DOCSEARCHbyAlgolia
Submit Docs

Netconan Network Configuration Anonymization Utilities

repository·master·Indexed 41 days ago

https://github.com/intentionet/netconan

A network configuration anonymizer designed to strip sensitive information—including IP addresses (IPv4 and IPv6), passwords, AS numbers, and specific keywords—from network device configuration files while preserving network topology and structure. It provides a CLI tool and a programmatic Python interface via the FileAnonymizer class, supporting salted anonymization, IP preservation modes, and the ability to reverse IP anonymization using mapping dump files.

Tokens
6.7K
Snippets
14
Records
20
Agent score
48%

What's inside Netconan

  1. How IP address anonymization works

    master

    Netconan uses prefix-preserving anonymization for IPv4 and IPv6 addresses. This means addresses with a common prefix will share the same prefix length after anonymization, preserving network topology.

    Key behaviors:

    • Host Bits: By default, the last 8 bits of each IP address are preserved to prevent breaking point-to-point links or NAT pools. Use --preserve-host-bits B to change this or --preserve-host-bits 0 to disable it.
    • Prefix Preservation: Use --preserve-prefixes to preserve specific prefixes (host bits within them will still be anonymized).
    • Address Preservation: Use --preserve-addresses to skip anonymization for specific networks or addresses entirely.
    • Private Addresses: Use --preserve-private-addresses to skip anonymizing all addresses in private-use blocks (e.g., RFC 1918).
    • Reversibility: If you use a consistent --salt, you can reverse IP anonymization using the --undo flag.

  2. How deterministic anonymization works with salts

    master

    Netconan is deterministic when a --salt (or -s) is provided. Files processed with the same salt will have consistent anonymization (e.g., the same IP address will always map to the same anonymized IP).

    This is critical for maintaining compatibility across different files or sessions. It is highly recommended to set the salt in a configuration file using the -c flag to ensure consistent results.

  3. Use Pipe Mode for streaming input/output

    master

    Netconan supports reading from stdin and writing to stdout by using - as the input or output path. This allows you to integrate Netconan into shell pipelines.

    Note: You cannot combine directory input with stdout (-o -).

    # Read from stdin, write to stdout
$ cat config.cfg | netconan -i - -o - -a -p -s mysalt > anonymized.cfg

# Read from stdin, write to a file
$ cat config.cfg | netconan -i - -o anonymized.cfg -a -p -s mysalt

# Read from a file, write to stdout
$ netconan -i config.cfg -o - -a -p -s mysalt > anonymized.cfg

  4. Build and publish a Netconan release via GitHub Actions

    master

    To publish a new version of Netconan, follow these steps using the GitHub Actions workflow:

    1. Create a clean release branch (e.g., release-0.xx).
    2. Update the version number in netconan/__init__.py to remove the .dev suffix (e.g., change 0.13.0.dev to 0.13.0).
    3. Push the branch to GitHub.
    4. In the GitHub repository, navigate to the Actions tab.
    5. Select the Publish Python Package workflow.
    6. Click Run workflow and select your release branch.
    7. Choose the target repository: pypi for production or testpypi for testing.
    8. Click Run workflow and wait for completion.
    9. For PyPI releases, create a corresponding GitHub release.

  5. Anonymize network configuration files

    master

    Netconan anonymizes sensitive information in text files (like Cisco configurations) to make them safe for sharing. It can anonymize passwords, IP addresses, and user-specified sensitive words while attempting to preserve network structure (like IP prefixes and host bits).

    To anonymize a directory of files, specify the input directory with -i and the output directory with -o.

    $ netconan -i sensitive -o anonymized \
    --sensitive-words intentionet,sea,lax,atl \
    --anonymize-passwords \
    --anonymize-ips

  6. Test a Netconan release with TestPyPI

    master

    Before publishing to the main PyPI repository, you should verify your release by publishing to TestPyPI and installing it via a specific index URL.

    1. Use the GitHub Actions "Publish Python Package" workflow and select testpypi as the target repository.
    2. Once published, install the package using the following command to ensure you are pulling from TestPyPI while still being able to resolve dependencies from PyPI:
    pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ netconan
    1. Verify the installation and functionality. If successful, re-run the GitHub Actions workflow selecting pypi as the target.

  8. Configure IP address preservation modes

    master

    Netconan provides three distinct ways to handle IP address preservation when using --anonymize-ips:

    1. --preserve-prefixes: Preserves the network prefix but anonymizes the host bits. (Default behavior uses IpAnonymizer.DEFAULT_PRESERVED_PREFIXES).
    2. --preserve-addresses: Preserves the entire network/address, including both the prefix and the host bits. Use this for specific static IPs or specific subnets where you want no changes at all.
    3. --preserve-private-addresses: A shortcut to preserve all RFC 1918 private-use IP networks. This merges the private networks into the --preserve-addresses list.
    4. --preserve-host-bits <int>: Controls how many trailing bits (host bits) are kept. For example, setting this to 8 for a /24 network preserves the subnet portion and only anonymizes the last 8 bits.

  9. Dump IP anonymization mappings to a file

    master

    To allow for the reversal of IP anonymization (using undo_ip_anon=True), you must save the mapping used during the anonymization process.

    When calling anonymize_files, provide a path to the dumpfile argument. This will write the internal mappings from IpAnonymizer and IpV6Anonymizer to the specified file. This requires anon_ip to be True.

  10. Use the netconan CLI to anonymize files

    master

    Netconan is a command-line tool used to anonymize sensitive information in files, such as IP addresses, AS numbers, passwords, and specific keywords.

    Basic Usage Pattern: To run netconan, you must specify an input (-i) and an output (-o). You can use - to indicate stdin for input or stdout for output.

    Key Features:

    • IP Anonymization: Anonymize IP addresses using --anonymize-ips. You can control how much of the address is preserved using --preserve-prefixes, --preserve-addresses, or --preserve-host-bits.
    • Sensitive Data: Anonymize passwords/SNMP community strings with --anonymize-passwords or specific keywords with --sensitive-words.
    • Reversibility: Use --undo to reverse anonymization, provided you use the same --salt used during the initial anonymization.
    • Configuration: Use -c or --config to specify a configuration file to set default parameters.
    # Example: Anonymize IPs and passwords from an input file to stdout
netconan -i input_config.txt -o - --anonymize-ips --anonymize-passwords

# Example: Anonymize using a config file and a specific salt
netconan -c my_config.ini -i ./configs -o ./anonymized_configs --anonymize-ips --salt "my-secret-salt"

  11. Configure IP address preservation and suffixing

    master

    When using FileAnonymizer or anonymize_files, you can control how much of the IP address remains intact. This is useful for maintaining network topology information while hiding specific hosts.

    • preserve_prefixes: A list of IP prefixes to keep as-is.
    • preserve_networks: A list of IP networks to keep as-is.
    • preserve_suffix_v4: An integer specifying how many bits at the end of an IPv4 address should be preserved.
    • preserve_suffix_v6: An integer specifying how many bits at the end of an IPv6 address should be preserved.

    Note: To use these, anon_ip must be set to True.

  12. Netconan CLI Reference

    master

    The following command-line arguments are available for netconan.

    usage: netconan [-h] [--version] [-a] [-c CONFIG] [-d DUMP_IP_MAP] -i INPUT
                [-l {DEBUG,INFO,WARNING,ERROR,CRITICAL}] [-n AS_NUMBERS] -o
                OUTPUT [-p] [-r RESERVED_WORDS] [-s SALT] [-u] [-w SENSITIVE_WORDS]
                [--preserve-prefixes PRESERVE_PREFIXES]
                [--preserve-addresses PRESERVE_ADDRESSES]
                [--preserve-private-addresses]
                [--preserve-host-bits PRESERVE_HOST_BITS]

optional arguments:
  -h, --help                            show this help message and exit
  --version                             Print version number and exit
  -a, --anonymize-ips                   Anonymize IP addresses
  -c CONFIG, --config CONFIG            Netconan configuration file with defaults
  -d DUMP_IP_MAP, --dump-ip-map MAP     Dump IP address anonymization map to file
  -i INPUT, --input INPUT              Input file or directory
  -l {DEBUG,INFO,WARNING,ERROR,CRITICAL}
                                        Determines log level
  -n AS_NUMBERS, --as-numbers           List of comma separated AS numbers to anonymize
  -o OUTPUT, --output OUTPUT           Output file or directory
  -p, --anonymize-passwords            Anonymize password and snmp community lines
  -r RESERVED_WORDS, --reserved-words   List of comma separated words to NOT anonymize
  -s SALT, --salt SALT                 Salt for IP and sensitive keyword anonymization
  -u, --undo                            Undo reversible anonymization (requires salt)
  -w SENSITIVE_WORDS, --sensitive-words  List of comma separated keywords to anonymize
  --preserve-prefixes PREFIXES          List of IP prefixes to preserve (host bits anonymized)
  --preserve-addresses ADDRESSES        List of addresses/networks to preserve entirely
  --preserve-private-addresses          Preserve private-use IP addresses
  --preserve-host-bits B                Preserve the trailing B bits of IP addresses