netdryrun 0.1.0__py3-none-any.whl

netdryrun/__init__.py

@@ -0,0 +1,3 @@
+"""NetDryRun: test network changes in a real virtual lab before they touch production."""
+
+__version__ = "0.1.0"

netdryrun/checks.py

@@ -0,0 +1,164 @@
+"""Run behavioral checks.
+
+Positive checks poll until they pass (networks need time to converge), then must pass again on
+consecutive samples so a flapping session can't pass on one lucky sample. Negative checks run
+after convergence and must hold for a whole window.
+"""
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+
+from .config import Check
+from .drivers import Driver
+
+
+@dataclass
+class Result:
+    check: Check
+    passed: bool
+    detail: str
+    attempts: int
+    duration: float
+    started: str
+    evidence: list[dict] = field(default_factory=list)  # raw outputs from the final attempt
+    history: list[dict] = field(default_factory=list)   # every sample: time offset, pass/fail, detail
+
+
+def _bgp_session(d: Driver, p: dict) -> tuple[bool, str, list]:
+    obs = d.bgp_neighbors(p.get("vrf", "default"))
+    n = obs.value.get(p["neighbor"])
+    if n is None:
+        return False, f"neighbor {p['neighbor']} not configured (seen: {', '.join(obs.value) or 'none'})", obs.evidence
+    return n.state == p["state"], f"state is {n.state}", obs.evidence
+
+
+def _bgp_prefixes(d: Driver, p: dict) -> tuple[bool, str, list]:
+    obs = d.bgp_neighbors(p.get("vrf", "default"))
+    n = obs.value.get(p["neighbor"])
+    if n is None:
+        return False, f"neighbor {p['neighbor']} not configured", obs.evidence
+    if n.state != "established":
+        # counters reset to 0 when a session drops (e.g. a max-prefix trip), so a count
+        # from a down session would satisfy "max" by accident
+        return False, f"session is {n.state}; prefix counts are only meaningful when established", obs.evidence
+    afi = p.get("afi", "ipv4-unicast")
+    count = n.prefixes.get(afi, 0)  # established but the family reports nothing: zero prefixes
+    if "exact" in p:
+        ok = count == p["exact"]
+    else:
+        ok = count >= p.get("min", 0) and ("max" not in p or count <= p["max"])
+    return ok, f"{count} {afi} prefixes accepted", obs.evidence
+
+
+def _route(d: Driver, p: dict) -> tuple[bool, str, list]:
+    obs = d.routes(p["prefix"], p.get("vrf", "default"))
+    want_proto = str(p.get("protocol", "")).lower()
+    matching = [r for r in obs.value if not want_proto or r.protocol == want_proto]
+    active = [r for r in matching if r.active]
+    if p.get("present", True):
+        if active:
+            return True, f"active via {active[0].protocol}", obs.evidence
+        seen = ", ".join(f"{r.protocol}{'' if r.active else ' (inactive)'}" for r in obs.value) or "nothing"
+        return False, f"not active{' via ' + want_proto if want_proto else ''}; seen: {seen}", obs.evidence
+    # Absent means not in the routing table at all: a received-but-not-selected route
+    # (e.g. a leaked default losing to a local one) is still a leak.
+    if matching:
+        r = matching[0]
+        return False, f"unexpectedly present via {r.protocol}{'' if r.active else ' (not selected)'}", obs.evidence
+    return True, "absent", obs.evidence
+
+
+def _ping(d: Driver, p: dict) -> tuple[bool, str, list]:
+    count = int(p.get("count", 3))
+    obs = d.ping(p["target"], p.get("source"), count, p.get("vrf", "default"))
+    sent, received = obs.value
+    if sent == 0:  # ping never ran properly (bad source address, missing VRF, ...): not a result
+        err = obs.evidence[-1].get("stderr", "").strip() if obs.evidence else ""
+        return False, f"error: ping did not run{': ' + err if err else ''}", obs.evidence
+    if p.get("expect", "success") == "success":
+        need = int(p.get("min_replies", max(1, sent - 1)))  # tolerate one lost packet (first-packet ARP)
+        return received >= need, f"{received}/{sent} replies (need {need})", obs.evidence
+    return received == 0, f"{received}/{sent} replies", obs.evidence
+
+
+EVALUATORS = {"bgp_session": _bgp_session, "bgp_prefixes": _bgp_prefixes, "route": _route, "ping": _ping}
+
+
+def is_post_convergence(check: Check) -> bool:
+    """Checks that are trivially true before the network converges, so they must run afterwards
+    and hold: "must be absent", "must fail", a session expected NOT established, and upper bounds
+    on prefix counts (0 prefixes satisfies "max: 10" while BGP is still coming up)."""
+    p = check.params
+    return (
+        (check.type == "route" and p.get("present", True) is False)
+        or (check.type == "ping" and p.get("expect", "success") == "failure")
+        or (check.type == "bgp_session" and p.get("state", "established") != "established")
+        or (check.type == "bgp_prefixes" and ("max" in p or "exact" in p))
+    )
+
+
+def _evaluate(check: Check, driver: Driver) -> tuple[bool, str, list]:
+    try:
+        return EVALUATORS[check.type](driver, check.params)
+    except Exception as e:  # a crashed check is a failed check, with the reason kept
+        return False, f"error: {e}", []
+
+
+def run_check(check: Check, driver: Driver, interval: float = 3.0, confirm: int = 2,
+              clock=time.monotonic, sleep=time.sleep) -> Result:
+    """Positive check: poll until it passes `confirm` samples in a row, or the timeout expires."""
+    started = datetime.now(timezone.utc).isoformat(timespec="seconds")
+    t0 = clock()
+    history: list[dict] = []
+    streak = 0
+    while True:
+        ok, detail, evidence = _evaluate(check, driver)
+        elapsed = clock() - t0
+        history.append({"t": round(elapsed, 1), "passed": ok, "detail": detail})
+        streak = streak + 1 if ok else 0
+        if streak >= confirm or elapsed >= check.timeout:
+            passed = streak >= confirm
+            if not passed and ok:
+                detail = f"{detail}, but not stable ({streak}/{confirm} consecutive passes before timeout)"
+            elif not passed and any(h["passed"] for h in history):
+                detail = f"{detail} (flapping: passed {sum(h['passed'] for h in history)} of {len(history)} samples)"
+            return Result(check, passed, detail, len(history), round(elapsed, 1), started, evidence, history[-50:])
+        sleep(min(interval, max(0.0, check.timeout - elapsed)))
+
+
+def hold_check(check: Check, driver: Driver, hold: float = 10.0, interval: float = 3.0,
+               clock=time.monotonic, sleep=time.sleep) -> Result:
+    """Negative check: must stay true for the whole hold window; fails at the first violation."""
+    started = datetime.now(timezone.utc).isoformat(timespec="seconds")
+    t0 = clock()
+    history: list[dict] = []
+    while True:
+        ok, detail, evidence = _evaluate(check, driver)
+        elapsed = clock() - t0
+        history.append({"t": round(elapsed, 1), "passed": ok, "detail": detail})
+        if not ok or elapsed >= hold:
+            if ok:
+                detail = f"{detail} (held {round(elapsed)}s, {len(history)} samples)"
+            return Result(check, ok, detail, len(history), round(elapsed, 1), started, evidence, history[-50:])
+        sleep(min(interval, max(0.0, hold - elapsed)))
+
+
+def converge_then_hold(check: Check, driver: Driver, hold: float = 10.0, interval: float = 3.0,
+                       clock=time.monotonic, sleep=time.sleep) -> Result:
+    """Post-convergence check: reach the expected state (e.g. prefix count up to min), then hold it.
+
+    Only prefix counts need the "reach" phase (counters ramp up). For absent routes, failing pings
+    and down sessions, a violation seen after convergence is a real failure: fail fast."""
+    if check.type != "bgp_prefixes":
+        return hold_check(check, driver, hold=check.hold or hold, interval=interval, clock=clock, sleep=sleep)
+    first = run_check(check, driver, interval=interval, confirm=1, clock=clock, sleep=sleep)
+    if not first.passed:
+        return first
+    held = hold_check(check, driver, hold=check.hold or hold, interval=interval, clock=clock, sleep=sleep)
+    held.started = first.started
+    held.duration = round(first.duration + held.duration, 1)
+    held.attempts += first.attempts
+    held.history = (first.history + held.history)[-50:]
+    return held

netdryrun/cli.py

@@ -0,0 +1,88 @@
+"""Command-line interface: netdryrun run | check | validate."""
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+from pathlib import Path
+
+from . import __version__, report
+from .config import ConfigError, load
+from .runner import run
+
+
+def _write_outputs(rep, args) -> None:
+    outputs = {"json": report.to_json, "markdown": report.to_markdown, "junit": report.to_junit}
+    for key, render in outputs.items():
+        path = getattr(args, key, None)
+        if path:
+            Path(path).write_text(render(rep), encoding="utf-8")
+            print(f"  wrote {key} report: {path}")
+    summary = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary and not args.no_step_summary:
+        with open(summary, "a", encoding="utf-8") as f:
+            f.write(report.to_markdown(rep))
+
+
+def _cmd_run(args, deploy: bool) -> int:
+    try:
+        cfg = load(args.path)
+    except ConfigError as e:
+        print(f"config error: {e}", file=sys.stderr)
+        return 2
+    print(f"NetDryRun {__version__}: {len(cfg.checks)} checks from {cfg.path}")
+    rep = run(cfg, deploy=deploy, keep=args.keep, keep_on_failure=getattr(args, 'keep_on_failure', False),
+              settle=args.settle, hold=args.hold,
+              on_result=lambda r: print(report.console_line(r), flush=True),
+              log=lambda m: print(m, flush=True))
+    print(report.summary_line(rep))
+    _write_outputs(rep, args)
+    return rep.exit_code
+
+
+def _cmd_validate(args) -> int:
+    try:
+        cfg = load(args.path)
+    except ConfigError as e:
+        print(f"config error: {e}", file=sys.stderr)
+        return 2
+    print(f"OK: {cfg.path} ({len(cfg.checks)} checks, lab {cfg.lab})")
+    for c in cfg.checks:
+        print(f"  - [{c.type}] {c.name}")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(prog="netdryrun", description="Test network changes in a real virtual lab before production.")
+    ap.add_argument("--version", action="version", version=f"netdryrun {__version__}")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+
+    def add_run_opts(p):
+        p.add_argument("path", nargs="?", default=".", help="netdryrun.yml or the folder containing it")
+        p.add_argument("--json", metavar="FILE", help="write the full evidence report as JSON")
+        p.add_argument("--markdown", metavar="FILE", help="write a Markdown summary (for PR comments)")
+        p.add_argument("--junit", metavar="FILE", help="write JUnit XML (for CI test reporting)")
+        p.add_argument("--settle", type=float, default=10.0, help="seconds to wait before negative checks (default 10)")
+        p.add_argument("--hold", type=float, default=10.0, help="seconds a negative check must hold (default 10)")
+        p.add_argument("--no-step-summary", action="store_true", help="don't append to $GITHUB_STEP_SUMMARY")
+
+    p_run = sub.add_parser("run", help="deploy the lab, run checks, destroy the lab")
+    add_run_opts(p_run)
+    p_run.add_argument("--keep", action="store_true", help="leave the lab running afterwards (for debugging)")
+    p_run.add_argument("--keep-on-failure", action="store_true", help="leave the lab running only if a check fails")
+
+    p_check = sub.add_parser("check", help="run checks against an already running lab")
+    add_run_opts(p_check)
+    p_check.set_defaults(keep=True)
+
+    p_val = sub.add_parser("validate", help="validate netdryrun.yml without running anything")
+    p_val.add_argument("path", nargs="?", default=".")
+
+    args = ap.parse_args(argv)
+    if args.cmd == "validate":
+        return _cmd_validate(args)
+    return _cmd_run(args, deploy=args.cmd == "run")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

netdryrun/config.py

@@ -0,0 +1,142 @@
+"""Load and validate netdryrun.yml."""
+from __future__ import annotations
+
+import ipaddress
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+CHECK_TYPES = {
+    "bgp_session": {"required": ("node", "neighbor"), "optional": ("state", "vrf")},
+    "bgp_prefixes": {"required": ("node", "neighbor"), "optional": ("min", "max", "exact", "afi", "vrf")},
+    "route": {"required": ("node", "prefix"), "optional": ("present", "protocol", "vrf")},
+    "ping": {"required": ("node", "target"), "optional": ("source", "expect", "vrf", "count", "min_replies")},
+}
+COMMON_KEYS = ("type", "name", "timeout", "hold")
+BGP_STATES = ("idle", "connect", "active", "opensent", "openconfirm", "established")
+
+
+class ConfigError(ValueError):
+    pass
+
+
+@dataclass
+class Check:
+    type: str
+    params: dict[str, Any]
+    name: str
+    timeout: float
+    hold: float | None = None  # per-check hold window for post-convergence checks
+
+    @property
+    def node(self) -> str:
+        return self.params["node"]
+
+
+@dataclass
+class Config:
+    path: Path
+    lab: Path
+    timeout: float
+    checks: list[Check]
+    drivers: dict[str, str] = field(default_factory=dict)  # node -> driver override
+
+
+def _describe(ctype: str, p: dict[str, Any]) -> str:
+    if ctype == "bgp_session":
+        return f"{p['node']}: BGP session to {p['neighbor']} is {p.get('state', 'established')}"
+    if ctype == "bgp_prefixes":
+        rng = []
+        if "min" in p:
+            rng.append(f">= {p['min']}")
+        if "max" in p:
+            rng.append(f"<= {p['max']}")
+        return f"{p['node']}: prefixes from {p['neighbor']} {' and '.join(rng) or 'counted'}"
+    if ctype == "route":
+        verb = "present" if p.get("present", True) else "absent"
+        via = f" via {p['protocol']}" if p.get("protocol") else ""
+        return f"{p['node']}: route {p['prefix']}{via} is {verb}"
+    if ctype == "ping":
+        exp = p.get("expect", "success")
+        src = f" from {p['source']}" if p.get("source") else ""
+        return f"{p['node']}: ping {p['target']}{src} expects {exp}"
+    return ctype
+
+
+def _validate_check(i: int, raw: Any, default_timeout: float) -> Check:
+    where = f"checks[{i}]"
+    if not isinstance(raw, dict):
+        raise ConfigError(f"{where}: must be a mapping")
+    ctype = raw.get("type")
+    if ctype not in CHECK_TYPES:
+        raise ConfigError(f"{where}: unknown type {ctype!r}; expected one of {sorted(CHECK_TYPES)}")
+    spec = CHECK_TYPES[ctype]
+    allowed = set(spec["required"]) | set(spec["optional"]) | set(COMMON_KEYS)
+    unknown = set(raw) - allowed
+    if unknown:
+        raise ConfigError(f"{where}: unknown keys {sorted(unknown)} for type {ctype}")
+    for key in spec["required"]:
+        if key not in raw:
+            raise ConfigError(f"{where}: missing required key {key!r}")
+    params = {k: v for k, v in raw.items() if k not in COMMON_KEYS}
+    try:
+        # canonical spellings so 2001:db8:0::1 in YAML matches 2001:db8::1 on the device
+        if ctype == "route":
+            params["prefix"] = str(ipaddress.ip_network(str(params["prefix"]), strict=False))
+        for key in ("neighbor", "target", "source"):
+            if key in params:
+                params[key] = str(ipaddress.ip_address(str(params[key])))
+    except ValueError as e:
+        raise ConfigError(f"{where}: {e}") from None
+    for key in ("min", "max", "exact", "count", "min_replies"):
+        if key in params and (isinstance(params[key], bool) or not isinstance(params[key], int) or params[key] < 0):
+            raise ConfigError(f"{where}: {key} must be a non-negative integer")
+    if "exact" in params and ({"min", "max"} & set(params)):
+        raise ConfigError(f"{where}: use exact on its own, or min/max, not both")
+    if params.get("min", 0) > params.get("max", float("inf")):
+        raise ConfigError(f"{where}: min is greater than max")
+    for key in ("timeout", "hold"):
+        if key in raw and (not isinstance(raw[key], (int, float)) or isinstance(raw[key], bool) or raw[key] <= 0):
+            raise ConfigError(f"{where}: {key} must be a positive number of seconds")
+    if "vrf" in params:
+        params["vrf"] = str(params["vrf"])
+    if ctype == "bgp_session":
+        params["state"] = str(params.get("state", "established")).lower()
+        if params["state"] not in BGP_STATES:
+            raise ConfigError(f"{where}: state must be one of {', '.join(BGP_STATES)}")
+    if ctype == "ping":
+        params["expect"] = str(params.get("expect", "success")).lower()
+        if params["expect"] not in ("success", "failure"):
+            raise ConfigError(f"{where}: expect must be 'success' or 'failure'")
+    if ctype == "bgp_prefixes" and not ({"min", "max", "exact"} & set(params)):
+        raise ConfigError(f"{where}: bgp_prefixes needs at least one of min, max or exact")
+    if ctype == "route" and "protocol" in params:
+        params["protocol"] = str(params["protocol"]).lower()
+    timeout = float(raw.get("timeout", default_timeout))
+    hold = float(raw["hold"]) if "hold" in raw else None
+    return Check(type=ctype, params=params, name=raw.get("name") or _describe(ctype, params), timeout=timeout, hold=hold)
+
+
+def load(path: str | Path) -> Config:
+    path = Path(path)
+    if path.is_dir():
+        path = path / "netdryrun.yml"
+    if not path.exists():
+        raise ConfigError(f"{path}: not found")
+    data = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    if not isinstance(data, dict):
+        raise ConfigError(f"{path}: top level must be a mapping")
+    if "lab" not in data:
+        raise ConfigError(f"{path}: missing 'lab' (path to the containerlab topology file)")
+    lab = (path.parent / data["lab"]).resolve()
+    if not lab.exists():
+        raise ConfigError(f"{path}: lab file {lab} not found")
+    timeout = float(data.get("timeout", 120))
+    raw_checks = data.get("checks") or []
+    if not raw_checks:
+        raise ConfigError(f"{path}: no checks defined")
+    checks = [_validate_check(i, c, timeout) for i, c in enumerate(raw_checks)]
+    drivers = {str(k): str(v.get("driver")) for k, v in (data.get("nodes") or {}).items() if isinstance(v, dict) and v.get("driver")}
+    return Config(path=path, lab=lab, timeout=timeout, checks=checks, drivers=drivers)

netdryrun/drivers/__init__.py

@@ -0,0 +1,32 @@
+"""Per-platform drivers that turn device state into a common shape."""
+from __future__ import annotations
+
+from ..lab import Lab, Node
+from .base import Driver, DriverError
+from .frr import FrrDriver
+from .srlinux import SrlDriver
+
+DRIVERS: dict[str, type[Driver]] = {"frr": FrrDriver, "srlinux": SrlDriver}
+
+
+def detect(node: Node) -> str:
+    if node.kind in ("nokia_srlinux", "srl"):
+        return "srlinux"
+    if "frr" in node.image.lower():
+        return "frr"
+    raise DriverError(
+        f"cannot detect driver for node {node.name} (kind={node.kind!r}, image={node.image!r}); "
+        f"set nodes.{node.name}.driver in netdryrun.yml to one of {sorted(DRIVERS)}"
+    )
+
+
+def for_node(lab: Lab, node: str, override: str | None = None) -> Driver:
+    if node not in lab.nodes:
+        raise DriverError(f"node {node!r} is not in the topology (nodes: {', '.join(lab.nodes)})")
+    name = override or detect(lab.nodes[node])
+    if name not in DRIVERS:
+        raise DriverError(f"unknown driver {name!r} for node {node}; expected one of {sorted(DRIVERS)}")
+    return DRIVERS[name](lab, node)
+
+
+__all__ = ["Driver", "DriverError", "DRIVERS", "detect", "for_node"]

netdryrun/drivers/base.py

@@ -0,0 +1,57 @@
+"""Driver interface. Every method returns normalized data plus the raw evidence it came from."""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from ..lab import Lab
+
+
+class DriverError(RuntimeError):
+    pass
+
+
+@dataclass
+class BgpNeighbor:
+    address: str
+    state: str                                          # lower-case, e.g. "established"
+    prefixes: dict[str, int] = field(default_factory=dict)  # afi -> accepted/received prefixes
+
+
+@dataclass
+class Route:
+    prefix: str
+    protocol: str   # lower-case, e.g. "bgp", "connected", "static"
+    active: bool
+
+
+@dataclass
+class Observation:
+    """What a driver saw, with the raw command output kept as evidence."""
+    value: object
+    evidence: list[dict]
+
+
+class Driver:
+    name = "base"
+
+    def __init__(self, lab: Lab, node: str):
+        self.lab = lab
+        self.node = node
+
+    def _exec(self, cmd: list[str], evidence: list[dict], timeout: float = 60) -> str:
+        """Run a state command; a failing command is an error, never silently 'empty state'."""
+        r = self.lab.exec(self.node, cmd, timeout=timeout)
+        evidence.append({"node": self.node, "cmd": " ".join(cmd), "rc": r.rc, "output": r.stdout[-20000:], "stderr": r.stderr[-2000:]})
+        if r.rc != 0:
+            msg = (r.stderr or r.stdout).strip().splitlines()
+            raise DriverError(f"`{' '.join(cmd)}` failed on {self.node} (rc={r.rc}): {msg[-1] if msg else 'no output'}")
+        return r.stdout
+
+    def bgp_neighbors(self, vrf: str = "default") -> Observation:
+        raise NotImplementedError
+
+    def routes(self, prefix: str, vrf: str = "default") -> Observation:
+        raise NotImplementedError
+
+    def ping(self, target: str, source: str | None, count: int, vrf: str = "default") -> Observation:
+        raise NotImplementedError

netdryrun/drivers/frr.py

@@ -0,0 +1,88 @@
+"""FRRouting driver: vtysh JSON output plus ping from the container."""
+from __future__ import annotations
+
+import ipaddress
+import json
+import re
+
+from .base import BgpNeighbor, Driver, Observation, Route
+
+AFI_NAMES = {"ipv4Unicast": "ipv4-unicast", "ipv6Unicast": "ipv6-unicast", "l2VpnEvpn": "evpn"}
+
+
+def _canon_addr(addr: str) -> str:
+    """Canonical address key so 2001:db8:0::1 and 2001:db8::1 match; non-IP keys (interfaces) kept."""
+    try:
+        return str(ipaddress.ip_address(addr.split("%")[0]))
+    except ValueError:
+        return addr
+
+
+def parse_bgp_neighbors(text: str) -> dict[str, BgpNeighbor]:
+    data = json.loads(text or "{}")
+    out = {}
+    for addr, info in data.items():
+        if not isinstance(info, dict) or "bgpState" not in info:
+            continue
+        prefixes = {}
+        for afi, af in (info.get("addressFamilyInfo") or {}).items():
+            if isinstance(af, dict) and "acceptedPrefixCounter" in af:
+                prefixes[AFI_NAMES.get(afi, afi)] = int(af["acceptedPrefixCounter"])
+        # "Idle (Admin)" -> "idle": the first word is the FSM state
+        out[_canon_addr(addr)] = BgpNeighbor(addr, str(info["bgpState"]).split()[0].lower(), prefixes)
+    return out
+
+
+def parse_routes(text: str, prefix: str) -> list[Route]:
+    data = json.loads(text or "{}")
+    if not isinstance(data, dict):
+        raise ValueError(f"unexpected vtysh route output: {text.strip()[:200]}")
+    want = ipaddress.ip_network(prefix)
+    out = []
+    for key, entries in data.items():
+        try:
+            if ipaddress.ip_network(key) != want:
+                continue
+        except ValueError:
+            continue
+        if not isinstance(entries, list):
+            raise ValueError(f"unexpected vtysh route entry for {key}: {str(entries)[:200]}")
+        out += [Route(prefix, str(e.get("protocol", "")).lower(), bool(e.get("selected")) and bool(e.get("installed", True)))
+                for e in entries]
+    return out
+
+
+def parse_ping(text: str) -> tuple[int, int]:
+    m = re.search(r"(\d+) packets transmitted, (\d+) (?:packets )?received", text)
+    return (int(m.group(1)), int(m.group(2))) if m else (0, 0)
+
+
+class FrrDriver(Driver):
+    name = "frr"
+
+    def _vtysh(self, command: str, evidence: list[dict]) -> str:
+        return self._exec(["vtysh", "-c", command], evidence)
+
+    def bgp_neighbors(self, vrf: str = "default") -> Observation:
+        ev: list[dict] = []
+        cmd = "show bgp neighbors json" if vrf == "default" else f"show bgp vrf {vrf} neighbors json"
+        return Observation(parse_bgp_neighbors(self._vtysh(cmd, ev)), ev)
+
+    def routes(self, prefix: str, vrf: str = "default") -> Observation:
+        ev: list[dict] = []
+        fam = "ipv6" if ipaddress.ip_network(prefix).version == 6 else "ip"
+        vrf_part = "" if vrf == "default" else f" vrf {vrf}"
+        text = self._vtysh(f"show {fam} route{vrf_part} {prefix} json", ev)
+        return Observation(parse_routes(text, prefix), ev)
+
+    def ping(self, target: str, source: str | None, count: int, vrf: str = "default") -> Observation:
+        ev: list[dict] = []
+        cmd = ["ping", "-c", str(count), "-W", "1"]
+        if source:
+            cmd += ["-I", source]
+        cmd.append(target)
+        if vrf != "default":
+            cmd = ["ip", "vrf", "exec", vrf, *cmd]
+        r = self.lab.exec(self.node, cmd, timeout=count * 2 + 10)
+        ev.append({"node": self.node, "cmd": " ".join(cmd), "rc": r.rc, "output": r.stdout[-5000:], "stderr": r.stderr[-1000:]})
+        return Observation(parse_ping(r.stdout), ev)

netdryrun/drivers/srlinux.py

@@ -0,0 +1,91 @@
+"""Nokia SR Linux driver: sr_cli JSON state, ping from the network-instance namespace."""
+from __future__ import annotations
+
+import ipaddress
+import json
+
+from .base import BgpNeighbor, Driver, DriverError, Observation, Route
+from .frr import _canon_addr, parse_ping
+
+# SR Linux route-type names -> the shared vocabulary used in netdryrun.yml (FRR's names)
+PROTOCOLS = {"local": "connected", "host": "local", "ospfv2": "ospf", "ospfv3": "ospf6"}
+
+
+def _json(text: str) -> dict:
+    if not text.strip():
+        return {}  # sr_cli prints nothing when the path has no entries
+    try:
+        data = json.loads(text)
+    except json.JSONDecodeError:
+        raise DriverError(f"unexpected sr_cli output: {text.strip()[:200]}") from None
+    return data if isinstance(data, dict) else {}
+
+
+def parse_bgp_neighbors(text: str) -> dict[str, BgpNeighbor]:
+    out = {}
+    for n in _json(text).get("neighbor", []):
+        prefixes = {}
+        for af in n.get("afi-safi", []):
+            if "received-routes" in af:
+                # accepted = received minus rejected by import policy (matches FRR's acceptedPrefixCounter)
+                prefixes[af["afi-safi-name"]] = int(af["received-routes"]) - int(af.get("rejected-routes", 0))
+        addr = str(n.get("peer-address", ""))
+        out[_canon_addr(addr)] = BgpNeighbor(addr, str(n.get("session-state", "")).lower(), prefixes)
+    return out
+
+
+def parse_routes(text: str, prefix: str) -> list[Route]:
+    want = ipaddress.ip_network(prefix)
+    key = "ipv6-prefix" if want.version == 6 else "ipv4-prefix"
+    out = []
+    for r in _json(text).get("route", []):
+        try:
+            if ipaddress.ip_network(str(r.get(key))) != want:
+                continue
+        except ValueError:
+            continue
+        rtype = str(r.get("route-type", "")).lower()
+        out.append(Route(prefix, PROTOCOLS.get(rtype, rtype), bool(r.get("active"))))
+    return out
+
+
+class SrlDriver(Driver):
+    name = "srlinux"
+
+    def _cli(self, command: str, evidence: list[dict]) -> str:
+        return self._exec(["sr_cli", "--output-format", "json", command], evidence)
+
+    def bgp_neighbors(self, vrf: str = "default") -> Observation:
+        ev: list[dict] = []
+        text = self._cli(f"info from state /network-instance {vrf} protocols bgp neighbor *", ev)
+        return Observation(parse_bgp_neighbors(text), ev)
+
+    def routes(self, prefix: str, vrf: str = "default") -> Observation:
+        ev: list[dict] = []
+        table = "ipv6-unicast" if ipaddress.ip_network(prefix).version == 6 else "ipv4-unicast"
+        text = self._cli(
+            f"info from state /network-instance {vrf} route-table {table} route {prefix} "
+            "id * route-type * route-owner * origin-network-instance *",
+            ev,
+        )
+        return Observation(parse_routes(text, prefix), ev)
+
+    def _netns(self, vrf: str) -> str:
+        """Linux namespace of a network-instance: srbase-<name>; some releases name default plain 'srbase'."""
+        r = self.lab.exec(self.node, ["ip", "netns", "list"], timeout=15)
+        names = {line.split()[0] for line in r.stdout.splitlines() if line.strip()}
+        wanted = f"srbase-{vrf}"
+        if wanted in names or vrf != "default":
+            return wanted
+        return "srbase" if "srbase" in names else wanted
+
+    def ping(self, target: str, source: str | None, count: int, vrf: str = "default") -> Observation:
+        ev: list[dict] = []
+        ping = "ping6" if ipaddress.ip_address(target).version == 6 else "ping"
+        cmd = ["ip", "netns", "exec", self._netns(vrf), ping, "-c", str(count), "-W", "1"]
+        if source:
+            cmd += ["-I", source]
+        cmd.append(target)
+        r = self.lab.exec(self.node, cmd, timeout=count * 2 + 10)
+        ev.append({"node": self.node, "cmd": " ".join(cmd), "rc": r.rc, "output": r.stdout[-5000:], "stderr": r.stderr[-1000:]})
+        return Observation(parse_ping(r.stdout), ev)