napalm-windows 0.2.0__tar.gz

napalm_windows-0.2.0/LICENSE

@@ -0,0 +1,191 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship made available under
+      the License, as indicated by a copyright notice that is included in
+      or attached to the work (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other transformations
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean, as submitted to the Licensor for inclusion
+      in the Work by the copyright owner or by an individual or Legal Entity
+      authorized to submit on behalf of the copyright owner. For the purposes
+      of this definition, "submitted" means any form of electronic, verbal,
+      or written communication sent to the Licensor or its representatives,
+      including but not limited to communication on electronic mailing lists,
+      source code control systems, and issue tracking systems that are managed
+      by, or on behalf of, the Licensor for the purpose of discussing and
+      improving the Work, but excluding communication that is conspicuously
+      marked or designated in writing by the copyright owner as "Not a
+      Contribution."
+
+      "Contributor" shall mean Licensor and any Legal Entity on behalf of
+      whom a Contribution has been received by the Licensor and incorporated
+      within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by the combined Contribution(s) and the Work
+      to which such Contribution(s) was submitted. If You institute patent
+      litigation against any entity (including a cross-claim or counterclaim
+      in a lawsuit) alleging that the Work or any Contribution embodied
+      within the Work constitutes direct or contributory patent infringement,
+      then any patent licenses granted to You under this License for that
+      Work shall terminate as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, You must include a readable copy of the
+          attribution notices contained within such NOTICE file, in
+          at least one of the following places: within a NOTICE text file
+          distributed as part of the Derivative Works; within the Source
+          form or documentation, if provided along with the Derivative
+          Works; or, within a display generated by the Derivative Works,
+          if and wherever such third-party notices normally appear. The
+          contents of the NOTICE file are for informational purposes only
+          and do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own license statement for Your modifications and
+      may provide additional grant of rights to use, copy, modify, merge,
+      publish, distribute, sublicense, and/or sell copies of the Work,
+      and to permit persons to whom the Work is furnished to do so,
+      subject to the following conditions:
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any conditions of TITLE,
+      MERCHANTIBILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+      See the License for the specific language governing permissions and
+      limitations under the License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or exemplary damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (even if such Contributor has been advised of the possibility
+      of such damages).
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may offer only
+      conditions consistent with this License, subject to the following
+      additional conditions:
+
+      (a) You may offer additional warranty, indemnity, or other liability
+          terms and conditions; and
+
+      (b) You may offer support for the Work in return for a fee.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format in question. It may also be
+      possible to make it available with a creative commons license.
+
+   Copyright 2026 Christian Manivong
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

napalm_windows-0.2.0/PKG-INFO

@@ -0,0 +1,130 @@
+Metadata-Version: 2.4
+Name: napalm-windows
+Version: 0.2.0
+Summary: NAPALM driver for Windows hosts via PowerShell Remoting (WinRM)
+Author-email: Christian Manivong <christian@manivong.de>
+License-Expression: Apache-2.0
+Project-URL: Repository, https://git.netork.io/NAPALM/napalm-windows
+Project-URL: Issues, https://git.netork.io/NAPALM/napalm-windows/issues
+Project-URL: Changelog, https://git.netork.io/NAPALM/napalm-windows/src/branch/main/CHANGELOG.md
+Keywords: napalm,network,automation,windows,winrm,powershell,psrp,driver
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Systems Administration
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: napalm>=4.0
+Requires-Dist: napalm-device-types>=4.21.1
+Requires-Dist: pypsrp>=0.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-cov>=5; extra == "dev"
+Requires-Dist: mypy>=1.11; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Dynamic: license-file
+
+# napalm-windows
+
+NAPALM driver for Windows Server 2016+ and Windows 10/11, part of the netOrk
+driver family built on [`napalm-device-types`](https://git.netork.io/NAPALM/napalm-device-types).
+
+Driver name: `windows` · Role: `OSDriver` · Transport: PowerShell Remoting
+(PSRP) over WinRM via [`pypsrp`](https://pypi.org/project/pypsrp/).
+
+## Tested against
+
+Not recorded yet: the fixtures under `tests/fixtures/synthetic/` are the JSON the scripts
+are designed to emit, not output recorded from a host.
+
+## Install
+
+```bash
+pip install napalm-windows
+```
+
+## How it works
+
+Every getter sends one PowerShell script. The script projects the cmdlet
+results onto flat, primitive fields and ends in `ConvertTo-Json`, so the
+Python side parses JSON, never text. All device I/O goes through a single
+seam (`PsrpTransport.run(script) -> str`), which is what the tests replace.
+
+One runspace pool stays open per connection, so a poll pays the WinRM
+handshake once.
+
+## Supported
+
+| Method | Source |
+|---|---|
+| `get_facts` | `Win32_ComputerSystem`, `Win32_OperatingSystem`, `Win32_BIOS`, registry (`DisplayVersion`, `UBR`) |
+| `get_interfaces` | `Get-NetAdapter` |
+| `get_interfaces_ip` | `Get-NetIPAddress` (loopback dropped, IPv6 zone index stripped) |
+| `get_arp_table` | `Get-NetNeighbor -AddressFamily IPv4` (broadcast, multicast, unreachable dropped) |
+| `get_route_to` | `Get-NetRoute` (multicast, broadcast, loopback dropped) |
+| `get_services` / `manage_service` | `Win32_Service`, `Start-/Stop-/Restart-Service`, `Set-Service -StartupType` |
+| `get_listening_sockets` | `Get-NetTCPConnection -State Listen`, `Get-NetUDPEndpoint`, `Get-Process`, `Win32_Service` (a shared svchost names no service) |
+
+`running_kernel` carries the full build including the update revision
+(`10.0.20348.2340`): Windows ships fixes as UBR bumps, which is what CVE
+matching has to compare against.
+
+Not yet: packages, Windows Update, scheduled tasks, health metrics, Hyper-V.
+See netork#300 for the plan.
+
+## Preparing a host
+
+WinRM is on by default on Windows Server; on Windows 10/11 run
+`Enable-PSRemoting` once. Then either
+
+* **HTTPS (5986, default)** — needs a certificate-backed HTTPS listener, or
+* **HTTP (5985)** — set the device port to 5985. Traffic is still encrypted at
+  message level (NTLM/Kerberos), credentials never travel in the clear.
+
+A **local** administrator account additionally needs
+`LocalAccountTokenFilterPolicy = 1` under
+`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System`; without it
+remote UAC strips the admin token. Domain accounts are not affected.
+
+## optional_args
+
+| Key | Default | Meaning |
+|---|---|---|
+| `port` | `5986` | WinRM port |
+| `winrm_ssl` | `port != 5985` | force HTTPS on or off |
+| `winrm_auth` | `negotiate` | pypsrp auth protocol (`negotiate`, `ntlm`, `kerberos`, `credssp`, `basic`) |
+| `ssl_verify` | `True` | validate the WinRM certificate |
+
+## Development
+
+The rules are in [STANDARDS.md](https://git.netork.io/NAPALM/driver-standard/src/branch/main/STANDARDS.md).
+
+```bash
+python -m venv .venv && .venv/bin/pip install -e ".[dev]"
+.venv/bin/pytest --cov
+```
+
+## Tests and fixtures
+
+`tests/fixtures/synthetic/` holds the JSON the scripts are *designed* to emit.
+To record the real thing from a host:
+
+```bash
+python tools/harvest.py <host> <user> <label> [--port 5985] [--insecure]
+```
+
+Output lands in `tools/harvest-out/` (gitignored); scrub it before copying
+anything into `tests/`.
+
+## License
+
+Apache-2.0, see [LICENSE](LICENSE).

napalm_windows-0.2.0/README.md

@@ -0,0 +1,95 @@
+# napalm-windows
+
+NAPALM driver for Windows Server 2016+ and Windows 10/11, part of the netOrk
+driver family built on [`napalm-device-types`](https://git.netork.io/NAPALM/napalm-device-types).
+
+Driver name: `windows` · Role: `OSDriver` · Transport: PowerShell Remoting
+(PSRP) over WinRM via [`pypsrp`](https://pypi.org/project/pypsrp/).
+
+## Tested against
+
+Not recorded yet: the fixtures under `tests/fixtures/synthetic/` are the JSON the scripts
+are designed to emit, not output recorded from a host.
+
+## Install
+
+```bash
+pip install napalm-windows
+```
+
+## How it works
+
+Every getter sends one PowerShell script. The script projects the cmdlet
+results onto flat, primitive fields and ends in `ConvertTo-Json`, so the
+Python side parses JSON, never text. All device I/O goes through a single
+seam (`PsrpTransport.run(script) -> str`), which is what the tests replace.
+
+One runspace pool stays open per connection, so a poll pays the WinRM
+handshake once.
+
+## Supported
+
+| Method | Source |
+|---|---|
+| `get_facts` | `Win32_ComputerSystem`, `Win32_OperatingSystem`, `Win32_BIOS`, registry (`DisplayVersion`, `UBR`) |
+| `get_interfaces` | `Get-NetAdapter` |
+| `get_interfaces_ip` | `Get-NetIPAddress` (loopback dropped, IPv6 zone index stripped) |
+| `get_arp_table` | `Get-NetNeighbor -AddressFamily IPv4` (broadcast, multicast, unreachable dropped) |
+| `get_route_to` | `Get-NetRoute` (multicast, broadcast, loopback dropped) |
+| `get_services` / `manage_service` | `Win32_Service`, `Start-/Stop-/Restart-Service`, `Set-Service -StartupType` |
+| `get_listening_sockets` | `Get-NetTCPConnection -State Listen`, `Get-NetUDPEndpoint`, `Get-Process`, `Win32_Service` (a shared svchost names no service) |
+
+`running_kernel` carries the full build including the update revision
+(`10.0.20348.2340`): Windows ships fixes as UBR bumps, which is what CVE
+matching has to compare against.
+
+Not yet: packages, Windows Update, scheduled tasks, health metrics, Hyper-V.
+See netork#300 for the plan.
+
+## Preparing a host
+
+WinRM is on by default on Windows Server; on Windows 10/11 run
+`Enable-PSRemoting` once. Then either
+
+* **HTTPS (5986, default)** — needs a certificate-backed HTTPS listener, or
+* **HTTP (5985)** — set the device port to 5985. Traffic is still encrypted at
+  message level (NTLM/Kerberos), credentials never travel in the clear.
+
+A **local** administrator account additionally needs
+`LocalAccountTokenFilterPolicy = 1` under
+`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System`; without it
+remote UAC strips the admin token. Domain accounts are not affected.
+
+## optional_args
+
+| Key | Default | Meaning |
+|---|---|---|
+| `port` | `5986` | WinRM port |
+| `winrm_ssl` | `port != 5985` | force HTTPS on or off |
+| `winrm_auth` | `negotiate` | pypsrp auth protocol (`negotiate`, `ntlm`, `kerberos`, `credssp`, `basic`) |
+| `ssl_verify` | `True` | validate the WinRM certificate |
+
+## Development
+
+The rules are in [STANDARDS.md](https://git.netork.io/NAPALM/driver-standard/src/branch/main/STANDARDS.md).
+
+```bash
+python -m venv .venv && .venv/bin/pip install -e ".[dev]"
+.venv/bin/pytest --cov
+```
+
+## Tests and fixtures
+
+`tests/fixtures/synthetic/` holds the JSON the scripts are *designed* to emit.
+To record the real thing from a host:
+
+```bash
+python tools/harvest.py <host> <user> <label> [--port 5985] [--insecure]
+```
+
+Output lands in `tools/harvest-out/` (gitignored); scrub it before copying
+anything into `tests/`.
+
+## License
+
+Apache-2.0, see [LICENSE](LICENSE).

napalm_windows-0.2.0/napalm_windows/__init__.py

@@ -0,0 +1,5 @@
+"""NAPALM driver for Windows hosts via PowerShell Remoting (WinRM)."""
+
+from napalm_windows.windows import WindowsDriver
+
+__all__ = ["WindowsDriver"]

napalm_windows-0.2.0/napalm_windows/transport.py

@@ -0,0 +1,122 @@
+"""PowerShell Remoting (PSRP) over WinRM — the driver's only path to the host.
+
+One runspace pool stays open for the lifetime of the connection, so a poll
+that sends a dozen scripts pays the WinRM handshake once. Everything the
+driver knows about pypsrp lives in this module; the driver itself sees a
+``run(script) -> str`` seam, which is what its tests replace and what an SSH
+transport (Windows OpenSSH) would implement later.
+"""
+
+from __future__ import annotations
+
+import logging
+
+import requests
+from napalm.base.exceptions import ConnectionClosedException, ConnectionException
+from pypsrp.exceptions import AuthenticationError, WinRMError, WinRMTransportError
+from pypsrp.powershell import PowerShell, RunspacePool
+from pypsrp.wsman import WSMan
+
+logger = logging.getLogger(__name__)
+
+
+class PowerShellError(Exception):
+    """A script ran but wrote to PowerShell's error stream."""
+
+
+class PsrpTransport:
+    def __init__(
+        self,
+        host: str,
+        username: str,
+        password: str,
+        *,
+        port: int,
+        ssl: bool,
+        cert_validation: bool,
+        auth: str,
+        timeout: int,
+    ) -> None:
+        self.host = host
+        self.username = username
+        self._password = password
+        self.port = port
+        self.ssl = ssl
+        self.cert_validation = cert_validation
+        self.auth = auth
+        self.timeout = timeout
+        self._wsman: WSMan | None = None
+        self._pool: RunspacePool | None = None
+
+    def __repr__(self) -> str:
+        scheme = "https" if self.ssl else "http"
+        return f"<PsrpTransport {self.username}@{scheme}://{self.host}:{self.port}>"
+
+    @property
+    def is_open(self) -> bool:
+        return self._pool is not None
+
+    def open(self) -> None:
+        # encryption="auto" gives message-level encryption on plain HTTP when
+        # the auth protocol supports it (NTLM/Kerberos), so 5985 does not mean
+        # credentials or output travel in the clear.
+        self._wsman = WSMan(
+            self.host,
+            port=self.port,
+            username=self.username,
+            password=self._password,
+            ssl=self.ssl,
+            auth=self.auth,
+            cert_validation=self.cert_validation,
+            connection_timeout=self.timeout,
+            read_timeout=self.timeout,
+            operation_timeout=max(self.timeout - 10, 20),
+            encryption="auto",
+        )
+        pool = RunspacePool(self._wsman)
+        try:
+            pool.open()
+        except AuthenticationError as exc:
+            self._drop()
+            raise ConnectionException(f"Authentication failed for {self.username}: {exc}") from exc
+        except WinRMTransportError as exc:
+            self._drop()
+            if exc.code == 401:
+                raise ConnectionException(
+                    f"Authentication failed for {self.username}: HTTP 401"
+                ) from exc
+            raise ConnectionException(f"WinRM error from {self.host}:{self.port}: {exc}") from exc
+        except (requests.RequestException, WinRMError, OSError) as exc:
+            self._drop()
+            raise ConnectionException(
+                f"Cannot reach WinRM on {self.host}:{self.port}: {exc}"
+            ) from exc
+        self._pool = pool
+
+    def run(self, script: str) -> str:
+        if self._pool is None:
+            raise ConnectionClosedException("WinRM connection is not open")
+        ps = PowerShell(self._pool)
+        ps.add_script(script)
+        output = ps.invoke()
+        if ps.had_errors:
+            message = "; ".join(str(e) for e in ps.streams.error).strip()
+            raise PowerShellError(message or "PowerShell reported an error")
+        return "\n".join(str(o) for o in output if o is not None)
+
+    def close(self) -> None:
+        if self._pool is not None:
+            try:
+                self._pool.close()
+            except Exception:  # a dead connection is closed enough
+                logger.debug("Closing runspace pool on %s failed", self.host, exc_info=True)
+        self._drop()
+
+    def _drop(self) -> None:
+        if self._wsman is not None:
+            try:
+                self._wsman.close()
+            except Exception:
+                logger.debug("Closing WSMan session on %s failed", self.host, exc_info=True)
+        self._wsman = None
+        self._pool = None