fortinet-ansible-dev / ansible-galaxy-fortios-sphinxdoc

https://ansible-galaxy-fortios-docs.readthedocs.io/en/latest/
2 stars 7 forks source link

fortios_web_proxy_explicit pac_file_data cutting off #8

Closed rrobles12 closed 3 years ago

rrobles12 commented 3 years ago

I am unable to fully populate the pac_file_data with the actual contents. It cuts off and seems to have issues with certain symbols.

ansible 2.10.5
  python version = 3.6.5 (default, Jan 19 2021, 14:04:45) [GCC 10.2.1 20200826 (Red Hat 10.2.1-3)]
ansible-galaxy collection list

Collection        Version
----------------- -------
ansible.netcommon 1.5.0
fortinet.fortios  2.0.1

The playbook is as follows:

  - name: CONFIGURE EXPLICIT-PROXY PAC FILE AND SETTINGS
    fortios_web_proxy_explicit:
      vdom:  "{{ vdom }}"
      web_proxy_explicit:
        ftp_over_http: "enable"
        http_incoming_port: "12345"
        message_upon_server_error: "enable"
        pac_file_data: "{{ lookup('file', 'proxy_ex.pac') }}"
        pac_file_name: "proxy.pac"
        pac_file_server_status: "enable"
        pref_dns_result: "ipv4"
        realm: "default"
        sec_default_action: "deny"
        socks: "disable"
        ssl_algorithm: "low"
        status: "enable"
        strict_guest: "disable"
        trace_auth_no_rsp: "disable"
        unknown_http_version: "reject"

and what actually gets pushed is the following:

PROXY 4.5.6.7:8080; PROXY 7.8.9.10:8080

The PAC file contents are the following:

function FindProxyForURL(url, host) {

// If the hostname matches, send direct.
    if (dnsDomainIs(host, "intranet.domain.com") ||
        shExpMatch(host, "(*.abcdomain.com|abcdomain.com)"))
        return "DIRECT";

// If the protocol or URL matches, send direct.
    if (url.substring(0, 4)=="ftp:" ||
        shExpMatch(url, "http://abcdomain.com/folder/*"))
        return "DIRECT";

// If the requested website is hosted within the internal network, send direct.
    if (isPlainHostName(host) ||
        shExpMatch(host, "*.local") ||
        isInNet(dnsResolve(host), "10.0.0.0", "255.0.0.0") ||
        isInNet(dnsResolve(host), "172.16.0.0",  "255.240.0.0") ||
        isInNet(dnsResolve(host), "192.168.0.0",  "255.255.0.0") ||
        isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0"))
        return "DIRECT";

// If the IP address of the local machine is within a defined
// subnet, send to a specific proxy.
    if (isInNet(myIpAddress(), "10.10.5.0", "255.255.255.0"))
        return "PROXY 1.2.3.4:8080";

// DEFAULT RULE: All other traffic, use below proxies, in fail-over order.
    return "PROXY 4.5.6.7:8080; PROXY 7.8.9.10:8080";

}

And the ansible debug is the following:

changed: [firewall] => {
    "changed": true,
    "invocation": {
        "module_args": {
            "access_token": null,
            "enable_log": null,
            "vdom": "root",
            "web_proxy_explicit": {
                "ftp_incoming_port": null,
                "ftp_over_http": "enable",
                "http_incoming_port": "12345",
                "https_incoming_port": null,
                "https_replacement_message": null,
                "incoming_ip": null,
                "incoming_ip6": null,
                "ipv6_status": null,
                "message_upon_server_error": "enable",
                "outgoing_ip": null,
                "outgoing_ip6": null,
                "pac_file_data": "function FindProxyForURL(url, host) {\n\n// If the hostname matches, send direct.\n\tif (dnsDomainIs(host, \"intranet.domain.com\") ||\n\t\tshExpMatch(host, \"(*.abcdomain.com|abcdomain.com)\"))\n\t\treturn \"DIRECT\";\n\n// If the protocol or URL matches, send direct.\n\tif (url.substring(0, 4)==\"ftp:\" ||\n\t\tshExpMatch(url, \"http://abcdomain.com/folder/*\"))\n\t\treturn \"DIRECT\";\n\n// If the requested website is hosted within the internal network, send direct.\n\tif (isPlainHostName(host) ||\n\t\tshExpMatch(host, \"*.local\") ||\n\t\tisInNet(dnsResolve(host), \"10.0.0.0\", \"255.0.0.0\") ||\n\t\tisInNet(dnsResolve(host), \"172.16.0.0\",  \"255.240.0.0\") ||\n\t\tisInNet(dnsResolve(host), \"192.168.0.0\",  \"255.255.0.0\") ||\n\t\tisInNet(dnsResolve(host), \"127.0.0.0\", \"255.255.255.0\"))\n\t\treturn \"DIRECT\";\n\n// If the IP address of the local machine is within a defined\n// subnet, send to a specific proxy.\n\tif (isInNet(myIpAddress(), \"10.10.5.0\", \"255.255.255.0\"))\n\t\treturn \"PROXY 1.2.3.4:8080\";\n\n// DEFAULT RULE: All other traffic, use below proxies, in fail-over order.\n\treturn \"PROXY 4.5.6.7:8080; PROXY 7.8.9.10:8080\";\n\n}",
                "pac_file_name": "proxy.pac",
                "pac_file_server_port": null,
                "pac_file_server_status": "enable",
                "pac_file_url": null,
                "pac_policy": null,
                "pref_dns_result": "ipv4",
                "realm": "default",
                "sec_default_action": "deny",
                "socks": "disable",
                "socks_incoming_port": null,
                "ssl_algorithm": "low",
                "status": "enable",
                "strict_guest": "disable",
                "trace_auth_no_rsp": "disable",
                "unknown_http_version": "reject"
            }
        }
    },
    "meta": {
        "build": 1190,
        "http_method": "PUT",
        "http_status": 200,
        "name": "explicit",
        "old_revision": "4a01d4d8969443cd9406d8920856c2ef",
        "path": "web-proxy",
        "revision": "18a1aa6bb651a9b2a26bbc6d5cfdab0d",
        "revision_changed": true,
        "serial": "FG200E4Q17914080",
        "status": "success",
        "vdom": "root",
        "version": "v6.2.7"
    }
}

What the firewall actually sees is the following when debugging:

firewall (root) # 0: config vdom
0: edit root
0: config web-proxy explicit
0: unset pac-file-url
0: unset pac-file-data
0: set pac-file-data "PROXY 4.5.6.7:8080; PROXY 7.8.9.10:8080"
0: end
0: end

Despite the debug of ansible showing it sent the whole file it still shows up sliced at the actual firewall. Is there a specific way I have to enter the contents of the PAC file so this does not happen?

Thanks

JieX19 commented 3 years ago

Hi @rrobles12

Please install the latest version ansible-galaxy collection install fortinet.fortios:2.0.2 to use the module 'upload.webproxy.pacfile' in fortios_monitor and then run the task fortios_web_proxy_explicit.

When executing the task fortios_web_proxy_explicit, the first step would be uploading the pac file, it's not just a simple string as in CLI.

You can open an issue at https://github.com/fortinet-ansible-dev/ansible-galaxy-fortios-collection/issues is you have any questions.

Thanks!