python-netgear-switch-library 0.0.post154__py3-none-any.whl

netgear_switch/protocols/nsdp/parsers.py

@@ -0,0 +1,209 @@
+"""Per-tag NSDP byte parsers. Lifted from ``gdoc2netcfg/src/nsdp/parsers.py``,
+plus ``ports_to_bitmap`` (the write-path inverse of ``bitmap_to_ports``).
+
+Every parser is total over the bytes it accepts and raises ``ValueError`` on a
+wrong length or a bad prefix, so a malformed TLV surfaces early rather than
+producing a silently-wrong value.
+"""
+from __future__ import annotations
+
+import socket
+import struct
+from typing import TYPE_CHECKING
+
+from .protocol import Tag
+from .types import (
+    LinkSpeed,
+    NsdpDevice,
+    NsdpIgmpSnooping,
+    NsdpPortMirroring,
+    NsdpPortPvid,
+    NsdpPortStatistics,
+    NsdpPortStatus,
+    NsdpVlanMembership,
+    VLANEngine,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import Iterable
+
+    from .protocol import NSDPPacket
+
+
+def parse_ipv4(data: bytes) -> str:
+    if len(data) != 4:
+        raise ValueError(f"IPv4 TLV must be 4 bytes, got {len(data)}")
+    return socket.inet_ntoa(data)
+
+
+def parse_mac(data: bytes) -> str:
+    if len(data) != 6:
+        raise ValueError(f"MAC TLV must be 6 bytes, got {len(data)}")
+    return ":".join(f"{b:02x}" for b in data)
+
+
+def parse_port_status(data: bytes) -> NsdpPortStatus:
+    if len(data) != 3:
+        raise ValueError(f"PORT_STATUS TLV must be 3 bytes, got {len(data)}")
+    return NsdpPortStatus(port_id=data[0], speed=LinkSpeed.from_byte(data[1]))
+
+
+def parse_port_statistics(data: bytes) -> NsdpPortStatistics:
+    if len(data) != 49:
+        raise ValueError(f"PORT_STATISTICS TLV must be 49 bytes, got {len(data)}")
+    rx, tx, crc = struct.unpack_from(">QQQ", data, 1)
+    return NsdpPortStatistics(
+        port_id=data[0], bytes_received=rx, bytes_sent=tx, crc_errors=crc
+    )
+
+
+def parse_port_pvid(data: bytes) -> NsdpPortPvid:
+    if len(data) != 3:
+        raise ValueError(f"PORT_PVID TLV must be 3 bytes, got {len(data)}")
+    return NsdpPortPvid(port_id=data[0], vlan_id=struct.unpack_from(">H", data, 1)[0])
+
+
+def parse_serial(data: bytes) -> str:
+    if not data or data[0] != 0x01:
+        raise ValueError(f"SERIAL_NUMBER TLV: unexpected prefix byte {data[:1]!r}")
+    return data[1:].decode("ascii", errors="replace").rstrip("\x00")
+
+
+def bitmap_to_ports(bitmap: bytes) -> frozenset[int]:
+    """MSB-first, 1-based: byte 0 bit 0x80 = port 1 ... 0x01 = port 8."""
+    ports: set[int] = set()
+    for byte_idx, byte_val in enumerate(bitmap):
+        for bit in range(8):
+            if byte_val & (0x80 >> bit):
+                ports.add(byte_idx * 8 + bit + 1)
+    return frozenset(ports)
+
+
+def ports_to_bitmap(ports: Iterable[int], width_bytes: int) -> bytes:
+    """Inverse of ``bitmap_to_ports`` for the write path (same MSB-first layout)."""
+    data = bytearray(width_bytes)
+    for p in ports:
+        byte_idx, bit = divmod(p - 1, 8)
+        while byte_idx >= len(data):
+            data.append(0)
+        data[byte_idx] |= 0x80 >> bit
+    return bytes(data)
+
+
+def parse_vlan_members(data: bytes, port_count: int = 8) -> NsdpVlanMembership:
+    bitmap_bytes = (port_count + 7) // 8
+    expected = 2 + bitmap_bytes * 2
+    if len(data) < expected:
+        raise ValueError(
+            f"VLAN_MEMBERS TLV must be >={expected} bytes for {port_count} ports, "
+            f"got {len(data)}"
+        )
+    vlan_id = struct.unpack_from(">H", data, 0)[0]
+    member = data[2 : 2 + bitmap_bytes]
+    tagged = data[2 + bitmap_bytes : 2 + bitmap_bytes * 2]
+    return NsdpVlanMembership(
+        vlan_id=vlan_id,
+        member_ports=bitmap_to_ports(member),
+        tagged_ports=bitmap_to_ports(tagged),
+    )
+
+
+def _decode_str(data: bytes) -> str:
+    return data.decode("ascii", errors="replace").rstrip("\x00")
+
+
+def parse_port_mirroring(data: bytes) -> NsdpPortMirroring:
+    """Parse NSDP tag 0x5C00 (4 bytes: dest_port(1) + source bitmap(3)).
+
+    Lifted from ``gdoc2netcfg/src/nsdp/parsers.py::parse_port_mirroring``.
+    """
+    if len(data) != 4:
+        raise ValueError(f"PORT_MIRRORING TLV must be 4 bytes, got {len(data)}")
+    dest_port = data[0]
+    # Bytes 1-3 are the source-port bitmap (MSB first).
+    source_ports = bitmap_to_ports(data[1:4])
+    return NsdpPortMirroring(destination_port=dest_port, source_ports=source_ports)
+
+
+def parse_igmp_snooping(data: bytes) -> NsdpIgmpSnooping:
+    """Parse NSDP tag 0x6800 (>=2 bytes: unknown, enabled, [unknown, vlan?]).
+
+    Lifted from ``gdoc2netcfg/src/nsdp/parsers.py::parse_igmp_snooping``.
+    """
+    if len(data) < 2:
+        raise ValueError(f"IGMP_SNOOPING TLV must be >= 2 bytes, got {len(data)}")
+    enabled = bool(data[1])
+    vlan_id = None
+    if len(data) >= 4:
+        vlan_id = data[3] if data[3] != 0 else None
+    return NsdpIgmpSnooping(enabled=enabled, vlan_id=vlan_id)
+
+
+def parse_device(packet: NSDPPacket) -> NsdpDevice:
+    """Aggregate a READ_RESPONSE packet's TLVs into an NsdpDevice."""
+    model: str | None = None
+    mac: str | None = None
+    fields: dict[str, object] = {}
+    port_status: list[NsdpPortStatus] = []
+    port_stats: list[NsdpPortStatistics] = []
+    vlan_members: list[NsdpVlanMembership] = []
+    pvids: list[NsdpPortPvid] = []
+    port_count = 8
+    # First pass to learn the real port count (bitmaps need it).
+    for tlv in packet.tlvs:
+        if tlv.tag == Tag.PORT_COUNT and tlv.value:
+            port_count = tlv.value[0]
+    for tlv in packet.tlvs:
+        if tlv.tag == Tag.MODEL:
+            model = _decode_str(tlv.value)
+        elif tlv.tag == Tag.MAC:
+            mac = parse_mac(tlv.value)
+        elif tlv.tag == Tag.HOSTNAME:
+            fields["hostname"] = _decode_str(tlv.value)
+        elif tlv.tag == Tag.IP_ADDRESS:
+            fields["ip"] = parse_ipv4(tlv.value)
+        elif tlv.tag == Tag.NETMASK:
+            fields["netmask"] = parse_ipv4(tlv.value)
+        elif tlv.tag == Tag.GATEWAY:
+            fields["gateway"] = parse_ipv4(tlv.value)
+        elif tlv.tag == Tag.FIRMWARE_VER_1:
+            fields["firmware_version"] = _decode_str(tlv.value)
+        elif tlv.tag == Tag.DHCP_MODE and tlv.value:
+            fields["dhcp_enabled"] = bool(tlv.value[0])
+        elif tlv.tag == Tag.PORT_COUNT and tlv.value:
+            fields["port_count"] = tlv.value[0]
+        elif tlv.tag == Tag.SERIAL_NUMBER:
+            fields["serial_number"] = parse_serial(tlv.value)
+        elif tlv.tag == Tag.VLAN_ENGINE and tlv.value:
+            fields["vlan_engine"] = VLANEngine(tlv.value[0])
+        elif tlv.tag == Tag.PORT_STATUS:
+            port_status.append(parse_port_status(tlv.value))
+        elif tlv.tag == Tag.PORT_STATISTICS:
+            port_stats.append(parse_port_statistics(tlv.value))
+        elif tlv.tag == Tag.VLAN_MEMBERS:
+            vlan_members.append(parse_vlan_members(tlv.value, port_count))
+        elif tlv.tag == Tag.PORT_PVID:
+            pvids.append(parse_port_pvid(tlv.value))
+        elif tlv.tag == Tag.QOS_ENGINE and tlv.value:
+            fields["qos_engine"] = tlv.value[0]
+        elif tlv.tag == Tag.PORT_MIRRORING:
+            fields["port_mirroring"] = parse_port_mirroring(tlv.value)
+        elif tlv.tag == Tag.IGMP_SNOOPING:
+            fields["igmp_snooping"] = parse_igmp_snooping(tlv.value)
+        elif tlv.tag == Tag.BROADCAST_FILTERING and tlv.value:
+            fields["broadcast_filtering"] = bool(tlv.value[0])
+        elif tlv.tag == Tag.LOOP_DETECTION and tlv.value:
+            fields["loop_detection"] = bool(tlv.value[0])
+    if model is None:
+        raise ValueError("no MODEL tag in NSDP response")
+    if mac is None:
+        mac = parse_mac(packet.server_mac)
+    return NsdpDevice(
+        model=model,
+        mac=mac,
+        port_status=tuple(port_status),
+        port_statistics=tuple(port_stats),
+        vlan_members=tuple(vlan_members),
+        port_pvids=tuple(pvids),
+        **fields,  # type: ignore[arg-type]
+    )

netgear_switch/protocols/nsdp/protocol.py

@@ -0,0 +1,201 @@
+"""NSDP wire codec: 32-byte header, TLV entries, and packet encode/decode.
+
+Lifted verbatim (field-for-field) from ``gdoc2netcfg/src/nsdp/protocol.py``.
+The header is ``struct`` layout ``>BB H 4s 6s 6s HH 4s 4s`` (32 bytes): version
+(always 0x01), operation, result, reserved(4), client MAC(6), server MAC(6),
+reserved(2), sequence, signature ``b"NSDP"`` at offset 0x18, reserved(4). Each
+TLV is ``>HH`` (tag, length) followed by ``length`` value bytes; a packet ends
+with the ``0xFFFF 0x0000`` end-of-marker.
+
+This module is a pure, zero-dependency codec: no sockets, no I/O. The write
+path (``Op.WRITE_REQUEST``/``Op.WRITE_RESPONSE`` and ``NSDPPacket.add_tlv``
+with a non-empty value) is new relative to the read-only prior-art client,
+but uses the exact same wire layout.
+"""
+from __future__ import annotations
+
+import struct
+from dataclasses import dataclass, field
+from enum import IntEnum
+
+NSDP_SIGNATURE = b"NSDP"
+HEADER_SIZE = 32
+HEADER_FORMAT = ">BB H 4s 6s 6s HH 4s 4s"
+END_MARKER = struct.pack(">HH", 0xFFFF, 0x0000)  # b"\xff\xff\x00\x00"
+
+
+class Op(IntEnum):
+    """NSDP operation codes (header byte 1).
+
+    READ_REQUEST/RESPONSE are used for discovery and property queries.
+    WRITE_REQUEST/RESPONSE are used to modify switch configuration
+    (requires authentication via Tag.PASSWORD or Tag.AUTH_V2_PASSWORD).
+    """
+
+    READ_REQUEST = 0x01
+    READ_RESPONSE = 0x02
+    WRITE_REQUEST = 0x03
+    WRITE_RESPONSE = 0x04
+
+
+class Tag(IntEnum):
+    """NSDP TLV tag identifiers.
+
+    Each tag represents a switch property. Tags are 16-bit unsigned integers
+    encoded big-endian in the packet. See
+    ``gdoc2netcfg/docs/nsdp-protocol.md`` (TLV Tag Registry) for byte-level
+    encoding details of each tag's value field.
+    """
+
+    # Packet markers
+    START_OF_MARK = 0x0000
+    END_OF_MARK = 0xFFFF
+
+    # Device identity
+    MODEL = 0x0001
+    HOSTNAME = 0x0003
+    MAC = 0x0004
+    LOCATION = 0x0005
+    IP_ADDRESS = 0x0006
+    NETMASK = 0x0007
+    GATEWAY = 0x0008
+    DHCP_MODE = 0x000B
+    FIRMWARE_VER_1 = 0x000D
+    FIRMWARE_VER_2 = 0x000E
+    PORT_COUNT = 0x6000
+    SERIAL_NUMBER = 0x7800
+
+    # Authentication
+    PASSWORD = 0x000A
+    AUTH_V2_SALT = 0x0017
+    AUTH_V2_PASSWORD = 0x001A
+
+    # Port information
+    PORT_STATUS = 0x0C00
+    PORT_STATISTICS = 0x1000
+
+    # VLAN
+    VLAN_ENGINE = 0x2000
+    VLAN_MEMBERS = 0x2800
+    PORT_PVID = 0x3000
+
+    # QoS
+    QOS_ENGINE = 0x3400
+    PORT_QOS_PRIORITY = 0x3800
+
+    # Traffic control
+    INGRESS_RATE_LIMIT = 0x4C00
+    EGRESS_RATE_LIMIT = 0x5000
+    BROADCAST_FILTERING = 0x5400
+    BROADCAST_BANDWIDTH = 0x5800
+    PORT_MIRRORING = 0x5C00
+
+    # IGMP
+    IGMP_SNOOPING = 0x6800
+    BLOCK_UNKNOWN_MULTICAST = 0x6C00
+    IGMPV3_HEADER_VALIDATION = 0x7000
+    IGMP_STATIC_ROUTER_PORTS = 0x8000
+
+    # Other
+    LOOP_DETECTION = 0x9000
+    ACTIVE_FIRMWARE = 0x000C
+
+    # Actions (write-only)
+    REBOOT = 0x0013
+    FACTORY_RESET = 0x0400
+
+
+@dataclass(frozen=True)
+class TLVEntry:
+    """One NSDP TLV: a 2-byte tag, 2-byte length, then that many value bytes."""
+
+    tag: Tag | int
+    value: bytes = b""
+
+    def encode(self) -> bytes:
+        return struct.pack(">HH", int(self.tag), len(self.value)) + self.value
+
+    @classmethod
+    def decode(cls, data: bytes) -> tuple[TLVEntry, int]:
+        if len(data) < 4:
+            raise ValueError("NSDP TLV shorter than its 4-byte header")
+        tag_raw, length = struct.unpack_from(">HH", data, 0)
+        if len(data) < 4 + length:
+            raise ValueError(
+                f"NSDP TLV declares {length} value bytes but only "
+                f"{len(data) - 4} are present"
+            )
+        value = data[4 : 4 + length]
+        tag: Tag | int
+        try:
+            tag = Tag(tag_raw)
+        except ValueError:
+            tag = tag_raw  # unknown/uncatalogued tag: keep the raw int
+        return cls(tag=tag, value=value), 4 + length
+
+
+@dataclass
+class NSDPPacket:
+    """A full NSDP datagram: a fixed header plus a list of TLVs."""
+
+    op: Op
+    client_mac: bytes
+    server_mac: bytes = b"\x00" * 6
+    sequence: int = 0
+    result: int = 0
+    tlvs: list[TLVEntry] = field(default_factory=list)
+
+    def add_tlv(self, tag: Tag | int, value: bytes = b"") -> None:
+        self.tlvs.append(TLVEntry(tag=tag, value=value))
+
+    def encode(self) -> bytes:
+        header = struct.pack(
+            HEADER_FORMAT,
+            0x01,
+            int(self.op),
+            self.result,
+            b"\x00" * 4,
+            self.client_mac,
+            self.server_mac,
+            0,
+            self.sequence,
+            NSDP_SIGNATURE,
+            b"\x00" * 4,
+        )
+        body = b"".join(t.encode() for t in self.tlvs)
+        return header + body + END_MARKER
+
+    @classmethod
+    def decode(cls, data: bytes) -> NSDPPacket:
+        if len(data) < HEADER_SIZE:
+            raise ValueError(f"NSDP packet shorter than {HEADER_SIZE}-byte header")
+        (
+            _version,
+            op_raw,
+            result,
+            _reserved1,
+            client_mac,
+            server_mac,
+            _reserved2,
+            sequence,
+            signature,
+            _reserved3,
+        ) = struct.unpack(HEADER_FORMAT, data[:HEADER_SIZE])
+        if signature != NSDP_SIGNATURE:
+            raise ValueError(f"bad NSDP signature {signature!r}")
+        tlvs: list[TLVEntry] = []
+        offset = HEADER_SIZE
+        while offset + 4 <= len(data):
+            entry, consumed = TLVEntry.decode(data[offset:])
+            if entry.tag == Tag.END_OF_MARK:
+                break
+            tlvs.append(entry)
+            offset += consumed
+        return cls(
+            op=Op(op_raw),
+            client_mac=client_mac,
+            server_mac=server_mac,
+            sequence=sequence,
+            result=result,
+            tlvs=tlvs,
+        )

netgear_switch/protocols/nsdp/types.py

@@ -0,0 +1,137 @@
+"""NSDP-native parsed value types. Lifted from ``gdoc2netcfg/src/nsdp/types.py``.
+
+These are the raw protocol shapes the parsers return; ``nsdp_read.py`` maps them
+onto the shared ``models.py`` types. Named with an ``Nsdp`` prefix so they never
+collide with the public ``models`` dataclasses.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import IntEnum
+
+_MBPS = {
+    0x00: 0, 0x01: 10, 0x02: 10, 0x03: 100, 0x04: 100, 0x05: 1000, 0xFF: 10000,
+}
+
+
+class LinkSpeed(IntEnum):
+    DOWN = 0x00
+    HALF_10M = 0x01
+    FULL_10M = 0x02
+    HALF_100M = 0x03
+    FULL_100M = 0x04
+    GIGABIT = 0x05
+    # ASSUMED/UNVERIFIED — the reference spec states 2.5G/5G/10G speed byte
+    # values are undocumented and require a hardware capture; 0xFF is carried
+    # over from prior art without independent confirmation.
+    TEN_GIGABIT = 0xFF
+
+    @classmethod
+    def from_byte(cls, value: int) -> LinkSpeed:
+        try:
+            return cls(value)
+        except ValueError:
+            return cls.DOWN  # unknown 2.5G/5G codes: report DOWN, never raise
+
+    @property
+    def speed_mbps(self) -> int:
+        return _MBPS.get(int(self), 0)
+
+
+class VLANEngine(IntEnum):
+    DISABLED = 0
+    BASIC_PORT = 1
+    ADVANCED_PORT = 2
+    BASIC_802_1Q = 3
+    ADVANCED_802_1Q = 4
+
+
+@dataclass(frozen=True)
+class NsdpPortStatus:
+    port_id: int
+    speed: LinkSpeed
+
+
+@dataclass(frozen=True)
+class NsdpPortStatistics:
+    port_id: int
+    bytes_received: int
+    bytes_sent: int
+    crc_errors: int
+
+
+@dataclass(frozen=True)
+class NsdpVlanMembership:
+    vlan_id: int
+    member_ports: frozenset[int]
+    tagged_ports: frozenset[int] = frozenset()
+
+    @property
+    def untagged_ports(self) -> frozenset[int]:
+        return self.member_ports - self.tagged_ports
+
+
+@dataclass(frozen=True)
+class NsdpPortPvid:
+    port_id: int
+    vlan_id: int
+
+
+@dataclass(frozen=True)
+class NsdpPortMirroring:
+    """Port mirroring configuration (NSDP tag 0x5C00).
+
+    Lifted from ``gdoc2netcfg/src/nsdp/types.py::PortMirroring``.
+
+    Attributes:
+        destination_port: Port receiving mirrored traffic (0 = disabled).
+        source_ports: Ports being mirrored.
+    """
+
+    destination_port: int
+    source_ports: frozenset[int] = frozenset()
+
+
+@dataclass(frozen=True)
+class NsdpIgmpSnooping:
+    """IGMP snooping configuration (NSDP tag 0x6800).
+
+    Lifted from ``gdoc2netcfg/src/nsdp/types.py::IGMPSnooping``.
+
+    Attributes:
+        enabled: Whether IGMP snooping is enabled.
+        vlan_id: VLAN for IGMP snooping (if applicable); ``None`` when the
+            wire value is 0 (no VLAN association).
+    """
+
+    enabled: bool
+    vlan_id: int | None = None
+
+
+@dataclass(frozen=True)
+class NsdpDevice:
+    model: str
+    mac: str
+    hostname: str | None = None
+    ip: str | None = None
+    netmask: str | None = None
+    gateway: str | None = None
+    firmware_version: str | None = None
+    dhcp_enabled: bool | None = None
+    port_count: int | None = None
+    serial_number: str | None = None
+    vlan_engine: VLANEngine | None = None
+    port_status: tuple[NsdpPortStatus, ...] = ()
+    port_statistics: tuple[NsdpPortStatistics, ...] = ()
+    vlan_members: tuple[NsdpVlanMembership, ...] = ()
+    port_pvids: tuple[NsdpPortPvid, ...] = field(default_factory=tuple)
+    # QoS engine mode (tag 0x3400): 0=disabled, 1=port-based, 2=802.1p.
+    qos_engine: int | None = None
+    # Port mirroring configuration (tag 0x5C00).
+    port_mirroring: NsdpPortMirroring | None = None
+    # IGMP snooping configuration (tag 0x6800).
+    igmp_snooping: NsdpIgmpSnooping | None = None
+    # Whether broadcast storm filtering is enabled (tag 0x5400).
+    broadcast_filtering: bool | None = None
+    # Whether loop detection is enabled (tag 0x9000).
+    loop_detection: bool | None = None

netgear_switch/protocols/nsdp/write.py

@@ -0,0 +1,98 @@
+"""NSDP request framing + value-TLV encoders for the read and write paths.
+
+Pure: builds ``NSDPPacket`` objects, no I/O. The write path (absent from the
+lifted ``gdoc2netcfg`` package, which was read-only) prepends a v1 ``PASSWORD``
+TLV — a real switch rejects an unauthenticated or wrongly-authenticated write
+with result 0x0700, which the transport turns into an ``NsdpError`` (Task 4).
+
+UNVERIFIED write path (mirrors ``snmp_write.py``'s house style for its
+mgmt_write_* OIDs). This entire NSDP write path — the WRITE_REQUEST value-TLV
+encodings here plus the v1 XOR auth in ``auth.py`` — is a from-scratch addition
+with ZERO verification against real hardware: the lifted ``gdoc2netcfg/src/nsdp``
+prior art is READ-ONLY, so nothing in it exercises writes. It stays UNVERIFIED
+pending a real capture (Slice 7 capture utility / a real-hardware run);
+verify-after-write in ``nsdp_write.py`` is the runtime guard against a silently
+wrong encoding. Critically, the reference spec
+(``gdoc2netcfg/docs/nsdp-protocol.md``) marks ``PORT_PVID`` (0x3000) and
+``VLAN_MEMBERS`` (0x2800) as READ-ONLY (R), unlike hostname/ip/netmask/gateway/
+dhcp_mode/vlan_engine (R/W). Writing PVID/VLAN membership via NSDP may therefore
+be REJECTED by real hardware — the switch may only accept those changes via the
+``vlan_engine`` (or other R/W) tags or via HTTP. Do NOT read the ``pvid_tlv`` /
+``vlan_members_tlv`` encoders here as confirmation that those tags are writable;
+their writability is unconfirmed and must be settled by a hardware capture.
+"""
+from __future__ import annotations
+
+import socket
+import struct
+from typing import TYPE_CHECKING
+
+from .auth import encode_password_v1
+from .parsers import ports_to_bitmap
+from .protocol import NSDPPacket, Op, Tag, TLVEntry
+
+if TYPE_CHECKING:
+    from collections.abc import Iterable
+
+RESULT_SUCCESS = 0x0000
+RESULT_BAD_PASSWORD = 0x0700
+
+
+def build_read_request(
+    client_mac: bytes, server_mac: bytes, sequence: int, tags: list[Tag]
+) -> NSDPPacket:
+    pkt = NSDPPacket(
+        op=Op.READ_REQUEST,
+        client_mac=client_mac,
+        server_mac=server_mac,
+        sequence=sequence,
+    )
+    for tag in tags:
+        pkt.add_tlv(tag)  # length-0 TLV = "please read this"
+    return pkt
+
+
+def build_write_request(
+    client_mac: bytes,
+    server_mac: bytes,
+    sequence: int,
+    password: str,
+    tlvs: list[TLVEntry],
+) -> NSDPPacket:
+    pkt = NSDPPacket(
+        op=Op.WRITE_REQUEST,
+        client_mac=client_mac,
+        server_mac=server_mac,
+        sequence=sequence,
+    )
+    pkt.tlvs.append(TLVEntry(Tag.PASSWORD, encode_password_v1(password)))
+    pkt.tlvs.extend(tlvs)
+    return pkt
+
+
+def pvid_tlv(port: int, vlan: int) -> TLVEntry:
+    return TLVEntry(Tag.PORT_PVID, bytes([port]) + struct.pack(">H", vlan))
+
+
+def vlan_members_tlv(
+    vlan: int, members: Iterable[int], tagged: Iterable[int], port_count: int
+) -> TLVEntry:
+    width = (port_count + 7) // 8
+    value = (
+        struct.pack(">H", vlan)
+        + ports_to_bitmap(members, width)
+        + ports_to_bitmap(tagged, width)
+    )
+    return TLVEntry(Tag.VLAN_MEMBERS, value)
+
+
+def ipv4_tlv(tag: Tag, dotted: str) -> TLVEntry:
+    return TLVEntry(tag, socket.inet_aton(dotted))
+
+
+def dhcp_tlv(enabled: bool) -> TLVEntry:
+    return TLVEntry(Tag.DHCP_MODE, b"\x01" if enabled else b"\x00")
+
+
+def reboot_tlv() -> TLVEntry:
+    return TLVEntry(Tag.REBOOT, b"")

netgear_switch/protocols/snmp/__init__.py

@@ -0,0 +1 @@
+"""SNMP protocol logic (pure, I/O-free)."""