[pve-devel] [PATCH pve-network 1/1] fix #6569: ipam: netbox: better prefix lookup

[Trygve Laugstøl]

On Wed, Sep 17, 2025, at 15:15, Fiona Ebner wrote:
> Sorry about the very late response and thank you for the contribution!
>
> Am 30.07.25 um 11:36 PM schrieb Trygve Laugstøl via pve-devel:
>> The problem description in #6569 is correct, but instead of depending on the
>> freetext query parameter "q", this uses the "prefix" parameter for an explicit
>> lookup.
>> 
>> This also checks if there are multiple prefixes that matched. This will happen
>> if the same prefix is registered in multiple VRFs.
>> 
>> Signed-off-by: Trygve Laugstøl <trygvis at inamo.no>
>> ---
>>  src/PVE/Network/SDN/Ipams/NetboxPlugin.pm | 21 ++++++++++++++-------
>>  1 file changed, 14 insertions(+), 7 deletions(-)
>> 
>> diff --git a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
>> index e118d03..3799e47 100644
>> --- a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
>> +++ b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
>> @@ -423,18 +423,25 @@ sub on_update_hook {
>>  sub get_prefix_id {
>>      my ($config, $cidr, $noerr) = @_;
>>  
>> -    # we need to supply any IP inside the prefix, without supplying the mask, so
>> -    # just take the one from the cidr
>> -    my ($ip, undef) = split(/\//, $cidr);
>> -
>> -    my $result = eval { netbox_api_request($config, "GET", "/ipam/prefixes/?q=$ip") };
>> +    # look up the prefix by matching the prefix exactly.
>> +    my $result = eval { netbox_api_request($config, "GET", "/ipam/prefixes/?prefix=$cidr") };
>>      if ($@) {
>>          return if $noerr;
>>          die "could not obtain ID for prefix $cidr: $@";
>>      }
>>  
>> -    my $data = @{ $result->{results} }[0];
>> -    return $data->{id};
>> +    # we can get multiple prefixes returned if the netbox configuration allows
>> +    # it, or if the prefix is registered in different VRFs.
>> +    my $count = $result->{count} || 0;
>> +    if ($count > 1) {
>> +        die "ambiguous prefix lookup for $cidr: found $count matches";
>
> Can't this break existing setups where there are multiple prefixes?
> Because the old code would just pick the first, but the new code would
> die rather than also picking the first.
>
> If we really want this, it should honor the $noerr parameter and return
> instead of die if $noerr is set.

The current one would pick the first, but also a random, inconsistent one. A better solution here would be to somehow include the VRF as a part of the lookup, but that requires a bigger expansion of the Netbox support than I'm prepared to do.

Also, the code doesn't handle missing prefixes well so if the prefix is removed on the Netbox side the current code will just not allow you to remove the subnet at all. But I guess that is another issue.

-- 
Trygve

>> +    }
>> +
>> +    if ($count == 0) {
>> +        return;
>> +    }
>> +
>> +    return $result->{results}[0]{id};
>>  }
>>  
>>  sub get_iprange_id {
>> -- 
>> 2.47.2
>> 
>>