Mangesh-Bhattacharya · Sep 18, 2026
diff --git a/.gitattributes b/.gitattributes
@@ -1 +1,12 @@
 *.py diff=python
+
+# Keep Unix line endings in everything that runs inside Linux (install
+# scripts, Mininet itself, the Docker image, VMs), even when the repo is
+# cloned on Windows with core.autocrlf=true
+* text=auto eol=lf
+*.cmd text eol=crlf
+*.bat text eol=crlf
+*.ps1 text eol=crlf
+*.png binary
+*.jpg binary
+*.pdf binary
diff --git a/.github/workflows/code-check.yaml b/.github/workflows/code-check.yaml
@@ -9,14 +9,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Python 3.x
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: 3.x
+          # pylint 2.15 does not run on Python 3.12+
+          python-version: "3.11"
       - name: Check out Mininet source
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Mininet code check dependencies
         run: |
           PYTHON=`which python` util/install.sh -n
-          python -m pip install pylint==2.15.7
+          python -m pip install pylint==2.15.7 pyflakes pycodestyle
       - name: Run code check
         run:  make codecheck
diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml
@@ -9,11 +9,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, ubuntu-20.04]
-        py: [python3, python2]
+        # ubuntu-20.04 runners are retired, and Python 2 (end of life in
+        # 2020) is not installable on ubuntu-24.04
+        os: [ubuntu-22.04, ubuntu-24.04]
+        py: [python3]
     steps:
       - name: Check out Mininet source
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Python ${{ matrix.py }}
         run: sudo apt install ${{ matrix.py }}
       - name: Install Mininet and base dependencies
@@ -37,7 +39,7 @@ jobs:
         run: |
           sudo apt-get install -qq vlan
           export PYTHON=${{ matrix.py }}
-          sudo $PYTHON -m pip install pexpect
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -qq ${PYTHON}-pexpect
           util/install.sh -fw
       - name: Run core tests
         run: |

diff --git a/.gitignore b/.gitignore
@@ -1,14 +1,39 @@
+# Build output
 mnexec
+*.1
+build/
+dist/
+*.egg-info/
+doc/html/
+doc/latex/
+debian/.debhelper/
+debian/debhelper-build-stamp
+debian/files
+debian/mininet/
+debian/*.substvars
+debian/*.log
+
+# Python
+__pycache__/
 *.pyc
+.venv/
+venv/
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Security scan reports produced locally
+*.sarif
+
+# Editors and OS
 *~
-*.1
+\#*\#
+.vscode/
+.idea/
 *.xcodeproj
 *.xcworkspace
-\#*\#
-mininet.egg-info
-build
-dist
-doc/html
-doc/latex
-trunk
+.DS_Store
+Thumbs.db
 
+# Historical
+trunk
diff --git a/.pylint b/.pylint
@@ -6,8 +6,14 @@
 # * handle message activation / deactivation at the module level
 # * handle some basic but necessary stats'data (number of classes, methods...)
 #
+# Pylint configuration for `make codecheck` (pylint 2.15, Python 3.9+)
+
 [MASTER]
 
+# Oldest Python this fork supports
+py-version=3.9
+
+
 # Specify a configuration file.
 #rcfile=
 
@@ -158,15 +164,13 @@ ignore-mixin-members=yes
 
 # List of classes names for which member attributes should not be checked
 # (useful for classes with attributes dynamicaly set).
-ignored-classes=SQLObjec
 
 # When zope mode is activated, add a predefined set of Zope acquired attributes
 # to generated-members.
 #zope=no
 
 # List of members which are set dynamically and missed by pylint inference
 # system, and so shouldn't trigger E0201 when accessed.
-generated-members=REQUEST,acl_users,aq_paren
 
 
 # checks for

diff --git a/Makefile b/Makefile
@@ -2,13 +2,14 @@ MININET = mininet/*.py
 TEST = mininet/test/*.py
 EXAMPLES = mininet/examples/*.py
 MN = bin/mn
-PYTHON ?= python
+PYTHON ?= python3
 PYMN = $(PYTHON) -B bin/mn
 BIN = $(MN)
 PYSRC = $(MININET) $(TEST) $(EXAMPLES) $(BIN)
 MNEXEC = mnexec
 MANPAGES = mn.1 mnexec.1
-P8IGN = E251,E201,E302,E202,E126,E127,E203,E226,E402,W504,W503,E731
+PEP8 ?= $(shell command -v pycodestyle || command -v pep8)
+P8IGN = E251,E201,E302,E202,E126,E127,E203,E226,E402,W504,W503,E731,E275,E741
 PREFIX ?= /usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man/man1
@@ -17,6 +18,12 @@ PDF = doc/latex/refman.pdf
 CC ?= cc
 
 CFLAGS += -Wall -Wextra
+# mnexec runs as root: build it hardened (distribution packaging may
+# override these with its own flags)
+HARDEN_CFLAGS ?= -O2 -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fPIE
+HARDEN_LDFLAGS ?= -pie -Wl,-z,relro,-z,now
+CFLAGS += $(HARDEN_CFLAGS)
+LDFLAGS += $(HARDEN_LDFLAGS)
 
 all: codecheck test
 
@@ -29,7 +36,7 @@ codecheck: $(PYSRC)
 	pyflakes3 $(PYSRC) || pyflakes $(PYSRC)
 	pylint --rcfile=.pylint $(PYSRC)
 #	Exclude miniedit from pep8 checking for now
-	pep8 --repeat --ignore=$(P8IGN) `ls $(PYSRC) | grep -v miniedit.py`
+	$(PEP8) --ignore=$(P8IGN) `ls $(PYSRC) | grep -v miniedit.py`
 
 errcheck: $(PYSRC)
 	-echo "Running check for errors only"

diff --git a/bin/mn b/bin/mn
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
 """
 Mininet runner

diff --git a/custom/topo-2sw-2host.py b/custom/topo-2sw-2host.py
@@ -1,3 +1,5 @@
+#!/usr/bin/env python3
+
 """Custom topology example
 
 Two directly connected switches plus a host for each switch:

diff --git a/debian/changelog b/debian/changelog
@@ -1,3 +1,15 @@
+mininet (2.3.1~b4-1) unstable; urgency=medium
+
+  * Refresh packaging for current Debian and Ubuntu:
+    - Build with Python 3 and pybuild, debhelper compat 13; drop
+      Python 2 and debian/compat.
+    - Depend on current package names (iproute2, net-tools,
+      openvswitch-testcontroller, cgroup-tools).
+    - Build mnexec with all hardening flags.
+    - Machine-readable copyright with the current BSD-3-Clause license.
+
+ -- Mangesh Bhattacharya <84471637+Mangesh-Bhattacharya@users.noreply.github.com>  Fri, 18 Sep 2026 18:00:00 +0000
+
 mininet (2.1.0-0ubuntu1) saucy; urgency=low
 
   * Add 2.1.0 final packaging

diff --git a/debian/compat b/debian/compat
diff --git a/debian/control b/debian/control
@@ -1,29 +1,40 @@
 Source: mininet
 Section: net
-Priority: extra
+Priority: optional
 Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
 XSBC-Original-Maintainer: Bob Lantz <rlantz@cs.stanford.edu>
-Standards-Version: 3.9.3
 Build-Depends:
- debhelper (>= 9~),
+ debhelper-compat (= 13),
+ dh-python,
  help2man,
- python-dev,
- python-pkg-resources,
- python-setuptools
-Homepage: http://openflow.org/mininet
+ python3-all,
+ python3-setuptools,
+Rules-Requires-Root: no
+Standards-Version: 4.7.0
+Homepage: http://mininet.org
+Vcs-Browser: https://github.com/mininet/mininet
+Vcs-Git: https://github.com/mininet/mininet.git
 
 Package: mininet
 Architecture: any
 Depends:
+ bridge-utils,
+ ethtool,
+ iperf,
+ iproute2,
+ iputils-ping,
+ net-tools,
  openvswitch-switch,
- telnet,
+ psmisc,
  socat,
- iperf,
- cgroup-bin,
+ telnet | inetutils-telnet,
  ${misc:Depends},
- ${python:Depends},
- ${shlibs:Depends}
-Recommends: openvswitch-controller
+ ${python3:Depends},
+ ${shlibs:Depends},
+Recommends:
+ cgroup-tools,
+ openvswitch-testcontroller,
+ xterm,
 Description: Process-based network emulator
  Mininet is a network emulator which uses lightweight
  virtualization to create virtual networks for rapid

diff --git a/debian/copyright b/debian/copyright
@@ -1,37 +1,36 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: mininet
+Upstream-Contact: Bob Lantz <rlantz@cs.stanford.edu>
 Source: https://github.com/mininet/mininet
 
 Files: *
-Copyright: 2012-2013 Open Networking Laboratory,
-           2009-2012 Bob Lantz,
-           2009-2012 The Board of Trustees of the Leland Stanford Junior
-           University
-License:
-  Original authors: Bob Lantz and Brandon Heller
+Copyright: 2013-2022 Open Networking Foundation
+           2009-2012 Bob Lantz
+           2009-2012 The Board of Trustees of the Leland Stanford Junior University
+License: BSD-3-Clause
+
+License: BSD-3-Clause
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions are met:
   .
-  We are making Mininet available for public use and benefit with the
-  expectation that others will use, modify and enhance the Software and
-  contribute those enhancements back to the community. However, since we
-  would like to make the Software available for broadest use, with as few
-  restrictions as possible permission is hereby granted, free of charge, to
-  any person obtaining a copy of this Software to deal in the Software
-  under the copyrights without restriction, including without limitation
-  the rights to use, copy, modify, merge, publish, distribute, sublicense,
-  and/or sell copies of the Software, and to permit persons to whom the
-  Software is furnished to do so, subject to the following conditions:
+  1. Redistributions of source code must retain the above copyright notice, this
+     list of conditions and the following disclaimer.
   .
-  The above copyright notice and this permission notice shall be included
-  in all copies or substantial portions of the Software.
+  2. Redistributions in binary form must reproduce the above copyright notice,
+     this list of conditions and the following disclaimer in the documentation
+     and/or other materials provided with the distribution.
   .
-  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-  OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-  CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-  TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+  3. Neither the name of the copyright holder nor the names of its
+     contributors may be used to endorse or promote products derived from
+     this software without specific prior written permission.
   .
-  The name and trademarks of copyright holder(s) may NOT be used in
-  advertising or publicity pertaining to the Software or any derivatives
-  without specific, written prior permission.
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/debian/rules b/debian/rules
@@ -1,12 +1,23 @@
 #!/usr/bin/make -f
 
+export PYBUILD_NAME = mininet
+# mnexec runs as root: enable every hardening option
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+
 %:
-	dh $@ --buildsystem=python_distutils --with=python2 
+	dh $@ --with python3 --buildsystem=pybuild
 
 override_dh_auto_build:
-	make man
-	make mnexec
+	$(MAKE) PYTHON=python3 mnexec man
 	dh_auto_build
 
+override_dh_auto_test:
+	# Mininet's tests need root and network namespaces; CI runs them
+	# against the installed package instead
+
+override_dh_auto_clean:
+	dh_auto_clean
+	$(MAKE) clean
+
 get-orig-source:
 	uscan --force-download --rename
diff --git a/debian/watch b/debian/watch
@@ -1,3 +1,3 @@
-version=3
-opts=filenamemangle=s/(.*)\/archive/$1/,uversionmangle=s/([abdr].*)\.tar\.gz/~$1/ \
-https://github.com/mininet/mininet/tags .*/archive\/(\d.*\.tar\.gz)
+version=4
+opts=filenamemangle=s%.*/v?(\d\S+)\.tar\.gz%mininet-$1.tar.gz%,uversionmangle=s/(\d)([abr]\d+)/$1~$2/ \
+  https://github.com/mininet/mininet/tags .*/archive/refs/tags/v?(\d\S+)\.tar\.gz
diff --git a/doc/doxygen.cfg b/doc/doxygen.cfg
@@ -274,6 +274,9 @@ OPTIMIZE_OUTPUT_FOR_C  = NO
 # The default value is: NO.
 
 OPTIMIZE_OUTPUT_JAVA   = NO
+# Let the @param/@returns commands produced by util/doxify.py
+# work inside Python docstrings (doxygen 1.9+)
+PYTHON_DOCSTRING       = NO
 
 # Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran
 # sources. Doxygen will then generate output that is tailored for Fortran.

diff --git a/examples/baresshd.py b/examples/baresshd.py
@@ -1,11 +1,11 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
 "This example doesn't use OpenFlow, but attempts to run sshd in a namespace."
 
 import sys
 
 from mininet.node import Host
-from mininet.util import ensureRoot, waitListening
+from mininet.util import ensureRoot, waitListening, quietRun
 from mininet.log import info, warn, output
 
 
@@ -31,6 +31,9 @@
     f.write( 'Welcome to %s at %s\n' % ( h1.name, h1.IP() ) )
 
 info( "*** Running sshd\n" )
+# sshd refuses to start without its privilege separation directory,
+# which current distributions only create when the ssh service runs
+quietRun( 'mkdir -p -m 0755 /run/sshd' )
 cmd = '/usr/sbin/sshd -o UseDNS=no -u0 -o "Banner /tmp/%s.banner"' % h1.name
 # add arguments from the command line
 if len( sys.argv ) > 1: