Can not change CIDR param under IPSet through API using HTTP PUT

[jory]

Hello, I searched for some time and checked docs and API viewer here:
API viewer - PUT - /api2/json/cluster/firewall/ipset/{name}/{cidr}
But I'm not able to change my CIDR range when already exists using HTTP PUT API call.

There is no issue create CIDR range (in already created IPSet management) like this:

curl -sS --noproxy "*" -k -b "PVEAuthCookie=${TIC}" -H "CSRFPreventionToken: ${TOK}" -X POST --data-urlencode cidr="192.168.251.0/24" https://${H}:8006/api2/json/cluster/firewall/ipset/management

I get {"data":null} response which is completely fine and CIDR range is created under IPSet named management:


But if I try to change it with PUT, I get duplicate parameter error.

curl -sS --noproxy "*" -k -b "PVEAuthCookie=${TIC}" -H "CSRFPreventionToken: ${TOK}" -X PUT --data-urlencode cidr="192.168.251.100/32" https://${H}:8006/api2/json/cluster/firewall/ipset/management/192.168.251.0/24

{"data":null,"errors":{"cidr":"duplicate parameter (already defined in URI) with conflicting values!"}}

According to documentation I should use cidr param. What can I do to be able to change already set cidr?

pve-manager/7.3-6/723bb6ec (running kernel: 5.15.85-1-pve)

Thanks,
J.

 

[Moayad]

The IP/CIDR, I guess it's an Alias name not IP address/CIDR so in your case the post request should include `cidr=<name of the alias` instead.

 

[jory]

Unfortunately, there is nothing like alias. Only cidr param exists directly as IP/mask which is in fact also name of the CIDR range. Check API viewer I post before.

You can test it with HTTP method DELETE which you are sending directly to

/cluster/firewall/ipset/management/192.168.251.0/24

And delete works also.

 

[fiona]

Hi,
I don't think you can change it. The API endpoint is for that specific CIDR, that's why the parameter is already part of the URL of the endpoint. I think you need to delete it and create a new one instead.

 

[jory]

It seem like that but in API viewer there is PUT method with description that you actually can update IP. It seems to me that either documentation or API implementation in this case is wrong.

 

[fiona]

It seem like that but in API viewer there is PUT method with description that you actually can update IP. It seems to me that either documentation or API implementation in this case is wrong.

Parameters that are part of the request URI can't be changed AFAIK. Yes, they are listed as parameters of the API call, but where do you see an indication that they can be changed? E.g. all API calls below /nodes/{node} require the node name as a parameter, but that doesn't mean you can change the node name with any PUT API call below that.

 

[jory]

where do you see an indication that they can be changed?

Here. I sent URL to this page in first post also. Read the Description please.



Regards,
J.

 

[fiona]

I think it means "Update settings for this IP". Compare with "Update VM settings" which means "Updating settings for the VM". But yes, it could be worded a bit better.

 

[jory]

Ah, yes. It's just a little bit confusing but now it makes sense. Especially when I take into account this part

Parameters that are part of the request URI can't be changed AFAIK

So, delete and recreate whole CIDR is the only way.
Thank you and have a nice day.
J.

 

[fiona]

I think it means "Update settings for this IP". Compare with "Update VM settings" which means "Updating settings for the VM". But yes, it could be worded a bit better.

Ah, it's actually not just that. Because the PUT call is also used to create a new one.