Skip to content

Conversation

@sanjaydilli
Copy link
Contributor

@sanjaydilli sanjaydilli commented Nov 5, 2025

Problem:

When comparing before and after Cisco running‑configs, RunningConfigDiff treats Type‑6 encrypted password lines as changed if the hash string changes.

Type‑6 passwords are salted and re‑encrypted every time the config is written, even if the underlying plaintext password hasn’t changed.
This caused false positive diffs during test steps such as C_check_running_diff, especially for NETCONF/YANG flows.
example of false diff:

- password 6 IJIahKNcYaRW]]aXgDa[_feZAAB
+ password 6 U_LKiCFX_IQ\WPBbfeIKhNdhM_dAAB

Change

Added _normalize_passwords() helper method inside RunningConfigDiff.
Normalization replaces the hash portion of any password 6 line with a placeholder before parsing configs into lists.
This ensures that only meaningful password changes (or encryption type changes) are flagged in diffs.

@sanjaydilli sanjaydilli marked this pull request as ready for review November 6, 2025 17:52
@sanjaydilli sanjaydilli requested a review from a team as a code owner November 6, 2025 17:52
Copy link
Collaborator

@ThomasJRyan ThomasJRyan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we able to have some unittests for this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants