search

PaloAltoNetworks / pan-os-php

Framework and utilities to easily manage and edit Palo Alto Network PANOS devices
ISC License
72 stars 15 forks source link

Moving object to DG two or more levels higher in hierarchy may result in it being overridden #752

Closed jkaczmarski09 closed 1 year ago

jkaczmarski09 commented 1 year ago

Describe the bug

Suppose we have the following DG hierarchy:

shared
 - DG_A
   - DG_B

DG_A has addr1 with value 1.1.1.1 DG_B has addr1 with value 2.2.2.2

Moving addr1 from DG_B to shared is possible and no warning is displayed that such action results in addr1's value for DG_B changing from 2.2.2.2 to 1.1.1.1.

Command used: pan-os-php type=address in=panorama.xml location=DG_B 'actions=move:shared,skipIfConflict'

Expected behavior

If option skipIfConflict is used the address object should not be moved or a warning message should be displayed.

Current behavior

Address object is moved to shared without any warning message.

Possible solution

When object is moved 2 or more levels in DG hierarchy check if after moving it will not become overridden by an object lower in the DG hierarchy.

Steps to reproduce

Create simple config as presented in the bug description.

Your Environment

$ pan-os-php version

swaschkut commented 1 year ago

fixed with v2.1.6