Skip to content

Conversation

@joewesch
Copy link
Collaborator

Closes: #780

This PR changes the logic a bit when dealing with Palo Alto banners that start on the same line as login-banner. The existing test only tests if they start with an empty line:

          login-banner "
************************************************************************

But a banner isn't required to have a blank line on the first line.

          login-banner "####################################################
WARNING TO UNAUTHORIZED USERS:

@itdependsnetworks
Copy link
Contributor

Can you add a ConfigLine output of this as well? Want to make sure it renders correctly. Otherwise, looks good :)

line = "set " + line
cfg_value.append(line.strip())
elif line.endswith('login-banner "') or line.endswith('content "'):
elif 'login-banner "' in line or line.endswith('content "'):
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is " the only allowed delimeter?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems that way, yes. Because it's technically saved in XML it is just using double quotes here for this format.

      <login-banner admin="ntc" dirtyId="23" time="2026/01/27 16:15:46">####################################################
WARNING TO UNAUTHORIZED USERS:
This system is for use by authorized users only.
Any individual using this system, by such use,
acknowledges and consents to the right of the
company to monitor, access, use, and disclose any
information generated, received, or stored on the
systems, and waives any right of privacy or
expectation of privacy on the part of that
individual in connection with his or her use of
this system. Unauthorized and/or improper use of
this system, as delineated by corporate policies,
is not tolerated and the company may take formal
action against such individuals.
####################################################
</login-banner>

You can't even escape the double quotes:

ntc@pa-ntc# set deviceconfig system login-banner "test"

[edit]
ntc@pa-ntc# set deviceconfig system login-banner "test"test"

Invalid syntax.
[edit]
ntc@pa-ntc# set deviceconfig system login-banner "test\"test"

Invalid syntax.
[edit]
ntc@pa-ntc#

config_line="set deviceconfig system ntp-servers primary-ntp-server authentication-type none", parents=()
),
ConfigLine(
config_line='set deviceconfig system login-banner "####################################################',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't all of this be in a single config_line? I think that is how we do banners.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No. The line that starts the banner (e.g., banner motd or banner login) is one line and the whole banner is another line that has a parent of the banner start. It just so happens that part of this banner is on the first line.

Arista banner for example:

ConfigLine(config_line="banner login", parents=()),
ConfigLine(
config_line="********************************************************************\n* This system is the property of Allied Widget Co. *\n* UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED *\n* *\n* You must have explicit, authorized permission to access or *\n* configure this device. Unauthorized attempts and actions to *\n* access or use this system may result in civil and/or criminal *\n* penalties. *\n* *\n* All activities performed on this deviceare logged and monitored. *\n********************************************************************\nEOF",
parents=("banner login",),
),

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The config has it on the same line, so having the parent be just set deviceconfig system login-banner would not be exact.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

paloalto_panos_brace_to_set does not handle banner correctly

4 participants