cli: add show snmp

Give the agent the same read-out the other services have: whether it is
enabled, which versions and addresses it answers on, and the configured
communities.

Version and listen have no default in the model, so mark the values that
apply when they are unset rather than print "none".

The source column reports what the agent actually does, not what the
configuration says.  A community whose target-tag matches no target is
dropped rather than widened to any source, so show that instead of an
unrestricted community that is not being served.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

Author: troglobit

package/klish-plugin-infix/klish-plugin-infix.mk

@@ -23,6 +23,12 @@ else
 KLISH_PLUGIN_INFIX_CONF_OPTS += --disable-containers
 endif
 
+ifeq ($(BR2_PACKAGE_NETSNMP),y)
+KLISH_PLUGIN_INFIX_CONF_OPTS += --enable-snmp
+else
+KLISH_PLUGIN_INFIX_CONF_OPTS += --disable-snmp
+endif
+
 ifeq ($(BR2_PACKAGE_KLISH_PLUGIN_INFIX_SHELL),y)
 KLISH_PLUGIN_INFIX_CONF_OPTS += --enable-shell
 else

src/bin/show/__init__.py

@@ -544,6 +544,19 @@ def mdns(args: List[str]) -> None:
     cli_pretty(data, "show-mdns")
 
 
+def snmp(args: List[str]) -> None:
+    data = get_json("/ietf-snmp:snmp", "running")
+    if not data:
+        print("SNMP not configured.")
+        return
+
+    if RAW_OUTPUT:
+        print(json.dumps(data, indent=2))
+        return
+
+    cli_pretty(data, "show-snmp")
+
+
 def system(args: List[str]) -> None:
     """Get system state from sysrepo"""
     data = get_json("/ietf-system:system-state")
@@ -757,6 +770,7 @@ def execute_command(command: str, args: List[str]):
         'rip': rip,
         'routes': routes,
         'services': services,
+        'snmp': snmp,
         'software': software,
         'stp': stp,
         'system': system

src/klish-plugin-infix/configure.ac

@@ -26,6 +26,10 @@ AC_ARG_ENABLE(shell,
         AS_HELP_STRING([--enable-shell], [Enable shell access from CLI]),,[
 	enable_shell=no])
 
+AC_ARG_ENABLE(snmp,
+        AS_HELP_STRING([--enable-snmp], [Enable SNMP agent commands in CLI]),,[
+	enable_snmp=no])
+
 AC_ARG_WITH(shell,
         AS_HELP_STRING([--with-shell=shell], [Path to shell to use, default: /bin/sh]),
 	[shell=$withval], [shell=yes])
@@ -40,6 +44,7 @@ AC_CHECK_LIB([klish], [kplugin_new],, AC_MSG_ERROR([Klish not found]))
 # Control build with automake flags
 AM_CONDITIONAL(CONTAINERS,   [test "x$enable_containers" != "xno"])
 AM_CONDITIONAL(SHELL,        [test "x$enable_shell" != "xno"])
+AM_CONDITIONAL(SNMP,         [test "x$enable_snmp" != "xno"])
 
 AS_IF([test "x$with_shell" != "xno"], [
 	AS_IF([test "x$shell" = "xyes"], [shell=/bin/sh])
@@ -70,6 +75,7 @@ cat <<EOF
 
 Optional features:
   Container support ....: $enable_containers
+  SNMP support .........: $enable_snmp
   Allow shell access ...: $enable_shell
   Shell to use .........: $with_shell
 

src/klish-plugin-infix/xml/Makefile.am

@@ -8,3 +8,7 @@ endif
 if SHELL
 klishconf_DATA += shell.xml
 endif
+
+if SNMP
+klishconf_DATA += snmp.xml
+endif

src/klish-plugin-infix/xml/snmp.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<KLISH
+  xmlns="https://klish.libcode.org/klish3"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="https://src.libcode.org/pkun/klish/src/master/klish.xsd">
+
+<VIEW name="main">
+
+<COMMAND name="show" help="Show system status and configuration files" mode="switch">
+
+  <COMMAND name="snmp" help="Show SNMP agent configuration">
+    <ACTION sym="script">show snmp</ACTION>
+  </COMMAND>
+
+</COMMAND>
+
+</VIEW>
+</KLISH>

src/statd/python/cli_pretty/cli_pretty.py

@@ -3946,6 +3946,84 @@ def _mdns_svc_name(stype):
     return stype.lstrip("_").split("._")[0]
 
 
+def _snmp_source(snmp, tag):
+    """Where a community is answered from, as the agent sees it.
+
+    An unset tag means any source.  A tag no target carries is the
+    operator asking for a restriction that does not exist, and the agent
+    drops the community rather than widen it, so say so here too.
+    """
+    if tag is None:
+        return "any"
+
+    out = []
+    for target in snmp.get("target", []):
+        if tag not in target.get("tag", []):
+            continue
+        udp = target.get("udp", {})
+        addr = udp.get("ip")
+        if not addr:
+            continue
+        plen = udp.get("prefix-length")
+        out.append(f"{addr}/{plen}" if plen is not None else addr)
+
+    return ", ".join(out) if out else f"none, no target tagged {tag}"
+
+
+def show_snmp(json):
+    snmp = json.get("ietf-snmp:snmp", {})
+    if not snmp:
+        print("SNMP not configured.")
+        return
+
+    engine = snmp.get("engine", {})
+
+    enabled = engine.get("enabled")
+    print(f"{'Enabled':<16}: {'yes' if enabled else 'no'}")
+
+    # Neither leaf has a YANG default; unset means the agent serves
+    # every version it supports, and listens on every address.
+    versions = [v for v in ("v1", "v2c") if v in engine.get("version", {})]
+    print(f"{'Versions':<16}: {', '.join(versions or ['v1', 'v2c'])}"
+          f"{'' if versions else ' (default)'}")
+
+    listen = []
+    for entry in engine.get("listen", []):
+        udp = entry.get("udp", {})
+        addr = udp.get("ip")
+        if not addr:
+            continue
+        port = udp.get("port", 161)
+        listen.append(f"[{addr}]:{port}" if ":" in addr else f"{addr}:{port}")
+    print(f"{'Listen':<16}: {', '.join(listen or ['0.0.0.0:161', '[::]:161'])}"
+          f"{'' if listen else ' (default)'}")
+
+    if engine.get("engine-id"):
+        print(f"{'Engine ID':<16}: {engine['engine-id']}")
+
+    communities = snmp.get("community", [])
+    if not communities:
+        print("\nNo communities, the agent answers nothing.")
+        return
+
+    print()
+    table = SimpleTable([
+        Column("COMMUNITY", flexible=True),
+        Column("SECURITY NAME"),
+        Column("SOURCE"),
+    ])
+    for entry in communities:
+        secname = entry.get("security-name", "")
+        # An unset name means the agent uses the security name as
+        # the community, see RFC 7407.  A binary name has octets
+        # that do not survive being printed.
+        name = entry.get("text-name")
+        if name is None:
+            name = "<binary>" if entry.get("binary-name") else secname
+        table.row(name, secname, _snmp_source(snmp, entry.get("target-tag")))
+    table.print()
+
+
 def show_mdns(json):
     mdns = json.get("infix-services:mdns", {})
     if not mdns:
@@ -6110,6 +6188,8 @@ def main():
 
     subparsers.add_parser('show-mdns', help='Show mDNS configuration and neighbors')
 
+    subparsers.add_parser('show-snmp', help='Show SNMP agent configuration')
+
     subparsers.add_parser('show-firewall', help='Show firewall overview')
     subparsers.add_parser('show-firewall-matrix', help='Show firewall matrix')
     subparsers.add_parser('show-firewall-zone', help='Show firewall zones') \
@@ -6187,6 +6267,8 @@ def main():
         show_lldp(json_data)
     elif args.command == "show-mdns":
         show_mdns(json_data)
+    elif args.command == "show-snmp":
+        show_snmp(json_data)
     elif args.command == "show-firewall":
         show_firewall(json_data)
     elif args.command == "show-firewall-matrix":