Plugin(network::paloalto::ssh) - Mode(ipsec): Fail parsing XML with PAN-OS 12.x

[tizianosartori]

Bug report

Quick description

The centreon_paloalto_ssh.pl plugin fails to parse valid XML output when monitoring Palo Alto firewalls running PAN‑OS 12.x, due to additional security messages printed in the SSH CLI stdout.

How to reproduce

• Environment:

  Linux centreon 5.15.x #1 SMP x86_64 GNU/Linux
  Rocky Linux release 9.x
  

• Version of the plugin:
  centreon-plugins package including centreon_paloalto_ssh.pl
  (issue reproducible with current packaged version and recent repository clones).

• Information about the monitored resource:
  Palo Alto Networks firewall running PAN‑OS 12.x
  Monitoring performed via SSH backend (libssh).

• Command line:

  /usr/lib/centreon/plugins/centreon_paloalto_ssh.pl \
    --mode ipsec \
    --hostname 192.168.1.1 \
    --ssh-username=monitoring \
    --ssh-password=****** \
    --ssh-backend=libssh \
    --filter-name tunnel05 \
    --critical-ipsec-total 1:

Expected result

The plugin should correctly parse the XML response returned by the Palo Alto firewall and report the IPsec tunnel status (OK/WARNING/CRITICAL) as expected.

Actual result

The plugin exits with:

UNKNOWN: Cannot find xml response

even though the firewall returns a valid XML response.

With PAN‑OS 12.x, the SSH CLI output includes additional security messages such as:

Number of failed attempts since last successful login: 0

These messages are printed before or after the <response>...</response> XML block, causing the plugin to fail XML detection and parsing.
``

[tizianosartori]

Description

This pull request improves the robustness of centreon_paloalto_ssh.pl when monitoring Palo Alto Networks firewalls running PAN‑OS 12.x.

Starting with PAN‑OS 11 and confirmed in PAN‑OS 12, additional security-related messages (e.g. login accounting information) can be printed in the SSH CLI stdout before or after the XML payload.
As a result, the plugin may fail to detect the <response>...</response> block and exit with UNKNOWN: Cannot find xml response, even though a valid XML response is returned by the device.

---

Changes

• Sanitize the SSH command output before XML parsing
• Explicitly extract the <response>...</response> XML block from stdout
• Pass only the extracted XML to the existing parsing logic

This change does not alter the parsing logic itself and only affects how the XML payload is isolated.

---

Benefits

• Restores compatibility with PAN‑OS 12.x
• Backward-compatible with PAN‑OS ≤ 11
• No impact on performance or security
• Prevents false UNKNOWN states caused by non-XML CLI output

---

Context

Palo Alto Networks does not provide a supported way to disable these security messages in the SSH CLI.
Therefore, defensive parsing on the plugin side is required and aligns with common monitoring best practices.

---

Testing

• Tested against Palo Alto firewall running PAN‑OS 12.x (SSH backend: libssh)
• Verified correct behavior for IPsec tunnel monitoring (--mode ipsec)
• No regression observed on earlier PAN‑OS versions

[tizianosartori]

This is the output with --debug flag:

UNKNOWN: Cannot find xml response

<response status="success"><result>
  <entry>
    <gwid>1</gwid>
    <name>xx-GTW06</name>
    <role>Init</role>
    <mode>Main</mode>
    <algo>PSK/DH2/3DES/SHA1</algo>
    <created>Jan.22 14:44:53</created>
    <expires>Jan.23 14:44:53</expires>
  </entry>
  <entry>
    <gwid>2</gwid>
    <name>xx-GTW05</name>
    <role>Resp</role>
    <mode>Main</mode>
    <algo>PSK/DH2/3DES/SHA1</algo>
    <created>Jan.22 14:45:49</created>
    <expires>Jan.23 14:45:49</expires>
  </entry>
  <entry>
    <gwid>3</gwid>
    <name>tunnel05</name>
    <role>Resp</role>
    <mode>Main</mode>
    <algo>PSK/DH2/3DES/SHA1</algo>
    <created>Jan.22 14:45:49</created>
    <expires>Jan.23 14:45:49</expires>
  </entry>
  <entry>
    <gwid>4</gwid>
    <name>yy-GTW06</name>
    <role>Init</role>
    <mode>Main</mode>
    <algo>PSK/DH2/3DES/SHA1</algo>
    <created>Jan.22 14:44:55</created>
    <expires>Jan.23 14:44:55</expires>
  </entry>
  <entry>
    <gwid>6</gwid>
    <name>HYYY</name>
    <role>Init</role>
    <mode>IKEv2</mode>
    <algo>PSK/DH2/AES128-CBC/SHA1</algo>
    <created>Jan.23 10:48:39</created>
    <expires>Jan.23 18:48:39</expires>
  </entry>
  <entry>
    <gwid>7</gwid>
    <name>ZZZTUNNEL1</name>
    <role>Init</role>
    <mode>IKEv2</mode>
    <algo>PSK/DH21/AES256-CBC/SHA512</algo>
    <created>Jan.23 04:18:48</created>
    <expires>Jan.23 12:18:48</expires>
  </entry>
</result></response>



Number of failed attempts since last successful login: 0




command response:
<response status="success"><result>
  <entry>
    <gwid>1</gwid>
    <name>xx-GTW06</name>
    <role>Init</role>
    <mode>Main</mode>
    <algo>PSK/DH2/3DES/SHA1</algo>
    <created>Jan.22 14:44:53</created>
    <expires>Jan.23 14:44:53</expires>
  </entry>
  <entry>
    <gwid>2</gwid>
    <name>xx-GTW05</name>
    <role>Resp</role>
    <mode>Main</mode>
    <algo>PSK/DH2/3DES/SHA1</algo>
    <created>Jan.22 14:45:49</created>
    <expires>Jan.23 14:45:49</expires>
  </entry>
  <entry>
    <gwid>3</gwid>
    <name>tunnel05</name>
    <role>Resp</role>
    <mode>Main</mode>
    <algo>PSK/DH2/3DES/SHA1</algo>
    <created>Jan.22 14:45:49</created>
    <expires>Jan.23 14:45:49</expires>
  </entry>
  <entry>
    <gwid>4</gwid>
    <name>yy-GTW06</name>
    <role>Init</role>
    <mode>Main</mode>
    <algo>PSK/DH2/3DES/SHA1</algo>
    <created>Jan.22 14:44:55</created>
    <expires>Jan.23 14:44:55</expires>
  </entry>
  <entry>
    <gwid>6</gwid>
    <name>HYYY</name>
    <role>Init</role>
    <mode>IKEv2</mode>
    <algo>PSK/DH2/AES128-CBC/SHA1</algo>
    <created>Jan.23 10:48:39</created>
    <expires>Jan.23 18:48:39</expires>
  </entry>
  <entry>
    <gwid>7</gwid>
    <name>ZZZTUNNEL1</name>
    <role>Init</role>
    <mode>IKEv2</mode>
    <algo>PSK/DH21/AES256-CBC/SHA512</algo>
    <created>Jan.23 04:18:48</created>
    <expires>Jan.23 12:18:48</expires>
  </entry>
</result></response>



Number of failed attempts since last successful login: 0



skipping  'xx-GTW06': no matching filter.
skipping  'xx-GTW05': no matching filter.
skipping  'yy-GTW06': no matching filter.
skipping  'HYYY': no matching filter.
skipping  'ZZZTUNNEL1': no matching filter.

Invalid user. Please login using a valid account.

command response:
Invalid user. Please login using a valid account.

[lucie-tirand]

Hello :)

Thank you for your feedback and your suggested solution. We have created a ticket for your issue in our backlog and will keep you updated.

[tizianosartori]

@lucie-tirand FYI i switch from libssh to sshcli ssh-backend