Environment
- EDR Server: 7.7.0
- Hosted EDR: 7.7.0
Objective
Using the REST API (/api/approvedlist/entries) to add CIDR IP ranges fails with a "400 Bad Request" error. For example:
[root@localhost]# curl -k -X POST "https://FQDN/api/approvedlist/entries" -H "X-Auth-Token:`psql -d cb -p 5002 -t -c 'select auth_token from cb_user where id = 1;'`" -H "Content-Type: application/json" -d "{\"ipaddr\": \"1.2.3.4/24\"}"
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>400 Bad Request</title>
<h1>Bad Request</h1>
<p>The browser (or proxy) sent a request that this server could not understand.</p>Resolution
Workaround:
1. Insert a new CIDR IP range directly into the Postgres database, replacing <x.x.x.x/y> with your IP range:
psql -d cb -p 5002 -c "insert into nginx_approvedlist (ipaddr) values ('<x.x.x.x/y>');"
2. Repeat step 1 for each IP address or CIDR IP range to be added.
3. Restart the cluster to make changes take effect.
/usr/share/cb/cbcluster stop
/usr/share/cb/cbcluster start
4. You can validate that the IP range was added to the nginx approved list by reviewing this file:
cat /var/cb/nginx/props/nginx.runtime.ipfilters.prop
Additional Notes
- The REST API (/api/approvedlist/entries) can still be used with single IP addresses in EDR Server 7.7.0.
- For Hosted EDR customers, please open a case with VMware Carbon Black Technical Support to implement the workaround above on your behalf, until the issue (CB-39972) is fixed in a future release.
