python-netgear-switch-library 0.0.post342__tar.gz → 0.0.post344__tar.gz

{python_netgear_switch_library-0.0.post342 → python_netgear_switch_library-0.0.post344}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-netgear-switch-library
-Version: 0.0.post342
+Version: 0.0.post344
 Summary: Python library and CLI to query and control Netgear switches over SNMP, NSDP and HTTP.
 Author-email: Tim Ansell <me@mith.ro>
 License-Expression: Apache-2.0

{python_netgear_switch_library-0.0.post342 → python_netgear_switch_library-0.0.post344}/docs/superpowers/specs/2026-08-02-snmp-surface-findings.md

@@ -149,3 +149,69 @@ user**, a different thing from a local login account. They must not be conflated
 - Port speed/duplex **configuration** (as opposed to `ifHighSpeed`, which is the
   negotiated rate). EtherLike-MIB `dot3` at `1.3.6.1.2.1.10.7` carries 1416
   varbinds on the S3300 and is the obvious candidate for duplex status.
+
+
+## Local users and service protocols — CLI, measured 2026-08-02
+
+Captured from m4300-24x (10.1.5.13) and gsm7252ps (10.1.5.22). Three things
+here would have been got wrong by assuming, which is why they are recorded
+before any code is written against them.
+
+### `show users` — two users, and the access-mode WORDS differ by firmware
+
+Both switches carry `admin` and `guest`, and both print the same five columns
+(User Name, User Access Mode, three SNMPv3 columns). The **values** are not the
+same vocabulary:
+
+| Switch | admin | guest |
+|---|---|---|
+| m4300-24x | `Privilege-15` | `Privilege-1` |
+| gsm7252ps | `Read/Write` | `Read Only` |
+
+A parser mapping the access-mode column to an enum must accept both spellings.
+Matching on `Privilege-N` alone would silently fail on the gsm7252ps and vice
+versa — the same shape of defect as the `show logging hosts` column count.
+
+`show users long` prints just the names, on both.
+
+### `show telnet` is OUTBOUND telnet, not the telnet server
+
+    Outbound Telnet Login Timeout (minutes)........ 5
+    Maximum Number of Outbound Telnet Sessions..... 5
+    Allow New Outbound Telnet Sessions............. Yes
+
+Every field is about the switch acting as a telnet **client**. None of it
+reports whether the inbound telnet server — the thing this library's TELNET
+backend connects to — is enabled. Reading "Allow New Outbound Telnet Sessions:
+Yes" as "telnet is on" would be wrong in exactly the way that looks right.
+The inbound server state has NOT been located yet.
+
+### `show ip ssh` works, but its field set differs by firmware
+
+    Administrative Mode: .......................... Enabled
+    SSH Port: ..................................... 22          <- m4300 ONLY
+    Protocol Levels: .............................. Version 2
+    Max SSH Sessions Allowed: ..................... 5
+
+The gsm7252ps prints **no `SSH Port` line at all**, and reports its protocol
+levels as `Versions 1 and 2` against the m4300's `Version 2`. A reader must
+treat the port as optional rather than assume every FASTPATH image reports it.
+
+### HTTP has no `show ip http server`
+
+Both switches answer `% Invalid input detected` to `show ip http server` and to
+`show ip http secure-server`. The command that reports web-server state has not
+been found yet; it is not either of those.
+
+### What this means for implementation
+
+`get_users` is implementable on the FASTPATH CLI today, across both firmwares,
+provided the access-mode parser accepts both vocabularies. Note the SNMP side
+disagrees about scope: the S3300's vendor user table (`4526.11.1.2.1.3`) held
+only ONE user, while its CLI shows two — so the two backends are not reporting
+the same set, and that must be resolved before `get_users` is registered as a
+cross-backend operation.
+
+Service protocols are NOT implementable yet: SSH state is readable, inbound
+telnet state is unlocated, and HTTP state is unlocated. Recording that as three
+separate unknowns rather than one blocked feature.

{python_netgear_switch_library-0.0.post342 → python_netgear_switch_library-0.0.post344}/src/netgear_switch/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.0.post342'
-__version_tuple__ = version_tuple = (0, 0, 'post342')
+__version__ = version = '0.0.post344'
+__version_tuple__ = version_tuple = (0, 0, 'post344')
 
 __commit_id__ = commit_id = None

{python_netgear_switch_library-0.0.post342 → python_netgear_switch_library-0.0.post344}/src/netgear_switch/cli_read.py

@@ -36,6 +36,7 @@ if TYPE_CHECKING:
         PortStats,
         PortStatus,
         Sensor,
+        SwitchUser,
         SyslogConfig,
         VLANInfo,
     )
@@ -104,6 +105,15 @@ class CliReader:
     def get_mgmt_ip(self) -> MgmtIpConfig:
         return parse.parse_mgmt_ip(self.session.run(self._spec.network_cmd))
 
+    def get_users(self) -> list[SwitchUser]:
+        """The switch's local login accounts, from ``show users``.
+
+        The access-mode wording differs between firmware images, so
+        ``SwitchUser.access_mode`` keeps the raw text and ``privileged``
+        carries the normalised reading -- see ``parse.parse_users``.
+        """
+        return parse.parse_users(self.session.run(self._spec.users_cmd))
+
     def get_syslog(self) -> SyslogConfig:
         """Remote-logging configuration, from ``show logging`` + its host table.
 

{python_netgear_switch_library-0.0.post342 → python_netgear_switch_library-0.0.post344}/src/netgear_switch/models.py

@@ -119,6 +119,28 @@ class MgmtIpConfig:
     base_mac: str | None = None
 
 
+@dataclass(frozen=True)
+class SwitchUser:
+    """One local login account on the switch."""
+
+    name: str
+    #: The access mode exactly as this firmware words it. Kept verbatim because
+    #: the vocabulary is NOT the same across images: measured 2026-08-02, the
+    #: m4300-24x prints ``Privilege-15``/``Privilege-1`` where the gsm7252ps
+    #: prints ``Read/Write``/``Read Only`` for the same two accounts.
+    access_mode: str
+    #: Whether ``access_mode`` is the full-privilege level, normalised across
+    #: both vocabularies so callers do not have to know which image they are on.
+    #: ``None`` when the text is neither spelling -- an unrecognised level is
+    #: reported honestly rather than guessed as unprivileged.
+    privileged: bool | None
+    #: The three SNMPv3 columns the same table carries. ``None`` where the
+    #: firmware prints nothing.
+    snmpv3_access: str | None = None
+    snmpv3_auth: str | None = None
+    snmpv3_encryption: str | None = None
+
+
 @dataclass(frozen=True)
 class SyslogServer:
     """One remote syslog collector the switch is configured to send to."""

{python_netgear_switch_library-0.0.post342 → python_netgear_switch_library-0.0.post344}/src/netgear_switch/protocols/cli/commands.py

@@ -103,6 +103,9 @@ class CliModelSpec:
     # SNMP's sysName, so it is what keeps the two backends returning the same
     # answer for the same switch.
     hosts_cmd: str = "show hosts"
+    # Local login accounts. Present on both FASTPATH images measured; the
+    # ACCESS-MODE vocabulary differs between them (see parse.parse_users).
+    users_cmd: str = "show users"
     # Remote logging. `show syslog` does NOT exist -- all three FASTPATH
     # switches answered "% Invalid input detected" on 2026-08-02.
     logging_cmd: str = "show logging"

{python_netgear_switch_library-0.0.post342 → python_netgear_switch_library-0.0.post344}/src/netgear_switch/protocols/cli/parse.py

@@ -42,6 +42,7 @@ from ...models import (
     PortStats,
     PortStatus,
     Sensor,
+    SwitchUser,
     SyslogConfig,
     SyslogServer,
     VLANInfo,
@@ -608,6 +609,66 @@ def parse_environment(text: str) -> list[Sensor]:
     return out
 
 
+# ---------------------------------------------------------------------------
+# show users -> local login accounts
+# ---------------------------------------------------------------------------
+
+#: Access-mode text meaning full privilege, in BOTH vocabularies FASTPATH uses.
+#: Measured 2026-08-02: m4300-24x prints "Privilege-15"/"Privilege-1" while
+#: gsm7252ps prints "Read/Write"/"Read Only" for the same admin/guest pair. A
+#: parser that knew only one spelling would silently mis-report the other image.
+_PRIVILEGED_ACCESS = frozenset({"privilege-15", "read/write"})
+_UNPRIVILEGED_ACCESS = frozenset({"privilege-1", "read only", "no access"})
+
+
+def _privileged(access_mode: str) -> bool | None:
+    text = access_mode.strip().lower()
+    if text in _PRIVILEGED_ACCESS:
+        return True
+    if text in _UNPRIVILEGED_ACCESS:
+        return False
+    return None
+
+
+def parse_users(text: str) -> list[SwitchUser]:
+    """``show users`` -> the switch's local login accounts.
+
+    Captured 2026-08-02 from m4300-24x (10.1.5.13) and gsm7252ps (10.1.5.22);
+    both list ``admin`` and ``guest``, under a header that wraps over three
+    lines::
+
+        User        SNMPv3         SNMPv3        SNMPv3
+        User Name                 Access Mode   Access Mode  Authentication  Encryption
+        ------------------------  ------------  -----------  --------------  ----------
+        admin                     Privilege-15  Read Only    MD5             None
+
+    Sliced by the ruler rather than split on whitespace, because an access mode
+    legitimately contains a space (``Read Only``, ``Read/Write``) and a naive
+    split would tear it in half.
+
+    The ACCESS-MODE VOCABULARY differs by firmware -- see ``_PRIVILEGED_ACCESS``
+    -- so the raw text is preserved on ``SwitchUser.access_mode`` and only the
+    normalised ``privileged`` flag interprets it.
+    """
+    users: list[SwitchUser] = []
+    for cells in iter_table_rows(text):
+        if not cells or not cells[0].strip():
+            continue
+        padded = [*cells, "", "", "", ""]
+        name, access, snmp_access, snmp_auth, snmp_enc = (c.strip() for c in padded[:5])
+        users.append(
+            SwitchUser(
+                name=name,
+                access_mode=access,
+                privileged=_privileged(access),
+                snmpv3_access=snmp_access or None,
+                snmpv3_auth=snmp_auth or None,
+                snmpv3_encryption=snmp_enc or None,
+            )
+        )
+    return users
+
+
 # ---------------------------------------------------------------------------
 # show logging / show logging hosts -> syslog configuration
 # ---------------------------------------------------------------------------