Updating Interface.tagged_vlans via API improperly allowed on interface with mode: tagged-all

[radek-senfeld]

Deployment Type

Self-hosted

NetBox Version

v3.7.5, 4.0.3

Python Version

3.9

Steps to Reproduce

• Choose any interface.
• Set the interface's 801.1Q Mode to Tagged (all) (in API terms, "mode": "tagged-all")
• Use a PATCH request to set a non-empty value for the interface's tagged_vlans property
• Use a second PATCH request to change only the interface's description property, leaving tagged_vlans and untagged_vlans out of the patch
• Retrieve the interface via the API.

$ curl -X PATCH -H "Content-type: application/json"  -H "Accept: application/json" -H "Authorization: Token $TOKEN"  http://localhost/api/dcim/interfaces/1/  --data '{"description": "Patching the description and tagged_vlans", "tagged_vlans": [ 1 ] }'

$ curl -X PATCH -H "Content-type: application/json"  -H "Accept: application/json" -H "Authorization: Token $TOKEN"  http://localhost/api/dcim/interfaces/1/  --data '{"description": "Patching the description only" }'

Expected Behavior

The first PATCH should be rejected with an API error message indicating that setting tagged_vlan is not allowed on an interface with "mode": "tagged_all".

Observed Behavior

The first (invalid) PATCH is accepted, and reflected as specified. The second (valid) PATCH is accepted, and results in the unexpected obliteration of the tagged_vlan result.

[jeffgdotorg]

Thanks for reporting a suspected bug.

It appears you're using the pynetbox API library. To eliminate the possibility that a bug in pynetbox underlies this behavior, please try to reproduce the problem by operating the API directly using curl or the requests library.

[radek-senfeld]

Thanks for reporting a suspected bug.

It appears you're using the pynetbox API library. To eliminate the possibility that a bug in pynetbox underlies this behavior, please try to reproduce the problem by operating the API directly using curl or the requests library.

Yes, we're using pynetbox API library.

As formerly shown, the bug is not connected to the pynetbox library. It happens on the server side whenever the attribute "tagged_vlans" is missing from the PATCH request. Just give it a go, please..

As I stated, I'm pretty sure it could affect all other SerializedPKRelatedField fields in similar situation.

[radek-senfeld]

Tested via Requests. VLANs got nuked.

r = requests.patch("https://netbox.domain.tld/api/dcim/interfaces/69/", json={"description": "Patching just the description will vaporize VLANs"}, headers={"Authorization": "Token deadbeefbabe"})

[jeremystretch]

I was not able to reproduce this on v3.7.8. After assigning both tagged VLANs and an untagged VLAN to an interface, sending the following request did not change anything except its description (as intended):

curl -X PATCH \
-H "Authorization: Token $TOKEN" \
-H "Content-Type: application/json" \
-H "Accept: application/json; indent=4" \
http://netbox:8000/api/dcim/interfaces/1/ \
--data '{"description": "testing"}'

Please try upgrading to v3.7.8.

[radek-senfeld]

I was able to reproduce the issue on v3.7.8 using the curl command.

[jeremystretch]

@radek-senfeld then you'll need to provide more information about how someone else can reproduce the problem. As it stands, it appears to be an issue with your specific deployment or configuration.

[jeffgdotorg]

@radek-senfeld please try to keep in mind that every minute the maintainers spend fiddling with variables in an attempt to reproduce the behavior you're seeing is a minute that they're not working on another issue. The more specific and detailed you can be in your steps to reproduce, the quicker the team can validate the problem and get on with fixing it.

[MarianRychtecky]

Hi Jeff, this is Marian from Radek's team. We took some time to install a fresh instance of Netbox and test it on a new environment. Doing so will give us more details about where the problem could be. We tested the instance we use as a production clone and found the problem persistent. Now, we will test in a new instance and provide you with all the details.

[github-actions]

This is a reminder that additional information is needed in order to further triage this issue. If the requested details are not provided, the issue will soon be closed automatically.