trigger / trigger

Trigger is a robust network automation toolkit written in Python that was designed for interfacing with network devices.

What is Trigger?

Trigger is a robust network automation toolkit written in Python that was designed for interfacing with network devices and managing network configuration and security policy. It increases the speed and efficiency of managing large-scale networks while reducing the risk of human error.

Started by the AOL Network Security team in 2006, Trigger was originally designed for security policy management on firewalls, routers, and switches. It has since been expanded to be a full-featured network automation toolkit.

With the high number of network devices on the AOL network this application is invaluable to performance and reliability. We hope you'll find it useful on your network and consider participating!

Supported Platforms

• Cisco IOS, NX-OS, and ASA software
• Juniper Junos and ScreenOS
• Force10 router and switch platforms running FTOS
• Arista Networks 7000-family switches
• ... and more!

Refer to the official docs for the full list.

Key Features

Trigger is designed to work at scale and can support hundreds or thousands of network devices with ease. Here are some of things that make Trigger tick:

• Support for SSH, Telnet, and Juniper's Junoscript XML API.
• Easily get an interactive shell or execute commands asynchronously.
• Leverage advanced event-driven functionality to manage any number of jobs in parallel and handle output or errors as they return.
• Powerful metadata interface for performing complex queries to group and associate network devices by name, manufacturer, type, location, and more.
• Encrypted storage of login credentials so you can interact without constantly being prompted to enter your password.
• Flexible access-list & firewall policy parser that can test access if access is permitted, or easily convert ACLs from one format to another.
• Detailed support for timezones and maintenance windows.
• A suite of tools for simplifying many common tasks.

New in version 1.2:

• Import your metadata from an existing RANCID installation to get up-and-running quickly!

New in version 1.3:

• Import your metadata from a CSV file and get up-and-running even quicker!

Getting Started

The best way to get started is to read the documentation hosted by Read the Docs at http://trigger.readthedocs.io. There you will find everything you need to get going including usage examples, installation and configuration instructions, and more!

Before you begin

• The develop branch is the default branch that will be active when you clone this repository. While it is generally stable this branch is not considered production-ready. Use at your own risk!
• The master branch is the stable branch, and will reflect the latest production-ready changes. It is recommended that this is the branch you use if you are installing Trigger for the first time.
• Each point release of Trigger is maintained as a tag branch. If you require a specific Trigger version, please refer to these.

Get in touch!

If you run into any snags, have questions, feedback, or just want to talk shop: contact us!

Pro tip: Find us on IRC at #trigger on Freenode (irc://irc.freenode.net/trigger).

trigger's Issues

NetDevices needs a way to track metadata for virtual devices

NetDevices currently expects NetDevice objects to be physical assets. We need a way to identify a device as virtual or physical so that we can begin to utilize VRRP/HSRP/NSRP or VIP hostnames within Trigger. This is especially important for firewalls and load-balancers in active/passive configuration.

The rough 10,000ft idea is to have an additional attribute that designates a device as virtual, and to have some special methods like .is_virtual() or .is_physical().

Async support with Arista? Force10 OK

I see in settings.py that Arista is known not to work w/SSH async yet. Can you elaborate on what needs to be done? It looks like it gets stuck in an event loop. I tried the async "Slightly Advanced Examples" from the docs.

On a positive note, the async examples work fine with Force10 S-series, so I can do some more testing with Force10 and trigger. I'd like to help improve Arista and Force10 support in trigger.

Term.output() method does not seem to honor 'ios' format

ACL.output('ios') honors 'ios' format:

>>> print '\n'.join(acl.output('ios')[-3:])
!!! Deny All Else
!
access-list 2217 deny ip any any

But `Term.output('ios') does not and actually outputs 'ios_named' format:

>>> print '\n'.join(acl.terms[-1].output('ios'))
!
!!! Deny All Else
!
deny ip any any

Make `bin/load_acls`'s device grouping algorithm read from a configurable parameter in `settings.py`

The current grouping algorithm is hard-coded to a pattern match on the hostname of the device. That is why I did factor it out to the group() function as you determined, so that we can make this something that can be tweaked in the settings.

Let's move this criteria to a callable that can be found within settings.py.

Update dot_gorc.example with [init_commands]

In the current master tarball conf/dot_gorc.example, replace [initial_commands] with [init_commands] so that the example works correctly.

Make Trigger twister.execute_ioslike() work with SSH

Trigger should be able to execute commands on IOS-like devices (like Arista, Brocade VDX) over SSH. Currently this is only supported over telnet.

trigger.acl.check_access() doesn't check Juniper's firewall "port" statement

A firewall term with port configured (which will match either source-port or destination-port) will return a false positive match if the other criteria match.

Fix SSH channels for Arista, Brocade VDX, and other "exec" style channels

Arista and Brocade VDX platforms do not send along a prompt when connecting without a PTY, which means they are better served using SSH "exec" vs "shell". Fix support for these platforms to utilize "exec" when connecting asynchronously using the .connect() method.

Fork ACL parser into distinct project.

This work will be non-trivial. The thought goes as follows:

• Fork trigger.acl
• Put all new ACL-related changes into this project; backport them into trigger.acl in the near-term as necessary
• Once this project is stable, remove it from Trigger core
• Replace core functionality with "contrib.acl" functionality that is optional and can be toggled in the global settings.

load_acl uncaught exception in creating a cm ticket

Traceback (most recent call last): 
 File "/usr/local/bin/load_acl", line 764, in <module> 
   main() 
 File "/usr/local/bin/load_acl", line 704, in main 
   cm_ticketnum = create_cm_ticket(work, oncall) 
 File "/etc/trigger/settings.py", line 421, in create_cm_ticket 
   return create_ticket(**oncall) 
 File "/usr/local/lib/python/site-packages/aol/remedy.py", line 181, in create_ticket 
   verbose=verbose, debug=debug) 
 File "/usr/local/lib/python/site-packages/aol/remedy.py", line 259, in __init__ 
   self.client = setup_client(self.url) 
 File "/usr/local/lib/python/site-packages/aol/remedy.py", line 221, in setup_client 
   client = Client(url) 
 File "/usr/local/lib/python/site-packages/suds/client.py", line 112, in __init__ 
   self.wsdl = reader.open(url) 
 File "/usr/local/lib/python/site-packages/suds/reader.py", line 152, in open 
   d = self.fn(url, self.options) 
 File "/usr/local/lib/python/site-packages/suds/wsdl.py", line 136, in __init__ 
   d = reader.open(url) 
 File "/usr/local/lib/python/site-packages/suds/reader.py", line 79, in open 
   d = self.download(url) 
 File "/usr/local/lib/python/site-packages/suds/reader.py", line 95, in download 
   fp = self.options.transport.open(Request(url)) 
 File "/usr/local/lib/python/site-packages/suds/transport/https.py", line 60, in open 
   return HttpTransport.open(self, request) 
 File "/usr/local/lib/python/site-packages/suds/transport/http.py", line 62, in open 
   return self.u2open(u2request) 
 File "/usr/local/lib/python/site-packages/suds/transport/http.py", line 118, in u2open 
   return url.open(u2request, timeout=tm) 
 File "/usr/local/lib/python2.6/urllib2.py", line 391, in open 
   response = self._open(req, data) 
 File "/usr/local/lib/python2.6/urllib2.py", line 409, in _open 
   '_open', req) 
 File "/usr/local/lib/python2.6/urllib2.py", line 369, in _call_chain 
   result = func(*args) 
 File "/usr/local/lib/python2.6/urllib2.py", line 1178, in https_open 
   return self.do_open(httplib.HTTPSConnection, req) 
 File "/usr/local/lib/python2.6/urllib2.py", line 1145, in do_open 
   raise URLError(err) 
urllib2.URLError: <urlopen error The read operation timed out> 

Gong should tell you when a device hostname does not resolve

% gong abc-bb1
Matched 'abc-bb1-net.aol.com'.
WARNING: You are connecting to a non-production device.
Connecting to abc-bb1-net.aol.com. Use ^X to exit.

Fetching credentials from /home/jathan/.tacacsrc

Look closely and you'll see that 'abc-bb1-net.aol.com' is typoed and therefore doesn't resolve:

% host abc-bb1-net.aol.com
Host abc-bb1-net.aol.com not found: 3(NXDOMAIN)

This hostname is misspelled in the NetDevices metadata.

Gong should not mask this problem, and should report it back to the user.

gong should handle ssh connection failures and optionally fallback to telnet

We have a switch which is failing sshd connections. When gong attempts to connect to it, it silently exits with no error message. Gong should either display an error when it receives one, fall back to telnet, or (ideally) do both.

$ ssh foo3-xyz2-sw2 
ssh_exchange_identification: Connection closed by remote host 

$ gong foo3-xyz2-sw2 
Connecting to foo3-xyz2-sw2.net.aol.com. Use ^X to exit. 

Fetching credentials from /home/jathan/.tacacsrc 


$

Need to research what the error condition is for "ssh_exchange_identification: Connection closed by remote host" so that it can be replicated within Trigger and handled accordingly (log, warn, react, etc).

Trigger should support JunOS policy-options

Take this very benign example of a policy-statement:

policy-statement Martians {
    term T1 {
        from {
            route-filter 0.0.0.0/0 prefix-length-range /25-/32;
            route-filter 10.0.0.0/8 orlonger;
            route-filter 127.0.0.0/8 orlonger;
            route-filter 128.0.0.0/16 orlonger;
            route-filter 169.254.0.0/16 orlonger;
            route-filter 172.16.0.0/12 orlonger;
            route-filter 191.255.0.0/16 orlonger;
            route-filter 192.0.0.0/24 orlonger;
            route-filter 192.0.2.0/24 orlonger;
            route-filter 192.168.0.0/16 orlonger;
            route-filter 224.0.0.0/4 orlonger;
        }
        then reject;
    }
}

which I would call then in some sort of routing policy, in this case it might be for a bgp peer:

bgp {
    log-updown;
    remove-private;
     group Your Mom {
        type external;
        import [ Martians YM_communities-next_hop ];
        export [ Public-Stuff Match_Any_Deny ];
        peer-as 1234;
        neighbor 1.2.3.4;
    }
}

Trigger should be able to handle me modifying either a section of the policy, either to add a new term, possibly insert a statement into an existing term, or change the behavior of the policy-statement in some way:

policy-statement Martians {
    term T1 {
        from {
            route-filter 0.0.0.0/0 prefix-length-range /25-/32;
            route-filter 10.0.0.0/8 orlonger;
            route-filter 127.0.0.0/8 orlonger;
            route-filter 128.0.0.0/16 orlonger;
            route-filter 169.254.0.0/16 orlonger;
            route-filter 172.16.0.0/12 orlonger;
            route-filter 191.255.0.0/16 orlonger;
            route-filter 192.0.0.0/24 orlonger;
            route-filter 192.0.2.0/24 orlonger;
            route-filter 192.168.0.0/16 orlonger;
            route-filter 224.0.0.0/4 orlonger;
        }
        then reject;
     }
    term T2 {
       then log;
   } 

}

Or possibly even add/change another variable of my peer. Lets say I wish to drain this router:

bgp {
    log-updown;
    remove-private;
     group Your Mom {
        type external;
        import [ YM_communities-next_hop ];
        export [ Your_Mom_Drain_Policy ];
        peer-as 1234;
        neighbor 1.2.3.4;
    }
}

Examples could vary. I may roll a new routing policy to a router and add it to an import or export statement. There are also a huge variety of types of policy match conditions and actions that might be useful.

SSH async execution is not disabling paging on multi-line output

This is related to the SSH auto-detection support that was added in Trigger 1.2. The problem is noticably occuring when a Brocade router is found in the path, but could be with any IOS-like device that is returning more than 25 lines of output causing the device to send a "--more--" prompt and blocks the entire program while it waits for user input (which is not displayed to the end user because it's async).

The workaround is to disabled SSH async execution on Brocade routers within the Trigger configuration.

Like so:

SSH_ASYNC_DISABLED = {
    'arista': ['SWITCH'],  # Known not to work w/ SSH ... yet
    'brocade': ['SWITCH', 'ROUTER'], # Namely the Brocade VDX (I also added ROUTER!)
    'dell': ['SWITCH'],    # Dell SSH is just straight up broken
}

What needs to happen is that the Base SSH channel (trigger.twister.TriggerSSHChannelBase) needs a way to accept an optional NetDevice object as an argument to the constructor. When this is set, it should populate the self.initialize list of commands to the appropriate "disable paging" command for the platform (e.g. terminal length 0 on Cisco). This functionality already exists within trigger.twister.IoslikeSendExpect (telnet) and needs to be implemented for SSH channels.

Notification events should be extensible (not just email)

This will require adding a hook to the Trigger configuration for when alerts are to be sent. Currently it's assumed that an email will be sent, but this will need to be changed to just perform a function call. The default function call will just send email as it does now. This is similiar to the current implementation of get_current_oncall() and create_cm_ticket() from within the Trigger settings.py.

Fallback to telnet when SSH is detected but fails

When SSH connect/execute fails with something like this, fallback to telnet:

Connection failed for the following reason:

bad packet mod (35%8 == 3)

BYE

acl -r not working

$ acl -r tealeaf abc-xyz-sw0
Traceback (most recent call last):
  File "/usr/local/bin/acl", line 138, in <module>
    except ModifyACLSetError, err:
NameError: name 'ModifyACLSetError' is not defined

settings.get_firewall_db_connection() is not found in Settings object

Traceback (most recent call last):
  File "/opt/bcs/bin/acl", line 84, in <module>
    queue = Queue()
  File "/opt/bcs/packages/python-modules-2.0/lib/python/site-packages/trigger/acl/queue.py", line 42, in __init__
    self.dbconn = settings.get_firewall_db_conn()
AttributeError: 'Settings' object has no attribute 'get_firewall_db_conn'

Because of the recent changes to how settings are imported, anything not in ALL_CAPS is not attached to the settings object. Need to fix this so that the database helper can be called.

interactive pty with init_commands doesn't accept carriage returns

When I use connect() with init_commands, pty no longer accepts carriage returns to execute commands interactively.

Add support to `bin/load_acl` for copying configs over SSH for Cisco devices

We need to research the commands required to do this.

init_commands not working properly in pty

2012-09-20 12:35:43-0700 [-] No option <Vendor: Juniper> in section: 'init_commands'

Need to make twister pass device.vendor.name to gorc.get_init_commands()

trigger.acl.tools.check_access() needs to also check modifiers

trigger.acl.tools.check_access() looks for both permits and denies and can search for membership within networks or port-ranges, protocols, but does not check modifiers such as fragment-offsets, or other header options. Because term block_snmp_fragments has a fragment-offset 0 modifier in the term, the access was not an exact match and therefore was being skipped.

Note in this output below that it displays term block_snmp_fragments as being part of the access path, but it does not accurately determine it to be dropping the traffic because were weren't asking it to check fragment-offset 0. It reports the following term 10net-TCPUDP-ALLOW as permitting the access with the inline comment "/*check_access: PERMITTED HERE*/".

% ./check_access acl.123 10.180.124.82/32 1.2.3.4/32 udp 161 
term cflow { 
    then { 
    next term; 
    count arbor-cflow; 
    } 
} 
term block_snmp_fragments { 
    /* DIsallow snmp fragments */ 
    from { 
    fragment-offset 0; 
    protocol udp; 
    destination-port 161-162; 
    } 
    then { 
    discard; 
    count T42; 
    } 
} 
term 10net-TCPUDP-ALLOW { 
    /*check_access: PERMITTED HERE*/ 
    from { 
    source-address { 
        10.0.0.0/16; 
        10.2.0.0/16; 
...

Fix timeout problem on Brocade MLX w/ load_acl

The timeouts for brocade need to be looked at because they don't seem to be timing out and just hand on "connecting to....". Finally, need to determine why certain ACLs couldn't complete the load on Brocade devices and fix/throw error.

Trigger execute_ioslike() should catch Brocade VDX errors such as "syntax error:"

When you login to a device and don't have the proper permissions, commands return "syntax error:"

% gong test3-abc-sw1.net.aol.com
Connecting to test3-abc-sw1.net.aol.com. Use ^X to exit.

Fetching credentials from /home/j/jathan/.tacacsrc
User's role is unavailable, using default.
Welcome to the Brocade Network Operating System Software
jathan connected from 172.20.21.51 using console on test3-abc-sw1
test3-abc-sw1# show clock
rbridge-id 2: 2012-04-06 19:11:07 Etc/GMT+0
test3-abc-sw1# configure terminal
------------------------------^
syntax error: unknown argument.
test3-abc-sw1#

We need to be able to identify these so that execute_ioslike() can properly catch errors.

Allow user to decide whether gong should suppress pre-authentication login messages

When using gong/go to access a device, any banner messages or other alerts that appear before authentication will not be displayed.

e.g., this message gets bypassed from the user's perspective on a Juniper EX4200:

set system login message "IMPORTANT STUFF!" 

While this message (post-auth) displays successfully:

set system login announcement "IMPORTANT STUFF!"

Can we get a toggle, like in .gorc, to display these?

Replace IPy with netaddr

In all libs and tools, replace usage of IPy with netaddr, which is way more robust and Pythonic.

Trigger ACL parser can't parse `fragment-offset` with byte-ranges in Juniper ACLs

Trigger can definitely parse fragment-offset in Juniper ACLs but it looks like we never actually account for a fragment- offset range.

So it can parse this:

fragment-offset 0;

But not this:

fragment-offset 6-8191;

When parsing an ACL with this it results in the following error:

Cannot parse /data/firewalls/acl.foo: missing semicolon on line 625

bin/netdev budget code option error

% netdev -s -b '12345678 (INTERNAL NETWORKS)' 
Traceback (most recent call last): 
  File "/opt/bcs/bin/netdev", line 182, in <module> 
    opts, args = parse_args(sys.argv) 
  File "/opt/bcs/bin/netdev", line 71, in parse_args 
    search_builder(opts) 
  File "/opt/bcs/bin/netdev", line 121, in search_builder 
    vars.append(" '%s' in x.budgetName.lower()" % opts.budget_name.lower()) 
AttributeError: 'NoneType' object has no attribute 'lower' 

Juniper firewall filter parser is not recognizing the fragment-offset match condition for larger than 0 offsets.

Because this is not parsed correctly, it will break all tooling around any filters updated with the match condition. This match condition needs to be either parsed correctly or ignored so tools like check_access will continue to work.

Example term:

    term dns_FRAGMENTATION { 
        from { 
            destination-address { 
                10.20.161.21/32; 
            } 
            fragment-offset 1024-8191; 
        } 
        then { 
            accept; 
            count dns_FRAGMENTATION; 
        } 
    }

check_access *make discard* term display can be misleading

check_access alters the action field for any term marked with /trigger: make discard/ to discard. I do not know if this is by design but it actually comes off a little confusing. I spent the last 30 minutes telling someone something was blocked.

Real Term:

    term foo { 
        /*trigger: make discard*/ 
        from { 
            destination-address { 
                10.20.30.0/26; 
                10.20.30.64/26; 
            } 
            protocol [ tcp udp ]; 
        } 
        then { 
            accept; 
            count foo;
        } 
    } 

Check_access displayed term:

term foo { 
    /*trigger: make discard*/ 
    from { 
        destination-address { 
            10.20.30.0/26; 
            10.20.30.64/26; 
        } 
        protocol [ tcp udp ]; 
    } 
    then { 
        discard; 
        count foo;
    } 
}

ACL parser should fix invalid port-ranges

Such as this:

access-list 2018 permit tcp 172.28.22.0 0.0.0.255 host 172.1.2.3 range 21 20

The dst-ports get parsed into:

<RangeList: [(21, 20)]>

Which should be normalized (sorted) upon creating a RangeList object and result in:

<RangeList: [(20, 21)]>

gong is less capable of substring matching when preferring oob

Some strings which gong is able to match on when run normally fail when preferring oob with the "-o" flag.

$ gong test18-xy6
Matched 'test18-xy6-sw0.net.aol.com'.
Connecting to test-xy6-sw0.net.aol.com. Use ^X to exit.

Fetching credentials from /home/jathan/.tacacsrc
User login successful.

telnet@test-xy6-sw0#

$ gong -o test18-xy6
Traceback (most recent call last):
File "/opt/bcs/bin/gong", line 144, in
main()
File "/opt/bcs/bin/gong", line 83, in main
connect_to_oob(args[1].lower())
File "/opt/bcs/bin/gong", line 55, in connect_to_oob
f = dev.find(device)
File "/opt/bcs/packages/python-modules-2.0/lib/python/site-packages/trigger/netdevices.py", line 431, in find
raise KeyError(key)
KeyError: 'test18-xy6'

$ gong -o test18-xy6-sw0
OOB Information for test18-xy6-sw0.net.aol.com
telnet ts-xy6.oob.aol.com 5003
Connecting you now...
Trying 10.302.206.509...
Connected to ts-xy6.oob.aol.com (10.302.206.509).
Escape character is '^]'.

test18-xy6-sw0>

bin/acl has "/home/tftp" hard-coded as the tftproot

Change it so it reads from settings.TFTPROOT_DIR instead!

Allow settings.py location to be specified via environment variable

RTFD doc builds are failing because when installed via pip + virtualenv the settings.py file is not found in the default location (/etc/trigger/settings.py).

We need a way to specify an alternate location via an environment variable that is read by simian.conf so that this can be set for RTFD within conf.py when it goes to build the docs.

http://readthedocs.org/docs/read-the-docs/en/latest/faq.html#how-do-i-change-behavior-for-read-the-docs

Make Commando interface more dynamic; ditch static methods

Currently trigger.cmds.Commando relies on a static mapping of vendor names to parse/generate/execute methods. This does not scale well and in the case of vendors with multiple device types with different behavior, it becomes very unwieldy. Here are some examples:

• Brocade VDX router vs. Brocade VDX switch run different firmware versions
• Vendor Juniper has routers/switches/firewalls running Junos, but also NetScreen firewalls running ScreenOS

We should ake the callbacks use dynamic attribute lookups or just do the logic within generic parse/generate methods. See TastyPie's custom serializers on a good pattern for that (ref: http://bit.ly/Mzawdv)

Cisco/IOS port range of "0-65535" gets converted to bad "lt 65536"

When syntax-checking a policy with a port range of 0-65535, the parser turns this:

access-list 123 permit tcp host 1. host 10.62.138.209 range 0 65535

Into this:

access-list 123 permit tcp host 1.2.3.4 host 10.20.30.40 lt 65536

"lt 65536" is not valid. Both Cisco and Foundry devices do not like it. We should change the parser to just keep "range 0 65535" OR just omit the ports altogether.

execute_ioslike() hangs on confirmation prompt on Brocade VDX platform

When executing "copy running-config startup-config" on a Brocade VDX switch, it prompts with:

This operation will modify your startup configuration. Do you want to continue? [y/n]:

2012-04-04 11:18:02-0700 [TriggerTelnet,client] Sending command: 'copy running-config startup-config'
2012-04-04 11:18:02-0700 [TriggerTelnet,client] dataReceived, got bytes: 'copy running-config startup-config\n'
2012-04-04 11:18:02-0700 [TriggerTelnet,client] dataReceived, got data: 'copy running-config startup-config\n'
2012-04-04 11:18:02-0700 [TriggerTelnet,client] dataReceived, got bytes: 'This operation will modify your startup configuration. Do you want to continue? [y/n]:'
2012-04-04 11:18:02-0700 [TriggerTelnet,client] dataReceived, got data: 'copy running-config startup-config\nThis operation will modify your startup configuration. Do you want to continue? [y/n]:'

And it just hangs there (IoslikeSendExpect.dataReceived keeps returning None)

Need a way to catch confirmation prompts and do something with them.

Load_acl uncaught exception when MySQL is unreachable

load_acl crashes when MySQL is unreachable. Let's make it exit gracefully.

Exception 1:

Traceback (most recent call last): 
 File "/usr/local/bin/load_acl", line 58, in <module> 
   queue = Queue(verbose=False) 
 File "/usr/local/packages/python-modules-2.0/lib/python/site-packages/trigger/acl/queue.py", line 42, in __init__ 
   self.dbconn = settings.get_firewall_db_conn() 
 File "/etc/trigger_settings.py", line 183, in get_firewall_db_conn 
   port=DATABASE_PORT, user=DATABASE_USER, passwd=DATABASE_PASSWORD) 
 File "/usr/local/packages/python-modules-2.0/lib/python/site-packages/MySQLdb/__init__.py", line 81, in Connect 
   return Connection(*args, **kwargs) 
 File "/usr/local/packages/python-modules-2.0/lib/python/site-packages/MySQLdb/connections.py", line 188, in __init__ 
   super(Connection, self).__init__(*args, **kwargs2) 
_mysql_exceptions.OperationalError: (2003, "Can't connect to MySQL server on '127.0.0.1' (111)") 

Exception 2:

Traceback (most recent call last): 
 File "/usr/local/bin/load_acl", line 58, in <module> 
   queue = Queue(verbose=False) 
 File "/usr/local/packages/python-modules-2.0/lib/python/site-packages/trigger/acl/queue.py", line 42, in __init__ 
   self.dbconn = settings.get_firewall_db_conn() 
 File "/etc/trigger_settings.py", line 179, in get_firewall_db_conn 
   port=DATABASE_PORT, user=DATABASE_USER, passwd=DATABASE_PASSWORD) 
 File "/usr/local/packages/python-modules-2.0/lib/python/site-packages/MySQLdb/__init__.py", line 81, in Connect 
   return Connection(*args, **kwargs) 
 File "/usr/local/packages/python-modules-2.0/lib/python/site-packages/MySQLdb/connections.py", line 188, in __init__ 
   super(Connection, self).__init__(*args, **kwargs2) 
_mysql_exceptions.OperationalError: (2013, "Lost connection to MySQL server at 'reading initial communication packet', system error: 104")

Fix python IPy bug w/ Python 2.7 in ACL parser

% ./load_acl --bouncy -Q testops_blockmj 
Traceback (most recent call last): 
  File "./load_acl", line 39, in <module> 
    from simian.acl import parse as acl_parse 
  File "/home/j/jathan/sandbox/simian/acl/__init__.py", line 22, in <module> 
    from simian.acl.parser import * 
  File "/home/j/jathan/sandbox/simian/acl/parser.py", line 1600, in <module> 
    lambda (net, length): IP('%s/%d' % (net, length))), 
  File "/home/j/jathan/sandbox/simian/acl/parser.py", line 1441, in S 
    subtagged.add(prod) 
TypeError: can only compare to a set 

This has something to do with the comparison of an IP object. This also might be worth dropping in lieu of replacing IPy w/ netaddr, especially since this should go hand-in-hand w/ the IPv6 work since it's the same machinery.

go mangles transient, full-screen output when connected via ssh

Since upgrade to Trigger 1.2.1, "go" mangles transient command output such as "monitor interface" when connected to a Juniper router via ssh. Examples will be included below.

check_access needs to normalize source-address of "any"

When passing "any" to check_access it is converted to an empty list ([]) that is equivalent to Cisco's "any" or Juniper's null "source-address" block, which equates to "any source" when performing an access test.

Source addresses passed along such as "0.0.0.0" or "0.0.0./0" need to also be properly normalized to "any" (or []) in this context). This should be something that is standard throughout the Trigger ACL libraries.

acl_script is missing an import from trigger.acl.parser.Term

Traceback (most recent call last):
  File "/usr/local/bin/acl_script", line 530, in <module>
    opts.protocol)
  File "/usr/local/bin/acl_script", line 305, in create_trigger_term
    term = Term()
NameError: global name 'Term' is not defined

acl_script defines its own copy of create_trigger_term() and should just instead import it from trigger.acl.tools

bin/find_access should be merged into bin/check_access

These two tools have almost identical functionality. check_access could be considered to be a "loose" version to and find_access is "strict". One tool should do both.

Add flags to `bin/gong` to force telnet or ssh connection

Self-explanatory.

Add A10 support for execute/pty in trigger.twister

Add support for A10 Networks AX3000 platform

• interactive (pty) sessions
• factory method (execute_)
• Commando support
• Error messages/timeouts
• Prompt matching/state machine for remote execution (telnet/ssh)

User-friendly tacacsrc parsing output bleeding into load_acl curses output

The ...fetching credentials..." print statement is showing up in the "redraw" portion of load_acl. This should either be a status message or not printed to the screen.

Update load_acl to optionally perform "commit full" on Juniper EX4200 devices.

There is a Juniper bug affecting Juniper EX4200 devices, causing VLAN mappings to drop which can result in outages. The work around from Juniper is to issue a "commit full" instead of just a commit.

The load_acl utility performs a "commit" using JunoScript. We need a way to optionally perform "commit full" on Juniper EX4200 devices (aka switches).

Add Arista support for load_acl

Self-explanatory.

Go-created .tacacsrc files should not be world-readable

gong appears to be generating .tacacsrc files with -rw-r--r-- permissions (or perhaps depending on the user's umask settings) instead of a more protected state.

make gong's disconnect option user-configurable

One of my team mates just pointed out to me that when he does ^X on a Juniper device (to clear the command line of all characters), it disconnects the session. This is expected behavior in gong, but as far as I know it leave the user with no way to pass a ^X to the remote device.

Juniper ``^ commands are listed here: http://www.juniper.net/techpubs/en_US/junos10.0/information-products/topic-collections/nog-baseline/junos-cli-keyboard-shortcuts.html

In this case, ^U does the same thing as ^X, so that's a workaround, but there could be other uses for ^X out there in the wild. Also, it's nice not to force users to relearn their favorite tricks.

Could we make the disconnect character user-configurable (or even able to be disabled) in the .gorc file? Currently the .gorc file just sets auto commands to be done when you log in, but it's totally the right place for an override like this.