Demystifying iControl REST Part 7 - Understanding Transactions

Is it possible to do something like a "verify" to know whether a transaction would succeed before applying it?

hi Josh, yes, you can add this property to the payload of the patch:

"validateOnly": true

Not sure how I missed this article until now, this is a powerful tool when crafting a custom API integration.

Nice article. 5*

/commands

I'm working on a python script which needs to create a LTM policy with 1 condition and 2 corresponding actions. Creating the policy and empty rule works like a charm but when I try adding the condition and actions in a transaction it fails.

def updatePolicy(partition, policyName, serverName, virtualServerName, env):
    pol = ''
    cCondition = {
        u'name': u'0',
        u'fullPath': u'0',
        u'index': 0,
        u'all': True,
        u'caseInsensitive': True,
        u'equals': True,
        u'external': True,
        u'httpHost': True,
        u'present': True,
        u'remote': True,
        u'request': True,
        u'values': [serverName]
    }
    cAction1 = {
        u'name': u'0',
        u'fullPath': u'0',
        u'forwards': True,
        u'request': True,
        u'select': True,
        u'virtual': u'/{0}/{1}'.format(partition, virtualServerName),
    }
    cAction2 = {
        u'name': u'1',
        u'fullPath': u'1',
        u'disable': True,
        u'request': True,
        u'serverSsl': True,
    }
    try:
        pol = mgmt.tm.ltm.policys.policy.load(name=policyName, partition=partition)
        pol.draft()
    except Exception as e:
        try:
            pol = mgmt.tm.ltm.policys.policy.load(name=policyName, partition=partition, subPath='Drafts')
            print("...loaded policy draft")
        except Exception as ee:
            try:
                pol = mgmt.tm.ltm.policys.policy.create(
                    name = policyName,
                    subPath = 'Drafts',
                    partition = partition,
                    ordinal = 0,
                    strategy = 'first-match',
                    controls = ["forwarding","server-ssl"],
                    requires = ["http"]
                )
                print("...created policy")
            except Exception as eee:
                print(eee)
                sys.exit(1)
    
    print("...adding rule to policy {0}".format(pol.name))
    rules = pol.rules_s.get_collection()
    
    rule = pol.rules_s.rules.create(
        name = "rule-{0}".format(serverName),
        subPath = 'Drafts',
        ordinal = 0,
        description = 'Redirect to /{0}/{1}'.format(partition, virtualServerName)
    )
    # Incorrect URI path must be corrected else setting condition won't work
    rule._meta_data['uri'] = pol._meta_data['uri'] + 'rules/rule-{0}/'.format(serverName)
    tx = mgmt.tm.transactions.transaction
    with TransactionContextManager(tx) as api:
        print("...add condition")
        rule.conditions_s.conditions.create(**cCondition)
        print("...add actions")
        rule.actions_s.actions.create(**cAction1)
        rule.actions_s.actions.create(**cAction2)
    print("...updating rule")
    rule.update()
    pol.publish()

The issue I'm facing is maybe connected to the actions being added to the rule. When I run the script I receive the following output (rule is deleted manually before each run):

...loaded policy draft
...adding rule to policy policy-test-001
...create rule
...add condition
...add actions
Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/f5/bigip/contexts.py", line 96, in __exit__
    self.transaction.modify(state="VALIDATING",
  File "/usr/lib/python3.9/site-packages/f5/bigip/resource.py", line 423, in modify
    self._modify(**patch)
  File "/usr/lib/python3.9/site-packages/f5/bigip/resource.py", line 408, in _modify
    response = session.patch(patch_uri, json=patch, **requests_params)
  File "/usr/lib/python3.9/site-packages/icontrol/session.py", line 295, in wrapper
    raise iControlUnexpectedHTTPError(error_message, response=response)
icontrol.exceptions.iControlUnexpectedHTTPError: 400 Unexpected Error: Bad Request for uri: https://10.0.0.10:443/mgmt/tm/transaction/1683888226128082/
Text: '{"code":400,"message":"transaction failed:0107186c:3: Policy \'/Common/Drafts/policy-test-001\', rule \'rule-test.local\'; missing or invalid target.","errorStack":[],"apiError":2}'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/var/www/apps/f5-python/./cert.py", line 239, in 
    main(sys.argv[1:])
  File "/var/www/apps/f5-python/./cert.py", line 236, in main
    updatePolicy('Common','policy-test-001', serverName, virtualServerName, environment)
  File "/var/www/apps/f5-python/./cert.py", line 184, in updatePolicy
    rule.actions_s.actions.create(**cAction2)
  File "/usr/lib/python3.9/site-packages/f5/bigip/contexts.py", line 100, in __exit__
    raise TransactionSubmitException(e)
f5.sdk_exception.TransactionSubmitException: 400 Unexpected Error: Bad Request for uri: https://10.0.0.10:443/mgmt/tm/transaction/1683888226128082/
Text: '{"code":400,"message":"transaction failed:0107186c:3: Policy \'/Common/Drafts/policy-test-001\', rule \'rule-test.local\'; missing or invalid target.","errorStack":[],"apiError":2}'

If I comment out the second action additition rule.actions_s.actions.create(**cAction2) I receive the same error but this time rule.actions_s.actions.create(**cAction1).

If both action lines are removed from the code the policy is updated but with only the condition.

Are there any specific things I need to keep in mind when adding actions to a rule and how can I change the code so that it works?

Hi all,

I have question on the PEM rest API query.

[root@ip-10-1-1-8:Active:Standalone] config # tmsh show pem sessiondb all
Pem::Sessiondb
Blade number              0
TMM number                2
-------------------------------------
Subscriber Information  
-------------------------------------
Subscriber Id             demouser1
Subscriber Id Type        NAI
Subscriber Type           Dynamic
-------------------------------------
Session Information     
-------------------------------------
IP Address                10.1.20.11
Policy Server Session Id  
Quota Server Session Id   
Session State             provisioned
Session Origin            radius
User-Name                 
3GPP-IMSI                 
3GPP-IMEISV               
3GPP-User-Location-Info   
Called-Station-Id         
Calling-Station-Id        
NAS-IP-Address            
NAS-IPv6-Address          
Device Name               
Device OS                 
Bytes Uplink              404726
Bytes Downlink            3060546
Flows Total               126
Flows Current             1
Flows Max                 61
Transactions              36
-------------------------------------
Policy Name               Policy Type
-------------------------------------

.......

or query filer with "subscriber-id"

[root@ip-10-1-1-8:Active:Standalone] config # tmsh show pem sessiondb Subscriber-Id demouser1
Pem::Sessiondb
Blade number              0
TMM number                2
-------------------------------------
Subscriber Information  
-------------------------------------
Subscriber Id             demouser1
Subscriber Id Type        NAI
Subscriber Type           Dynamic
-------------------------------------
Session Information     
-------------------------------------
IP Address                10.1.20.11
Policy Server Session Id  
Quota Server Session Id   
Session State             provisioned
Session Origin            radius
User-Name                 
3GPP-IMSI                 
3GPP-IMEISV               
3GPP-User-Location-Info   
Called-Station-Id         
Calling-Station-Id        
NAS-IP-Address            
NAS-IPv6-Address          
Device Name               
Device OS                 
Bytes Uplink              404726
Bytes Downlink            3060546
Flows Total               126
Flows Current             1
Flows Max                 61
Transactions              36
-------------------------------------
Policy Name               Policy Type
-------------------------------------
Student_block             Predefined
Student                   Predefined
-------------------------------------

Total sessions found: 1

But i don't know how can i request in API uri.  I had tried some but still failed.
Can you help to educate me how to convert this as rest API request?

root@ip-10-1-1-8:Active:Standalone] config # curl -k -u admin:admin -H "Content-Type: application/json" -X GET https://10.1.1.8/mgmt/tm/pem/sessiondb?Subscriber-Id=demosuer1
{"code":400,"message":"Query parameter Subscriber-Id is invalid.","errorStack":[],"apiError":1}[root@ip-10-1-1-8:Active:Standalone] config # curl -k -u admin:admin c^C
[root@ip-10-1-1-8:Active:Standalone] config # curl -k -u admin:admin -H "Content-Type: application/json" -X GET https://10.1.1.8/mgmt/tm/pem/sessiondb
{"code":400,"message":"At least one filtering argument or option 'all' must be specified","errorStack":[],"apiError":26214401}[root@ip-10-1-1-8:Active:Standalone] config # curl -k -u admin:admin -H "Content-Type: application/json" -X GET https://10.1.1.8/mgmt/tm/pem/sessiondb/all
{"code":400,"message":"Found unexpected URI tmapi_mapper/pem/sessiondb/all.","errorStack":[],"apiError":1}[root@ip-10-1-1-8:Active:Standalone] config # 
[root@ip-10-1-1-8:Active:Standalone] config # 

I confirm, it works!
It will be interesting to understand now how to enrich the attribute by categorizing the subscriber-id
Thanks a lot for your help