python-netgear-switch-library 0.0.post353__py3-none-any.whl → 0.0.post355__py3-none-any.whl

netgear_switch/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.0.post353'
-__version_tuple__ = version_tuple = (0, 0, 'post353')
+__version__ = version = '0.0.post355'
+__version_tuple__ = version_tuple = (0, 0, 'post355')
 
 __commit_id__ = commit_id = None

netgear_switch/capabilities.py

@@ -101,6 +101,11 @@ class Operation:
 
 _CLI_BACKENDS = frozenset({Backend.SSH, Backend.TELNET, Backend.CONSOLE})
 
+#: HTTP writes implemented by scraping the Plus dialect's CSRF token. A dialect
+#: without that token cannot serve any of them -- see
+#: ``endpoints.dialect_has_csrf_hash`` for the measurement.
+_CSRF_HTTP_WRITES = frozenset({"create_vlan", "delete_vlan"})
+
 READ_OPERATIONS: tuple[Operation, ...] = (
     Operation("get_ports", OperationKind.READ, "Per-port link/admin status"),
     Operation("get_stats", OperationKind.READ, "Per-port octet/packet counters"),
@@ -351,7 +356,7 @@ def _http_path_for(spec: HttpModelSpec, op: Operation) -> str | None:
 
 def _http_support(model: SwitchModel, op: Operation) -> tuple[Support, str]:
     from .http_write import CERT_UPLOAD_KNOWN_UNIMPLEMENTED
-    from .protocols.http.endpoints import http_spec
+    from .protocols.http.endpoints import dialect_has_csrf_hash, http_spec
 
     spec = http_spec(model)
     if not spec.reads_verified:
@@ -374,6 +379,17 @@ def _http_support(model: SwitchModel, op: Operation) -> tuple[Support, str]:
                 f"this model takes a certificate by {mechanism}, not over the "
                 "web UI -- use upload_certificate_scp",
             )
+    if op.name in _CSRF_HTTP_WRITES and not dialect_has_csrf_hash(spec.html_dialect):
+        # These writers scrape an <input name="hash"> before posting, and this
+        # dialect's pages do not carry one -- MEASURED on gsm7252ps and
+        # gs110emx, see endpoints.dialect_has_csrf_hash. Driving them raises
+        # HttpUnexpectedPageError on real hardware, so claiming support here
+        # would publish a support table that contradicts the device.
+        return (
+            Support.UNSUPPORTED,
+            f"model {model.key!r} web UI carries no CSRF 'hash' token, which "
+            f"the HTTP {op.name} writer requires",
+        )
     path = _http_path_for(spec, op)
     if path is None:
         return (

netgear_switch/http_write.py

@@ -268,6 +268,25 @@ def _check_goahead_upload_response(text: str) -> None:
         )
 
 
+def _require_csrf_dialect(spec: HttpModelSpec, model_key: str, op: str) -> None:
+    """Refuse a hash-scraping write on a dialect whose pages carry no token.
+
+    This is a CAPABILITY refusal, not a surprise, so it raises
+    UnsupportedCapabilityError rather than HttpUnexpectedPageError: the writer
+    is built on the Plus form, and MEASURED probes of gsm7252ps and gs110emx
+    found no ``<input name="hash">`` anywhere in their write pages. Saying so by
+    type is what lets the facade, the capability table and the caller agree --
+    and what stops a bare "unexpected page" from reading like a transient fault.
+    """
+    from .protocols.http.endpoints import dialect_has_csrf_hash
+
+    if not dialect_has_csrf_hash(spec.html_dialect):
+        raise UnsupportedCapabilityError(
+            f"model {model_key!r} web UI carries no CSRF 'hash' token, which "
+            f"the HTTP {op} writer requires"
+        )
+
+
 def _csrf(html: str) -> str:
     token = parse.parse_csrf_hash(html)
     if token is None:
@@ -747,6 +766,7 @@ class HttpWriter:
         return shown
 
     def create_vlan(self, vlan: int, name: str, *, force: bool = False) -> None:
+        _require_csrf_dialect(self._spec, self.model.key, "create_vlan")
         del name, force  # web UI 8021qCf.cgi has no VLAN-name field (GROUNDED).
         path = _require_path(self.model.key, self._spec.vlan_config_path, "VLAN config")
         page = self.session.get_page(path)
@@ -760,6 +780,7 @@ class HttpWriter:
             )
 
     def delete_vlan(self, vlan: int, *, force: bool = False) -> None:
+        _require_csrf_dialect(self._spec, self.model.key, "delete_vlan")
         del force  # VLAN delete disruptiveness is guarded per-member elsewhere.
         path = _require_path(self.model.key, self._spec.vlan_config_path, "VLAN config")
         page = self.session.get_page(path)
@@ -1215,6 +1236,7 @@ class AsyncHttpWriter:
         return shown
 
     async def create_vlan(self, vlan: int, name: str, *, force: bool = False) -> None:
+        _require_csrf_dialect(self._spec, self.model.key, "create_vlan")
         del name, force
         path = _require_path(self.model.key, self._spec.vlan_config_path, "VLAN config")
         page = await self.session.get_page(path)
@@ -1228,6 +1250,7 @@ class AsyncHttpWriter:
             )
 
     async def delete_vlan(self, vlan: int, *, force: bool = False) -> None:
+        _require_csrf_dialect(self._spec, self.model.key, "delete_vlan")
         del force
         path = _require_path(self.model.key, self._spec.vlan_config_path, "VLAN config")
         page = await self.session.get_page(path)

netgear_switch/protocols/http/endpoints.py

@@ -140,6 +140,27 @@ class HtmlDialect(enum.Enum):
     GOAHEAD_XML = "goahead_xml"
 
 
+def dialect_has_csrf_hash(dialect: HtmlDialect) -> bool:
+    """Whether this dialect's pages carry an ``<input name="hash">`` CSRF token.
+
+    ``http_write`` scrapes that token before every form post, so a dialect
+    without one cannot be driven by those writers at all.
+
+    MEASURED 2026-08-02, not inferred. Live probes found NO hash on any write
+    page of gsm7252ps (10.1.5.22: vlanStatus, poeInterfaceConfiguration,
+    portPvidConfiguration, vlan_port_cfg, portsConfiguration) nor of gs110emx
+    (10.1.5.25: Cf8021q, vlan_pvidsetting). Only the Plus ``.cgi`` pages have
+    it -- the surface ``HttpWriter`` was originally written against.
+
+    ONE definition, read by the capability oracle AND by the virtual switch, so
+    the mock can never emit a token the hardware lacks. That divergence is
+    exactly how HTTP ``create_vlan`` passed the entire test suite while failing
+    on all four FASTPATH switches.
+    """
+    return dialect in {HtmlDialect.STANDARD, HtmlDialect.GS105PE}
+
+
+
 @dataclass(frozen=True)
 class XuiMgmtIpFields:
     """Which fields of a FASTPATH XUI management-IP page carry what.

netgear_switch/virtual/web.py

@@ -39,8 +39,40 @@ def _hash_input() -> str:
     return f'<input type="hidden" name="hash" value="{_HASH}">'
 
 
+def _has_csrf_hash(spec: HttpModelSpec) -> bool:
+    """Whether this model's real web UI carries an ``<input name="hash">``.
+
+    ONLY the Plus ``.cgi`` dialects do. MEASURED 2026-08-02: a live capture of
+    the FASTPATH ``vlanStatus.html`` on gsm7252ps (10.1.5.22, committed as
+    ``tests/fixtures/http/gsm7252ps_vlan_status_live.html``) carries no ``hash``
+    input anywhere -- only ``applet_port``, ``applet_unit``, ``dbgopt`` and the
+    XUI cell hiddens.
+
+    This mock used to emit the token on EVERY page regardless of dialect, and
+    that is how ``HttpWriter.create_vlan`` -- which scrapes the token and is
+    written for the Plus form -- passed here while failing on real FASTPATH
+    hardware with "no CSRF 'hash' token on page before write". The mock and the
+    writer agreed with each other while both disagreed with the device, which
+    is exactly the failure principle 5 exists to prevent. Emitting it only
+    where the hardware does makes the mock refuse the same write the switch
+    refuses.
+    """
+    from ..protocols.http.endpoints import dialect_has_csrf_hash
+
+    return dialect_has_csrf_hash(spec.html_dialect)
+
+
 def render_page(
     state: VirtualSwitchState, spec: HttpModelSpec, path: str, form: dict[str, str]
+) -> str:
+    html = _render_page_body(state, spec, path, form)
+    if not _has_csrf_hash(spec):
+        html = html.replace(_hash_input(), "")
+    return html
+
+
+def _render_page_body(
+    state: VirtualSwitchState, spec: HttpModelSpec, path: str, form: dict[str, str]
 ) -> str:
     if path == spec.dashboard_path:
         return _render_dashboard(state)

{python_netgear_switch_library-0.0.post353.dist-info → python_netgear_switch_library-0.0.post355.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-netgear-switch-library
-Version: 0.0.post353
+Version: 0.0.post355
 Summary: Python library and CLI to query and control Netgear switches over SNMP, NSDP and HTTP.
 Author-email: Tim Ansell <me@mith.ro>
 License-Expression: Apache-2.0

{python_netgear_switch_library-0.0.post353.dist-info → python_netgear_switch_library-0.0.post355.dist-info}/RECORD

@@ -1,14 +1,14 @@
 netgear_switch/__init__.py,sha256=3P68qR3Rcf9zl5u4_SMkmloD8MnzZi6VWv7n4AMb_-4,5835
 netgear_switch/_dispatch.py,sha256=JO30TCPjE_1Y10SIGEkQybPT5EQB5z0LGfyT5YDQYMc,12615
-netgear_switch/_version.py,sha256=RQfwfyXRGb0ZUVK1NxgTp_zOxRf2JaUrtvY7vGNbuek,534
+netgear_switch/_version.py,sha256=zWbegVLGRk_tDrqYbjadt8rHBhj6Vv_pjARz9Mr8w0g,534
 netgear_switch/aio_api.py,sha256=5b7a6LPT_LkMmcRdCzyPRhiE9nte9TseOFCcmlTj-5o,29561
-netgear_switch/capabilities.py,sha256=duMr2-MVJIcDzxmppdBplysq_e-_Q4E1W1T7w1guVww,20594
+netgear_switch/capabilities.py,sha256=ZG9QX0k0zZTelaat70Kfn_bW3UZ9Dk4Pfq49CiqzdAc,21524
 netgear_switch/cli_read.py,sha256=EpbFLYPSA_tErwMfqHJBOjonhUVvPpS-pmlnYGQ73W0,6477
 netgear_switch/cli_write.py,sha256=NGcitE5ZRfFSohOn38mLUcFsshofJNfI9XxcbQsd5Ss,33156
 netgear_switch/config.py,sha256=z2vV1LqsLTb83ekEJwy_nnkeUlxcknicmkmKfILH5kc,5787
 netgear_switch/errors.py,sha256=zb9fFU71o69NXBhH51OOe5tXVp1UigMd2U64TN5cTW0,2203
 netgear_switch/http_read.py,sha256=LsgticMEeFdeSZgQwx16RSYc81i4wlHoe6tm_wStefg,39779
-netgear_switch/http_write.py,sha256=bkg1w8kPvUK-Llawv-DYkdIK5TOPlSgKFX7eOyoqAfU,61669
+netgear_switch/http_write.py,sha256=dcMhpJ-qKJh-bE1fS0B06JoDeZpDhH9WXmcAH3jsqbU,62884
 netgear_switch/models.py,sha256=5esfLwV47kM_8kyVeVAOihhS9nxB0CHj0kaRbd64388,8557
 netgear_switch/nsdp_read.py,sha256=CXJ4FrIWvEnk1slERgJbZRD2G189vgE6t0YclrCMoH4,15467
 netgear_switch/nsdp_write.py,sha256=NaMvrGbDqiej5gk27pS24UWY_T2WdamwK1kHX65e884,21366
@@ -31,7 +31,7 @@ netgear_switch/protocols/cli/commands.py,sha256=88Dt506mDAMUEW6fpmntjarAxnHyjVLJ
 netgear_switch/protocols/cli/parse.py,sha256=dNxnzy49IsPrO5oYXWT7NLYsXZySRz0S_0IZUzwU0D8,38864
 netgear_switch/protocols/http/__init__.py,sha256=n_iSvNTdSqeEE8U2hbk5SYSNXrWHDYzlqok89FVnK10,85
 netgear_switch/protocols/http/crypt.py,sha256=zwFqE9ff49-j-qlvo7k-ydcG3z1l2SNJ8WLel65-w58,976
-netgear_switch/protocols/http/endpoints.py,sha256=krxd8cDbvOPecHQzk8SMbWOrdKmqlAWKRH9YcYZmZ1c,52469
+netgear_switch/protocols/http/endpoints.py,sha256=mNvzll3pQLZC5rKUOLcf994v7LR8nKJ288MrYd9akVQ,53466
 netgear_switch/protocols/http/forms.py,sha256=a218L58_D62pgYACtlVzGpej88dQLEfTXsQqM7K3Pww,11228
 netgear_switch/protocols/http/parse.py,sha256=1qwGOX0l1kFxvwFWZXAFWoTnT4iM0qorIuJanof0qSk,116681
 netgear_switch/protocols/http/session.py,sha256=kJto8197Q3_ArIr3DnwapmVPZP--zG-T17uCxxqyiHM,1766
@@ -67,7 +67,7 @@ netgear_switch/virtual/cli_fastpath.py,sha256=Mk1ER8_PRp2apT-l85Imnd8fPhQcM05RaM
 netgear_switch/virtual/seed.py,sha256=xoaaQbgVQsN1lAzq7D9yPxQzRAs3B8RFOrMn-ikmOz4,96821
 netgear_switch/virtual/server.py,sha256=L6pkdsK48nVhSOVx-TCNLQTtjTJkud-xi-EuRh5CbiQ,9335
 netgear_switch/virtual/state.py,sha256=I0U9n3rqBQaTqwfoaKDdEb6D3Zt45s_ha6eBxBnCLdc,74611
-netgear_switch/virtual/web.py,sha256=abRn0pr_T_SycW2khBt8lvErPiq1KdiMVqSnloeG-WY,7323
+netgear_switch/virtual/web.py,sha256=hMrDQgVP2DDQO-2ebE1z4NXSuCvZozzookRSfkUvx-k,8737
 netgear_switch/virtual/web_fastpath_vlan.py,sha256=W5TsIrjRzt57jno-YAjXUiuXW_6IwIzTzPqs1N2O_Pw,19443
 netgear_switch/virtual/web_fastpath_xui.py,sha256=B2K3c_CJ5dzOzCw8ELIdMiUyCj1wmw_psp7luNh70s0,11208
 netgear_switch/virtual/web_gs105pe.py,sha256=4BJ7xEkTdnQiI5r20doFv-ErLEr5BDLMq4fmCayqMEs,7568
@@ -84,8 +84,8 @@ netgear_switch/virtual/faces/mibview.py,sha256=g4EsSfXO6ojyPDT633lEkNVmPcqzU0Vdb
 netgear_switch/virtual/faces/nsdp.py,sha256=WX9w1YWArUvm4-L2Y7QI8njvBRD4t0TVFUL2V0yuQmI,10395
 netgear_switch/virtual/faces/snmp.py,sha256=y8N3rDwO3AuHWi9Ke10WLG1yzZITpn363PunIG_ZuSk,21252
 netgear_switch/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-python_netgear_switch_library-0.0.post353.dist-info/METADATA,sha256=Wcyk29yyIW62th7llMNa3SJx29yf7ODE-Ve1AR29KRY,6682
-python_netgear_switch_library-0.0.post353.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
-python_netgear_switch_library-0.0.post353.dist-info/entry_points.txt,sha256=mf6HFDGVV0KIDI0dHkh0BNcCjHkSg1lhE70xTzB47WQ,96
-python_netgear_switch_library-0.0.post353.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-python_netgear_switch_library-0.0.post353.dist-info/RECORD,,
+python_netgear_switch_library-0.0.post355.dist-info/METADATA,sha256=TIr7LAfmhFmpnN_MfzW95BARs64CxWKGG0a60Cywk24,6682
+python_netgear_switch_library-0.0.post355.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+python_netgear_switch_library-0.0.post355.dist-info/entry_points.txt,sha256=mf6HFDGVV0KIDI0dHkh0BNcCjHkSg1lhE70xTzB47WQ,96
+python_netgear_switch_library-0.0.post355.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+python_netgear_switch_library-0.0.post355.dist-info/RECORD,,