Prevent from adding an IP address with a different tenant

[ychamps]

Hi,
I have an existing prefix, how can I prevent a user from adding an IP address in this prefix with a different tenant ?

Cheers.

[candlerb]

With a Custom Validator.

How you get from an IPAddress object to its parent Prefix is not obvious though, I can't find a helper for this. The following logic is borrowed from PrefixFilterSet.search_contains (tested with nbshell):

>>> i = IPAddress.objects.get(address="10.12.0.1/24")
>>> i.address
IPNetwork('10.12.0.1/24')
>>> Prefix.objects.filter(prefix__net_contains_or_equals=i.address, vrf=i.vrf)
<PrefixQuerySet [<Prefix: 10.12.0.0/16>, <Prefix: 10.12.0.0/22>, <Prefix: 10.12.0.0/24>]>

You'd then have to sort this by prefix length, and take the longest one.

[ychamps]

Hi Brian,

thank you for your answer. I new with Netbox customization and scripting.
My idea it to first create a script that gets the parent prefix's tenant based on a simple ip address as input. I will then adapt it to a custom validator.
Now I am struggling to create a simple script to add a single ip address. Any help will be appreciated.

Cheers.

from django.utils.text import slugify
from ipam.models import IPAddress
from extras.scripts import *


class NewIpScript(Script):

    class Meta:
        name = "New IP Address"
        description = "Provision an IP address"

    ip_add = IPAddressField(
        verbose_name=_('address'),
        help_text=_('IPv4 or IPv6 address (with mask)')
    )
    def run(self, data, commit):

        # Create the new ip address
        ipaddress = IPAddress(
        address=ip_add,
        status=IPAddressStatusChoices.STATUS_PLANNED
        )
        ipaddress.full_clean()
        ipaddress.save()
        self.log_success(f"Created new IP Address: {ipaddress}")

[candlerb]

There are sample scripts at https://github.com/netbox-community/customizations/tree/master/scripts

You haven't said exactly what the problem is that you see when you run this, but at a glance one thing I notice is that you're accessing the data passed to the script wrongly. It should be:

        ipaddress = IPAddress(
            address=data["ip_add"],       // <<<< HERE
            status=IPAddressStatusChoices.STATUS_PLANNED
        )

(I would also remove the unused import of slugify, and it's cleaner to import explicit names you use, rather than *)

However, Netbox is terrible when it comes to support for debugging scripts which have syntax errors or name errors. If I import your script, the UI just shows me the file containing no scripts to run, but no error. In fact, there are multiple errors.

To get a useful error message, use the following trick. Add the following 4 lines to the top of the file:

import django, os, sys
sys.path.append('/opt/netbox/netbox')
os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'netbox.settings')
django.setup()

Then run it like this:

# /opt/netbox/venv/bin/python newipaddress.py
Traceback (most recent call last):
  File "/root/newipaddress.py", line 8, in <module>
    class NewIpScript(Script):
  File "/root/newipaddress.py", line 14, in NewIpScript
    ip_add = IPAddressField(
             ^^^^^^^^^^^^^^
NameError: name 'IPAddressField' is not defined

Ah, there's one problem. Change the imports to:

from ipam.models import IPAddress
from ipam.fields import IPAddressField
from ipam.choices import IPAddressStatusChoices
from extras.scripts import Script

Now you get another error:

# /opt/netbox/venv/bin/python newipaddress.py
Traceback (most recent call last):
  File "/root/newipaddress.py", line 10, in <module>
    class NewIpScript(Script):
  File "/root/newipaddress.py", line 17, in NewIpScript
    verbose_name=_('address'),
                 ^
NameError: name '_' is not defined

Hmm, I've never attempted to use that method. Looking at Netbox source, I think you'd need something like

from django.utils.translation import gettext as _

At this point, the script can be parsed at the CLI without errors, and can be uploaded to the UI (without those extra four lines) and is shown available to run. But it doesn't prompt for any parameters. The problem is that you should be using IPAddressVar not IPAddressField. Except IPAddressVar only allows a single IP address (e.g. "1.1.1.1") not an IP Address with mask ("1.1.1.1/24"), so actually you want IPAddressWithMaskVar - at least for now. (Eventually you might look up the parent prefix to find the mask length)

The next problem is a runtime error when the script executes (fortunately this is shown in the UI):

  File "/opt/netbox/netbox/scripts/newipaddress.py", line 21, in run
    status=IPAddressStatusChoices.STATUS_PLANNED
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: type object 'IPAddressStatusChoices' has no attribute 'STATUS_PLANNED'

The valid choices (from netbox/ipam/choices.py) are:

    STATUS_ACTIVE = 'active'
    STATUS_RESERVED = 'reserved'
    STATUS_DEPRECATED = 'deprecated'
    STATUS_DHCP = 'dhcp'
    STATUS_SLAAC = 'slaac'

Changing this to STATUS_RESERVED, and also disabling the option to schedule the script, gives the following:

from ipam.models import IPAddress
from ipam.choices import IPAddressStatusChoices
from extras.scripts import Script, IPAddressWithMaskVar
from django.utils.translation import gettext as _

class NewIpScript(Script):

    class Meta:
        name = "New IP Address"
        description = "Provision an IP address"
        scheduling_enabled = False
        commit_default = True

    ip_add = IPAddressWithMaskVar(
        label=_('address'),
        description=_('IPv4 or IPv6 address (with mask)')
    )

    def run(self, data, commit):
        # Create the new ip address
        ipaddress = IPAddress(
            address=data["ip_add"],
            status=IPAddressStatusChoices.STATUS_RESERVED
        )
        ipaddress.full_clean()
        ipaddress.save()
        self.log_success(f"Created new IP Address: {ipaddress}")

At last, that works. I hope the above has highlighted some of the things you need to do when debugging scripts.

[ychamps]

Many thanks Brian for your help.
I made some progress in my custom validator and adapted some code from IA.
I have an error when no parent prefix is found. I have to troubleshoot, let me know your thoughts.

Cheers

import django, os, sys
sys.path.append('/opt/netbox/netbox')
os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'netbox.settings')
django.setup()
from extras.scripts import Script, StringVar
from extras.validators import CustomValidator
from ipam.models import IPAddress, Prefix
from tenancy.models import Tenant
from django.core.exceptions import ValidationError
import ipaddress

class AssignTenantToIPAddressScript(CustomValidator):

    def validate(self, instance, request):
        ip_input = str(instance.address)
#        prefixes = Prefix.objects.filter(prefix__net_contains_or_equals=str(instance.address))
        prefixes = Prefix.objects.filter(prefix__net_contains_or_equals=ip_input)
        if prefixes:
            closest_parent = max(prefixes, key=lambda p: p.prefix.prefixlen)
            #self.log_info(f"L'adresse IP '{ip_input}' est contenue dans le préfixe parent le plus proche : {closest_parent.prefix}")
        else:
            # Si aucun préfixe ne contient directement l'IP, trouver les parents les plus proches
            all_prefixes = Prefix.objects.filter(prefix__family=4)

            # Calculer la distance entre l'IP et chaque préfixe
            prefix_distances = []
            for prefix in all_prefixes:
                network = ipaddress.ip_network(prefix.prefix)
                # Calcul de la distance (distance minimale à l'adresse de réseau ou de diffusion)
                if instance > network.network_address:
                    distance = int(ip_obj) - int(network.network_address)
                else:
                    distance = int(network.broadcast_address) - int(instance)
                prefix_distances.append((prefix, distance))

            # Trier les préfixes par distance croissante
            sorted_prefixes = sorted(prefix_distances, key=lambda x: x[1])

            # Sélectionner le préfixe parent le plus proche
            if sorted_prefixes:
                closest_parent = sorted_prefixes[0][0]
                #self.log_info(f"Aucun préfixe exact ne contient l'adresse IP '{ip_input}'. Le préfixe parent le plus proche est : {closest_parent.prefix}.")
            else:
                self.fail("Aucun préfixe parent trouvé pour l'adresse IP {ip_input}.")
                return

        # Obtenir le tenant associé au préfixe parent le plus proche
        tenant = closest_parent.tenant
        if tenant:
                 pass
                 #self.log_info("Le tenant associé au préfixe '{closest_parent.prefix}' est : {tenant.name}.")

        else:
            self.fail("Aucun tenant n'est associé au préfixe '{closest_parent.prefix}'.")

        if str(instance.tenant) == str(tenant):
            pass
            #self.log_info("Les tenant parent et enfant sont pareils.")
        else:
            self.fail("tenant parent different de l'enfant!", field='description')

[candlerb]

I have an error when no parent prefix is found.

And what exactly is that error? Does it show a backtrace? If not, try setting DEBUG=True in configuration.py

[ychamps]

<class 'ValueError'>

Cannot use None as a query value

[candlerb]

Then can you get a full backtrace by setting DEBUG=True in configuration.py? Work back from the end towards your own code, that should show what line the error is in.

[ychamps]

The full backtrace did not show explicitly the error or I don't know where to find it.
From my investigations I supposed that the none error is caused by "instance.address" which is NULL when the entered address has no mask.
Do you know why ?

Secondly, I would like to use user's group in my validation script, which object and attribute should I query to get it ?

Regards.

[candlerb]

Please show the full backtrace. Someone with more experience should be able to decipher it; at very least it will point to the exact line where the error occurs.

From my investigations I supposed that the none error is caused by "instance.address" which is NULL when the entered address has no mask.
Do you know why ?

That's an assumption you've made with no evidence to back it up.

[ychamps]

Here is the backtrace :
Environment:

Request Method: POST
Request URL: http://192.168.250.214:8000/ipam/ip-addresses/add/

Django Version: 5.0.8
Python Version: 3.10.12
Installed Applications:
['django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'django.contrib.humanize',
'django.forms',
'corsheaders',
'debug_toolbar',
'django_filters',
'django_htmx',
'django_tables2',
'django_prometheus',
'strawberry_django',
'mptt',
'rest_framework',
'social_django',
'taggit',
'timezone_field',
'core',
'account',
'circuits',
'dcim',
'ipam',
'extras',
'tenancy',
'users',
'utilities',
'virtualization',
'vpn',
'wireless',
'django_rq',
'drf_spectacular',
'drf_spectacular_sidecar']
Installed Middleware:
['strawberry_django.middlewares.debug_toolbar.DebugToolbarMiddleware',
'corsheaders.middleware.CorsMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.locale.LocaleMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django.middleware.security.SecurityMiddleware',
'django_htmx.middleware.HtmxMiddleware',
'netbox.middleware.RemoteUserMiddleware',
'netbox.middleware.CoreMiddleware',
'netbox.middleware.MaintenanceModeMiddleware']

Traceback (most recent call last):
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/core/handlers/exception.py", line 55, in inner
response = get_response(request)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/core/handlers/base.py", line 197, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/views/generic/base.py", line 104, in view
return self.dispatch(request, *args, **kwargs)
File "/opt/netbox-4.0.9/netbox/netbox/views/generic/object_views.py", line 180, in dispatch
return super().dispatch(request, *args, **kwargs)
File "/opt/netbox-4.0.9/netbox/netbox/views/generic/base.py", line 26, in dispatch
return super().dispatch(request, *args, **kwargs)
File "/opt/netbox-4.0.9/netbox/utilities/views.py", line 113, in dispatch
return super().dispatch(request, *args, **kwargs)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/views/generic/base.py", line 143, in dispatch
return handler(request, *args, **kwargs)
File "/opt/netbox-4.0.9/netbox/netbox/views/generic/object_views.py", line 268, in post
if form.is_valid():
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/forms/forms.py", line 197, in is_valid
return self.is_bound and not self.errors
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/forms/forms.py", line 192, in errors
self.full_clean()
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/forms/forms.py", line 329, in full_clean
self._post_clean()
File "/opt/netbox-4.0.9/netbox/netbox/forms/base.py", line 76, in _post_clean
return super()._post_clean()
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/forms/models.py", line 496, in _post_clean
self.instance.full_clean(exclude=exclude, validate_unique=False)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/base.py", line 1536, in full_clean
self.clean()
File "/opt/netbox-4.0.9/netbox/ipam/models/ip.py", line 838, in clean
super().clean()
File "/opt/netbox-4.0.9/netbox/netbox/models/init.py", line 71, in clean
super().clean()
File "/opt/netbox-4.0.9/netbox/netbox/models/features.py", line 267, in clean
super().clean()
File "/opt/netbox-4.0.9/netbox/netbox/models/features.py", line 316, in clean
post_clean.send(sender=self.class, instance=self)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/dispatch/dispatcher.py", line 189, in send
response = receiver(signal=self, sender=sender, **named)
File "/opt/netbox-4.0.9/netbox/extras/signals.py", line 241, in run_save_validators
run_validators(instance, validators)
File "/opt/netbox-4.0.9/netbox/extras/signals.py", line 47, in run_validators
validator(instance, request)
File "/opt/netbox-4.0.9/netbox/extras/validators.py", line 130, in call
self.validate(instance, request)
File "/opt/netbox-4.0.9/netbox/validators/custom.py", line 17, in validate
prefixes = Prefix.objects.filter(prefix__net_contains_or_equals=ip_input)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/manager.py", line 87, in manager_method
return getattr(self.get_queryset(), name)(*args, **kwargs)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/query.py", line 1476, in filter
return self._filter_or_exclude(False, args, kwargs)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/query.py", line 1494, in _filter_or_exclude
clone._filter_or_exclude_inplace(negate, args, kwargs)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/query.py", line 1501, in _filter_or_exclude_inplace
self._query.add_q(Q(*args, **kwargs))
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/sql/query.py", line 1613, in add_q
clause, _ = self._add_q(q_object, self.used_aliases)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/sql/query.py", line 1645, in _add_q
child_clause, needed_inner = self.build_filter(
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/sql/query.py", line 1559, in build_filter
condition = self.build_lookup(lookups, col, value)
File "/opt/netbox-4.0.9/venv/lib/python3.10/site-packages/django/db/models/sql/query.py", line 1394, in build_lookup
raise ValueError("Cannot use None as a query value")

Exception Type: ValueError at /ipam/ip-addresses/add/
Exception Value: Cannot use None as a query value

ValueError at ipam_ip-addresses_add.zip

https://dpaste.com/3LN2CJRE3

[candlerb]

This shows that the error originates in this line of your validator:

prefixes = Prefix.objects.filter(prefix__net_contains_or_equals=ip_input)

and the previous line is:

ip_input = str(instance.address)

It would appear that instance.address is unset (None) at this point, but you have explicitly converted it to the string "None", which is not a valid IP address.

Clearly, an IPAddress object should never have an unset address, as this is not a nullable field in the model class. However, it doesn't seem to be documented whether your custom validator is called before or after Netbox has done its own validation (or called after even if Netbox's own validation has failed), and hence whether the model is in a potentially-valid state or not.

Since have shown that it's not, you'll have to write your class to defend against this:

    def validate(self, instance, request):
        if not instance.address:
            #self.log_info("Address not set")
            return

Note 1: I don't think logging is supported in a custom validator - it's not documented as such anyway.

Note 2: personally I would avoid calling str(...) on model objects where possible. In this case, you can't use the IPAddress model instance as a filter value, but you can use the IPNetwork object that it contains:

prefixes = Prefix.objects.filter(prefix__net_contains_or_equals=instance.address)

Checking in nbshell:

>>> ip = IPAddress.objects.get(address="10.12.255.53/24")
>>> ip
<IPAddress: 10.12.255.53/24>
>>> ip.address
IPNetwork('10.12.255.53/24')
>>> Prefix.objects.filter(prefix__net_contains_or_equals=ip.address)
<PrefixQuerySet [<Prefix: 10.12.0.0/16>, <Prefix: 10.12.255.0/24>]>

It's not a problem - it's just arguably more flexible to keep objects as objects.

Aside: I notice your code has import ipaddress and uses ipaddress.ip_network. However, that's not the library that Netbox uses; it uses the netaddr library, defining its own Postgres database field types in netbox/ipam/fields.py which use netaddr.

>>> type(ip.address)
<class 'netaddr.ip.IPNetwork'>

Even if you're just using it for some internal subnet calculations, it'll probably be cleaner overall if you stick to the same library that Netbox uses.