PVE REST-API - Sometimes error: Not a HASH reference at /usr/share/perl5/PVE/APIServer/AnyEvent.pm

[linushstge]

Sometimes I'm getting an error by the Proxmox REST-API for any QEMU related task.

pveversion
pve-manager/7.1-6/4e61e21c (running kernel: 5.11.22-5-pve)

root@node49:~#  pvesh create /nodes/node49/qemu/XXXXX/agent/ping

┌────────┬───────┐
│ key    │ value │
╞════════╪═══════╡
│ result │ {}    │
└────────┴───────┘

pvesh working fine.

REST API Post call results in following exception (Cookie Auth or API Token Auth results in same error)

Request:

POST https://XX.XX.XX.XX:8006/api2/json/nodes/node49/qemu/XXXXX/agent/ping
Headers:
Authorization (******)

-----------------------

Response:
Code: 501
Phrase: Not a HASH reference at /usr/share/perl5/PVE/APIServer/AnyEvent.pm line 873.
Body: NULL

HTTP Code 501 seems to be "not implemented" but also GET or PUT doesn't work.

Any ideas on this?

pvedaemon / pveproxy already restarted without any change.
Tested on more than 10 nodes on the cluster.

This error also occurs on complete different tasks like Power on (start).

thanks in advance
Linus

 

[Moayad]

Hello,

Is the Csrfpreventiontoken included in the request?

 

[linushstge]

Hey thanks for your fast reply,

In tests with the API Tokens it seems the token can't be applied because there is no pre auth like auth by cookie?
In tests with the Cookie auth its included

 

[t.lamprecht]

Phrase: Not a HASH reference at /usr/share/perl5/PVE/APIServer/AnyEvent.pm line 873.

That error should be only possible in some specific situations when multipart file upload is involved.

In tests with the API Tokens it seems the token can't be applied because there is no pre auth like auth by cookie?

Yeah, CSRF is an issue in browser only, for API tokens they're not required.

 

[linushstge]

Thanks, that was the correct hint!

The POST requests contained an empty json body which results in this error.
A "parameter validation exception" would make much more sense

Thank you very much, works now fine after removing the JSON body.

 

[t.lamprecht]

A "parameter validation exception" would make much more sense

Yeah, could definitively get improved, we do not even require to throw an exception here at that stage, an actual parameter verification error is already handled by the schema-verification of the API call and an empty.