PaloAltoNetworks / PaloAltoNetworks/pan-os-python

Interface full_delete fails if static route references any other interface

Open
#481 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
400
Forks
199
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

If a static route exists on the firewall which references an interface, a full_delete() will fail on a different interface.

Expected behavior

full_delete() should complete without throwing an exception

Current behavior

A TypeError exception is thrown, such as:

File "/work/panos/network.py", line 595, in full_delete
elif "__iter__" in dir(obj.interface) and self in obj.interface:
TypeError: 'in ' requires string as left operand, not EthernetInterface

Possible solution

StaticRoute's interface attribute gets populated as a string, whereas the full_delete code appears to expect a list (which is the case for other objects such as VirtualRouter or Zone). Since the str type will also pass the __iter__ check, a more specific type check may be needed to avoid the in test that results at network.py:595.

Steps to reproduce

Minimal pan-os-python reproduction without a live firewall (StaticRoute is being added directly to Firewall for brevity but error still triggers with VirtualRouter):

from panos.network import EthernetInterface, StaticRoute
from panos.firewall import Firewall

firewall = Firewall()
ethernet1 = firewall.add(EthernetInterface("ethernet1/1", mode="layer3"))
ethernet2 = firewall.add(EthernetInterface("ethernet1/2", mode="layer3"))
route = firewall.add(StaticRoute("test", interface="ethernet1/1"))

ethernet2.full_delete()  # generates error

Context

This can be a really tricky situation to avoid since the StaticRoute that triggers the error is unrelated to the interface being changed. Routes targeted at interfaces rather than next-hops can be common in environments with IPSec tunnels, but the interface can also be present in addition to a next-hop for any static route.

Your Environment

Python 3.9.15
pan-os-python 1.7.3

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in panos/network.py at full_delete(), especially line 595, and inspect how StaticRoute stores its interface attribute compared with objects such as VirtualRouter or Zone. Run the minimal reproduction from the issue without a live firewall. Done means ethernet2.full_delete() completes without raising the TypeError when an unrelated StaticRoute references ethernet1/1.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.