[rancid] excluding certain lines from diffs without editing @commandtable - fnrancid

[Adam Korab]

Hi,

Using fnrancid.in 2258 2010-10-11 20:49:05Z included with 2.3.6, I'm
polling a FortiGate FGT1000A running FortiOS 3.00.

@commandtable contains only two commands, 'get system status' and
'show full-configuration'. Per the earlier FortiGate discussion, it's
pulling the entire full (default) configuration for the sake of
completeness. The problem comes in when spurious diffs are generated
every hour because the system time, config version, and RSA key
change:

- !System time: Thu Jul 7 02:02:09 2011
+ !System time: Thu Jul 7 03:02:11 2011

- #conf_file_ver=9393629122155995517
+ #conf_file_ver=4523938947618233296

- DEK-Info: DES-EDE3-CBC
- [blah blah private key]
+ DEK-Info: DES-EDE3-CBC
+ [blah blah other private key]

So I figure it should be something along the lines of grep -v "System
time","conf_file_ver" and "DEK-Info" but I don't know how to go about
this. I found Dave LaPorte's post from 2006 in the archives
(http://www.shrubbery.net/pipermail/rancid-discuss/2006-June/001542.html)
but I'd like to make sure those changes would still work considering
they apply to a 5 year old version of control_rancid and I'm using
$RCSSYS = "svn".

Thanks!

--Adam

[john heasley]

Post by Adam Korab
- !System time: Thu Jul 7 02:02:09 2011
+ !System time: Thu Jul 7 03:02:11 2011
- #conf_file_ver=9393629122155995517
+ #conf_file_ver=4523938947618233296

what will become 2.3.7 has filters for these. attached.

Post by Adam Korab
- DEK-Info: DES-EDE3-CBC
- [blah blah private key]
+ DEK-Info: DES-EDE3-CBC
+ [blah blah other private key]

any idea why this would change constantly? i'd have thought that private
keys wouldnt change unless an admin changed them.

Post by Adam Korab
So I figure it should be something along the lines of grep -v "System
time","conf_file_ver" and "DEK-Info" but I don't know how to go about
this. I found Dave LaPorte's post from 2006 in the archives
(http://www.shrubbery.net/pipermail/rancid-discuss/2006-June/001542.html)
but I'd like to make sure those changes would still work considering
they apply to a 5 year old version of control_rancid and I'm using
$RCSSYS = "svn".

they should; just use svn options instead of cvs.

[Adam Korab]

what will become 2.3.7 has filters for these.  attached.

Cool, thanks!

any idea why this would change constantly?  i'd have thought that private
keys wouldnt change unless an admin changed them.

No idea, unless it's used for HA sync and gets constant regenerated or
something.
How would I modify fnlogin.in to also exclude DEK-Info?

--Adam

[Adam Korab]

Post by Adam Korab
How would I modify fnlogin.in to also exclude DEK-Info?

and I meant fnrancid.in here, not fnlogin.in -- just to preemptively
avoid confusion.

--Adam

[Adam Korab]

what will become 2.3.7 has filters for these.  attached.

In other news, dropping this in place over $PREFIX/bin/fnrancid causes
breakage. Did I miss a step here?

Trying to get all of the configs.
exec failed router manufacturer fortigate: No such file or directory
=====================================
Getting missed routers: round 1.
exec failed router manufacturer fortigate: No such file or directory
=====================================
Getting missed routers: round 2.
exec failed router manufacturer fortigate: No such file or directory
=====================================
Getting missed routers: round 3.
exec failed router manufacturer fortigate: No such file or directory
=====================================
Getting missed routers: round 4.
exec failed router manufacturer fortigate: No such file or directory

[john heasley]

Post by Adam Korab

what will become 2.3.7 has filters for these. ?attached.

In other news, dropping this in place over $PREFIX/bin/fnrancid causes
breakage. Did I miss a step here?

you probably didnt replace the interpretter line.

[Krzysztof Zygmunt]

Hi,

- !System time: Thu Jul  7 02:02:09 2011
+ !System time: Thu Jul  7 03:02:11 2011
- #conf_file_ver=9393629122155995517
+ #conf_file_ver=4523938947618233296

what will become 2.3.7 has filters for these.  attached.

Awesome, I've been waiting for that so much. Thanks.

- DEK-Info: DES-EDE3-CBC
- [blah blah private key]
+ DEK-Info: DES-EDE3-CBC
+ [blah blah other private key]

any idea why this would change constantly?  i'd have thought that private
keys wouldnt change unless an admin changed them.

So I figure it should be something along the lines of grep -v "System
time","conf_file_ver" and "DEK-Info" but I don't know how to go about
this.  I found Dave LaPorte's post from 2006 in the archives
(http://www.shrubbery.net/pipermail/rancid-discuss/2006-June/001542.html)
but I'd like to make sure those changes would still work considering
they apply to a 5 year old version of control_rancid and I'm using
$RCSSYS = "svn".

they should; just use svn options instead of cvs.
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

[Gavin McCullagh]

Hi,

Post by Adam Korab
- DEK-Info: DES-EDE3-CBC
- [blah blah private key]
+ DEK-Info: DES-EDE3-CBC
+ [blah blah other private key]

I discovered this problem too and patched fnrancid to ignore the key. I may
have forgotten to post it back to the mailing list. My GetConf is now as
follows:

sub GetConf {
print STDERR " In GetConf: $_" if ($debug);

while (<INPUT>) {
tr/\015//d;
next if /^\s*$/;
last if (/$prompt/);
# spot the start of an RSA private key
$priv_key = 1 if(/^\s*set private-key "-----BEGIN RSA PRIVATE KEY-----/);
# spot the end of an RSA private key
$priv_key = 0 && next if(/^\s*-----END RSA PRIVATE KEY-----"/);
next if($priv_key == 1);

# remove occurrances of conf_file_ver
next if (/^#?conf_file_ver=/);
# filter variabilities between configurations. password encryption
# upon each display of the configuration.
if (/^\s*(set [^\s]*)\s(Enc\s[^\s]+)(.*)/i && $filter_pwds > 0 ) {
ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
next;
}
ProcessHistory("","","","$_");
}
$found_end = 1;
return(1);
}


I asked Fortinet support who said:

------------------------------------------------------------------------------------
Dear Gavin,

Certificate private key will keep changing every time you make a configuration
change. This is because the private key is printed by an OpenSSL function which
uses a new random number as the salt each time the function is called. So there
is no way to keep it unchanged.

It does not mean that the associated certificate is changing.
------------------------------------------------------------------------------------

so I figure it makes sense to just ignore it from rancid. My recollection
is that it changed more often than at each config update, but it took me a
fair bit of time to get this answer, so I figured this would do.

Gavin