PaloAltoNetworks / pan-os-ansible

Ansible collection for easy automation of Palo Alto Networks next generation firewalls and Panorama, in both physical and virtual form factors.
https://pan.dev/ansible/docs/panos
Apache License 2.0
209 stars 97 forks source link

Gathered_filter regex escape characters is too restrictive #579

Open jgiroso opened 2 months ago

jgiroso commented 2 months ago

Is your feature request related to a problem?

Utilizing the gathered_filter with regex requires very strict usage of escape characters, which is not consistent with other ansible filters/tasks. This means that as a user, local testing of the regex using a debug may return different results than when that regex is passed to the module.

I discovered this when the regex I had successfully tested locally with a regex_search filter was not returning any results with the palo gathered_filter even though I knew the objects existed

Current regex syntax to return results:

Describe the solution you'd like

Increased handling of regex escape characters when using regex for the gathered_filter.

In addition to the current behavior, I'd like to also see the following situations return results (note these are very over-simplified regex examples):

Additional context

Because the roles we create that utilize the palo modules can be consumed by other teams at our company that may not be aware of these restrictions, we've had to add a task to our roles to re-format the regex for them before the value is passed to the module

I'm including some screenshots of testing I did, including the playbook and printed output:

image image image

The playbook is run on localhost Ansible versions:

alperenkose commented 1 month ago

Hi @jgiroso ,

This has been implemented in the #583 PR which is merged to the beta branch for 3.0 release. This introduces a breaking change since the previous syntax for gathered_filter will not work but it accepts a valid regex now. We don't have a release date yet for 3.0, however you may manually run the code from beta branch if you would like. I will keep the issue open for reference if people come across this for now.

Thanks,