[pve-devel] [PATCH pve-network 1/1] fix #6569: ipam: netbox: better prefix lookup

[Fiona Ebner]

Sorry about the very late response and thank you for the contribution!

Am 30.07.25 um 11:36 PM schrieb Trygve Laugstøl via pve-devel:
> The problem description in #6569 is correct, but instead of depending on the
> freetext query parameter "q", this uses the "prefix" parameter for an explicit
> lookup.
> 
> This also checks if there are multiple prefixes that matched. This will happen
> if the same prefix is registered in multiple VRFs.
> 
> Signed-off-by: Trygve Laugstøl <trygvis at inamo.no>
> ---
>  src/PVE/Network/SDN/Ipams/NetboxPlugin.pm | 21 ++++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)
> 
> diff --git a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
> index e118d03..3799e47 100644
> --- a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
> +++ b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
> @@ -423,18 +423,25 @@ sub on_update_hook {
>  sub get_prefix_id {
>      my ($config, $cidr, $noerr) = @_;
>  
> -    # we need to supply any IP inside the prefix, without supplying the mask, so
> -    # just take the one from the cidr
> -    my ($ip, undef) = split(/\//, $cidr);
> -
> -    my $result = eval { netbox_api_request($config, "GET", "/ipam/prefixes/?q=$ip") };
> +    # look up the prefix by matching the prefix exactly.
> +    my $result = eval { netbox_api_request($config, "GET", "/ipam/prefixes/?prefix=$cidr") };
>      if ($@) {
>          return if $noerr;
>          die "could not obtain ID for prefix $cidr: $@";
>      }
>  
> -    my $data = @{ $result->{results} }[0];
> -    return $data->{id};
> +    # we can get multiple prefixes returned if the netbox configuration allows
> +    # it, or if the prefix is registered in different VRFs.
> +    my $count = $result->{count} || 0;
> +    if ($count > 1) {
> +        die "ambiguous prefix lookup for $cidr: found $count matches";

Can't this break existing setups where there are multiple prefixes?
Because the old code would just pick the first, but the new code would
die rather than also picking the first.

If we really want this, it should honor the $noerr parameter and return
instead of die if $noerr is set.

> +    }
> +
> +    if ($count == 0) {
> +        return;
> +    }
> +
> +    return $result->{results}[0]{id};
>  }
>  
>  sub get_iprange_id {
> -- 
> 2.47.2
> 
>