PaloAltoNetworks / pan-os-python

The PAN-OS SDK for Python is a package to help interact with Palo Alto Networks devices (including physical and virtualized Next-generation Firewalls and Panorama). The pan-os-python SDK is object oriented and mimics the traditional interaction with the device via the GUI or CLI/API.
https://pan-os-python.readthedocs.io
ISC License
347 stars 172 forks source link

Upgrade from standard to hotfix release fails on 1.12.0 #565

Open timothyfranson opened 6 months ago

timothyfranson commented 6 months ago

Describe the bug

Upgrade from non-hotifx to a hotfix release fails when pan-os-python==1.12.0

Reverting to pan-os-python 1.11.0 works just fine.

Expected behavior

Device is upgraded

Current behavior

Traceback (most recent call last):
  File ".../venv/lib/python3.11/site-packages/nornir/core/task.py", line 99, in start
    r = self.task(self, **self.params)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../panos_upgrade/run.py", line 197, in upgrade_device
    upgrade_successful = fw.software.upgrade_to_version(target_version)
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../venv/lib/python3.11/site-packages/panos/updater.py", line 337, in upgrade_to_version
    elif not self._direct_upgrade_possible(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../venv/lib/python3.11/site-packages/panos/updater.py", line 519, in _direct_upgrade_possible
    and current_version.subrelease_num < target_version.subrelease_num
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: '<' not supported between instances of 'NoneType' and 'int'

Possible solution

Seems the issue is that there is no value for subrelease_num if not coming from a hotfix release. Either populate that with 0, or account for it in the conditional.

Some quick and dirty testing:

>>> from panos import PanOSVersion
>>> t = PanOSVersion("10.1.13-h1")
>>> c = PanOSVersion('10.1.13')
>>> t
PanOSVersion ('10.1.13-h1')
>>> c
PanOSVersion ('10.1.13')
>>> c.subrelease_num
>>> t.subrelease_num
1
>>>

Steps to reproduce

Try to upgrade a firewall from 10.1.13 to 10.1.13-h1 using upgrade_to_version()

Screenshots

n/a

Context

Cannot use this to apply hotfix releases if coming from a normal release.

Your Environment