<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Noticed that a full config backup of some of our FortiGates have been failing due to a hash-mark (#) present in the configuration itself. FortiGates let you add comments to nearly any objects. The comment field is free-form, best I can tell, and lets you insert
hash-mark characters. For example a service object had this configuration causing the rancid run to fail at the offending line of "set comment":</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
--------------</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>config firewall service custom<br>
</span>
<div> edit "TCP/UDP-4118-4122"<br>
</div>
<div> set proxy disable<br>
</div>
<div> set category ''<br>
</div>
<div> set protocol TCP/UDP/SCTP<br>
</div>
<div> set helper auto<br>
</div>
<div> set check-reset-range default<br>
</div>
<div> set comment "Ticket # 123456"<br>
</div>
<div> set color 1<br>
</div>
<div> set visibility enable<br>
</div>
<div> set iprange 0.0.0.0<br>
</div>
<div> set fqdn ''<br>
</div>
<div> set tcp-portrange 4118-4122<br>
</div>
<div> set udp-portrange 4118-4122<br>
</div>
<div> unset sctp-portrange<br>
</div>
<div> set tcp-halfclose-timer 0<br>
</div>
<div> set tcp-halfopen-timer 0<br>
</div>
<div> set tcp-timewait-timer 0<br>
</div>
<div> set udp-idle-timer 0<br>
</div>
<div> set session-ttl 0<br>
</div>
<div> next<br>
</div>
<span>end</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">--------------</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">After removing all offending characters from the firewall config the rancid-run completed fully and normally.</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I've been playing around with fnrancid (3.8, build 3763) to try to find a way to accommodate this happening again, but with only partial success.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I changed the prompt setting code to the following:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">--------------</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><span># - FortiGate prompts end with either '#' or '$'. Further, they may<br>
</span>
<div># be prepended with a '~' if the hostname is too long. Therefore,<br>
</div>
<div># we need to figure out what our prompt really is.<br>
</div>
<div>if (!defined($prompt)) {<br>
</div>
<div> if ($_ =~ '^(.*) # ') {<br>
</div>
<span> $prompt = "$1 # ";</span></span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">--------------</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 16px;">The above works great when the rancid user has root/super_admin permissions (hash-mark (#) prompt). Adjusting rancid to have non-root permissions with a dollar-sign ($) prompt and tacking on some additional code, rancid fails
due to end of run not found.</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 16px;">--------------</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><span># - FortiGate prompts end with either '#' or '$'. Further, they may<br>
</span>
<div># be prepended with a '~' if the hostname is too long. Therefore,<br>
</div>
<div># we need to figure out what our prompt really is.<br>
</div>
<div>if (!defined($prompt)) {<br>
</div>
<div> if ($_ =~ '^(.*) # ') {<br>
</div>
<div> $prompt = "$1 # ";<br>
</div>
<div> } else {<br>
</div>
<div> if ($_ =~ '^(.*) \$ ') {<br>
</div>
<div> $prompt = "$1 \$ ";<br>
</div>
<div> }<br>
</div>
<div> }<br>
</div>
<span>}</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">--------------</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">I tried some variations and either get the same error (end of run not found) or every config line is pre-pended with #. I even tried explicitly defining the firewall
name inside $prompt against the firewall I am testing to bypass $1 expansion.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">Anyone have ideas why this is failing? I added some debug statements and my regex matches and $prompt is being set as I would expect, but for some reason it's not
matching when rancid runs.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">Doing some testing, when the hostname in the prompt does get truncated, it stays the same regardless of what config level you enter.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">Here is example of setting a 25-character hostname and then entering a few levels of config:</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">--------------</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><span>fortigate-firewall # config system global<br>
</span>
<div>fortigate-firewall (global) # set hostname 1234567890123456789012345<br>
</div>
<div>fortigate-firewall (global) # end<br>
</div>
<div>12345678901234567890~345 #<br>
</div>
<div>12345678901234567890~345 # config firewall service group<br>
</div>
<div>12345678901234567890~345 (group) # edit JD_TEST_GROUP<br>
</div>
<div>12345678901234567890~345 (JD_TEST_GROUP) # set comment "coding is fun"<br>
</div>
<div>12345678901234567890~345 (JD_TEST_GROUP) # end<br>
</div>
<div>12345678901234567890~345 #<br>
</div>
<span></span><span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">--------------</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important">Thanks,</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
-Aaron</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style=" font-size: 16px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
</body>
</html>