find subnets containing an IP address using API

[payam124]

I have a use case which I expected subnets/search/ would be the answer, but it wasn't and it didn't work.
I want to search for a specific IP address and if IP address has been not defined I would like to get the most specific defined subnet which contains that specific IP.
in the UI, when the user search for an IP, the system works exactly in this way. But I was not able to find the appropriate API call for such query. Using search in subnets
/api/ApplicationID/subnets/search/[IP]/
also returns {"code":400,"success":0,"message":"Subnet Id must be numeric (search)","time":0.01}
checking the code, seems nothing is there for "search" in the code.

[csatola]

I see the same thing when I issue a POST. The search endpoint is a GET endpoint. When I run it with GET, I receive:

{
"code": 200,
"success": true,
"data": [
{
"id": "2065",
"subnetId": "45",
"ip": "192.168.48.1",
"is_gateway": "1",
"description": null,
"hostname": null,
"mac": null,
"owner": null,
"tag": "2",
"deviceId": "0",
"location": "0",
"port": null,
"note": null,
"lastSeen": null,
"excludePing": "0",
"PTRignore": "0",
"PTR": "0",
"firewallAddressObject": null,
"editDate": null
}
],
"time": 0.003
}

[payam124]

I see the same thing when I issue a POST. The search endpoint is a GET endpoint. When I run it with GET, I receive:

{
"code": 200,
"success": true,
"data": [
{
"id": "2065",
"subnetId": "45",
"ip": "192.168.48.1",
"is_gateway": "1",
"description": null,
"hostname": null,
"mac": null,
"owner": null,
"tag": "2",
"deviceId": "0",
"location": "0",
"port": null,
"note": null,
"lastSeen": null,
"excludePing": "0",
"PTRignore": "0",
"PTR": "0",
"firewallAddressObject": null,
"editDate": null
}
],
"time": 0.003
}

this seems to be "address" search. not "subnet" search. what command did you run?

[csatola]

Ah, I misread. Sorry about that. I've never gotten /subnet/search working.

[zombah]

Subnet search looks for id not ip, for subnet ip search use subnet/cidr/

[payam124]

Subnet search looks for id not ip, for subnet ip search use subnet/cidr/

subnets/cidr only returns if the exact IP/netmask has been defined in the system. i.e. if I have defined an /23 network for a customer and have not defined every IP within the range and I get an abuse report on an IP within the range then the lookup for the IP would return not found.
in the UI if such search happens, for the subnets, this functionality exists

[zombah]

That is mix of ip addresses and subnets into one api call, there is no such api controller currently imo. It is possible to create such universal search subcontroller inside tools subcontroller as i imagine, it will need complex mysql selects to search flexible input data in all tables and fields, but that mostly mimic exist web ui "top right corner search".
It is also possible to do this on api client side, for example with python netaddr, it has nice function for that smallest_matching_cidr.
So if ip address not found, get all subnets from section and find smallest_matching_cidr for it.

[payam124]

That is mix of ip addresses and subnets into one api call, there is no such api controller currently imo. It is possible to create such universal search subcontroller inside tools subcontroller as i imagine, it will need complex mysql selects to search flexible input data in all tables and fields, but that mostly mimic exist web ui "top right corner search".
It is also possible to do this on api client side, for example with python netaddr, it has nice function for that smallest_matching_cidr.
So if ip address not found, get all subnets from section and find smallest_matching_cidr for it.

for the comment you gave, actually I was thinking the same. i.e. first search for the IP using addresses controller. if not found, then loop over subnets from most specific to less specific and find the first match.

back to the first part of your reply, I didn't meant an API call to do both IP and subnet search. what I meant was having the option of giving an IP and get back subnets including that IP.
I checked the DB, it seems to have both IPv4 and v6 in a same table, filed types are varchar (which I wish not). But even for the existing implementation, this is the query which works
select id,subnet,mask,cast(subnet as unsigned) from subnets where INET_ATON('x.x.x.x') >=cast(subnet as unsigned) and INET_ATON('x.x.x.x') <= cast(subnet as unsigned)+power(2,32-cast(mask as unsigned)) order by cast(mask as unsigned) desc;

@phpipam your comment is appreciated

[GaryAllan]

Would /api/my_app/sections/{id}/overlapping/{cidr}/ fit your use case? Discussion in #1792

[payam124]

Would /api/my_app/sections/{id}/overlapping/{cidr}/ fit your use case? Discussion in #1792

While it is pointing to a same approach which I proposed, the goal in that post was different.

This is my use case
I receive an Abuse report containing an IP address
I would like to know which customer/server this IP has been assigned. If there is a single IPAddress record in the phpipam, the first API call from "addresses" controller would return it
otherwise, I need to go over subnets and find the most specific subnet which gives me the next step for the customer lookup
so in this case, I don't now the "master subnet" out of the box so put its {id} in the API call.
the use cases for "subnet" look up would be like below

• a customer whom has been assigned a subnet. so the returning subnet would point to that particular customer
• the most specific subnet might lead me to another method of customer lookup. i.e. if the subnet says it is assigned to a pool for dynamic users. then I know my next action would be looking up in another system (i.e. AAA) to get the exact customer of the IP at the moment I want.

RIPE database could be a good example of such implementation. At the end of the day the question is "who is responsible for a specific IP"

[GaryAllan]

Added /overlaping/{subnet}/ API call. Subnet must be in IPv4/IPv6 CIDR format.

curl -X GET --header "token: {token}" https://phpipam/api/MyApp/Subnets/overlapping/2000::/3

curl -X GET --header "token: {token}" https://phpipam/api/MyApp/Subnets/overlapping/10.10.10.10/32/?filter_by=sectionId\&filter_value=2

[prav-raghu]

Given the following request given above doesn't seem to be working for us for a similar use case.

GET /api/MyApp/Subnets/overlapping/192.168.1.5/3 HTTP/1.1
Host: phpipam
token: xxxxxxxxxxxxxx

Respsonse

{
    "code": 400,
    "success": 0,
    "message": "Subnet Id must be numeric (overlapping)",
    "time": 0.007
}

Any ideas as to what could be causing this?

[GaryAllan]

Hello @Prav7728

It means you haven't pulled down the newly added code.
You need to be on the "master" git branch (git checkout master) and git pull the latest changes.
If you're on the 1.3 stable branch this feature won't be available.

As with all upgrades take good backups before making changes.

Alternatively you can wait for the official 1.40 release.

[prav-raghu]

Thanks for the heads up much appreciated

[prav-raghu]

when will the official 1.40 release be coming through?