panos_op module fails with "UnboundLocalError" when interface has a `/` in its name about ansible-pan HOT 6 CLOSED

I'm seeing the same issue trying to pass the following delete debug-log mp-log file *.1 the asterisk isn't being seen as just text but instead being interpreted.

Thank's to someone else's efforts:

So a little bit of context on this issue if you wanted to add it to your comments. The root on this issue is in pan-python. Specifically https://github.com/kevinsteves/pan-python/blob/master/lib/pan/xapi.py#L586

From your command, it is generating '<delete><debug-log><mp-log><file><*.1></*.1></file></mp-log></debug-log></delete>' which is invalid of course. It would need to generate '<delete><debug-log><mp-log><file>"*.1"</file></mp-log></debug-log></delete>'

from ansible-pan.

Hi zer0nimbus,

I am also facing this issue in "panos_op" module.

using command is "test security-policy-match source 10.0.0.111 destination 2.2.2.2 destination-port 443 protocol 6"

Error message:

UnboundLocalError: local variable 'xml_output' referenced before assignment

fatal: [10.88.10.104]: FAILED! => {
"changed": false,
"module_stderr": "Traceback (most recent call last):\n File "/tmp/ansible_NwWQek/ansible_module_panos_op.py", line 159, in \n main()\n File "/tmp/ansible_NwWQek/ansible_module_panos_op.py", line 152, in main\n obj_dict = xmltodict.parse(xml_output)\nUnboundLocalError: local variable 'xml_output' referenced before assignment\n",
"module_stdout": "",
"msg": "MODULE FAILURE",
"rc": 1
}

I try to understand your explanation change in code, but i am not understand what you change in code.
Could you help me to explain again.

Really appreciate if you help on this issue.

from ansible-pan.

arkaraung1993 -

I have not yet been able to fix this issue. Sorry if I did not make that clear in my initial post.

from ansible-pan.

Is there a fix for this yet?

from ansible-pan.

@zer0nimbus
As it turns out, depending on the command you're attempting to run, you could get one of a few different errors from PAN-OS. It seems like it's best to just always try to run the command a second time, because in your case of trying to run show interface ethernet1/12, running it the second way would actually work. So I'm going to update the code to do that.

@arkaraung1993
This module will not in its current form work for that particular command. The op command expects XML as its input, and in this case, the current code would try the following:

<test><security-policy-match><source><10.0.0.111><destination><2.2.2.2><destination-port><443><protocol><6></6></protocol></443></destination-port></2.2.2.2></destination></10.0.0.111></source></security-policy-match></test>

...and when that doesn't work, it will try this:

<test><security-policy-match><source><10.0.0.111><destination><2.2.2.2><destination-port><443><protocol>6</protocol></443></destination-port></2.2.2.2></destination></10.0.0.111></source></security-policy-match></test>

..But what it actually needs to execute is this:

<test><security-policy-match><source>10.0.0.111</source><destination>2.2.2.2</destination><destination-port>443</destination-port><protocol>6</protocol></security-policy-match></test>

I'll open a PR which should solve all of these issues.

from ansible-pan.

This updated panos_op will allow you to give the command as XML if it's more complicated than just a single "back-off", as is the "test security-policy-match" use case above. So you can specify the entire XML, then tell panos_op that it's XML already, so there's no need to try and fiddle with it.

from ansible-pan.