netbox-toolkit-plugin 0.1.0__py3-none-any.whl → 0.1.2__py3-none-any.whl

{netbox_toolkit → netbox_toolkit_plugin}/services/rate_limiting_service.py

@@ -7,38 +7,40 @@ from ..models import CommandLog
 
 class RateLimitingService:
     """Service for managing command execution rate limiting"""
-    
+
     def __init__(self):
         """Initialize the rate limiting service with plugin settings"""
-        self.plugin_settings = getattr(settings, 'PLUGINS_CONFIG', {}).get('netbox_toolkit', {})
-    
+        self.plugin_settings = getattr(settings, "PLUGINS_CONFIG", {}).get(
+            "netbox_toolkit_plugin", {}
+        )
+
     def is_rate_limiting_enabled(self):
         """Check if rate limiting is enabled in plugin settings"""
-        return self.plugin_settings.get('rate_limiting_enabled', False)
-    
+        return self.plugin_settings.get("rate_limiting_enabled", False)
+
     def get_device_command_limit(self):
         """Get the maximum number of commands allowed per device within the time window"""
-        return self.plugin_settings.get('device_command_limit', 10)
-    
+        return self.plugin_settings.get("device_command_limit", 10)
+
     def get_time_window_minutes(self):
         """Get the time window in minutes for rate limiting"""
-        return self.plugin_settings.get('time_window_minutes', 5)
-    
+        return self.plugin_settings.get("time_window_minutes", 5)
+
     def get_bypass_users(self):
         """Get list of usernames that bypass rate limiting"""
-        return self.plugin_settings.get('bypass_users', [])
-    
+        return self.plugin_settings.get("bypass_users", [])
+
     def get_bypass_groups(self):
         """Get list of group names that bypass rate limiting"""
-        return self.plugin_settings.get('bypass_groups', [])
-    
+        return self.plugin_settings.get("bypass_groups", [])
+
     def user_bypasses_rate_limiting(self, user):
         """
         Check if a user bypasses rate limiting based on username or group membership
-        
+
         Args:
             user: Django User object
-            
+
         Returns:
             bool: True if user bypasses rate limiting, False otherwise
         """
@@ -46,49 +48,49 @@ class RateLimitingService:
         bypass_users = self.get_bypass_users()
         if user.username in bypass_users:
             return True
-        
+
         # Check if user is in any bypass groups
         bypass_groups = self.get_bypass_groups()
         if bypass_groups:
-            user_groups = user.groups.values_list('name', flat=True)
+            user_groups = user.groups.values_list("name", flat=True)
             if any(group in bypass_groups for group in user_groups):
                 return True
-        
+
         return False
-    
+
     def get_recent_command_count(self, device, user=None):
         """
         Get the number of successful commands executed on a device within the time window
-        
+
         Args:
             device: Device object
             user: Optional User object to count only commands by this user
-            
+
         Returns:
             int: Number of recent successful commands
         """
         time_window = self.get_time_window_minutes()
         cutoff_time = timezone.now() - timedelta(minutes=time_window)
-        
+
         query = CommandLog.objects.filter(
             device=device,
             execution_time__gte=cutoff_time,
-            success=True  # Only count successful commands
+            success=True,  # Only count successful commands
         )
-        
+
         if user:
             query = query.filter(username=user.username)
-        
+
         return query.count()
-    
+
     def check_rate_limit(self, device, user):
         """
         Check if a command execution would exceed rate limits
-        
+
         Args:
             device: Device object to check rate limits for
             user: User object attempting to execute the command
-            
+
         Returns:
             dict: {
                 'allowed': bool,
@@ -101,128 +103,133 @@ class RateLimitingService:
         # If rate limiting is disabled, always allow
         if not self.is_rate_limiting_enabled():
             return {
-                'allowed': True,
-                'current_count': 0,
-                'limit': self.get_device_command_limit(),
-                'time_window_minutes': self.get_time_window_minutes(),
-                'reason': 'Rate limiting disabled'
+                "allowed": True,
+                "current_count": 0,
+                "limit": self.get_device_command_limit(),
+                "time_window_minutes": self.get_time_window_minutes(),
+                "reason": "Rate limiting disabled",
             }
-        
+
         # If user bypasses rate limiting, always allow
         if self.user_bypasses_rate_limiting(user):
             return {
-                'allowed': True,
-                'current_count': 0,
-                'limit': self.get_device_command_limit(),
-                'time_window_minutes': self.get_time_window_minutes(),
-                'reason': 'User bypasses rate limiting'
+                "allowed": True,
+                "current_count": 0,
+                "limit": self.get_device_command_limit(),
+                "time_window_minutes": self.get_time_window_minutes(),
+                "reason": "User bypasses rate limiting",
             }
-        
+
         # Check current command count
         current_count = self.get_recent_command_count(device)
         limit = self.get_device_command_limit()
         time_window = self.get_time_window_minutes()
-        
+
         if current_count >= limit:
             return {
-                'allowed': False,
-                'current_count': current_count,
-                'limit': limit,
-                'time_window_minutes': time_window,
-                'reason': f'Rate limit exceeded: {current_count}/{limit} successful commands in last {time_window} minutes'
+                "allowed": False,
+                "current_count": current_count,
+                "limit": limit,
+                "time_window_minutes": time_window,
+                "reason": f"Rate limit exceeded: {current_count}/{limit} successful commands in last {time_window} minutes",
             }
-        
+
         return {
-            'allowed': True,
-            'current_count': current_count,
-            'limit': limit,
-            'time_window_minutes': time_window,
-            'reason': 'Within rate limits'
+            "allowed": True,
+            "current_count": current_count,
+            "limit": limit,
+            "time_window_minutes": time_window,
+            "reason": "Within rate limits",
         }
-    
+
     def get_rate_limit_status(self, device, user):
         """
         Get rate limit status for display in UI
-        
+
         Args:
             device: Device object
             user: User object
-            
+
         Returns:
             dict: Rate limit status information for UI display
         """
         if not self.is_rate_limiting_enabled():
-            return {
-                'enabled': False,
-                'message': 'Rate limiting is disabled'
-            }
-        
+            return {"enabled": False, "message": "Rate limiting is disabled"}
+
         if self.user_bypasses_rate_limiting(user):
             return {
-                'enabled': True,
-                'bypassed': True,
-                'message': 'You have unlimited command execution (bypass enabled)'
+                "enabled": True,
+                "bypassed": True,
+                "message": "You have unlimited command execution (bypass enabled)",
             }
-        
+
         current_count = self.get_recent_command_count(device)
         limit = self.get_device_command_limit()
         time_window = self.get_time_window_minutes()
         remaining = max(0, limit - current_count)
-        
+
         # Determine status and appropriate message
         if current_count >= limit:
-            status = 'exceeded'
+            status = "exceeded"
             # Get time until reset for exceeded status
             time_until_reset = self.get_time_until_reset(device)
             if time_until_reset:
                 minutes_until_reset = int(time_until_reset.total_seconds() / 60) + 1
-                message = f'Rate limit exceeded! ({current_count}/{limit} successful commands) - Try again in {minutes_until_reset} minutes'
+                message = f"Rate limit exceeded! ({current_count}/{limit} successful commands) - Try again in {minutes_until_reset} minutes"
             else:
-                message = f'Rate limit exceeded! ({current_count}/{limit} successful commands in last {time_window} minutes)'
-        elif remaining <= 2 and current_count < limit:  # Only warning if we haven't exceeded the limit
-            status = 'warning'
-            message = f'{remaining} commands remaining ({current_count}/{limit} successful commands in last {time_window} minutes)'
+                message = f"Rate limit exceeded! ({current_count}/{limit} successful commands in last {time_window} minutes)"
+        elif (
+            remaining <= 2 and current_count < limit
+        ):  # Only warning if we haven't exceeded the limit
+            status = "warning"
+            message = f"{remaining} commands remaining ({current_count}/{limit} successful commands in last {time_window} minutes)"
         else:
-            status = 'normal'
-            message = f'{remaining} commands remaining ({current_count}/{limit} successful commands in last {time_window} minutes)'
-        
+            status = "normal"
+            message = f"{remaining} commands remaining ({current_count}/{limit} successful commands in last {time_window} minutes)"
+
         return {
-            'enabled': True,
-            'bypassed': False,
-            'current_count': current_count,
-            'limit': limit,
-            'remaining': remaining,
-            'time_window_minutes': time_window,
-            'status': status,
-            'message': message,
-            'is_exceeded': current_count >= limit,
-            'is_warning': remaining <= 2 and current_count < limit,
-            'time_until_reset': self.get_time_until_reset(device) if current_count >= limit else None,
+            "enabled": True,
+            "bypassed": False,
+            "current_count": current_count,
+            "limit": limit,
+            "remaining": remaining,
+            "time_window_minutes": time_window,
+            "status": status,
+            "message": message,
+            "is_exceeded": current_count >= limit,
+            "is_warning": remaining <= 2 and current_count < limit,
+            "time_until_reset": self.get_time_until_reset(device)
+            if current_count >= limit
+            else None,
         }
-    
+
     def get_time_until_reset(self, device):
         """
         Get the time until the rate limit resets (oldest successful command in window expires)
-        
+
         Args:
             device: Device object
-            
+
         Returns:
             timedelta or None: Time until oldest successful command expires, None if no recent successful commands
         """
         time_window = self.get_time_window_minutes()
         cutoff_time = timezone.now() - timedelta(minutes=time_window)
-        
-        oldest_command = CommandLog.objects.filter(
-            device=device,
-            execution_time__gte=cutoff_time,
-            success=True  # Only consider successful commands
-        ).order_by('execution_time').first()
-        
+
+        oldest_command = (
+            CommandLog.objects.filter(
+                device=device,
+                execution_time__gte=cutoff_time,
+                success=True,  # Only consider successful commands
+            )
+            .order_by("execution_time")
+            .first()
+        )
+
         if not oldest_command:
             return None
-        
+
         reset_time = oldest_command.execution_time + timedelta(minutes=time_window)
         time_until_reset = reset_time - timezone.now()
-        
+
         return time_until_reset if time_until_reset > timedelta(0) else None

netbox_toolkit_plugin/settings.py

@@ -0,0 +1,176 @@
+"""Configuration settings for the NetBox Toolkit plugin."""
+
+from typing import Any
+
+from django.conf import settings
+
+# Plugin metadata - required by NetBox's plugin discovery system
+__version__ = "0.1.1"
+__author__ = "Andy Norwood"
+
+# Make these available as module-level attributes for NetBox's plugin system
+version = __version__
+author = __author__
+release_track = "stable"  # or "beta", "alpha" - indicates the release track
+
+
+class ToolkitSettings:
+    """Configuration class for toolkit settings."""
+
+    # Default connection timeouts
+    DEFAULT_TIMEOUTS = {
+        "socket": 15,
+        "transport": 15,
+        "ops": 30,
+        "banner": 15,
+        "auth": 15,
+    }
+
+    # Device-specific timeout overrides
+    DEVICE_TIMEOUTS = {
+        "catalyst": {
+            "socket": 20,
+            "transport": 20,
+            "ops": 45,
+        },
+        "nexus": {
+            "socket": 25,
+            "transport": 25,
+            "ops": 60,
+        },
+    }
+
+    # SSH transport options
+    SSH_TRANSPORT_OPTIONS = {
+        "disabled_algorithms": {
+            "kex": [],  # Don't disable any key exchange methods
+        },
+        "allowed_kex": [
+            # Modern algorithms
+            "diffie-hellman-group-exchange-sha256",
+            "diffie-hellman-group16-sha512",
+            "diffie-hellman-group18-sha512",
+            "diffie-hellman-group14-sha256",
+            # Legacy algorithms for older devices
+            "diffie-hellman-group-exchange-sha1",
+            "diffie-hellman-group14-sha1",
+            "diffie-hellman-group1-sha1",
+        ],
+    }
+
+    # Netmiko configuration for fallback connections
+    NETMIKO_CONFIG = {
+        "banner_timeout": 20,
+        "auth_timeout": 20,
+        "global_delay_factor": 1,
+        "use_keys": False,  # Disable SSH key authentication
+        "allow_agent": False,  # Disable SSH agent
+        # Session logging (disabled by default)
+        "session_log": None,
+        # Connection options for legacy devices
+        "fast_cli": False,  # Disable for older devices
+        "session_log_record_writes": False,
+        "session_log_file_mode": "write",
+    }
+
+    # Retry configuration
+    RETRY_CONFIG = {
+        "max_retries": 2,
+        "retry_delay": 1,  # Reduced from 3s to 1s for faster fallback
+        "backoff_multiplier": 1.5,  # Reduced from 2 to 1.5 for faster progression
+    }
+
+    # Fast connection test timeouts (for initial Scrapli viability testing)
+    FAST_TEST_TIMEOUTS = {
+        "socket": 8,  # Reduced from 15s to 8s for faster detection
+        "transport": 8,  # Reduced from 15s to 8s for faster detection
+        "ops": 15,  # Keep ops timeout reasonable for actual commands
+    }
+
+    # Error patterns that should trigger immediate fallback to Netmiko
+    SCRAPLI_FAST_FAIL_PATTERNS = [
+        "No matching key exchange",
+        "No matching cipher",
+        "No matching MAC",
+        "connection not opened",
+        "Error reading SSH protocol banner",
+        "Connection refused",
+        "Operation timed out",
+        "SSH handshake failed",
+        "Protocol version not supported",
+        "Unable to connect to port 22",
+        "Name or service not known",
+        "Network is unreachable",
+    ]
+
+    # Platform mappings for better recognition
+    PLATFORM_ALIASES = {
+        "ios": "cisco_ios",
+        "iosxe": "cisco_ios",
+        "nxos": "cisco_nxos",
+        "iosxr": "cisco_iosxr",
+        "junos": "juniper_junos",
+        "eos": "arista_eos",
+    }
+
+    @classmethod
+    def get_fast_test_timeouts(cls) -> dict[str, int]:
+        """Get fast connection test timeouts for initial viability testing."""
+        return cls.FAST_TEST_TIMEOUTS.copy()
+
+    @classmethod
+    def should_fast_fail_to_netmiko(cls, error_message: str) -> bool:
+        """Check if error message indicates immediate fallback to Netmiko is needed."""
+        error_lower = error_message.lower()
+        return any(
+            pattern.lower() in error_lower for pattern in cls.SCRAPLI_FAST_FAIL_PATTERNS
+        )
+
+    @classmethod
+    def get_timeouts_for_device(cls, device_type_model: str = "") -> dict[str, int]:
+        """Get timeout configuration for a specific device type."""
+        timeouts = cls.DEFAULT_TIMEOUTS.copy()
+
+        if device_type_model:
+            model_lower = device_type_model.lower()
+            for device_keyword, custom_timeouts in cls.DEVICE_TIMEOUTS.items():
+                if device_keyword in model_lower:
+                    timeouts.update(custom_timeouts)
+                    break
+
+        return timeouts
+
+    @classmethod
+    def normalize_platform(cls, platform: str) -> str:
+        """Normalize platform name using aliases."""
+        if not platform:
+            return ""
+
+        platform_lower = platform.lower()
+        return cls.PLATFORM_ALIASES.get(platform_lower, platform_lower)
+
+    @classmethod
+    def get_ssh_options(cls) -> dict[str, Any]:
+        """Get SSH transport options."""
+        return cls.SSH_TRANSPORT_OPTIONS.copy()
+
+    @classmethod
+    def get_retry_config(cls) -> dict[str, int]:
+        """Get retry configuration."""
+        return cls.RETRY_CONFIG.copy()
+
+    @classmethod
+    def get_ssh_transport_options(cls) -> dict[str, Any]:
+        """Get SSH transport options for Scrapli."""
+        user_config = getattr(settings, "PLUGINS_CONFIG", {}).get(
+            "netbox_toolkit_plugin", {}
+        )
+        return {**cls.SSH_TRANSPORT_OPTIONS, **user_config.get("ssh_options", {})}
+
+    @classmethod
+    def get_netmiko_config(cls) -> dict[str, Any]:
+        """Get Netmiko configuration for fallback connections."""
+        user_config = getattr(settings, "PLUGINS_CONFIG", {}).get(
+            "netbox_toolkit_plugin", {}
+        )
+        return {**cls.NETMIKO_CONFIG, **user_config.get("netmiko", {})}

netbox_toolkit_plugin/tables.py

@@ -0,0 +1,51 @@
+import django_tables2 as tables
+from netbox.tables import NetBoxTable, columns
+from .models import Command, CommandLog
+
+
+class CommandTable(NetBoxTable):
+    name = tables.Column(
+        linkify=("plugins:netbox_toolkit_plugin:command_detail", [tables.A("pk")])
+    )
+    platform = tables.Column(linkify=True)
+    command_type = tables.Column()
+
+    class Meta(NetBoxTable.Meta):
+        model = Command
+        fields = ("pk", "id", "name", "platform", "command_type", "description")
+        default_columns = ("pk", "name", "platform", "command_type", "description")
+
+
+class CommandLogTable(NetBoxTable):
+    command = tables.Column(
+        linkify=(
+            "plugins:netbox_toolkit_plugin:command_detail",
+            [tables.A("command.pk")],
+        )
+    )
+    device = tables.Column(linkify=True)
+    success = tables.BooleanColumn(verbose_name="Status", yesno=("Success", "Failed"))
+
+    # Remove actions column entirely
+    actions = False
+
+    class Meta(NetBoxTable.Meta):
+        model = CommandLog
+        fields = (
+            "pk",
+            "id",
+            "command",
+            "device",
+            "username",
+            "execution_time",
+            "success",
+            "execution_duration",
+        )
+        default_columns = (
+            "pk",
+            "command",
+            "device",
+            "username",
+            "execution_time",
+            "success",
+        )

netbox_toolkit_plugin/templates/netbox_toolkit/command.html

@@ -0,0 +1,108 @@
+{% extends 'generic/object.html' %}
+{% load helpers %}
+{% load static %}
+
+{% block style %}
+<link href="{% static 'netbox_toolkit_plugin/css/toolkit.css' %}" rel="stylesheet">
+{% endblock %}
+
+{% block buttons %}
+{% if perms.netbox_toolkit_plugin.change_command %}
+<a href="{% url 'plugins:netbox_toolkit_plugin:command_edit' pk=object.pk %}" class="btn btn-warning">
+  <i class="mdi mdi-pencil" aria-hidden="true"></i> Edit
+</a>
+{% endif %}
+{% if perms.netbox_toolkit_plugin.delete_command %}
+<a href="{% url 'plugins:netbox_toolkit_plugin:command_delete' pk=object.pk %}" class="btn btn-danger">
+  <i class="mdi mdi-trash-can-outline" aria-hidden="true"></i> Delete
+</a>
+{% endif %}
+{% endblock %}
+
+{% block content %}
+<div class="row mb-3">
+  <div class="col col-md-6">
+    <div class="card">
+      <div class="card-header">
+        <h3 class="card-title">Command</h3>
+      </div>
+      <div class="card-body">
+        <table class="table table-hover attr-table">
+          <tr>
+            <th scope="row">Name</th>
+            <td>{{ object.name }}</td>
+          </tr>
+          <tr>
+            <th scope="row">Platform</th>
+            <td>{{ object.platform|linkify }}</td>
+          </tr>
+          <tr>
+            <th scope="row">Command Type</th>
+            <td>
+              {{ object.get_command_type_display }}
+              {% if can_execute %}
+              <span class="badge bg-success ms-2">
+                <i class="mdi mdi-check"></i> Executable
+              </span>
+              {% else %}
+              <span class="badge bg-secondary ms-2">
+                <i class="mdi mdi-lock"></i> No Execute Permission
+              </span>
+              {% endif %}
+            </td>
+          </tr>
+          <tr>
+            <th scope="row">Description</th>
+            <td>{{ object.description|placeholder }}</td>
+          </tr>
+        </table>
+      </div>
+    </div>
+    {% include 'inc/panels/custom_fields.html' %}
+    {% include 'inc/panels/tags.html' %}
+  </div>
+  <div class="col col-md-6">
+    <div class="card">
+      <div class="card-header">
+        <h3 class="card-title">Command Detail</h3>
+      </div>
+      <div class="card-body">
+        <pre>{{ object.command }}</pre>
+      </div>
+    </div>
+  </div>
+</div>
+<div class="row">
+  <div class="col col-md-12">
+    <div class="card">
+      <div class="card-header">
+        <h3 class="card-title">Recent Command Logs</h3>
+      </div>
+      <div class="card-body">
+        <table class="table table-hover table-headings">
+          <thead>
+            <tr>
+              <th>Device</th>
+              <th>Username</th>
+              <th>Execution Time</th>
+            </tr>
+          </thead>
+          <tbody>
+            {% for log in object.logs.all|slice:":5" %}
+            <tr>
+              <td>{{ log.device|linkify }}</td>
+              <td>{{ log.username }}</td>
+              <td>{{ log.execution_time }}</td>
+            </tr>
+            {% empty %}
+            <tr>
+              <td colspan="3" class="text-muted">No command executions recorded</td>
+            </tr>
+            {% endfor %}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </div>
+</div>
+{% endblock %}

netbox_toolkit_plugin/templates/netbox_toolkit/command_list.html

@@ -0,0 +1,12 @@
+{% extends 'generic/object_list.html' %}
+{% load helpers %}
+
+{% block title %}Commands{% endblock %}
+
+{% block buttons %}
+{% if perms.netbox_toolkit_plugin.add_command %}
+<a href="{% url 'plugins:netbox_toolkit_plugin:command_add' %}" class="btn btn-primary">
+  <span class="mdi mdi-plus-thick" aria-hidden="true"></span> Add Command
+</a>
+{% endif %}
+{% endblock %}