PaloAltoNetworks / pan-os-python

The PAN-OS SDK for Python is a package to help interact with Palo Alto Networks devices (including physical and virtualized Next-generation Firewalls and Panorama). The pan-os-python SDK is object oriented and mimics the traditional interaction with the device via the GUI or CLI/API.
https://pan-os-python.readthedocs.io
ISC License
340 stars 168 forks source link

Handling Log Collector Group (LCG) pushes #493

Closed jamesholland-uk closed 7 months ago

jamesholland-uk commented 1 year ago

Description

Attempting to handle "push" to Log Collector Groups (LCG)

Motivation and Context

Attempting to close #487

XML API response from a push to a DG, for example, returns a job ID etc:

Job enqueued with jobid 16892 16892

XML API response from a push to a LCG looks totally different:

Generated config and committed to connected collectors in group log-coll-grp

How Has This Been Tested?

Tested locally. Both native Python scripts and Ansible playbooks now complete successfully.

Python script:

    panorama = Panorama(HOSTNAME, USERNAME, PASSWORD)

    cmd = PanoramaCommitAll(
        style="log collector group",
        name="log-coll-grp",
        include_template=False,
        force_template_values=False,
    )
    sync = True
    sync_all = True

    result = panorama.commit(cmd=cmd, sync=sync, sync_all=sync_all)

    print(result)

Result before:

None

Result after:

{'success': True, 'result': 'Ok', 'jobid': '0', 'messages': ['Generated config and committed to connected collectors in group log-coll-grp']}

Ansible playbook:

    - name: push log collector config
      paloaltonetworks.panos.panos_commit_push:
        provider: "{{ device }}"
        description: "push log collector config"
        style: "log collector group"
        name: "{{ log_collector_group }}"

Result before:

TASK [push log collector config] *********************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: TypeError: 'NoneType' object is not subscriptable
fatal: [host_azurerama]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n  File \"/Users/jholland/.ansible/tmp/ansible-tmp-1675702328.0676868-37346-62199662455005/AnsiballZ_panos_commit_push.py\", line 107, in <module>\n    _ansiballz_main()\n  File \"/Users/jholland/.ansible/tmp/ansible-tmp-1675702328.0676868-37346-62199662455005/AnsiballZ_panos_commit_push.py\", line 99, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/Users/jholland/.ansible/tmp/ansible-tmp-1675702328.0676868-37346-62199662455005/AnsiballZ_panos_commit_push.py\", line 47, in invoke_module\n    runpy.run_module(mod_name='ansible_collections.paloaltonetworks.panos.plugins.modules.panos_commit_push', init_globals=dict(_module_fqn='ansible_collections.paloaltonetworks.panos.plugins.modules.panos_commit_push', _modlib_path=modlib_path),\n  File \"/Users/jholland/.pyenv/versions/3.10.4/lib/python3.10/runpy.py\", line 209, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/Users/jholland/.pyenv/versions/3.10.4/lib/python3.10/runpy.py\", line 96, in _run_module_code\n    _run_code(code, mod_globals, init_globals,\n  File \"/Users/jholland/.pyenv/versions/3.10.4/lib/python3.10/runpy.py\", line 86, in _run_code\n    exec(code, run_globals)\n  File \"/var/folders/5k/v6w2wvm92sg_drdh0rw6p74w0000gp/T/ansible_paloaltonetworks.panos.panos_commit_push_payload_1b9iz2xk/ansible_paloaltonetworks.panos.panos_commit_push_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_commit_push.py\", line 221, in <module>\n  File \"/var/folders/5k/v6w2wvm92sg_drdh0rw6p74w0000gp/T/ansible_paloaltonetworks.panos.panos_commit_push_payload_1b9iz2xk/ansible_paloaltonetworks.panos.panos_commit_push_payload.zip/ansible_collections/paloaltonetworks/panos/plugins/modules/panos_commit_push.py\", line 209, in main\nTypeError: 'NoneType' object is not subscriptable\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

PLAY RECAP *******************************************************************************************
host_azurerama             : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0   

Result after:

TASK [push log collector config] *********************************************************************
changed: [host_azurerama]

PLAY RECAP *******************************************************************************************
host_azurerama             : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

Types of changes

Checklist

jamesholland-uk commented 1 year ago

@btorresgil @shinmog Can you take a look at this proposed change please? The PR fixes an Issue here in pan-os-python, which itself causes an Issue in pan-os-ansible which NBS reported. I am fairly sure that my code is one of many, many ways this challenge could be solved, so more than happy to discuss alternatives if you want. Thanks :-)