Add snmptrapd handler for juniper syslog traps

[johannaengland]

Scope and purpose

Reference: https://mibs.observium.org/mib/JUNIPER-SYSLOG-MIB/

This PR adds a handler for snmptrapd that handles juniper syslog traps and posts events for relevant state changes for the high-availability services-redundancy-group.

Contributor Checklist

Every pull request should have this checklist filled out, no matter how small it is.
More information about contributing to NAV can be found in the
Hacker's guide to NAV.

• Added a changelog fragment for towncrier
• Added/amended tests for new/changed code
• Added/changed documentation
• Linted/formatted the code with ruff, easiest by using pre-commit
• Wrote the commit message so that the first line continues the sentence "If applied, this commit will ...", starts with a capital letter, does not end with punctuation and is 50 characters or less long. See https://cbea.ms/git-commit/
• Based this pull request on the correct upstream branch: For a patch/bugfix affecting the latest stable version, it should be based on that version's branch (<major>.<minor>.x). For a new feature or other additions, it should be based on master.
• If applicable: Created new issues if this PR does not fix the issue completely/there is further work to be done
• If it's not obvious from a linked issue, described how to interact with NAV in order for a reviewer to observe the effects of this change first-hand (commands, URLs, UI interactions)
• If this results in changes in the UI: Added screenshots of the before and after
• If this adds a new Python source code file: Added the boilerplate header to that file

[github-actions]

Test naming convention

All new test names follow the convention. 👍

[github-actions]

Test results

    5 files      5 suites   7m 31s ⏱️
3 370 tests 3 370 ✅ 0 💤 0 ❌
6 664 runs  6 664 ✅ 0 💤 0 ❌

Results for commit 4351150.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

❌ Patch coverage is 92.13483% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.46%. Comparing base (1838155) to head (4351150).
⚠️ Report is 128 commits behind head on master.

Files with missing lines	Patch %	Lines
python/nav/snmptrapd/handlers/sysloghandler.py	92.13%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4080      +/-   ##
==========================================
+ Coverage   64.59%   65.46%   +0.87%     
==========================================
  Files         633      630       -3     
  Lines       47010    47295     +285     
  Branches       43        0      -43     
==========================================
+ Hits        30366    30964     +598     
+ Misses      16634    16331     -303     
+ Partials       10        0      -10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[hmpf]

How can this be tested/triggered?

[johannaengland]

How can this be tested/triggered?

The relevant event sadly can't be manually triggered, one has to wait for the trap to happen when a firewall is experiencing problems
But it has been in production at a customer's since last August
And it is possible to test syslog traps with other event names - for that you have to ask the CNaaS engineers to trigger a trap like that

[lunkwill42]

How can this be tested/triggered?

The relevant event sadly can't be manually triggered, one has to wait for the trap to happen when a firewall is experiencing problems But it has been in production at a customer's since last August And it is possible to test syslog traps with other event names - for that you have to ask the CNaaS engineers to trigger a trap like that

Sure you can test it. Add 127.0.0.1 as a netbox to NAV and use snmptrap command line program to send a trap directly:

snmptrap -v 2c -c public 127.0.0.1:162 '' \
    1.3.6.1.4.1.2636.4.12.0.1 \
    1.3.6.1.4.1.2636.3.35.1.1.1.2.15   s "JSRPD_HA_SRG_STATE_CHANGE" \
    1.3.6.1.4.1.2636.3.35.1.1.1.9.15   s "JSRPD_HA_SRG_STATE_CHANGE: SRG[7]:HA state transitioned [BACKUP -->INELIGIBLE] Reason: [Control plane down]" \
    1.3.6.1.4.1.2636.3.35.1.2.1.2.15.1 s "srg-id" \
    1.3.6.1.4.1.2636.3.35.1.2.1.3.15.1 s "7" \
    1.3.6.1.4.1.2636.3.35.1.2.1.2.15.2 s "old-state" \
    1.3.6.1.4.1.2636.3.35.1.2.1.3.15.2 s "BACKUP" \
    1.3.6.1.4.1.2636.3.35.1.2.1.2.15.3 s "new-state" \
    1.3.6.1.4.1.2636.3.35.1.2.1.3.15.3 s "INELIGIBLE"

(or if you have the MIB module loaded):

snmptrap -v 2c -c public -m JUNIPER-SYSLOG-MIB 127.0.0.1:162 '' \
    JUNIPER-SYSLOG-MIB::jnxSyslogTrap \
    JUNIPER-SYSLOG-MIB::jnxSyslogEventName.15   s "JSRPD_HA_SRG_STATE_CHANGE" \
    JUNIPER-SYSLOG-MIB::jnxSyslogMessage.15     s "JSRPD_HA_SRG_STATE_CHANGE: SRG[7]:HA state transitioned [BACKUP -->INELIGIBLE] Reason: [Control plane down]" \
    JUNIPER-SYSLOG-MIB::jnxSyslogAvAttribute.15.1 s "srg-id" \
    JUNIPER-SYSLOG-MIB::jnxSyslogAvValue.15.1     s "7" \
    JUNIPER-SYSLOG-MIB::jnxSyslogAvAttribute.15.2 s "old-state" \
    JUNIPER-SYSLOG-MIB::jnxSyslogAvValue.15.2     s "BACKUP" \
    JUNIPER-SYSLOG-MIB::jnxSyslogAvAttribute.15.3 s "new-state" \
    JUNIPER-SYSLOG-MIB::jnxSyslogAvValue.15.3     s "INELIGIBLE"

(also, if you want to run snmptrapd without root access, put it on a different port than 162, run it in the foreground, e.g. navtrapd -f 0.0.0.0:2000, and change the port number in the snmptrap commands)

[lunkwill42]

This feels vaguely familiar; is this based on a PoC I threw together at the end of my last day before my summer vacation last year? 😆

Other than the inline comments:

• Test name complaints from CI are valid.
• The plugin is not listed as a handlermodule in snmptrapd.conf, so it will never be loaded.
• doc/reference/alerttypes.rst should be updated (we have make rule to help with that, make doc/reference/alerttypes.rst)

There might be more to dig into in the tests, but this is enough for a first look...

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
2 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud