Merge pull request #792 from Infisical/fix-ip-whitelisting

Update IP allowlist implementation

backend/src/helpers/workspace.ts

@@ -45,7 +45,7 @@ export const createWorkspace = async ({
 		workspaceId: workspace._id,
 	});
 	
-	// initialize default trusted ip of 0.0.0.0/0
+	// initialize default trusted IPv4 CIDR - 0.0.0.0/0
 	await new TrustedIP({
 		workspace: workspace._id,
 		ipAddress: "0.0.0.0",
@@ -54,6 +54,16 @@ export const createWorkspace = async ({
 		isActive: true,
 		comment: ""
 	}).save()
+	
+	// initialize default trusted IPv6 CIDR - ::/0
+	await new TrustedIP({
+		workspace: workspace._id,
+		ipAddress: "::",
+		type: IPType.IPV6,
+		prefix: 0,
+		isActive: true,
+		comment: ""
+	});
 
 	await EELicenseService.refreshPlan(organizationId);
 

backend/src/utils/setup/backfillData.ts

@@ -567,10 +567,29 @@ export const backfillTrustedIps = async () => {
       $nin: workspaceIdsWithTrustedIps
     }
   });
-
+  
   if (workspaceIdsToAddTrustedIp.length > 0) {
-    const operations = workspaceIdsToAddTrustedIp.map((workspaceId) => {
-      return {
+    const operations: {
+      updateOne: {
+        filter: {
+          workspace: Types.ObjectId;
+          ipAddress: string;
+        },
+        update: {
+          workspace: Types.ObjectId;
+          ipAddress: string;
+          type: string;
+          prefix: number;
+          isActive: boolean;
+          comment: string;
+        },
+        upsert: boolean;
+      }
+    }[] = [];
+    
+    workspaceIdsToAddTrustedIp.forEach((workspaceId) => {
+      // default IPv4 trusted CIDR
+      operations.push({
         updateOne: {
           filter: {
             workspace: workspaceId,
@@ -584,9 +603,28 @@ export const backfillTrustedIps = async () => {
             isActive: true,
             comment: ""
           },
-          upsert: true,
-        },
-      };
+          upsert: true
+        }
+      });
+      
+      // default IPv6 trusted CIDR
+      operations.push({
+        updateOne: {
+          filter: {
+            workspace: workspaceId,
+            ipAddress: "::"
+          },
+          update: {
+            workspace: workspaceId,
+            ipAddress: "::",
+            type: IPType.IPV6.toString(),
+            prefix: 0,
+            isActive: true,
+            comment: ""
+          },
+          upsert: true
+        }
+      });
     });
 
     await TrustedIP.bulkWrite(operations);

backend/src/validation/workspace.ts

@@ -26,6 +26,7 @@ import {
 } from "../variables";
 import { BotService } from "../services";
 import { AuthData } from "../interfaces/middleware";
+import { extractIPDetails } from "../utils/ip";
 
 /**
  * Validate authenticated clients for workspace with id [workspaceId] based
@@ -135,7 +136,8 @@ export const validateClientForWorkspace = async ({
 					}
 				}
 				
-				const check = blockList.check(authData.authIP);
+				const { type } = extractIPDetails(authData.authIP);
+				const check = blockList.check(authData.authIP, type);
 				
 				if (!check) throw UnauthorizedRequestError({
 					message: "Failed workspace authorization"