From 8f1a2789a930bff3eaba39964d58cb894a455985 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Tue, 21 Apr 2026 13:51:10 -0700 Subject: [PATCH] scripts/discover-fortigate: validate by IP presence, not error-string match MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug: FortiOS 7.x ana-gw replied to 'execute dhcp lease-list all' with "Interface name 'all' does not exist." — my error-pattern grep didn't include that phrase, so the script thought it got valid data, bailed out of the retry loop, and handed empty/garbage to the parser, which produced zero output with no error. Fix: try the plain `execute dhcp lease-list` form first (works across versions we've seen), fall back to the `all` variant only if the plain form returns nothing. Validate acceptance by grepping for an actual IP-shaped token — the parser needs IPs anyway, so "got real data" and "has at least one IP" are equivalent conditions. --- scripts/discover-fortigate.sh | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/scripts/discover-fortigate.sh b/scripts/discover-fortigate.sh index 982dd54..908103a 100755 --- a/scripts/discover-fortigate.sh +++ b/scripts/discover-fortigate.sh @@ -47,9 +47,17 @@ USER="${FORTIGATE_SSH_USER:-admin}" # signal when the command returns empty. Let them flow to the caller. raw="" -for cmd in 'execute dhcp lease-list all' 'execute dhcp lease-list'; do - raw=$(ssh -o StrictHostKeyChecking=accept-new "$TARGET" "$cmd" || true) - if [ -n "$raw" ] && ! grep -qiE 'unknown action|parse error|command fail' <<<"$raw"; then +# Try the plain form first — works across FortiOS versions. `all` is +# an interface name on some devices but errors with "Interface name +# 'all' does not exist" on others (including 7.x ana-gw). Fall back +# to `all` only if the plain form returns no lease rows. +for cmd in 'execute dhcp lease-list' 'execute dhcp lease-list all'; do + out=$(ssh -o StrictHostKeyChecking=accept-new "$TARGET" "$cmd" || true) + # Accept only output that actually contains at least one IP-like token. + # This filters out "Interface name X does not exist" and similar noise + # without needing to enumerate every FortiOS error phrase. + if grep -qE '([0-9]+\.){3}[0-9]+' <<<"$out"; then + raw="$out" break fi done