search

jaredhendrickson13 / pfsense-api

The missing REST API package for pfSense
https://pfrest.org/
Apache License 2.0
670 stars 101 forks source link

REST API: Add Firewall alias entry DELETE & POST using name & address instead of ID #517

Closed jpdsc closed 1 week ago

jpdsc commented 1 month ago

Is your feature request related to existing pfSense functionality that is missing from the API? Please describe. In v1, I was able to use below in Fail2ban action to delete an IP from an alias. https://IP/api/v1/firewall/alias/entry?name=**alias**&address=**ip**&apply=true

I have created a separate alias for Fail2ban to ensure the alias list is not huge. All blocked IP's are in 1 Fail2ban alias. image

I have been working on v2 integration in a new action and I noticed in the documentation that DELETE, is only possible with an ID. This also means, I cannot delete an IP in an existing alias.

After further research this also applies to /api/v2/firewall/alias both POST and PATCH, it is not possible to add an entry.

Describe the solution you'd like Would it be possible to bring back /api/v1/firewall/alias/entry using name and address to delete or add an individual line in the alias?

Describe alternatives you've considered Considered GET but this also using ID and I can only delete the full alias, instead of entries in the alias.

jaredhendrickson13 commented 1 month ago

This is related to #511. Essentially the behavior of the previous /api/v1/firewall/alias/entry is no longer feasible in v2 because v2 is fully object-oriented and the address items are not objects in the config. However, a control parameter to change the behavior of PATCH requests to remove the address items given in the request instead of replacing the entire array is feasible, and can easily be added alongside the new append control parameter being added in v2.1.0.

As far the IDs, v2 will only be using the IDs used by pfSense itself going forward. Using other fields as the ID requires too much redundant processing and is too inconsistent across endpoints. For endpoints that require IDs, you can make a GET request with a query to find the object you want to interact with, and then make your PATCH or DELETE request using the id field of the object identified in the GET request. This is standard practice for RESTful APIs.

jpdsc commented 1 month ago

Thanks a lot for the feedback and explanation/solution on this. I only have 1 alias for Fail2ban, so using ID is not an issue then. As long as I don't recreate the alias, it will keep the same ID.

Once v2.1.0 is available, I'll continue with the changes to the Fail2ban action.