|d	ur�|D]	}td||�
q�|D]	}td||�
q�td|�
|	d�|dd<d	}|
du
r�td||
|d�}d	}|du
�
rtd|�
}	t
|�
t
|	�
k}|�
sd|d<|S|�
s#d|d<|Sd|d<d	|d
<|S)a�
    Ensure a user is present with the specified groups

    name
        Name of user

    password
        Encrypted or Plain Text password for user

    roles
        List of roles the user should be assigned.  Any roles not in this list will be removed

    encrypted
        Whether the password is encrypted already or not.  Defaults to False

    crypt_salt
        Salt to use when encrypting the password.  Default is None (salt is
        randomly generated for unhashed passwords)

    algorithm
        Algorithm to use for hashing password.  Defaults to sha256.
        Accepts md5, blowfish, sha256, sha512

        .. note: sha512 may make the hash too long to save in NX OS which limits the has to 64 characters

    Examples:

    .. code-block:: yaml

        create:
          nxos.user_present:
            - name: daniel
            - roles:
              - vdc-admin

        set_password:
          nxos.user_present:
            - name: daniel
            - password: admin
            - roles:
              - network-admin

        update:
          nxos.user_present:
            - name: daniel
            - password: AiN9jaoP
            - roles:
              - network-admin
              - vdc-admin

    F���name�result�changes�commentNznxos.check_password)
�	encryptedznxos.get_rolesrTrzUser already existsr
�testzUser will be createdr�password)�add�remove�rolezUser will be updated�rolesznxos.set_passwordr
)rr�
crypt_salt�	algorithm)�new�oldz
nxos.set_roleznxos.unset_rolezFailed to set correct roleszFailed to set correct passwordzUser set correctly)r�set�any�__opts__�list)r
rrrrr�retZchange_passwordZchange_rolesZ	cur_roles�old_userZremove_rolesZ	add_rolesZnew_userrZcorrect_passwordZ
correct_rolesrrr�user_presents�;


�














�





�






�	
�





�


�




�
�
rc
Cs�|d
idd�}
td|�
}|sd|
d<d|
d<|
St
d	dur7|r7d
|
d<d|
d<||
dd
<d|
dd<|
Std|�

td|�
rId|
d<|
Sd|
d<d|
d<||
dd
<d|
dd<|
S)z�
    Ensure a user is not present

    name
        username to remove if it exists

    Examples:

    .. code-block:: yaml

        delete:
          nxos.user_absent:
            - name: daniel
    Frr	rTrzUser does not existr
rNzUser will be removedrrrznxos.remove_userzFailed to remove userzUser removed�rr)r
rrrrr�user_absent�s*








�



r!c
Cs�|d
idd�}
td|�
}|rd|
d<d|
d<|
St
d	dur/d
|
d<d|
d<||
dd
<|
Std|�

td|�
}|rMd|
d<d|
d<||
dd
<|
Sd
|
d<d|
d<|
S)at
    Ensure a specific configuration line exists in the running config

    name
        config line to set

    Examples:

    .. code-block:: yaml

        add snmp group:
          nxos.config_present:
            - names:
              - snmp-server community randoSNMPstringHERE group network-operator
              - snmp-server community AnotherRandomSNMPSTring group network-admin

        add snmp acl:
          nxos.config_present:
            - names:
              - snmp-server community randoSNMPstringHERE use-acl snmp-acl-ro
              - snmp-server community AnotherRandomSNMPSTring use-acl snmp-acl-rw
    Frr	�	nxos.findTrzConfig is already setr
rNzConfig will be addedrrznxos.configzSuccessfully added configzFailed to add configr �r
r�matchesrrr�config_present�s*

�



�




�
r%c
Cs�|d
idd�}
td|�
}|sd|
d<d|
d<|
St
d	dur/d
|
d<d|
d<||
dd
<|
Std|�

td|�
}|sMd|
d<d|
d<||
dd
<|
Sd
|
d<d|
d<|
S)a�
    Ensure a specific configuration line does not exist in the running config

    name
        config line to remove

    Examples:

    .. code-block:: yaml

        add snmp group:
          nxos.config_absent:
            - names:
              - snmp-server community randoSNMPstringHERE group network-operator
              - snmp-server community AnotherRandomSNMPSTring group network-admin

    .. note::
        For certain cases extra lines could be removed based on dependencies.
        In this example, included after the example for config_present, the
        ACLs would be removed because they depend on the existence of the
        group.

    Frr	r"TrzConfig is already absentr
rNzConfig will be removedrrznxos.delete_configzSuccessfully deleted configzFailed to delete configr r#rrr�
config_absent
s*

�



�




�
r&cs��d
idd�}|d
urd��d�}n�}td|�
}|s&d|d<d	|d
<|St
ddurJd|d<d
|d
<||dd<��
fdd�|D�
|dd<|Std��
|d�|d<td|�
}|rkd
|d<d��d�|d
<|Sd|d<d���
�|d
<|S)aU
    Replace all instances of a string or full line in the running config

    name
        String to replace

    repl
        The replacement text

    full_match
        Whether `name` will match the full line or only a subset of the line.
        Defaults to False. When False, .* is added around `name` for matching
        in the `show run` config.

    Examples:

    .. code-block:: yaml

        replace snmp string:
          nxos.replace:
            - name: randoSNMPstringHERE
            - repl: NEWrandoSNMPstringHERE

        replace full snmp string:
          nxos.replace:
            - name: ^snmp-server community randoSNMPstringHERE group network-operator$
            - repl: snmp-server community NEWrandoSNMPstringHERE group network-operator
            - full_match: True

    .. note::
        The first example will replace the SNMP string on both the group and
        the ACL, so you will not lose the ACL setting.  Because the second is
        an exact match of the line, when the group is removed, the ACL is
        removed, but not readded, because it was not matched.

    Frr	z^.*z.*$r"TrzNothing found to replacer
rNzConfigs will be changedrrc
sg|]	}
t�
��
|
��qSr)�re�sub)�.0�match�r
�replrr�
<listcomp>r
szreplace.<locals>.<listcomp>rznxos.replace)
�
full_matchz$Failed to replace all instances of "�
"z5Successfully replaced all instances of "{}" with "{}")rr�format)r
r,r.r�searchr$rr+r�replace;
s4%










�

�r2)NNFNr)
F)�__doc__r'rrr!r%r&r2rrrr�<module>
s	




�,23