Import elements from FIPS enabled device

[jakorsne]

Is there a way to import .enc file to SMC with FIPS enabled via the python api as it requires the password to decrypt the file? It's possible from the Management Client -software, and when the file is imported a separate popup prompts for the password.

The import_elements function in system.py only takes the file as an argument without other parameters as in the export_elements function.

If this feature is not available, is there some kind of workaround that could be used to accomplish it?

[lilianValeroFp]

Hi, we added recently the file_password paremeter for the export_elements operation, but indeed, we need to add now the same parameter for the import_elements operation. It will be available in the next smc-python release 1.0.30 planned for the beginning of Q4

[jakorsne]

Thanks. Is there any way to decrypt the .enc before this feature is released using the password it was made with?

[lilianValeroFp]

If you really want the fix, you can fork the smc-python with:
smc/administration/system.py

def import_elements(self, import_file, import_only_new=False, restoration=True, timeout= None, file_password=None):
        """
        Import elements into SMC. Specify the fully qualified path
        to the import file.
        :param str import_file: system level path to file
        :param bool import_only_new: if true the import will create only new elements
        and ignore all others
        :param bool restoration: if true the import will be in restoration mode
        (E.g. default resolution method for policies is IMPORT instead of RENAME)
        :param int timeout: to specify timeout in minutes we can wait before resolving conflict
        and ignore all others
        :param str file_password: password to decrypt the given xml file (if encrypted)
        :raises: ActionCommandFailed
        :return: None
        """
        params = {
            "import_only_new": import_only_new,
            "restoration": restoration
        }
        if timeout:
            params.update(timeout=timeout)
        if file_password:
            params.update(file_password=file_password)
        import_follower = Task(
            self.make_request(
                method="create",
                resource="import_elements",
                params=params,
                files={"import_file": open(import_file, "rb")}
            )
        )
        in_progress = import_follower.data.in_progress
        progress = import_follower.progress
        while in_progress is True:
            time.sleep(1)
            logger.info("XML import task progress: {}%".format(progress))
            in_progress = import_follower.update_status().data.in_progress
            progress = import_follower.update_status().progress
            succeed = import_follower.update_status().success
            last_message = import_follower.update_status().last_message
        if not succeed:
            logger.error("XML Import task failed: {}".format(last_message))
            raise ActionCommandFailed(last_message)
        logger.info("XML import task succeeded")

[jakorsne]

Thanks for the code snippet. I've merged it with the API code and get this error when running the code:

smc.api.exceptions.ActionCommandFailed: Import failed. Parse error in file exported_xxxxxxxxx

This is stored in the last_message variable and the crash seems to happen in the while loop. The 9 digits after file exported change each time the import is run. The file I'm trying to import is exported with the use of the API and is in format .zip.

[lilianValeroFp]

if you call after the code change:
import_elements(import_file=YOUR_IMPORT_ENC_FILE, file_password=PASSWORD_USED_FOR_EXPORT)
it should work as for the UI
Which SMC version are you using and which SMC API version are your using?

[jakorsne]

I've now tried to use encrypted .enc and .zip and both fail identically as I've stated in the last comment. The function is called like you suggested.

SMC version 7.1.5 and API 7.1

[lilianValeroFp]

It is strange since I've cheked in SMC 7.1.5 and api version 7.1, we have the SMC API import_elements operation supporting file_password.
Currently, we are using in our automatic tests this kind of scenarii:
logging.info("==> Export all Elements") export_all_file = os.path.join(output_path, "scenario6.zip") new System().export_elements(zip_filename=export_all_file, file_password="MyPassword00") logging.info("==> Import all Elements") new System().import_elements(zip_filename=export_all_file, file_password="MyPassword00")
So, if you are not managing to fix your issue, please contact your forcepoint support in order to raise your issue with your mgt_server backup, your script and your mgt_server sg_info.

[jakorsne]

There is difference in the function arguments provided in your previous messages zip_filename and import_elements. Has there been other changes?

import_elements(zip_filename=export_all_file, file_password="MyPassword00")

import_elements(import_file=YOUR_IMPORT_ENC_FILE, file_password=PASSWORD_USED_FOR_EXPORT)

[lilianValeroFp]

yes sorry it is:
new System().import_elements(export_all_file, file_password="MyPassword00")
or
new System().import_elements(import_file=export_all_file, file_password="MyPassword00")