hansjone/netx
1
0
Fork 0
mirror of https://github.com/hansjone/netx.git synced 2026-10-09 21:50:47 +08:00
Code Issues Projects Releases 1 Packages Wiki Activity Actions 3

Add explicit Huawei hop system-view option and startup column safety-net.

Browse source 
Some hops only accept stelnet in system-view; make it a saved yes/no setting (default off) instead of auto-retry, and always ALTER the new column on API boot when Alembic skips legacy DDL.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-08-28 23:58:05 +08:00
parent 0a550abcb0
commit b36174bfa4
20 changed files with 242 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
netx_api/app_startup.py
View file

@ -11,6 +11,7 @@ from .schema_patches import (
apply_all_legacy_startup_ddl,
apply_auth_schema_patches,
apply_collection_schema_safety_net,
apply_hop_schema_safety_net,
apply_topology_schema_safety_net,
run_alembic_upgrade_to_head,
)
@ -56,12 +57,13 @@ def run_api_startup() -> None:
try:
with engine.begin() as conn:
apply_auth_schema_patches(conn)
# Critical topology columns even when full legacy DDL is skipped
# Critical columns even when full legacy DDL is skipped
# (e.g. alembic stamped head without applying domain patches).
apply_topology_schema_safety_net(conn)
apply_collection_schema_safety_net(conn)
apply_hop_schema_safety_net(conn)
except Exception:
_log.exception("startup: auth/topology/collection schema safety patches failed")
_log.exception("startup: auth/topology/collection/hop schema safety patches failed")
if skip_ddl and alembic_ok:
_log.info("startup: schema via Alembic (legacy inline DDL skipped)")
else:

1
netx_api/cli_resolve.py
View file

@ -107,6 +107,7 @@ def profile_to_creds(
"hop_command_template": str(profile.hop_command_template or ""),
"hop_vrf": str(profile.hop_vrf or ""),
"hop_target_auth_mode": str(profile.hop_target_auth_mode or "bastion_managed"),
"hop_enter_system_view": bool(getattr(profile, "hop_enter_system_view", False)),
}

3
netx_api/cli_schemas.py
View file

@ -27,6 +27,7 @@ class CliConnectProfileCreate(BaseModel):
hop_command_template: str = ""
hop_vrf: str = ""
hop_target_auth_mode: str = "bastion_managed"
hop_enter_system_view: bool = False
@field_validator("vendor_default")
@classmethod
@ -60,6 +61,7 @@ class CliConnectProfileUpdate(BaseModel):
hop_command_template: str | None = None
hop_vrf: str | None = None
hop_target_auth_mode: str | None = None
hop_enter_system_view: bool | None = None
class CliConnectProfileOut(BaseModel):
@ -81,6 +83,7 @@ class CliConnectProfileOut(BaseModel):
hop_command_template: str
hop_vrf: str
hop_target_auth_mode: str
hop_enter_system_view: bool = False
created_at: datetime
updated_at: datetime

5
netx_api/cli_service.py
View file

@ -69,6 +69,7 @@ def _profile_out(row: CliConnectProfile) -> CliConnectProfileOut:
hop_command_template=str(row.hop_command_template or ""),
hop_vrf=str(row.hop_vrf or ""),
hop_target_auth_mode=str(row.hop_target_auth_mode or "bastion_managed"),
hop_enter_system_view=bool(getattr(row, "hop_enter_system_view", False)),
created_at=row.created_at,
updated_at=row.updated_at,
)
@ -133,6 +134,7 @@ def create_cli_profile(db: Session, body: CliConnectProfileCreate) -> CliConnect
hop_command_template=str(body.hop_command_template or "").strip(),
hop_vrf=str(body.hop_vrf or "").strip(),
hop_target_auth_mode=_normalize_hop_target_auth_mode(body.hop_target_auth_mode),
hop_enter_system_view=bool(body.hop_enter_system_view),
)
if body.is_default or db.query(CliConnectProfile).count() == 0:
db.query(CliConnectProfile).update({CliConnectProfile.is_default: False})
@ -180,6 +182,7 @@ def update_cli_profile(db: Session, profile_id: str, body: CliConnectProfileUpda
"hop_command_template",
"hop_vrf",
"hop_target_auth_mode",
"hop_enter_system_view",
)
for key in hop_keys:
if key in data and data[key] is not None:
@ -190,6 +193,8 @@ def update_cli_profile(db: Session, profile_id: str, body: CliConnectProfileUpda
row.hop_protocol = _normalize_protocol(data["hop_protocol"])
if "hop_target_auth_mode" in data and data["hop_target_auth_mode"] is not None:
row.hop_target_auth_mode = _normalize_hop_target_auth_mode(data["hop_target_auth_mode"])
if "hop_enter_system_view" in data and data["hop_enter_system_view"] is not None:
row.hop_enter_system_view = bool(data["hop_enter_system_view"])
if "hop_password" in data and data["hop_password"]:
_require_crypto()
row.hop_password_enc = encrypt_secret(str(data["hop_password"]))

3
netx_api/models/managed_ne.py
View file

@ -46,6 +46,8 @@ class ManagedNE(Base):
hop_command_template: Mapped[str] = mapped_column(Text, default="")
hop_vrf: Mapped[str] = mapped_column(String(128), default="")
hop_target_auth_mode: Mapped[str] = mapped_column(String(32), default="bastion_managed")
# Huawei CLI hop: run ``system-view`` before stelnet/telnet (default: stay in user-view).
hop_enter_system_view: Mapped[bool] = mapped_column(default=False)
created_at: Mapped[datetime] = mapped_column(DateTime, default=utcnow_naive)
updated_at: Mapped[datetime] = mapped_column(DateTime, default=utcnow_naive, index=True)
@ -75,6 +77,7 @@ class CliConnectProfile(Base):
hop_command_template: Mapped[str] = mapped_column(Text, default="")
hop_vrf: Mapped[str] = mapped_column(String(128), default="")
hop_target_auth_mode: Mapped[str] = mapped_column(String(32), default="bastion_managed")
hop_enter_system_view: Mapped[bool] = mapped_column(default=False)
created_at: Mapped[datetime] = mapped_column(DateTime, default=utcnow_naive)
updated_at: Mapped[datetime] = mapped_column(DateTime, default=utcnow_naive, index=True)

4
netx_api/ne_schemas.py
View file

@ -31,6 +31,7 @@ class ManagedNeCreate(BaseModel):
hop_command_template: str = ""
hop_vrf: str = ""
hop_target_auth_mode: str = "bastion_managed"
hop_enter_system_view: bool = False
@field_validator("vendor")
@classmethod
@ -65,6 +66,7 @@ class ManagedNeUpdate(BaseModel):
hop_command_template: str | None = None
hop_vrf: str | None = None
hop_target_auth_mode: str | None = None
hop_enter_system_view: bool | None = None
@field_validator("vendor")
@classmethod
@ -109,6 +111,7 @@ class ManagedNeOut(BaseModel):
hop_command_template: str = ""
hop_vrf: str = ""
hop_target_auth_mode: str = "bastion_managed"
hop_enter_system_view: bool = False
created_at: datetime
updated_at: datetime
@ -158,6 +161,7 @@ class HopProxyConfig(BaseModel):
hop_command_template: str = ""
hop_vrf: str = ""
hop_target_auth_mode: str = "bastion_managed"
hop_enter_system_view: bool = False
class BatchHopApplyRequest(BaseModel):

5
netx_api/ne_service_common.py
View file

@ -172,6 +172,7 @@ def _apply_hop_create(row: ManagedNE, body: ManagedNeCreate) -> None:
row.hop_command_template = str(body.hop_command_template or "").strip()
row.hop_vrf = str(body.hop_vrf or "").strip()
row.hop_target_auth_mode = _normalize_hop_target_auth_mode(body.hop_target_auth_mode)
row.hop_enter_system_view = bool(body.hop_enter_system_view)
def _apply_hop_update(row: ManagedNE, data: dict[str, Any]) -> None:
@ -196,6 +197,8 @@ def _apply_hop_update(row: ManagedNE, data: dict[str, Any]) -> None:
row.hop_vrf = str(data["hop_vrf"]).strip()
if "hop_target_auth_mode" in data and data["hop_target_auth_mode"] is not None:
row.hop_target_auth_mode = _normalize_hop_target_auth_mode(data["hop_target_auth_mode"])
if "hop_enter_system_view" in data and data["hop_enter_system_view"] is not None:
row.hop_enter_system_view = bool(data["hop_enter_system_view"])
if "hop_host" in data or "hop_username" in data or "hop_vendor" in data:
hop_host, hop_username = _normalize_saved_hop_endpoint(
hop_vendor=str(row.hop_vendor or ""),
@ -247,6 +250,7 @@ def row_to_out(row: ManagedNE) -> ManagedNeOut:
hop_command_template=str(row.hop_command_template or ""),
hop_vrf=str(row.hop_vrf or ""),
hop_target_auth_mode=str(row.hop_target_auth_mode or "bastion_managed"),
hop_enter_system_view=bool(getattr(row, "hop_enter_system_view", False)),
created_at=row.created_at,
updated_at=row.updated_at,
)
@ -279,4 +283,5 @@ def get_device_credentials(row: ManagedNE) -> dict[str, Any]:
"hop_command_template": str(row.hop_command_template or ""),
"hop_vrf": str(row.hop_vrf or ""),
"hop_target_auth_mode": str(row.hop_target_auth_mode or "bastion_managed"),
"hop_enter_system_view": bool(getattr(row, "hop_enter_system_view", False)),
}

2
netx_api/ne_service_crud.py
View file

@ -173,6 +173,7 @@ def update_managed_ne(db: Session, ne_id: str, body: ManagedNeUpdate) -> Managed
"hop_command_template",
"hop_vrf",
"hop_target_auth_mode",
"hop_enter_system_view",
)
if any(k in data for k in hop_keys):
_apply_hop_update(row, data)
@ -239,6 +240,7 @@ def batch_apply_hop_proxy(db: Session, ids: list[str], hop: HopProxyConfig) -> d
row.hop_command_template = template
row.hop_vrf = str(hop.hop_vrf or "").strip()
row.hop_target_auth_mode = hop_auth_mode
row.hop_enter_system_view = bool(getattr(hop, "hop_enter_system_view", False))
row.updated_at = now
db.commit()
return {"ok": True, "updated": len(rows)}

49
netx_api/ne_session_connect.py
View file

@ -798,6 +798,31 @@ def _resize_pty(conn: ConnectHandler, cols: int | None = None, rows: int | None
_log.debug("resize_pty failed cols=%s rows=%s", c, r, exc_info=True)
def _huawei_enter_system_view(
conn: ConnectHandler,
*,
progress_cb: Any = None,
emit_raw: bool = True,
) -> str:
"""Enter Huawei system-view; return the new ``[sysname]`` prompt marker if seen."""
_emit_progress(progress_cb, "\r\n[netx] hop system-view…\r\n")
_send_line(conn, "system-view")
acc = ""
for _ in range(8):
part = _read_channel(conn, wait=0.2, max_loops=10)
if not part:
time.sleep(0.15)
continue
acc += part
if emit_raw:
_emit_progress(progress_cb, part)
marker = extract_cli_prompt_marker(acc)
# System-view prompts are ``[sysname]`` / ``[~sysname]`` (not ``<sysname>``).
if marker.startswith("["):
return marker
return extract_cli_prompt_marker(acc)
def _connect_via_cli_hop(
creds: dict[str, Any],
*,
@ -833,13 +858,14 @@ def _connect_via_cli_hop(
# WebCRT passes ProgressBytesIO(session_log) that already tees device bytes to progress_cb.
# Re-emitting the same reads doubles every line (stelnet, Y/N, MOTD, prompts).
teed = isinstance(session_log, _ProgressBytesIO)
emit_raw = not teed
conn = _build_netmiko_connection(hop_dev, interactive=interactive)
try:
# MUST resize before stelnet/telnet — nested session captures hop TTY size at start
# and often ignores later WINCH. Wrong width → mid-line edit redraw wraps in WebCRT.
_resize_pty(conn, cols, rows)
pre = _read_channel(conn, wait=0.35)
if pre and not teed:
if pre and emit_raw:
_emit_progress(progress_cb, pre)
hop_prompt = extract_cli_prompt_marker(pre)
if not hop_prompt:
@ -849,7 +875,7 @@ def _connect_via_cli_hop(
except Exception:
_send_line(conn, "")
more = _read_channel(conn, wait=0.25, max_loops=12)
if more and not teed:
if more and emit_raw:
_emit_progress(progress_cb, more)
pre = pre + more
hop_prompt = extract_cli_prompt_marker(pre)
@ -859,39 +885,48 @@ def _connect_via_cli_hop(
for _ in range(6):
more = _read_channel(conn, wait=0.3, max_loops=10)
if more:
if not teed:
if emit_raw:
_emit_progress(progress_cb, more)
pre += more
hop_prompt = extract_cli_prompt_marker(pre)
if hop_prompt:
break
vendor = _hop_vendor(creds)
# Explicit hop option only (default False): never auto-enter system-view on failure.
if vendor == "huawei" and bool(creds.get("hop_enter_system_view")):
sv_prompt = _huawei_enter_system_view(conn, progress_cb=progress_cb, emit_raw=emit_raw)
if sv_prompt:
hop_prompt = sv_prompt
hop_cmd = render_hop_command(str(creds.get("hop_command_template") or ""), creds)
_emit_progress(progress_cb, f"\r\n[netx] hop jump: {hop_cmd}\r\n")
_send_line(conn, hop_cmd)
_interactive_target_auth(
conn,
str(creds["username"]),
str(creds["password"]),
progress_cb=progress_cb,
emit_raw=not teed,
emit_raw=emit_raw,
)
_attach_cli_hop_guard(
conn,
hop_prompt=hop_prompt,
hop_vendor=_hop_vendor(creds),
hop_vendor=vendor,
hop_host=hop_host,
)
if hop_prompt:
_log.info(
"cli hop guard armed vendor=%s hop=%s prompt=%r",
_hop_vendor(creds),
vendor,
hop_host,
hop_prompt,
)
else:
_log.warning(
"cli hop guard armed without hop prompt vendor=%s hop=%s (nested-close only)",
_hop_vendor(creds),
vendor,
hop_host,
)
return conn

15
netx_api/schema_patches.py
View file

@ -199,6 +199,18 @@ def apply_collection_schema_safety_net(conn: Connection) -> None:
)
def apply_hop_schema_safety_net(conn: Connection) -> None:
"""Always-on hop columns (Alembic head stamp skips legacy domain patches)."""
_run_sql(
conn,
"ALTER TABLE managed_ne ADD COLUMN IF NOT EXISTS hop_enter_system_view BOOLEAN DEFAULT FALSE",
)
_run_sql(
conn,
"ALTER TABLE cli_connect_profile ADD COLUMN IF NOT EXISTS hop_enter_system_view BOOLEAN DEFAULT FALSE",
)
def apply_key_alert_schema_patches(
engine: Engine | None = None,
*,
@ -348,6 +360,8 @@ def apply_domain_schema_patches(conn: Connection) -> None:
"ALTER TABLE managed_ne ADD COLUMN IF NOT EXISTS hop_command_template TEXT DEFAULT ''",
"ALTER TABLE managed_ne ADD COLUMN IF NOT EXISTS hop_vrf VARCHAR(128) DEFAULT ''",
"ALTER TABLE managed_ne ADD COLUMN IF NOT EXISTS hop_target_auth_mode VARCHAR(32) DEFAULT 'bastion_managed'",
"ALTER TABLE managed_ne ADD COLUMN IF NOT EXISTS hop_enter_system_view BOOLEAN DEFAULT FALSE",
"ALTER TABLE cli_connect_profile ADD COLUMN IF NOT EXISTS hop_enter_system_view BOOLEAN DEFAULT FALSE",
"ALTER TABLE managed_ne ADD COLUMN IF NOT EXISTS source VARCHAR(64) DEFAULT ''",
"ALTER TABLE managed_ne ADD COLUMN IF NOT EXISTS source_ref VARCHAR(128) DEFAULT ''",
"ALTER TABLE managed_ne ADD COLUMN IF NOT EXISTS connect_detail TEXT DEFAULT ''",
@ -409,6 +423,7 @@ def apply_domain_schema_patches(conn: Connection) -> None:
hop_command_template TEXT DEFAULT '',
hop_vrf VARCHAR(128) DEFAULT '',
hop_target_auth_mode VARCHAR(32) DEFAULT 'bastion_managed',
hop_enter_system_view BOOLEAN DEFAULT FALSE,
created_at TIMESTAMP,
updated_at TIMESTAMP
)