[PR #666] [MERGED] Allow CIDR ranges in Allowed IPs #759

New Issue

GiteaMirror · 2025-10-31T15:21:03-05:00

GiteaMirror commented

2025-10-31 15:21:03 -05:00

📋 Pull Request Information

Original PR: https://github.com/moghtech/komodo/pull/666
Author: @bpbradley
Created: 7/15/2025
Status: ✅ Merged
Merged: 7/28/2025
Merged by: @mbecker20

Base: 1.18.5 ← Head: support_cidr

📝 Commits (2)

3444d8c Allow CIDR ranges in Allowed IPs
fdd2982 Catch mixed IPv4/IPv6 mappings that are probably intended to match

📊 Changes

5 files changed (+28 additions, -14 deletions)

View changed files

📝 Cargo.toml (+1 -0)
📝 bin/periphery/Cargo.toml (+1 -0)
📝 bin/periphery/src/api/router.rs (+19 -8)
📝 client/core/rs/Cargo.toml (+2 -1)
📝 client/core/rs/src/entities/config/periphery.rs (+5 -5)

📄 Description

Attempt to implement #631

Changes allowed_ips from IpAddr to IpNetwork. The default serde will accept IP addresses and convert them to a /32 or /128 prefix if needed (depending on if the IP is v4 or v6).

For example

  periphery:
    environment:
      PERIPHERY_ALLOWED_IPS: "172.25.3.0/24,172.25.0.4,::ffff:172.25.55.3/64,::ffff:172.25.55.4"

Turns into

allowed_ips: [V4(Ipv4Network { addr: 172.25.3.0, prefix: 24 }), V4(Ipv4Network { addr: 172.25.0.4, prefix: 32 }), V6(Ipv6Network { addr: ::ffff:172.25.55.3, prefix: 64 }), V6(Ipv6Network { addr: ::ffff:172.25.55.4, prefix: 128 })]

I also added a check to the matching function in guard_request_by_ip that will check the ip network type, and when the network is IPv4, it will convert the address to its canonical form. This way, you can use a standard IPv4 address without IPv6 mapping, even if your bind IP is [::]

Will test some more tonight with more corner cases, but working for me with basic tests.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/moghtech/komodo/pull/666 **Author:** [@bpbradley](https://github.com/bpbradley) **Created:** 7/15/2025 **Status:** ✅ Merged **Merged:** 7/28/2025 **Merged by:** [@mbecker20](https://github.com/mbecker20) **Base:** `1.18.5` ← **Head:** `support_cidr` --- ### 📝 Commits (2) - [`3444d8c`](https://github.com/moghtech/komodo/commit/3444d8cfc8b4319ef528235c79de76d8981823e3) Allow CIDR ranges in Allowed IPs - [`fdd2982`](https://github.com/moghtech/komodo/commit/fdd2982fb34663dfb7295f6f9514c4b666728575) Catch mixed IPv4/IPv6 mappings that are probably intended to match ### 📊 Changes **5 files changed** (+28 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.toml` (+1 -0) 📝 `bin/periphery/Cargo.toml` (+1 -0) 📝 `bin/periphery/src/api/router.rs` (+19 -8) 📝 `client/core/rs/Cargo.toml` (+2 -1) 📝 `client/core/rs/src/entities/config/periphery.rs` (+5 -5) </details> ### 📄 Description Attempt to implement #631 Changes `allowed_ips` from `IpAddr` to `IpNetwork`. The default serde will accept IP addresses and convert them to a /32 or /128 prefix if needed (depending on if the IP is v4 or v6). For example ```yaml periphery: environment: PERIPHERY_ALLOWED_IPS: "172.25.3.0/24,172.25.0.4,::ffff:172.25.55.3/64,::ffff:172.25.55.4" ``` Turns into ``` allowed_ips: [V4(Ipv4Network { addr: 172.25.3.0, prefix: 24 }), V4(Ipv4Network { addr: 172.25.0.4, prefix: 32 }), V6(Ipv6Network { addr: ::ffff:172.25.55.3, prefix: 64 }), V6(Ipv6Network { addr: ::ffff:172.25.55.4, prefix: 128 })] ``` I also added a check to the matching function in `guard_request_by_ip` that will check the ip network type, and when the network is IPv4, it will convert the address to its canonical form. This way, you can use a standard IPv4 address without IPv6 mapping, even if your bind IP is `[::]` Will test some more tonight with more corner cases, but working for me with basic tests. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-10-31 15:21:03 -05:00

GiteaMirror closed this issue

2025-10-31 15:21:03 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/komodo#759