Skip to content

v1.4.1 — Per-IP CRUD on Multi-IP Zones

Latest
Latest

Choose a tag to compare

View all tags
@opastorello opastorello released this 07 May 16:35
· 1 commit to main since this release
v1.4.1
abc66b7

What's Changed

Multi-IP Zone Mutations

Some A10 zones group several IPs under one zone_name (e.g. the On-Demand zone bundling many static IPs). This release adds endpoints and MCP tools to check, add, and remove individual IPs in a zone's ip_list without touching the rest of the configuration.

REST Endpoints

Method Path Description
GET /api/v1/mitigation/zones/{zone_name}/ip/{ip} Returns {found: bool}
POST /api/v1/mitigation/zones/{zone_name}/ip/{ip} Adds the IP (idempotent — changed=false if already present)
DELETE /api/v1/mitigation/zones/{zone_name}/ip/{ip} Removes the IP (404 if absent, 422 if it's the last IP in the zone)

Scopes: mitigation:read for GET, mitigation:write for POST/DELETE. POST/DELETE are rate-limited at 20/minute per IP.

MCP Tools (15 total now)

  • zone_has_ip(zone_name, ip)
  • add_ip_to_zone(zone_name, ip)
  • remove_ip_from_zone(zone_name, ip)

Concurrency Safety

Multi-IP zones are vulnerable to lost updates because the A10 zone-update endpoint expects the full payload — read-modify-write races silently overwrite each other. Mitigations:

  • Per-zone threading.Lock in mitigation_service.py serializes add/remove for the same zone_name within the process. Different zones still run in parallel.
  • Post-write verification: after each write the zone is re-read; if the IP is not in the expected state (in ip_list after add, or not in after remove), the request returns 409 Conflict asking the client to retry. Catches A10 rejections and modifications made outside this API (e.g. via the Web UI).

For multi-replica deployments, swap the in-process lock for a distributed lock (Redis SET NX EX keyed on zone_name) — same call site.

Verified ✅

  • All 24 focused unit tests pass (test_mitigation_service, test_mcp_integration, test_client, test_health).
  • REST smoke test against the real On-Demand zone: GET → POST add → GET → POST add (idempotent) → DELETE → GET → DELETE (404). All status codes correct.
  • Concurrency smoke test: 3 simultaneous POST adds on the same zone → ip_count progresses 9 → 10 → 11 with no lost updates.
  • MCP smoke test (tests/manual_test_mcp_ip_tools.py) against the streamable-http server: all 3 new tools work end-to-end.

All 15 MCP Tools

get_system_health · get_system_devices · get_system_license · list_active_mitigations · list_ongoing_attacks · get_zone_status · mitigate_ip · remove_mitigation · zone_has_ip · add_ip_to_zone · remove_ip_from_zone · get_zone_template · set_zone_template · list_zone_templates · import_zone_template

Assets 2
Loading