python-netgear-switch-library 0.0.post343__tar.gz → 0.0.post345__tar.gz

{python_netgear_switch_library-0.0.post343 → python_netgear_switch_library-0.0.post345}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-netgear-switch-library
-Version: 0.0.post343
+Version: 0.0.post345
 Summary: Python library and CLI to query and control Netgear switches over SNMP, NSDP and HTTP.
 Author-email: Tim Ansell <me@mith.ro>
 License-Expression: Apache-2.0

{python_netgear_switch_library-0.0.post343 → python_netgear_switch_library-0.0.post345}/src/netgear_switch/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.0.post343'
-__version_tuple__ = version_tuple = (0, 0, 'post343')
+__version__ = version = '0.0.post345'
+__version_tuple__ = version_tuple = (0, 0, 'post345')
 
 __commit_id__ = commit_id = None

{python_netgear_switch_library-0.0.post343 → python_netgear_switch_library-0.0.post345}/src/netgear_switch/cli_read.py

@@ -36,6 +36,8 @@ if TYPE_CHECKING:
         PortStats,
         PortStatus,
         Sensor,
+        ServiceStatus,
+        SwitchUser,
         SyslogConfig,
         VLANInfo,
     )
@@ -104,6 +106,28 @@ class CliReader:
     def get_mgmt_ip(self) -> MgmtIpConfig:
         return parse.parse_mgmt_ip(self.session.run(self._spec.network_cmd))
 
+    def get_services(self) -> list[ServiceStatus]:
+        """Which management services are enabled, and on which ports.
+
+        Three commands, because the switch splits it that way -- and the telnet
+        one is ``show telnetcon``, not ``show telnet``. See
+        ``parse.parse_services`` for why that distinction matters.
+        """
+        return parse.parse_services(
+            self.session.run(self._spec.http_service_cmd),
+            self.session.run(self._spec.telnet_service_cmd),
+            self.session.run(self._spec.ssh_service_cmd),
+        )
+
+    def get_users(self) -> list[SwitchUser]:
+        """The switch's local login accounts, from ``show users``.
+
+        The access-mode wording differs between firmware images, so
+        ``SwitchUser.access_mode`` keeps the raw text and ``privileged``
+        carries the normalised reading -- see ``parse.parse_users``.
+        """
+        return parse.parse_users(self.session.run(self._spec.users_cmd))
+
     def get_syslog(self) -> SyslogConfig:
         """Remote-logging configuration, from ``show logging`` + its host table.
 

{python_netgear_switch_library-0.0.post343 → python_netgear_switch_library-0.0.post345}/src/netgear_switch/models.py

@@ -119,6 +119,45 @@ class MgmtIpConfig:
     base_mac: str | None = None
 
 
+@dataclass(frozen=True)
+class ServiceStatus:
+    """One management service the switch offers, and whether it is on.
+
+    Covers the four protocols an operator turns on or off to control how the
+    switch itself can be reached: ``http``, ``https``, ``telnet`` and ``ssh``.
+    """
+
+    #: One of ``http``, ``https``, ``telnet``, ``ssh``.
+    name: str
+    enabled: bool
+    #: The TCP port the service listens on, or ``None`` where the firmware does
+    #: not report one. Measured: gsm7252ps omits the ``SSH Port`` line that
+    #: m4300-24x prints, so this is genuinely absent rather than defaulted to 22.
+    port: int | None = None
+
+
+@dataclass(frozen=True)
+class SwitchUser:
+    """One local login account on the switch."""
+
+    name: str
+    #: The access mode exactly as this firmware words it. Kept verbatim because
+    #: the vocabulary is NOT the same across images: measured 2026-08-02, the
+    #: m4300-24x prints ``Privilege-15``/``Privilege-1`` where the gsm7252ps
+    #: prints ``Read/Write``/``Read Only`` for the same two accounts.
+    access_mode: str
+    #: Whether ``access_mode`` is the full-privilege level, normalised across
+    #: both vocabularies so callers do not have to know which image they are on.
+    #: ``None`` when the text is neither spelling -- an unrecognised level is
+    #: reported honestly rather than guessed as unprivileged.
+    privileged: bool | None
+    #: The three SNMPv3 columns the same table carries. ``None`` where the
+    #: firmware prints nothing.
+    snmpv3_access: str | None = None
+    snmpv3_auth: str | None = None
+    snmpv3_encryption: str | None = None
+
+
 @dataclass(frozen=True)
 class SyslogServer:
     """One remote syslog collector the switch is configured to send to."""

{python_netgear_switch_library-0.0.post343 → python_netgear_switch_library-0.0.post345}/src/netgear_switch/protocols/cli/commands.py

@@ -103,6 +103,15 @@ class CliModelSpec:
     # SNMP's sysName, so it is what keeps the two backends returning the same
     # answer for the same switch.
     hosts_cmd: str = "show hosts"
+    # Local login accounts. Present on both FASTPATH images measured; the
+    # ACCESS-MODE vocabulary differs between them (see parse.parse_users).
+    users_cmd: str = "show users"
+    # Management services. `show ip http` covers BOTH web servers; the inbound
+    # telnet server is `show telnetcon` and NOT `show telnet`, which reports
+    # the switch as an outbound telnet CLIENT (measured 2026-08-02).
+    http_service_cmd: str = "show ip http"
+    telnet_service_cmd: str = "show telnetcon"
+    ssh_service_cmd: str = "show ip ssh"
     # Remote logging. `show syslog` does NOT exist -- all three FASTPATH
     # switches answered "% Invalid input detected" on 2026-08-02.
     logging_cmd: str = "show logging"

{python_netgear_switch_library-0.0.post343 → python_netgear_switch_library-0.0.post345}/src/netgear_switch/protocols/cli/parse.py

@@ -42,6 +42,8 @@ from ...models import (
     PortStats,
     PortStatus,
     Sensor,
+    ServiceStatus,
+    SwitchUser,
     SyslogConfig,
     SyslogServer,
     VLANInfo,
@@ -608,6 +610,136 @@ def parse_environment(text: str) -> list[Sensor]:
     return out
 
 
+# ---------------------------------------------------------------------------
+# show ip http / show telnetcon / show ip ssh -> management services
+# ---------------------------------------------------------------------------
+
+
+def _enabled(text: str) -> bool:
+    """FASTPATH spells this two ways: "Enabled" and "Enable"."""
+    return text.strip().lower() in {"enabled", "enable", "yes"}
+
+
+def parse_services(
+    http_text: str, telnet_text: str, ssh_text: str
+) -> list[ServiceStatus]:
+    """The four management services, from the three commands that report them.
+
+    Captured 2026-08-02 from m4300-24x (10.1.5.13) and gsm7252ps (10.1.5.22).
+
+    ``show ip http`` carries BOTH the plain and secure web servers::
+
+        HTTP Mode (Unsecure)........................... Enabled
+        HTTP Port...................................... 80
+        HTTP Mode (Secure)............................. Enabled
+        Secure Port.................................... 443
+
+    ``show telnetcon`` -- NOT ``show telnet`` -- reports the INBOUND server::
+
+        Telnet Server Admin Mode....................... Enable
+        Telnet Server Port............................. 23
+
+    ``show telnet`` describes the switch as a telnet *client* ("Allow New
+    Outbound Telnet Sessions"), which says nothing about whether the server this
+    library's TELNET backend connects to is running. Reading it as the server
+    state would be wrong in the way that looks right.
+
+    ``show ip ssh`` reports SSH, and its field set differs by firmware: the
+    gsm7252ps prints no ``SSH Port`` line at all, so that port is honestly None
+    rather than assumed to be 22.
+    """
+    http = labelled_values(http_text)
+    telnet = labelled_values(telnet_text)
+    # `show ip ssh` writes its labels WITH a trailing colon before the dotted
+    # leader ("Administrative Mode: ......... Enabled"), unlike every other
+    # FASTPATH scalar command. Measured on both m4300-24x and gsm7252ps. Without
+    # stripping it the lookup misses and SSH reads as disabled on a switch whose
+    # own output says Enabled -- which is exactly what the first live run did.
+    ssh = {k.rstrip(":").strip(): v for k, v in labelled_values(ssh_text).items()}
+    return [
+        ServiceStatus(
+            name="http",
+            enabled=_enabled(http.get("HTTP Mode (Unsecure)", "")),
+            port=_int(http.get("HTTP Port", "")),
+        ),
+        ServiceStatus(
+            name="https",
+            enabled=_enabled(http.get("HTTP Mode (Secure)", "")),
+            port=_int(http.get("Secure Port", "")),
+        ),
+        ServiceStatus(
+            name="telnet",
+            enabled=_enabled(telnet.get("Telnet Server Admin Mode", "")),
+            port=_int(telnet.get("Telnet Server Port", "")),
+        ),
+        ServiceStatus(
+            name="ssh",
+            enabled=_enabled(ssh.get("Administrative Mode", "")),
+            port=_int(ssh.get("SSH Port", "")),
+        ),
+    ]
+
+
+# ---------------------------------------------------------------------------
+# show users -> local login accounts
+# ---------------------------------------------------------------------------
+
+#: Access-mode text meaning full privilege, in BOTH vocabularies FASTPATH uses.
+#: Measured 2026-08-02: m4300-24x prints "Privilege-15"/"Privilege-1" while
+#: gsm7252ps prints "Read/Write"/"Read Only" for the same admin/guest pair. A
+#: parser that knew only one spelling would silently mis-report the other image.
+_PRIVILEGED_ACCESS = frozenset({"privilege-15", "read/write"})
+_UNPRIVILEGED_ACCESS = frozenset({"privilege-1", "read only", "no access"})
+
+
+def _privileged(access_mode: str) -> bool | None:
+    text = access_mode.strip().lower()
+    if text in _PRIVILEGED_ACCESS:
+        return True
+    if text in _UNPRIVILEGED_ACCESS:
+        return False
+    return None
+
+
+def parse_users(text: str) -> list[SwitchUser]:
+    """``show users`` -> the switch's local login accounts.
+
+    Captured 2026-08-02 from m4300-24x (10.1.5.13) and gsm7252ps (10.1.5.22);
+    both list ``admin`` and ``guest``, under a header that wraps over three
+    lines::
+
+        User        SNMPv3         SNMPv3        SNMPv3
+        User Name                 Access Mode   Access Mode  Authentication  Encryption
+        ------------------------  ------------  -----------  --------------  ----------
+        admin                     Privilege-15  Read Only    MD5             None
+
+    Sliced by the ruler rather than split on whitespace, because an access mode
+    legitimately contains a space (``Read Only``, ``Read/Write``) and a naive
+    split would tear it in half.
+
+    The ACCESS-MODE VOCABULARY differs by firmware -- see ``_PRIVILEGED_ACCESS``
+    -- so the raw text is preserved on ``SwitchUser.access_mode`` and only the
+    normalised ``privileged`` flag interprets it.
+    """
+    users: list[SwitchUser] = []
+    for cells in iter_table_rows(text):
+        if not cells or not cells[0].strip():
+            continue
+        padded = [*cells, "", "", "", ""]
+        name, access, snmp_access, snmp_auth, snmp_enc = (c.strip() for c in padded[:5])
+        users.append(
+            SwitchUser(
+                name=name,
+                access_mode=access,
+                privileged=_privileged(access),
+                snmpv3_access=snmp_access or None,
+                snmpv3_auth=snmp_auth or None,
+                snmpv3_encryption=snmp_enc or None,
+            )
+        )
+    return users
+
+
 # ---------------------------------------------------------------------------
 # show logging / show logging hosts -> syslog configuration
 # ---------------------------------------------------------------------------