Interface full_delete fails if static route references any other interface

Abierto
  • ¿Algo no está bien?
#481 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
52/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
python
Área
networking

Línea de trabajo

Start in panos/network.py at full_delete(), especially line 595, and inspect how StaticRoute stores its interface attribute compared with objects such as VirtualRouter or Zone. Run the minimal reproduction from the issue without a live firewall. Done means ethernet2.full_delete() completes without raising the TypeError when an unrelated StaticRoute references ethernet1/1.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

Describe the bug

If a static route exists on the firewall which references an interface, a full_delete() will fail on a different interface.

Expected behavior

full_delete() should complete without throwing an exception

Current behavior

A TypeError exception is thrown, such as:

File "/work/panos/network.py", line 595, in full_delete
elif "__iter__" in dir(obj.interface) and self in obj.interface:
TypeError: 'in ' requires string as left operand, not EthernetInterface

Possible solution

StaticRoute's interface attribute gets populated as a string, whereas the full_delete code appears to expect a list (which is the case for other objects such as VirtualRouter or Zone). Since the str type will also pass the __iter__ check, a more specific type check may be needed to avoid the in test that results at network.py:595.

Steps to reproduce

Minimal pan-os-python reproduction without a live firewall (StaticRoute is being added directly to Firewall for brevity but error still triggers with VirtualRouter):

from panos.network import EthernetInterface, StaticRoute
from panos.firewall import Firewall

firewall = Firewall()
ethernet1 = firewall.add(EthernetInterface("ethernet1/1", mode="layer3"))
ethernet2 = firewall.add(EthernetInterface("ethernet1/2", mode="layer3"))
route = firewall.add(StaticRoute("test", interface="ethernet1/1"))

ethernet2.full_delete()  # generates error

Context

This can be a really tricky situation to avoid since the StaticRoute that triggers the error is unrelated to the interface being changed. Routes targeted at interfaces rather than next-hops can be common in environments with IPSec tunnels, but the interface can also be present in addition to a next-hop for any static route.

Your Environment

Python 3.9.15
pan-os-python 1.7.3

Lenguaje dominante
Python
Estrellas
402
Forks
198
Sin PR fusionados en 30 d

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de PaloAltoNetworks/pan-os-python

Todos los issues de PaloAltoNetworks/pan-os-python

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.