It took me a while to figure out that this was the package that had disabled all of my log messages. Your init() function runs for everybody that imports this library.

hi,

in metal-api we have some cleanup code that looks like this:

// release and delete
	err := a.ReleaseIP(*ip)
	if err != nil {
		return fmt.Errorf("cannot release IP %q: %w", ip.IPAddress, err)
	}
	err = a.DeleteIP(ip)
	if err != nil {
		return fmt.Errorf("cannot delete IP %q: %w", ip.IPAddress, err)
	}

the problem with the ReleaseIP and the DeleteIP is that they only return errors or OK. but the caller does not know if the error can be ignored or not.

suppose a function which does the upper block until it success. this is a problem if the ReleaseIP succeeds but the DeleteIP does not. In this case the next call of this block will fail with the ReleaseIP because the previous call to this code already released the IP. So the DeleteIP will never be reached again.

• the functions should return specific error-codes like NotFound so the caller can ignore this specific errors.
  --- OR ---
• the library should contain higher level functions like ReleaseAndDeleteIP which work with one transaction and they succeed or fail.

https://clickhouse.com/docs/en/integrations/go

https://www.postgresql.org/docs/14/datatype-json.html

Example

SELECT jsonb_column['key'] FROM table;
UPDATE table SET jsonb_column['key'] = '"value"';

Currently, according to

I'm looking for a solution that supports variable prefix allocation e.g. /24 /23 /22 again /24

Any chance that it can be implemented soon? @majst01

#102 has caused a regression in handling special characters in passwords.

In this case, my username/password comes from a kubernetes operator - i don't have control over how it's generated.

2023/02/20 17:16:42 Error in cli: parse "postgres://ipam:+S-@u]JBpWo^kduE7+([email protected]:5432/ipam?sslmode=require": net/url: invalid userinfo: unable to parse base URL:postgres://ipam:+S-@u]JBpWo^kduE7+([email protected]:5432/ipam?sslmode=require

unable to connect to database:dial tcp 127.0.0.1:5432: connect: connection refused

Hi. First of all I want to thank you for this project ;-)

I would like to know how to read your error messages and work with them.
The following scenario: I want to acquire a specific IP with AcquireSpecificIP() and it could be possible that this IP is already acquired, but that's ok. So I would like to read the error message like this

_, err = ipam.Ipamer.AcquireSpecificIP(ctx, prefix, ip)
if err != nil {
	if err == goipam.ErrAlreadyAllocated {
		log.Warnln("this is ok")
	} else {
		log.Errorln(err)
		return err
	}
}

But this does not work as expected, since I could see the error message is an assembled string. Can you tell me how to work with Variables and your error messages?

Because sqlx seems stale

For prefixes which are not for machines, but only for prefix ranges available for other purposes, wasting the network and the broadcast address is bad.

Add a flag for prefix acquire to skip this reservation

I'm trying to implement IPAM in stateless environment using Redis as central DB. After analyzing redis module it seems that there will be racing and traffic congestion issues.

1. To AcquireIP() library first calls ReadPrefix(). Then it locally fetches next available IP. After that UpdatePrefix() to write data back.
   Problem here that another node might have called ReadPrefix() with same state and will try to attempt same UpdatePrefix()
2. UpdatePrefix() relates on 'optimistic lock' by checking version. On failure (other node changed version) the whole process will be started again up to 10 times.
   Here I see that in case there are many nodes trying to work with same CIDR there will be racing condition. In the end current node can easily stumble on 10 retries and fail to allocate IP.
   Also Redis locks data only on read-write operations. So between version Read and updated prefix Write operation another node might update same prefix data. This result that 2 nodes allocates same IP from CIDR pool and both will consider operation to be successful.
3. Traffic congestion on lock checks, retries.

Library is OK for single node operation, but won't do on multinode due to lack of syncronization. Easy and dirty solution would be SETNX as a mutex. But this will slow operatons while other nodes wait for lock release.

There is also PubSub model. Where nodes can passively watch for key chanes. This way nodes can track updates and react faster on them.

And finally we should keep in mind latency. Extra checks and retries increases traffic. Instead it is more preferable to Pipeline or Script Redis commands.

I would like to add support for a mongodb storage back-end, and I'm also willing to contribute the code. I've tested it locally, with tests passing and benchmarks appearing favorable. Are you open to such a contribution? Cheers.

The current Storage interface returns Prefix structs. But the Prefix struct contains private fields which cannot be filled/returned by external implementations as they do not see this fields. But the Prefix implementation relies on these fields and their correctness.

i see the following options:

• extend the Storage interface with methods for manipulating the current private fields
• create a new StoragePrefix which is returned/consumed by a storage and contains only the data from the storage. the Prefix always copies the data to it's own fields.
• make the interface private and remove the NewWithStorage fuction. new storage backends have to be provided by the library and must provided as PR's

i'd propose the third option as atm i cannot see any other implementations for Storage from outside of our project.

I have ran the etcd on my local mac and I can curl without an issue, I tried to access ipam with edcd backend using a docker compose file and getting an error

{"level":"warn","ts":"2024-05-05T11:58:26.550315Z","logger":"etcd-client","caller":"[email protected]/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"etcd-endpoints://0x400037a8c0/localhost:2379","attempt":0,"error":"rpc error: code = DeadlineExceeded desc = latest balancer error: last connection error: connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:2379: connect: connection refused""}
ipam-1 | 2024/05/05 11:58:26 Error in cli: context deadline exceeded
ipam-1 exited with code 1

ipam: image: go-ipam environment: - GOIPAM_GRPC_SERVER_ENDPOINT=0.0.0.0:9090 - GOIPAM_ETCD_HOST=localhost - GOIPAM_ETCD_PORT=2379 # - GOIPAM_ETCD_CERT_FILE=cert.pem # - GOIPAM_ETCD_KEY_FILE=key.pem - GOIPAM_ETCD_INSECURE_SKIP_VERIFY=false restart: always command: etcd ports: - 9090:9090 healthcheck: test: ["CMD", "/bin/grpc_health_probe", "-addr","localhost:9090"] interval: 10s timeout: 2s retries: 3 start_period: 10s

this is a part of the compose file I used.

see https://devandchill.com/posts/2020/05/go-lib/pq-or-pgx-which-performs-better/

Hi, first off, awesome project, you all have done a really nice job!!

Quick question, are there plans to implement AcquireSpecificIP in the grpc IpamServiceClient Interface?

Looks like it accepts the /32 specific requested address in a prefix to lease but doesnt use it. apiv1.AcquireIPRequest{...}

Here we pass in a specific /32 but get returned the next ip in the pool.

	res, err := ct.ipam.AcquireIP(ctx, connect.NewRequest(&apiv1.AcquireIPRequest{
		PrefixCidr: ipamPrefix,
		Ip:         &nodeAddress,
	}))

Happy to hack, just wondering if this was a todo or specifically left out of the IpamServiceClient implementation. Thanks again for the neat project! 🥇

https://golangci.com/

Is there a idiomatic way to store metadata like name and alike for the various CIDRs/ IPs ?

This DB seems to be a viable alternative for ha distributed storage.

https://github.com/rqlite/rqlite

Transaction durability got better: https://rqlite.io/docs/api/read-consistency/

Add the ability to create a backup which does not depend on the used storage engine which enables end-users to migrate from one storage backend to another

Both calls must consider all existing Namespaces

Currently cidr/prefix is the primary key, therefore it is not possible to allocate the same prefix for two or more usage scenarios.
This restriction is valid for example for internet prefixes, but not for private network prefixes of nodes. They can overlap, the node prefixes must be disjoint, only if communication between the clusters is required.

A possible solution would be to make the primary key a joined primary key from UUID and CIDR/Prefix. The UUID is either totally unique, or a grouping,for example like a project or internet prefix.

Migration of the existing data to the new schema is a hard requirement.

This approach would also help to identify ips more easily in scenarios where they where released and acquired by different users.

@Gerrit91

Hey everyone!
I am playing around with this library in my IPAM controller for Kubernetes https://github.com/routerd/kube-ipam.

Today I stumbled across a strange Bug.
When a specific IPv6 address is already allocated AcquireSpecificIP will block forever...
(or at least longer than I am patient for :D -> 5min+ )

Hope I am not just grossly misusing this library :)

Tested on v1.8.1 according to go.mod

$ go version
go version go1.15.8 linux/amd64

Here is a little go-snippet that I have used to reproduce the issue:

const (
	cidr = "fd9c:fd74:6b8d:1020::/64"
)

func main() {
	ipam := goipam.New()
	ipam.NewPrefix(cidr)

	ip1, err := ipam.AcquireSpecificIP(cidr, "fd9c:fd74:6b8d:1020::1")
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	fmt.Println("got static: ", ip1)

	ip2, err := ipam.AcquireSpecificIP(cidr, "fd9c:fd74:6b8d:1020::1")
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	fmt.Println("got static: ", ip2)
}

will return:

$ go run ./ipv6/main.go 
got static:  &{fd9c:fd74:6b8d:1020::1 fd9c:fd74:6b8d:1020::/64}
< blocks forever >

The same code using IPv4 is working fine:

const (
	cidr = "172.20.0.0/24"
)

func main() {
	ipam := goipam.New()
	ipam.NewPrefix(cidr)

	ip1, err := ipam.AcquireSpecificIP(cidr, "172.20.0.1")
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	fmt.Println("got static: ", ip1)

	ip2, err := ipam.AcquireSpecificIP(cidr, "172.20.0.1")
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	fmt.Println("got static: ", ip2)
}

$ go run ./ipv4/main.go
got static:  &{172.20.0.1 172.20.0.0/24}
NoIPAvailableError: no more ips in prefix: 172.20.0.0/24 left, length of prefix.ips: 3
exit status 1

From what I could tell, the Ipamer interface is there to abstract out the Storage backend.

Wouldn't it make sense to have a method in the Ipamer interface to fetch existing CIDRs?

Only way I can see how to do it right now is via the ReadAllPrefixCidrs() method in the Storage interface.

Am I missing something?

Version: go-ipam v1.11.6

Here's the exact line that panics: https://github.com/metal-stack/go-ipam/blob/master/prefix.go#L642

The code to reproduce the issue:

package main

import (
	"context"
	"fmt"

	goipam "github.com/metal-stack/go-ipam"
)

type Subnet struct {
	cidr       string
	parentCidr string
}

var parentSubnets = []Subnet{
	{
		cidr:       "192.168.0.0/24",
		parentCidr: "",
	},
}

var subnets = []Subnet{
	{
		cidr:       "192.168.0.0/30",
		parentCidr: "192.168.0.0/24",
	},
}

var storage = map[string][]Subnet{
	"parents":  parentSubnets,
	"children": subnets,
}

func main() {
	ipam := goipam.New()

	ctx := context.Background()

	for _, parent := range storage["parents"] {
		parPrefix, err := ipam.NewPrefix(ctx, parent.cidr)
		if err != nil {
			fmt.Println(err)
		}

		for _, child := range storage["children"] {
			if child.parentCidr == parent.cidr {
				chPrefix, err := ipam.AcquireSpecificChildPrefix(ctx, parent.cidr, child.cidr)
				if err != nil {
					fmt.Println(err)
				}

                                 // This call will panic
				u := chPrefix.Usage()
				_ = u
			}
		}
	}
}

They claim to be 100% compatible with MongoDB so prove that and see the differences

https://github.com/FerretDB/FerretDB

Example/Usage of IP acquire and IP release with etcd or mongodb backend

I have deployed etcd and mongodb as a containerized service. I could not see any examples for etcd or mongodb backed IP acquire and IP release operations.

Current examples shows how to do IP acquire and release using in memory db not with external db.

Need your help for any pointers.

When a prefix is "loaded" - meaning that we have acquired a large number of ips from it - performance degrades as O(number of acquired IPs)

The benchmark code misses this because it immediately releases IPs after acquiring them. But with a slight change, you can see this:

--- a/prefix_benchmark_test.go
+++ b/prefix_benchmark_test.go
@@ -33,6 +33,7 @@ func BenchmarkAcquireIP(b *testing.B) {
                if err != nil {
                        panic(err)
                }
+               ips := make([]*IP, b.N)
                for n := 0; n < b.N; n++ {
                        ip, err := ipam.AcquireIP(ctx, p.Cidr)
                        if err != nil {
@@ -41,7 +42,10 @@ func BenchmarkAcquireIP(b *testing.B) {
                        if ip == nil {
                                panic("IP nil")
                        }
-                       p, err = ipam.ReleaseIP(ctx, ip)
+                       ips[n] = ip
+               }
+               for _, i := range ips {
+                       _, err := ipam.ReleaseIP(ctx, i)
                        if err != nil {
                                panic(err)
                        }

You should see performance degrade significantly.

On my machine, if i measure the time it takes to acquire the last IP, with in-memory storage the 2nd acquired is ~1us, the 101st is 13us, and the 10001 is 1ms.

I believe this is due to this loop: https://github.com/metal-stack/go-ipam/blob/master/prefix.go#L378, which will scan the entire range.

the Prefix struct contains a mutex named mux which is used for locking. This will only work when using the memory storage as you are using a central map with pointers to prefixes.

when using the database storage, every call to PrefixFrom returns a new prefix so every prefix will contain a new mutex. The locking will not work here.

I'd propose to completely remove this locking. if you really want to lock, it must be an implemenation detail of the concrete storage mechanism.

This should boost performance quite a lot

It's not possible (or at least I cannot do it) allocate a specific child Prefix given a Parent: function AcquireChildPrefix does not allow you to specify a Prefix.
Are you planning to implement this feature?

Using file.json ( other storage types untested ), creating new prefixes in separate namespaces works fine. However, when usingReadAllPrefixCidrs, it always returns values from the root namespace, completely ignoring the ones in the namespace it should query.

Code sample:

package main

import (
	context "context"
	"log"
	"time"

	"github.com/metal-stack/go-ipam"
)

var (
	rootNamespace = "root"
	ns            = "tenant-a"
	rootPrfx      = "10.76.0.0/25"
	contextPrfx   = "10.76.0.128/25"
)

func main() {

	rootCtx := context.Background()
	rootCtx, cancel := context.WithTimeout(rootCtx, 5*time.Second)
	defer cancel()

	storage := ipam.NewLocalFile(rootCtx, "file.json")

	ipamer := ipam.NewWithStorage(storage)

	ipamer.CreateNamespace(rootCtx, ns)
	log.Printf("\nCreated namespace %v", ns)

	log.Printf("\nCreating CIDR %v in %v namespace", rootPrfx, rootNamespace)
	_, err := ipamer.NewPrefix(rootCtx, rootPrfx)

	if err != nil {
		panic(err.Error())
	}

	tenantCtx := ipam.NewContextWithNamespace(rootCtx, ns)

	log.Printf("\nCreating CIDR %v in %v namespace", contextPrfx, ns)
	_, err = ipamer.NewPrefix(tenantCtx, contextPrfx)

	if err != nil {
		panic(err.Error())
	}

	rootCidrs, err := ipamer.ReadAllPrefixCidrs(rootCtx)
	if err != nil {
		panic(err.Error())
	}

	log.Printf("Discovered context cidr %v for %v", rootCidrs, rootNamespace)

	contextCidrs, err := ipamer.ReadAllPrefixCidrs(tenantCtx)
	if err != nil {
		panic(err.Error())
	}

	log.Printf("Discovered context cidr %v for %v", contextCidrs, ns)
}

Current result:

2023/11/21 16:41:56
Created namespace tenant-a
2023/11/21 16:41:56
Creating CIDR 10.76.0.0/25 in root namespace
2023/11/21 16:41:56
Creating CIDR 10.76.0.128/25 in tenant-a namespace
2023/11/21 16:41:56 Discovered context cidr [10.76.0.0/25] for root
2023/11/21 16:41:56 Discovered context cidr [10.76.0.0/25] for tenant-a

Expected result:

2023/11/21 16:41:56
Created namespace tenant-a
2023/11/21 16:41:56
Creating CIDR 10.76.0.0/25 in root namespace
2023/11/21 16:41:56
Creating CIDR 10.76.0.128/25 in tenant-a namespace
2023/11/21 16:41:56 Discovered context cidr [10.76.0.0/25] for root
2023/11/21 16:41:56 Discovered context cidr [10.76.0.128/25] for tenant-a

For reference, the json file that is being created looks like this:

{
  "root": {
    "10.76.0.0/25": {
      "Cidr": "10.76.0.0/25",
      "ParentCidr": "",
      "Namespace": "",
      "AvailableChildPrefixes": {},
      "ChildPrefixLength": 0,
      "IsParent": false,
      "IPs": {
        "10.76.0.0": true,
        "10.76.0.127": true
      },
      "Version": 0
    }
  },
  "tenant-a": {
    "10.76.0.128/25": {
      "Cidr": "10.76.0.128/25",
      "ParentCidr": "",
      "Namespace": "",
      "AvailableChildPrefixes": {},
      "ChildPrefixLength": 0,
      "IsParent": false,
      "IPs": {
        "10.76.0.128": true,
        "10.76.0.255": true
      },
      "Version": 0
    }
  }
}

I can run the container and execute cli to create prefix, but when I tried to do this with curl -X POST -H "Content-Type: application/json" -d '{"cidr": "192.168.0.0/16"}' http://localhost:9090/prefix/create

connection is not working even I have expose 9090 to host

As per official Redis guidelines

Warning: consider KEYS as a command that should only be used in production environments with extreme care. It may ruin performance when it is executed against large databases. This command is intended for debugging and special operations, such as changing your keyspace layout. Don't use KEYS in your regular application code. If you're looking for a way to find keys in a subset of your keyspace, consider using SCAN or sets.

https://redis.io/commands/keys/