From 7f17194c0f31766f4a647a90e9d8f4c6f7a78658 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Sun, 7 Jan 2024 16:32:25 +0100 Subject: [PATCH] Add IPv6 consideration to default identities IP allowlist --- .../controllers/v1/universalAuthController.ts | 8 +++--- backend/src/validation/auth.ts | 4 +-- .../IdentityUniversalAuthForm.tsx | 28 +++++++++++-------- 3 files changed, 22 insertions(+), 18 deletions(-) diff --git a/backend/src/controllers/v1/universalAuthController.ts b/backend/src/controllers/v1/universalAuthController.ts index 0e8818985..9e5bba715 100644 --- a/backend/src/controllers/v1/universalAuthController.ts +++ b/backend/src/controllers/v1/universalAuthController.ts @@ -550,7 +550,7 @@ export const attachIdentityUniversalAuth = async (req: Request, res: Response) = // validate trusted ips const reformattedClientSecretTrustedIps = clientSecretTrustedIps.map((clientSecretTrustedIp) => { - if (!plan.ipAllowlisting && clientSecretTrustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({ + if (!plan.ipAllowlisting && (clientSecretTrustedIp.ipAddress !== "0.0.0.0/0" && clientSecretTrustedIp.ipAddress !== "::/0")) return res.status(400).send({ message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range." }); @@ -564,7 +564,7 @@ export const attachIdentityUniversalAuth = async (req: Request, res: Response) = }); const reformattedAccessTokenTrustedIps = accessTokenTrustedIps.map((accessTokenTrustedIp) => { - if (!plan.ipAllowlisting && accessTokenTrustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({ + if (!plan.ipAllowlisting && (accessTokenTrustedIp.ipAddress !== "0.0.0.0/0" && accessTokenTrustedIp.ipAddress !== "::/0")) return res.status(400).send({ message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range." }); @@ -750,7 +750,7 @@ export const updateIdentityUniversalAuth = async (req: Request, res: Response) = let reformattedClientSecretTrustedIps; if (clientSecretTrustedIps) { reformattedClientSecretTrustedIps = clientSecretTrustedIps.map((clientSecretTrustedIp) => { - if (!plan.ipAllowlisting && clientSecretTrustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({ + if (!plan.ipAllowlisting && (clientSecretTrustedIp.ipAddress !== "0.0.0.0/0" && clientSecretTrustedIp.ipAddress !== "::/0")) return res.status(400).send({ message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range." }); @@ -767,7 +767,7 @@ export const updateIdentityUniversalAuth = async (req: Request, res: Response) = let reformattedAccessTokenTrustedIps; if (accessTokenTrustedIps) { reformattedAccessTokenTrustedIps = accessTokenTrustedIps.map((accessTokenTrustedIp) => { - if (!plan.ipAllowlisting && accessTokenTrustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({ + if (!plan.ipAllowlisting && (accessTokenTrustedIp.ipAddress !== "0.0.0.0/0" && accessTokenTrustedIp.ipAddress !== "::/0")) return res.status(400).send({ message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range." }); diff --git a/backend/src/validation/auth.ts b/backend/src/validation/auth.ts index 08ec3ac95..6e494a66b 100644 --- a/backend/src/validation/auth.ts +++ b/backend/src/validation/auth.ts @@ -108,14 +108,14 @@ export const AddUniversalAuthToIdentityV1 = z.object({ }) .array() .min(1) - .default([{ ipAddress: "0.0.0.0/0" }]), + .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]), accessTokenTrustedIps: z .object({ ipAddress: z.string().trim(), }) .array() .min(1) - .default([{ ipAddress: "0.0.0.0/0" }]), + .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]), accessTokenTTL: z.number().int().min(1).refine(value => value !== 0, { message: "accessTokenTTL must have a non zero number", }).default(2592000), diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx index 6261da947..13a2e1bf5 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx @@ -91,12 +91,14 @@ export const IdentityUniversalAuthForm = ({ accessTokenTTL: "2592000", accessTokenMaxTTL: "2592000", accessTokenNumUsesLimit: "0", - clientSecretTrustedIps: [{ - ipAddress: "0.0.0.0/0" - }], - accessTokenTrustedIps: [{ - ipAddress: "0.0.0.0/0" - }], + clientSecretTrustedIps: [ + { ipAddress: "0.0.0.0/0" }, + { ipAddress: "::/0" } + ], + accessTokenTrustedIps: [ + { ipAddress: "0.0.0.0/0" }, + { ipAddress: "::/0" } + ], } }); @@ -139,12 +141,14 @@ export const IdentityUniversalAuthForm = ({ accessTokenTTL: "2592000", accessTokenMaxTTL: "2592000", accessTokenNumUsesLimit: "0", - clientSecretTrustedIps: [{ - ipAddress: "0.0.0.0/0" - }], - accessTokenTrustedIps: [{ - ipAddress: "0.0.0.0/0" - }] + clientSecretTrustedIps: [ + { ipAddress: "0.0.0.0/0" }, + { ipAddress: "::/0" } + ], + accessTokenTrustedIps: [ + { ipAddress: "0.0.0.0/0" }, + { ipAddress: "::/0" } + ] }); } }, [data]);