16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356 | class NetconfChannel(Channel, BaseNetconfChannel):
def __init__(
self,
transport: Transport,
base_channel_args: BaseChannelArgs,
netconf_base_channel_args: NetconfBaseChannelArgs,
):
super().__init__(transport=transport, base_channel_args=base_channel_args)
self._netconf_base_channel_args = netconf_base_channel_args
# always use `]]>]]>` as the initial prompt to match
self._base_channel_args.comms_prompt_pattern = "]]>]]>"
self._server_echo: Optional[bool] = None
self._establishing_server_echo = False
self._capabilities_buf = b""
self._read_buf = b""
def open_netconf(self) -> None:
"""
Open the netconf channel
Args:
N/A
Returns:
None
Raises:
N/A
"""
# open in scrapli core is where we open channel log (if applicable), do that
self.open()
raw_server_capabilities = self._get_server_capabilities()
self._process_capabilities_exchange(raw_server_capabilities=raw_server_capabilities)
self._send_client_capabilities()
@staticmethod
def _authenticate_check_hello(buf: bytes) -> bool:
"""
Check if "hello" message is in output
Args:
buf: bytes output from the channel
Returns:
bool: true if hello message is seen, otherwise false
Raises:
N/A
"""
hello_match = re.search(pattern=HELLO_MATCH, string=buf)
if hello_match:
return True
return False
@timeout_wrapper
def channel_authenticate_netconf(
self, auth_password: str, auth_private_key_passphrase: str
) -> None:
"""
Handle SSH Authentication for transports that only operate "in the channel" (i.e. system)
Args:
auth_password: password to authenticate with
auth_private_key_passphrase: passphrase for ssh key if necessary
Returns:
None
Raises:
ScrapliAuthenticationFailed: if password prompt seen more than twice
ScrapliAuthenticationFailed: if passphrase prompt seen more than twice
"""
self.logger.debug("attempting in channel netconf authentication")
password_count = 0
passphrase_count = 0
authenticate_buf = b""
with self._channel_lock():
while True:
buf = self.read()
authenticate_buf += buf.lower()
self._capabilities_buf += buf
self._ssh_message_handler(output=authenticate_buf)
if re.search(
pattern=self.auth_password_pattern,
string=authenticate_buf,
):
# clear the authentication buffer so we don't re-read the password prompt
authenticate_buf = b""
password_count += 1
if password_count > 2:
msg = "password prompt seen more than once, assuming auth failed"
self.logger.critical(msg)
raise ScrapliAuthenticationFailed(msg)
self.write(channel_input=auth_password, redacted=True)
self.send_return()
if re.search(
pattern=self.auth_passphrase_pattern,
string=authenticate_buf,
):
# clear the authentication buffer so we don't re-read the passphrase prompt
authenticate_buf = b""
passphrase_count += 1
if passphrase_count > 2:
msg = "passphrase prompt seen more than once, assuming auth failed"
self.logger.critical(msg)
raise ScrapliAuthenticationFailed(msg)
self.write(channel_input=auth_private_key_passphrase, redacted=True)
self.send_return()
if self._authenticate_check_hello(buf=authenticate_buf):
self.logger.info(
"found start of server capabilities, authentication successful"
)
return
@timeout_wrapper
def _get_server_capabilities(self) -> bytes:
"""
Read until all server capabilities have been sent by server
Args:
N/A
Returns:
bytes: raw bytes containing server capabilities
Raises:
N/A
"""
capabilities_buf = self._capabilities_buf
# reset this to empty to avoid any confusion now that we are moving on
self._capabilities_buf = b""
with self._channel_lock():
while b"]]>]]>" not in capabilities_buf:
capabilities_buf += self.read()
capabilities_buf, _, over_read_buf = capabilities_buf.partition(b"]]>]]>")
if over_read_buf:
self._read_buf += over_read_buf
self.logger.debug(f"received raw server capabilities: {repr(capabilities_buf)}")
return capabilities_buf
@timeout_wrapper
def _send_client_capabilities(
self,
) -> None:
"""
Send client capabilities to the netconf server
Args:
N/A
Returns:
None
Raises:
N/A
"""
with self._channel_lock():
bytes_client_capabilities = self._pre_send_client_capabilities(
client_capabilities=self._netconf_base_channel_args.client_capabilities
)
self._read_until_input(channel_input=bytes_client_capabilities)
self.send_return()
def read(self) -> bytes:
"""
Read chunks of output from the channel
Prior to super-ing "normal" scrapli read, check if there is anything on our read_buf, if
there is, return that first
Args:
N/A
Returns:
bytes: output read from channel
Raises:
N/A
"""
if self._read_buf:
read_buf = self._read_buf
self._read_buf = b""
return read_buf
return super().read()
def _read_until_input(self, channel_input: bytes) -> bytes:
"""
Sync read until all input has been entered.
Args:
channel_input: string to write to channel
Returns:
bytes: output read from channel
Raises:
N/A
"""
output = b""
if self._server_echo is None or self._server_echo is False:
# if server_echo is `None` we dont know if the server echoes yet, so just return nothing
# if its False we know it doesnt echo and we can return empty byte string anyway
return output
if not channel_input:
self.logger.info(f"Read: {repr(output)}")
return output
while True:
output += self.read()
if self._establishing_server_echo:
output, partition, new_buf = output.partition(b"]]>]]>")
self._read_buf += new_buf
output += partition
break
# if we have all the input *or* we see the closing rpc tag we know we are done here
if channel_input in output or b"rpc>" in output:
break
self.logger.info(f"Read: {repr(output)}")
return output
def send_input_netconf(self, channel_input: str) -> bytes: # noqa: mccabe
"""
Send inputs to netconf server
Args:
channel_input: string of the base xml message to send to netconf server
Returns:
bytes: bytes result of message sent to netconf server
Raises:
ScrapliTimeout: re-raises channel timeouts with additional message if channel input may
be big enough to require setting `use_compressed_parser` to false -- note that this
has only been seen as an issue with NXOS so far.
"""
bytes_final_channel_input = channel_input.encode()
buf: bytes
buf, _ = super().send_input(channel_input=channel_input, strip_prompt=False, eager=True)
if bytes_final_channel_input in buf:
# if we got the input AND the rpc-reply we can strip out our inputs so we just have the
# reply remaining
buf = buf.split(bytes_final_channel_input)[1]
try:
buf = self._read_until_prompt(buf=buf)
except ScrapliTimeout as exc:
if len(channel_input) >= 4096:
msg = (
"timed out finding prompt after sending input, input is greater than 4096 "
"chars, try setting 'use_compressed_parser' to False"
)
self.logger.info(msg)
raise ScrapliTimeout(msg) from exc
raise ScrapliTimeout from exc
if self._server_echo is None:
# At least per early drafts of the netconf over ssh rfcs the netconf servers MUST NOT
# echo the input commands back to the client. In the case of "normal" scrapli netconf
# with the system transport this happens anyway because we combine the stdin and stdout
# fds into a single pty, however for other transports we have an actual stdin and
# stdout fd to read/write. It seems that at the very least IOSXE with NETCONF 1.1 seems
# to want to echo inputs back onto to the stdout for the channel. This is totally ok
# and we can deal with it, we just need to *know* that it is happening, so while the
# _server_echo attribute is still `None`, we can go ahead and see if the input we sent
# is in the output we read off the channel. If it is *not* we know the server does *not*
# echo and we can move on. If it *is* in the output, we know the server echoes, and we
# also have one additional step in that we need to read "until prompt" again in order to
# capture the reply to our rpc.
#
# See: https://tools.ietf.org/html/draft-ietf-netconf-ssh-02 (search for "echo")
self.logger.debug("server echo is unset, determining if server echoes inputs now")
# we may be reading the remainder of the echo from our capabilities message -- if we see
# that we know the server echoes, but we still need to read until our latest input.
if b"</hello>]]>]]>" in buf:
self.logger.debug("server echoes inputs, setting _server_echo to 'true'")
self._server_echo = True
_, _, buf = buf.partition(b"</hello>]]>]]>")
if buf:
# if we read past the end of the
self._read_buf += buf
# read up till our new input now to consume it from the channel
self._establishing_server_echo = True
self._read_until_input(bytes_final_channel_input)
elif bytes_final_channel_input in buf:
self.logger.debug("server echoes inputs, setting _server_echo to 'true'")
self._server_echo = True
else:
self.logger.debug("server does *not* echo inputs, setting _server_echo to 'false'")
self._server_echo = False
if self._server_echo:
# done with the establishment process
self._establishing_server_echo = False
# since echo is True and we only read until our input (because our inputs always end
# with a "prompt" that we read until) we need to once again read until prompt, this
# read will read all the way up through the *reply* to the prompt at end of the
# reply message
buf = self._read_until_prompt(buf=b"")
if self._netconf_base_channel_args.netconf_version == NetconfVersion.VERSION_1_1:
# netconf 1.1 with "chunking" style message format needs an extra return char here
self.send_return()
# we should be able to simply partition here and put any "over reads" back into the read buf
return buf
|