PaloAltoNetworks / PaloAltoNetworks/pan-os-python
Interface full_delete fails if static route references any other interface
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 400
- Forks
- 199
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
If a static route exists on the firewall which references an interface, a full_delete() will fail on a different interface.
Expected behavior
full_delete() should complete without throwing an exception
Current behavior
A TypeError exception is thrown, such as:
File "/work/panos/network.py", line 595, in full_delete
elif "__iter__" in dir(obj.interface) and self in obj.interface:
TypeError: 'in ' requires string as left operand, not EthernetInterface
Possible solution
StaticRoute's interface attribute gets populated as a string, whereas the full_delete code appears to expect a list (which is the case for other objects such as VirtualRouter or Zone). Since the str type will also pass the __iter__ check, a more specific type check may be needed to avoid the in test that results at network.py:595.
Steps to reproduce
Minimal pan-os-python reproduction without a live firewall (StaticRoute is being added directly to Firewall for brevity but error still triggers with VirtualRouter):
from panos.network import EthernetInterface, StaticRoute
from panos.firewall import Firewall
firewall = Firewall()
ethernet1 = firewall.add(EthernetInterface("ethernet1/1", mode="layer3"))
ethernet2 = firewall.add(EthernetInterface("ethernet1/2", mode="layer3"))
route = firewall.add(StaticRoute("test", interface="ethernet1/1"))
ethernet2.full_delete() # generates error
Context
This can be a really tricky situation to avoid since the StaticRoute that triggers the error is unrelated to the interface being changed. Routes targeted at interfaces rather than next-hops can be common in environments with IPSec tunnels, but the interface can also be present in addition to a next-hop for any static route.
Your Environment
Python 3.9.15
pan-os-python 1.7.3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in panos/network.py at full_delete(), especially line 595, and inspect how StaticRoute stores its interface attribute compared with objects such as VirtualRouter or Zone. Run the minimal reproduction from the issue without a live firewall. Done means ethernet2.full_delete() completes without raising the TypeError when an unrelated StaticRoute references ethernet1/1.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100