aaron.axvig/firewallissues
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

More processing tests

Browse Source
This commit is contained in:
aaron.axvig
2026-03-16 21:33:05 -05:00
parent a01e733084
commit f1e49c5830
12 changed files with 420 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/fixtures/PAA-25.6.2-known/meta.json
Vendored
+3
View File
@@ -0,0 +1,3 @@
{
"description": "Tests parsing of DITA-styled inline controls with bold and menucascade formatting"
}
test/fixtures/PAA-25.7.1-known/expected.md
Vendored
+25
View File
@@ -0,0 +1,25 @@
---
type: Known
product: Prisma Access Agent
version: 25.7.1
---
## PANG-10158
When attempting to install Prisma Access Agent on an Ubuntu 24 virtual machine (VM) via SSH or RDP, the installation fails with an error indicating that the user environment was not preserved, even when the `sudo -E` option is used.
## PANG-10342
An issue exists where the Prisma Access Agent on Debian Linux experiences intermittent SSL tunnel disconnection and automatic reconnection due to health keepalive timeouts. When using the agent with an SSL tunnel configuration on Debian, the tunnel repeatedly disconnects and reconnects without any manual intervention from the user. This behavior disrupts the stability of the connection, potentially affecting user productivity and network reliability.
## PANG-10309
An issue exists where the Prisma Access Agent on Linux fails to perform HIP updates when using the PACLI command. When administrators attempt to execute the `pacli hip update` command while the agent is connected, the operation fails because HIP updates are not supported yet.
## PANG-10271
When upgrading Prisma Access Agent from version 25.7.1.1 to 25.7.1.2 on a Debian ARM system, a crash file is automatically generated upon launching or using Prisma Access Agent.
## PANG-10019
After installing Prisma Access Agent 25.6.0.10 on an Arch Linux x86 system, a coredump occurs when attempting to connect to an endpoint management (EPM) system and a gateway.
test/fixtures/PAA-25.7.1-known/input.html
Vendored
+57
View File
@@ -0,0 +1,57 @@
<table class="table colsep rowsep table-striped">
<colgroup><col style="width: 33.003300330033%"><col style="width: 66.996699669967%"></colgroup>
<thead class="thead">
<tr class="row"><th class="entry">Issue ID</th><th class="entry">Description</th></tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p">PANG-10158</div>
</td>
<td class="entry relcol">
<div class="p">When attempting to install Prisma Access Agent on an Ubuntu 24
virtual machine (VM) via SSH or RDP, the installation fails with an
error indicating that the user environment was not preserved, even
when the <span class="ph userinput">sudo -E</span> option is used.</div>
</td>
</tr>
<tr class="row">
<td class="entry">PANG-10342</td>
<td class="entry relcol">An issue exists where the Prisma Access Agent on Debian Linux
experiences intermittent SSL tunnel disconnection and automatic
reconnection due to health keepalive timeouts. When using the agent with
an SSL tunnel configuration on Debian, the tunnel repeatedly disconnects
and reconnects without any manual intervention from the user. This
behavior disrupts the stability of the connection, potentially affecting
user productivity and network reliability.</td>
</tr>
<tr class="row">
<td class="entry">PANG-10309</td>
<td class="entry relcol">An issue exists where the Prisma Access Agent on Linux fails to
perform HIP updates when using the PACLI command. When administrators
attempt to execute the <span class="ph userinput">pacli hip update</span> command
while the agent is connected, the operation fails because HIP updates
are not supported yet.</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-10271</div>
</td>
<td class="entry relcol">
<div class="p">When upgrading Prisma Access Agent from version 25.7.1.1 to 25.7.1.2
on a Debian ARM system, a crash file is automatically generated upon
launching or using Prisma Access Agent.</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-10019</div>
</td>
<td class="entry relcol">
<div class="p">After installing Prisma Access Agent 25.6.0.10 on an Arch Linux x86
system, a coredump occurs when attempting to connect to an endpoint
management (EPM) system and a gateway.</div>
</td>
</tr>
</tbody>
</table>
test/fixtures/PAA-25.7.1-known/meta.json
Vendored
+3
View File
@@ -0,0 +1,3 @@
{
"description": "Tests handling of multiple issues with mixed formatting: some issue IDs wrapped in divs, some inline; `userinput` spans should render as backticks"
}
test/fixtures/PAA-26.1-Linux-known/expected.md
Vendored
+45
View File
@@ -0,0 +1,45 @@
---
type: Known
product: Prisma Access Agent
version: 26.1
---
## PANG-11201
```resolved
Resolved in Prisma Access Agent 26.1.1
```
On Prisma Access Agents for Linux, when NetworkManager is configured not to manage the tunnel interface, the Prisma Access Agent connection profile becomes stuck in an "activating" state, resulting in a tunnel connect and disconnect loop that prevents successful establishment of the tunnel.
## PANG-11153
```resolved
Resolved in Prisma Access Agent 26.1.1
```
On Linux, the Prisma Access Agent may experience recurring PASrv process crashes approximately every 20 seconds due to abnormal termination, causing the agent to become unresponsive and preventing log collection. This issue occurs primarily during agent upgrade operations.
## PANG-10947
When Prisma Access Agent is configured in on-demand mode on Arch Linux and the network connection is interrupted and then restored, the agent fails to automatically reconnect to the gateway. As a result, the agent remains in a disconnected state.
## PANG-10865
On Prisma Access Agent for Linux systems, the Prisma Access Agent user interface exhibits minor cosmetic and usability inconsistencies. The Location list lacks a line separator between entries and is not sorted alphabetically, with the exception of the "Best Location" option.
## PANG-10801
During a Host Information Profile (HIP) check on Prisma Access Agent for Linux, the system incorrectly validates certificates based solely on the issuer's Common Name (CN). This results in expired or revoked certificates being considered valid if their issuer's CN matches the configured criteria, potentially allowing non-compliant endpoints to pass HIP checks.
## PANG-10668
After upgrading to Prisma Access Agent version 26.1.0.25 on Arch Linux with KDE Plasma desktop environments, the settings page in the Prisma Access Agent app might appear partially blank when the operating system's dark theme is enabled. This prevents the display of relevant information on the settings page.
## PANG-9501
When using Prisma Access Agent on a system running Fedora 42 (GNOME), running the `pacli traffic log <n>` command does not show the log details.
## PANG-9196
When Prisma Access Agent is installed on a Linux virtual machine (VM) running on an ESXi host, and the VM undergoes network changes (such as connecting or disconnecting from gateways) or experiences a sleep/wake cycle, the entire VM and the ESXi host might become unresponsive. Access to the ESXi host is lost, and the system hangs for approximately 5 minutes before access is regained.
test/fixtures/PAA-26.1-Linux-known/input.html
Vendored
+108
View File
@@ -0,0 +1,108 @@
<table class="table colsep rowsep table-striped">
<colgroup><col style="width: 33.003300330033%"><col style="width: 66.996699669967%"></colgroup>
<thead class="thead" data-sticky-top="62" style="top: 62px;">
<tr class="row"><th class="entry">Issue ID</th><th class="entry">Description</th></tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p">PANG-11201</div>
<div class="p"><b class="ph b">Resolved in Prisma Access Agent 26.1.1</b></div>
</td>
<td class="entry relcol">
<div class="p">On Prisma Access Agents for Linux, when NetworkManager is
configured not to manage the tunnel interface, the Prisma Access
Agent connection profile becomes stuck in an "activating" state,
resulting in a tunnel connect and disconnect loop that prevents
successful establishment of the tunnel.</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-11153</div>
<div class="p"><b class="ph b">Resolved in Prisma Access Agent 26.1.1</b></div>
</td>
<td class="entry relcol">
<div class="p">On Linux, the Prisma Access Agent may experience recurring PASrv
process crashes approximately every 20 seconds due to abnormal
termination, causing the agent to become unresponsive and
preventing log collection. This issue occurs primarily during
agent upgrade operations.</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-10947</div>
</td>
<td class="entry relcol">
<div class="p">When Prisma Access Agent is configured in on-demand mode on Arch
Linux and the network connection is interrupted and then
restored, the agent fails to automatically reconnect to the
gateway. As a result, the agent remains in a disconnected
state.</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-10865</div>
</td>
<td class="entry relcol">
<div class="p">On Prisma Access Agent for Linux systems, the Prisma Access Agent
user interface exhibits minor cosmetic and usability
inconsistencies. The Location list lacks a line separator
between entries and is not sorted alphabetically, with the
exception of the "Best Location" option.</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-10801</div>
</td>
<td class="entry relcol">
<div class="p">During a Host Information Profile (HIP) check on Prisma Access
Agent for Linux, the system incorrectly validates certificates
based solely on the issuer's Common Name (CN). This results in
expired or revoked certificates being considered valid if their
issuer's CN matches the configured criteria, potentially
allowing non-compliant endpoints to pass HIP checks.</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-10668</div>
</td>
<td class="entry relcol">
<div class="p">After upgrading to Prisma Access Agent version 26.1.0.25 on Arch
Linux with KDE Plasma desktop environments, the settings page in
the Prisma Access Agent app might appear partially blank when
the operating system's dark theme is enabled. This prevents the
display of relevant information on the settings page.</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-9501</div>
</td>
<td class="entry relcol">
<div class="p">When using Prisma Access Agent on a system running Fedora 42
(GNOME), running the <span class="ph userinput">pacli traffic log
&lt;n&gt;</span> command does not show the log
details.</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PANG-9196</div>
</td>
<td class="entry relcol">
<div class="p">When Prisma Access Agent is installed on a Linux virtual machine
(VM) running on an ESXi host, and the VM undergoes network
changes (such as connecting or disconnecting from gateways) or
experiences a sleep/wake cycle, the entire VM and the ESXi host
might become unresponsive. Access to the ESXi host is lost, and
the system hangs for approximately 5 minutes before access is
regained.</div>
</td>
</tr>
</tbody>
</table>
test/fixtures/PAA-26.1-Linux-known/meta.json
Vendored
+3
View File
@@ -0,0 +1,3 @@
{
"description": "Resolved text in bold divs should go to resolved block, not caveat; tests mixed resolved/unresolved and `userinput` with angle brackets"
}
test/fixtures/PAA-26.1.1-known/expected.md
Vendored
+41
View File
@@ -0,0 +1,41 @@
---
type: Known
product: Prisma Access Agent
version: 26.1.1
---
## PANG-11346
When Prisma Access Agent is connected on a Linux host system, Docker containers running on that host are unable to perform network communication using `curl` commands. Attempts to send `curl` traffic from inside a container result in a "Network is unreachable" error, even though the host system itself retains full network connectivity.
## PANG-11254
```resolved
Fixed in Prisma Access Agent 26.1.2 (PANG-11311)
```
When the Dynamic Privilege Access-enabled Prisma Access Agent is in the notify-before-re-authentication period displaying a countdown timer banner and **Aggressive Authentication** is not enabled, switching projects in the Prisma Access Agent app triggers re-authentication and updates the User Refresh Token expiry time. However, the countdown timer banner continues to display the previous timer value until it expires, despite the successful re-authentication. Once the original timer completes, the banner disappears.
## PANG-11199
For Panorama Managed NGFW deployments, Prisma Access Agent ignores the IPv6 address field in external gateway configurations received from Endpoint Manager get-config responses. When an IPv6 address is configured for an external gateway in the Edit External Gateway window in Strata Cloud Manager, Prisma Access Agent fails to process it. For dual-stack gateways configured with both IPv4 and IPv6 addresses, only the IPv4 address is recognized and the IPv6 address is completely ignored. For IPv6-only gateways, Prisma Access Agent throws an invalid configuration error and the gateway cannot be established.
**Workaround**: Configure the gateway using a Fully Qualified Domain Name (FQDN) instead of an IPv6 address.
## PANG-11178
When Prisma Access Agent is configured with portal authentication and the **Save User Credentials** option disabled, and the user clicks on the re-authentication banner in the agent app when the session is about to expire, an "Authentication Failed" error notification is displayed instead of prompting the user to enter their credentials. The user is not given the opportunity to re-authenticate as expected.
## PANG-11141
When Prisma Access Agent is configured with client certificate authentication or portal authentication, the User Refresh Token does not automatically refresh at the end of its expiry period. The agent fails to attempt token renewal, which can result in authentication expiration and loss of user access once the User Refresh Token expires.
## PANG-11103
When Prisma Access agent is actively connected to a gateway and the IPv6 pool is disabled on the tenant, the agent retains a stale IPv6 tunnel IP address. This stale IP persists on the specific gateway that was connected during the configuration change, even after the agent signs out and signs back in. The gateway address and IPv4 tunnel IP correctly update to reflect the new configuration, but the IPv6 tunnel field incorrectly displays the old IPv6 pool IP instead of "N/A". Gateways that were not actively connected during the configuration change correctly show no IPv6 tunnel IP.
Users may incorrectly believe they still have IPv6 connectivity when they do not. This stale data complicates troubleshooting and causes automated tests to receive incorrect state information.
## PANG-10925
When a device with Prisma Access Agent configured for Dynamic Privilege Access wakes up from sleep mode, the agent reconnects without enforcing re-authentication, even when **Aggressive Authentication** is enabled. The agent establishes connectivity without requiring the user to provide credentials again, bypassing the expected authentication enforcement.
test/fixtures/PAA-26.1.1-known/input.html
Vendored
+100
View File
@@ -0,0 +1,100 @@
<table class="table colsep rowsep table-striped">
<colgroup><col style="width: 33.003300330033%"><col style="width: 66.996699669967%"></colgroup>
<thead class="thead">
<tr class="row"><th class="entry">Issue ID</th><th class="entry">Description</th></tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">PANG-11346</td>
<td class="entry relcol">When Prisma Access Agent is connected on a Linux host system, Docker
containers running on that host are unable to perform network
communication using <span class="ph userinput">curl</span> commands. Attempts to
send <span class="ph userinput">curl</span> traffic from inside a container result
in a "Network is unreachable" error, even though the host system itself
retains full network connectivity.</td>
</tr>
<tr class="row">
<td class="entry">PANG-11254<div class="p"><b class="ph b">Fixed in Prisma Access Agent 26.1.2
(PANG-11311)</b></div></td>
<td class="entry relcol">
<div class="p">When the Dynamic Privilege Access-enabled Prisma Access Agent is in
the notify-before-re-authentication period displaying a countdown
timer banner and <span class="ph uicontrol">Aggressive Authentication</span> is
not enabled, switching projects in the Prisma Access Agent app
triggers re-authentication and updates the User Refresh Token expiry
time. However, the countdown timer banner continues to display the
previous timer value until it expires, despite the successful
re-authentication. Once the original timer completes, the banner
disappears.</div>
</td>
</tr>
<tr class="row">
<td class="entry">PANG-11199</td>
<td class="entry relcol">
<div class="p">For Panorama Managed NGFW deployments, Prisma Access Agent ignores
the IPv6 address field in external gateway configurations received
from Endpoint Manager get-config responses. When an IPv6 address is
configured for an external gateway in the Edit External Gateway
window in Strata Cloud Manager, Prisma Access Agent fails to process
it. For dual-stack gateways configured with both IPv4 and IPv6
addresses, only the IPv4 address is recognized and the IPv6 address
is completely ignored. For IPv6-only gateways, Prisma Access Agent
throws an invalid configuration error and the gateway cannot be
established.</div>
<div class="p"><b class="ph b">Workaround</b>: Configure the gateway using a Fully Qualified
Domain Name (FQDN) instead of an IPv6 address.</div>
</td>
</tr>
<tr class="row">
<td class="entry">PANG-11178</td>
<td class="entry relcol">
<div class="p">When Prisma Access Agent is configured with portal authentication and
the <span class="ph uicontrol">Save User Credentials</span> option disabled,
and the user clicks on the re-authentication banner in the agent app
when the session is about to expire, an "Authentication Failed"
error notification is displayed instead of prompting the user to
enter their credentials. The user is not given the opportunity to
re-authenticate as expected.</div>
</td>
</tr>
<tr class="row">
<td class="entry">PANG-11141</td>
<td class="entry relcol">
<div class="p">When Prisma Access Agent is configured with client certificate
authentication or portal authentication, the User Refresh Token does
not automatically refresh at the end of its expiry period. The agent
fails to attempt token renewal, which can result in authentication
expiration and loss of user access once the User Refresh Token
expires.</div>
</td>
</tr>
<tr class="row">
<td class="entry">PANG-11103</td>
<td class="entry relcol">
<div class="p">When Prisma Access agent is actively connected to a gateway and the
IPv6 pool is disabled on the tenant, the agent retains a stale IPv6
tunnel IP address. This stale IP persists on the specific gateway
that was connected during the configuration change, even after the
agent signs out and signs back in. The gateway address and IPv4
tunnel IP correctly update to reflect the new configuration, but the
IPv6 tunnel field incorrectly displays the old IPv6 pool IP instead
of "N/A". Gateways that were not actively connected during the
configuration change correctly show no IPv6 tunnel IP.</div>
<div class="p">Users may incorrectly believe they still have IPv6 connectivity when
they do not. This stale data complicates troubleshooting and causes
automated tests to receive incorrect state information.</div>
</td>
</tr>
<tr class="row">
<td class="entry">PANG-10925</td>
<td class="entry relcol">
<div class="p">When a device with Prisma Access Agent configured for Dynamic
Privilege Access wakes up from sleep mode, the agent reconnects
without enforcing re-authentication, even when <span class="ph uicontrol">Aggressive
Authentication</span> is enabled. The agent establishes
connectivity without requiring the user to provide credentials
again, bypassing the expected authentication enforcement.</div>
</td>
</tr>
</tbody>
</table>
test/fixtures/PAA-26.1.1-known/meta.json
Vendored
+3
View File
@@ -0,0 +1,3 @@
{
"description": "Tests 'Fixed in' variant of resolved status; tests 'Workaround' text rendered as bold in description; tests multi-paragraph descriptions"
}
test/process-parser.test.mjs
+13 -1
View File
@@ -24,8 +24,20 @@ fixtures.forEach(fixtureId => {
const fixturePath = join(fixturesDir, fixtureId);
const inputPath = join(fixturePath, 'input.html');
const expectedPath = join(fixturePath, 'expected.md');
const metaPath = join(fixturePath, 'meta.json');
test(`parses ${fixtureId} correctly`, () => {
let description = '';
try {
const metaJson = readFileSync(metaPath, 'utf-8');
const meta = JSON.parse(metaJson);
description = meta.description || '';
} catch {
// meta.json is optional
}
const testName = description ? `${fixtureId} — ${description}` : fixtureId;
test(`parses ${testName}`, () => {
const inputHtml = readFileSync(inputPath, 'utf-8');
const expectedMarkdown = readFileSync(expectedPath, 'utf-8');
web/js/process.js
+19 -3
View File
@@ -16,7 +16,7 @@ let activeDownloadUrl = null;
const PROCESS_FORM_STATE_KEY = 'bugmedley.process.formState.v1';
const ISSUE_ID_PATTERN = /\b((?:[A-Z]{2,6}|WF500)-\d{4,8})\b/i;
const BLOCK_CONTAINER_TAGS = new Set(['ARTICLE', 'ASIDE', 'BLOCKQUOTE', 'DIV', 'P', 'PRE', 'SECTION']);
const RESOLVED_LINE_PATTERN = /^resolved\s+in\b/i;
const RESOLVED_LINE_PATTERN = /^(?:resolved|fixed)\s+in\b/i;
const TEXT_NODE = 3;
const ELEMENT_NODE = 1;
@@ -136,7 +136,10 @@ export function parseIssuesFromHtmlTable(htmlText) {
const leftCellTrailingText = normalizeWhitespace(
leftCellText.replace(issueIdMatch[0], '').replace(/^[-:;,.\s]+/, '')
);
const resolved = RESOLVED_LINE_PATTERN.test(leftCellTrailingText) ? leftCellTrailingText : '';
// Strip markdown formatting to check if this is resolved text
const plainTrailingText = stripMarkdownFormatting(leftCellTrailingText);
const resolved = RESOLVED_LINE_PATTERN.test(plainTrailingText) ? plainTrailingText : '';
const description = rightCellText;
if (!description) {
@@ -147,13 +150,21 @@ export function parseIssuesFromHtmlTable(htmlText) {
id,
description,
resolved,
caveat: issueDetails.caveat || (resolved ? '' : leftCellTrailingText)
caveat: resolved ? '' : leftCellTrailingText
});
});
return issues;
}
function stripMarkdownFormatting(text) {
return String(text || '')
.replace(/\*\*(.*?)\*\*/g, '$1')
.replace(/\*(.*?)\*/g, '$1')
.replace(/`(.*?)`/g, '$1')
.replace(/~~(.*?)~~/g, '$1');
}
function extractIssueDetails(cell) {
const caveatNode = cell.querySelector('tt');
const caveat = caveatNode ? normalizeWhitespace(caveatNode.textContent || '') : '';
@@ -262,6 +273,11 @@ function convertInlineNodeToMarkdown(node) {
return content ? `**${content}**` : '';
}
if (/\buserinput\b/i.test(className)) {
const content = normalizeInlineMarkdown(renderInlineChildren(node));
return content ? `\`${content}\`` : '';
}
const tagName = (node.tagName || '').toUpperCase();
if (tagName === 'BR') {