- NetBox Community | + NetBox Community | NetBox Cloud | NetBox Enterprise
diff --git a/SECURITY.md b/SECURITY.md index 97881a901..58b73cbb7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -14,6 +14,12 @@ Administrators are encouraged to adhere to industry best practices concerning th * Prohibit access to your database from clients other than the NetBox application * Keep your deployment updated to the most recent stable release +## Compliance Reporting + +Please note that security compliance reports (e.g. SOC 2) are provided by NetBox Labs only to customers using NetBox Cloud or NetBox Enterprise. They are not available to users of self-hosted NetBox Community Edition. + +If you would like to consider upgrading to NetBox Cloud or Enterprise, please contact `sales@netboxlabs.com`. + ## Reporting a Suspected Vulnerability If you believe you've uncovered a security vulnerability and wish to report it confidentially, you may do so by emailing `security@netboxlabs.com`. Please ensure that your report meets all the following conditions: diff --git a/base_requirements.txt b/base_requirements.txt index 0c6e308e1..e52ff042e 100644 --- a/base_requirements.txt +++ b/base_requirements.txt @@ -140,7 +140,8 @@ strawberry-graphql # Strawberry GraphQL Django extension # https://github.com/strawberry-graphql/strawberry-django/releases -strawberry-graphql-django +# See #19771 +strawberry-graphql-django==0.60.0 # SVG image rendering (used for rack elevations) # https://github.com/mozman/svgwrite/blob/master/NEWS.rst diff --git a/contrib/generated_schema.json b/contrib/generated_schema.json index 66a61cbad..baecb910f 100644 --- a/contrib/generated_schema.json +++ b/contrib/generated_schema.json @@ -329,6 +329,7 @@ "100base-tx", "100base-t1", "1000base-t", + "1000base-sx", "1000base-lx", "1000base-tx", "2.5gbase-t", diff --git a/docs/configuration/error-reporting.md b/docs/configuration/error-reporting.md index 3b86a78d2..45b18953a 100644 --- a/docs/configuration/error-reporting.md +++ b/docs/configuration/error-reporting.md @@ -4,7 +4,7 @@ Default: `None` -Defines a Sentry data source name (DSN) for automated error reporting. `SENTRY_ENABLED` must be True for this parameter to take effect. For example: +Defines a Sentry data source name (DSN) for automated error reporting. `SENTRY_ENABLED` must be `True` for this parameter to take effect. For example: ``` SENTRY_DSN = "https://examplePublicKey@o0.ingest.sentry.io/0" @@ -16,7 +16,7 @@ SENTRY_DSN = "https://examplePublicKey@o0.ingest.sentry.io/0" Default: `False` -Set to True to enable automatic error reporting via [Sentry](https://sentry.io/). +Set to `True` to enable automatic error reporting via [Sentry](https://sentry.io/). !!! note The `sentry-sdk` Python package is required to enable Sentry integration. diff --git a/docs/configuration/graphql-api.md b/docs/configuration/graphql-api.md index 9b02d745c..2c1a1c33b 100644 --- a/docs/configuration/graphql-api.md +++ b/docs/configuration/graphql-api.md @@ -6,7 +6,7 @@ Default: `True` -Setting this to False will disable the GraphQL API. +Setting this to `False` will disable the GraphQL API. --- diff --git a/docs/configuration/miscellaneous.md b/docs/configuration/miscellaneous.md index e4d46f428..1fbd0ee35 100644 --- a/docs/configuration/miscellaneous.md +++ b/docs/configuration/miscellaneous.md @@ -57,7 +57,7 @@ Sets content for the top banner in the user interface. Default: `True` -Enables anonymous census reporting. To opt out of census reporting, set this to False. +Enables anonymous census reporting. To opt out of census reporting, set this to `False`. This data enables the project maintainers to estimate how many NetBox deployments exist and track the adoption of new versions over time. Census reporting effects a single HTTP request each time a worker starts. The only data reported by this function are the NetBox version, Python version, and a pseudorandom unique identifier. @@ -102,7 +102,7 @@ The maximum size (in bytes) of an incoming HTTP request (i.e. `GET` or `POST` da Default: `True` -By default, NetBox will prevent the creation of duplicate prefixes and IP addresses in the global table (that is, those which are not assigned to any VRF). This validation can be disabled by setting `ENFORCE_GLOBAL_UNIQUE` to False. +By default, NetBox will prevent the creation of duplicate prefixes and IP addresses in the global table (that is, those which are not assigned to any VRF). This validation can be disabled by setting `ENFORCE_GLOBAL_UNIQUE` to `False`. --- @@ -143,7 +143,7 @@ The number of days to retain job results (scripts and reports). Set this to `0` Default: `False` -Setting this to True will display a "maintenance mode" banner at the top of every page. Additionally, NetBox will no longer update a user's "last active" time upon login. This is to allow new logins when the database is in a read-only state. Recording of login times will resume when maintenance mode is disabled. +Setting this to `True` will display a "maintenance mode" banner at the top of every page. Additionally, NetBox will no longer update a user's "last active" time upon login. This is to allow new logins when the database is in a read-only state. Recording of login times will resume when maintenance mode is disabled. --- @@ -181,7 +181,7 @@ Toggle the availability Prometheus-compatible metrics at `/metrics`. See the [Pr Default: `False` -When determining the primary IP address for a device, IPv6 is preferred over IPv4 by default. Set this to True to prefer IPv4 instead. +When determining the primary IP address for a device, IPv6 is preferred over IPv4 by default. Set this to `True` to prefer IPv4 instead. --- diff --git a/docs/configuration/plugins.md b/docs/configuration/plugins.md index 9e19622f9..9f838c119 100644 --- a/docs/configuration/plugins.md +++ b/docs/configuration/plugins.md @@ -35,7 +35,7 @@ Note that a plugin must be listed in `PLUGINS` for its configuration to take eff ## PLUGINS_CATALOG_CONFIG -Default: Empty +Default: `{}` (Empty) This parameter controls how individual plugins are displayed in the plugins catalog under Admin > System > Plugins. Adding a plugin to the `hidden` list will omit that plugin from the catalog. Adding a plugin to the `static` list will display the plugin, but not link to the plugin details or upgrade instructions. diff --git a/docs/configuration/remote-authentication.md b/docs/configuration/remote-authentication.md index 5f28d987f..5d5f1ee58 100644 --- a/docs/configuration/remote-authentication.md +++ b/docs/configuration/remote-authentication.md @@ -1,6 +1,6 @@ # Remote Authentication Settings -The configuration parameters listed here control remote authentication for NetBox. Note that `REMOTE_AUTH_ENABLED` must be true in order for these settings to take effect. +The configuration parameters listed here control remote authentication for NetBox. Note that `REMOTE_AUTH_ENABLED` must be `True` in order for these settings to take effect. --- @@ -8,7 +8,7 @@ The configuration parameters listed here control remote authentication for NetBo Default: `False` -If true, NetBox will automatically create groups specified in the `REMOTE_AUTH_GROUP_HEADER` header if they don't already exist. (Requires `REMOTE_AUTH_ENABLED`.) +If `True`, NetBox will automatically create groups specified in the `REMOTE_AUTH_GROUP_HEADER` header if they don't already exist. (Requires `REMOTE_AUTH_ENABLED`.) --- @@ -16,7 +16,7 @@ If true, NetBox will automatically create groups specified in the `REMOTE_AUTH_G Default: `False` -If true, NetBox will automatically create local accounts for users authenticated via a remote service. (Requires `REMOTE_AUTH_ENABLED`.) +If `True`, NetBox will automatically create local accounts for users authenticated via a remote service. (Requires `REMOTE_AUTH_ENABLED`.) --- @@ -43,7 +43,7 @@ The list of groups to assign a new user account when created using remote authen Default: `{}` (Empty dictionary) -A mapping of permissions to assign a new user account when created using remote authentication. Each key in the dictionary should be set to a dictionary of the attributes to be applied to the permission, or `None` to allow all objects. (Requires `REMOTE_AUTH_ENABLED` as True and `REMOTE_AUTH_GROUP_SYNC_ENABLED` as False.) +A mapping of permissions to assign a new user account when created using remote authentication. Each key in the dictionary should be set to a dictionary of the attributes to be applied to the permission, or `None` to allow all objects. (Requires `REMOTE_AUTH_ENABLED` as `True` and `REMOTE_AUTH_GROUP_SYNC_ENABLED` as `False`.) --- diff --git a/docs/configuration/required-parameters.md b/docs/configuration/required-parameters.md index 4a18e8a6c..25aa7978a 100644 --- a/docs/configuration/required-parameters.md +++ b/docs/configuration/required-parameters.md @@ -2,12 +2,12 @@ ## ALLOWED_HOSTS -This is a list of valid fully-qualified domain names (FQDNs) and/or IP addresses that can be used to reach the NetBox service. Usually this is the same as the hostname for the NetBox server, but can also be different; for example, when using a reverse proxy serving the NetBox website under a different FQDN than the hostname of the NetBox server. To help guard against [HTTP Host header attacks](https://docs.djangoproject.com/en/3.0/topics/security/#host-headers-virtual-hosting), NetBox will not permit access to the server via any other hostnames (or IPs). +This is a list of valid fully-qualified domain names (FQDNs) and/or IP addresses that can be used to reach the NetBox service. Usually this is the same as the hostname for the NetBox server, but can also be different; for example, when using a reverse proxy serving the NetBox website under a different FQDN than the hostname of the NetBox server. To help guard against [HTTP Host header attacks](https://docs.djangoproject.com/en/stable/topics/security/#host-headers-virtual-hosting), NetBox will not permit access to the server via any other hostnames (or IPs). !!! note This parameter must always be defined as a list or tuple, even if only a single value is provided. -The value of this option is also used to set `CSRF_TRUSTED_ORIGINS`, which restricts POST requests to the same set of hosts (more about this [here](https://docs.djangoproject.com/en/stable/ref/settings/#std:setting-CSRF_TRUSTED_ORIGINS)). Keep in mind that NetBox, by default, sets `USE_X_FORWARDED_HOST` to true, which means that if you're using a reverse proxy, it's the FQDN used to reach that reverse proxy which needs to be in this list (more about this [here](https://docs.djangoproject.com/en/stable/ref/settings/#allowed-hosts)). +The value of this option is also used to set `CSRF_TRUSTED_ORIGINS`, which restricts POST requests to the same set of hosts (more about this [here](https://docs.djangoproject.com/en/stable/ref/settings/#std:setting-CSRF_TRUSTED_ORIGINS)). Keep in mind that NetBox, by default, sets `USE_X_FORWARDED_HOST` to `True`, which means that if you're using a reverse proxy, it's the FQDN used to reach that reverse proxy which needs to be in this list (more about this [here](https://docs.djangoproject.com/en/stable/ref/settings/#allowed-hosts)). Example: diff --git a/docs/configuration/security.md b/docs/configuration/security.md index 771eba5c5..775490b70 100644 --- a/docs/configuration/security.md +++ b/docs/configuration/security.md @@ -5,7 +5,7 @@ Default: `False` !!! note - The default value of this parameter changed from true to false in NetBox v4.3.0. + The default value of this parameter changed from `True` to `False` in NetBox v4.3.0. If disabled, the values of API tokens will not be displayed after each token's initial creation. A user **must** record the value of a token prior to its creation, or it will be lost. Note that this affects _all_ users, regardless of assigned permissions. @@ -52,7 +52,7 @@ Although it is not recommended, the default validation rules can be disabled by Default: `False` -If True, cross-origin resource sharing (CORS) requests will be accepted from all origins. If False, a whitelist will be used (see below). +If `True`, cross-origin resource sharing (CORS) requests will be accepted from all origins. If False, a whitelist will be used (see below). --- @@ -62,7 +62,7 @@ If True, cross-origin resource sharing (CORS) requests will be accepted from all These settings specify a list of origins that are authorized to make cross-site API requests. Use `CORS_ORIGIN_WHITELIST` to define a list of exact hostnames, or `CORS_ORIGIN_REGEX_WHITELIST` to define a set of regular -expressions. (These settings have no effect if `CORS_ORIGIN_ALLOW_ALL` is True.) For example: +expressions. (These settings have no effect if `CORS_ORIGIN_ALLOW_ALL` is `True`.) For example: ```python CORS_ORIGIN_WHITELIST = [ @@ -84,7 +84,7 @@ The name of the cookie to use for the cross-site request forgery (CSRF) authenti Default: `False` -If true, the cookie employed for cross-site request forgery (CSRF) protection will be marked as secure, meaning that it can only be sent across an HTTPS connection. +If `True`, the cookie employed for cross-site request forgery (CSRF) protection will be marked as secure, meaning that it can only be sent across an HTTPS connection. --- @@ -92,7 +92,7 @@ If true, the cookie employed for cross-site request forgery (CSRF) protection wi Default: `[]` -Defines a list of trusted origins for unsafe (e.g. `POST`) requests. This is a pass-through to Django's [`CSRF_TRUSTED_ORIGINS`](https://docs.djangoproject.com/en/4.0/ref/settings/#std:setting-CSRF_TRUSTED_ORIGINS) setting. Note that each host listed must specify a scheme (e.g. `http://` or `https://). +Defines a list of trusted origins for unsafe (e.g. `POST`) requests. This is a pass-through to Django's [`CSRF_TRUSTED_ORIGINS`](https://docs.djangoproject.com/en/stable/ref/settings/#csrf-trusted-origins) setting. Note that each host listed must specify a scheme (e.g. `http://` or `https://). ```python CSRF_TRUSTED_ORIGINS = ( @@ -135,7 +135,7 @@ DEFAULT_PERMISSIONS = { ## EXEMPT_VIEW_PERMISSIONS -Default: Empty list +Default: `[]` (Empty list) A list of NetBox models to exempt from the enforcement of view permissions. Models listed here will be viewable by all users, both authenticated and anonymous. @@ -164,7 +164,7 @@ EXEMPT_VIEW_PERMISSIONS = ['*'] Default: `False` -If true, the lifetime of a user's authentication session will be automatically reset upon each valid request. For example, if [`LOGIN_TIMEOUT`](#login_timeout) is configured to 14 days (the default), and a user whose session is due to expire in five days makes a NetBox request (with a valid session cookie), the session's lifetime will be reset to 14 days. +If `True`, the lifetime of a user's authentication session will be automatically reset upon each valid request. For example, if [`LOGIN_TIMEOUT`](#login_timeout) is configured to 14 days (the default), and a user whose session is due to expire in five days makes a NetBox request (with a valid session cookie), the session's lifetime will be reset to 14 days. Note that enabling this setting causes NetBox to update a user's session in the database (or file, as configured per [`SESSION_FILE_PATH`](#session_file_path)) with each request, which may introduce significant overhead in very active environments. It also permits an active user to remain authenticated to NetBox indefinitely. @@ -191,7 +191,7 @@ The lifetime (in seconds) of the authentication cookie issued to a NetBox user u ## LOGIN_FORM_HIDDEN -Default: False +Default: `False` Option to hide the login form when only SSO authentication is in use. @@ -212,7 +212,7 @@ The view name or URL to which a user is redirected after logging out. Default: `False` -If true, the `includeSubDomains` directive will be included in the HTTP Strict Transport Security (HSTS) header. This directive instructs the browser to apply the HSTS policy to all subdomains of the current domain. +If `True`, the `includeSubDomains` directive will be included in the HTTP Strict Transport Security (HSTS) header. This directive instructs the browser to apply the HSTS policy to all subdomains of the current domain. --- @@ -220,7 +220,7 @@ If true, the `includeSubDomains` directive will be included in the HTTP Strict T Default: `False` -If true, the `preload` directive will be included in the HTTP Strict Transport Security (HSTS) header. This directive instructs the browser to preload the site in HTTPS. Browsers that use the HSTS preload list will force the site to be accessed via HTTPS even if the user types HTTP in the address bar. +If `True`, the `preload` directive will be included in the HTTP Strict Transport Security (HSTS) header. This directive instructs the browser to preload the site in HTTPS. Browsers that use the HSTS preload list will force the site to be accessed via HTTPS even if the user types HTTP in the address bar. --- @@ -236,7 +236,7 @@ If set to a non-zero integer value, the SecurityMiddleware sets the HTTP Strict Default: `False` -If true, all non-HTTPS requests will be automatically redirected to use HTTPS. +If `True`, all non-HTTPS requests will be automatically redirected to use HTTPS. !!! warning Ensure that your frontend HTTP daemon has been configured to forward the HTTP scheme correctly before enabling this option. An incorrectly configured frontend may result in a looping redirect. @@ -255,7 +255,7 @@ The name used for the session cookie. See the [Django documentation](https://doc Default: `False` -If true, the cookie employed for session authentication will be marked as secure, meaning that it can only be sent across an HTTPS connection. +If `True`, the cookie employed for session authentication will be marked as secure, meaning that it can only be sent across an HTTPS connection. --- diff --git a/docs/configuration/system.md b/docs/configuration/system.md index fe01e40b1..20143276c 100644 --- a/docs/configuration/system.md +++ b/docs/configuration/system.md @@ -95,7 +95,7 @@ Default: `('127.0.0.1', '::1')` A list of IP addresses recognized as internal to the system, used to control the display of debugging output. For example, the debugging toolbar will be viewable only when a client is accessing NetBox from one of the listed IP -addresses (and [`DEBUG`](./development.md#debug) is true). +addresses (and [`DEBUG`](./development.md#debug) is `True`). --- @@ -103,7 +103,7 @@ addresses (and [`DEBUG`](./development.md#debug) is true). Default: `False` -Set this configuration parameter to True for NetBox deployments which do not have Internet access. This will disable miscellaneous functionality which depends on access to the Internet. +Set this configuration parameter to `True` for NetBox deployments which do not have Internet access. This will disable miscellaneous functionality which depends on access to the Internet. !!! note If Internet access is available via a proxy, set [`HTTP_PROXIES`](#http_proxies) instead. @@ -114,7 +114,7 @@ Set this configuration parameter to True for NetBox deployments which do not hav Default: `{}` -A dictionary of custom jinja2 filters with the key being the filter name and the value being a callable. For more information see the [Jinja2 documentation](https://jinja.palletsprojects.com/en/3.1.x/api/#custom-filters). For example: +A dictionary of custom Jinja2 filters with the key being the filter name and the value being a callable. For more information see the [Jinja2 documentation](https://jinja.palletsprojects.com/en/3.1.x/api/#custom-filters). For example: ```python def uppercase(x): diff --git a/docs/development/release-checklist.md b/docs/development/release-checklist.md index e48cb140e..5478e37e9 100644 --- a/docs/development/release-checklist.md +++ b/docs/development/release-checklist.md @@ -53,6 +53,8 @@ If a new Django release is adopted or other major dependencies (Python, PostgreS * Update the installation guide (`docs/installation/index.md`) with the new minimum versions. * Update the upgrade guide (`docs/installation/upgrading.md`) for the current version accordingly. +* Update the minimum PostgreSQL version in the programming error template (`netbox/templates/exceptions/programming_error.html`). +* Update the minimum and supported Python versions in the project metadata file (`pyproject.toml`) ### Manually Perform a New Install @@ -164,7 +166,8 @@ Then, compile these portable (`.po`) files for use in the application: ### Update Version and Changelog -* Update the version number and date in `netbox/release.yaml`. Add or remove the designation (e.g. `beta1`) if applicable. +* Update the version number and published date in `netbox/release.yaml`. Add or remove the designation (e.g. `beta1`) if applicable. +* Copy the version number from `release.yaml` to `pyproject.toml` in the project root. * Update the example version numbers in the feature request and bug report templates under `.github/ISSUE_TEMPLATES/`. * Add a section for this release at the top of the changelog page for the minor version (e.g. `docs/release-notes/version-4.2.md`) listing all relevant changes made in this release. @@ -190,15 +193,3 @@ Create a [new release](https://github.com/netbox-community/netbox/releases/new) * **Description:** Copy from the pull request body, then promote the `###` headers to `##` ones Once created, the release will become available for users to install. - -### Update the Public Documentation - -After a release has been published, the public NetBox documentation needs to be updated. This is accomplished by running two actions on the [netboxlabs-docs](https://github.com/netboxlabs/netboxlabs-docs) repository. - -First, run the `build-site` action, by navigating to Actions > build-site > Run workflow. This process compiles the documentation along with an overlay for integration with the documentation portal at