Build allowlist validation

million-views / praas

Proxy as a service.

MIT License

4 stars 2 forks source link

Build allowlist validation #75

Closed 5r1n1 closed 4 years ago

5r1n1 commented 4 years ago

When a request is received by the proxy server, validate its source IP address against the conduit's allowlist. If the ip address is in the allowlist, then proceed. If not generate error.

Acceptance Criteria

[x] setup local loopback interface with pre-defined set of IP addresses
[x] client tests for allowLists
[x] helper functions uses pre-defined IP addresses to generate fake conduits
[x] gateway server validates allowList

m5nv commented 4 years ago

Changed verbiage to keep up with the times.

shinenelson commented 4 years ago

after discussion with @m5nv, we agreed that the allowList validation needs to apply only if at least one IP address is specified in the allowList of the conduit. If not, all connections are accepted.

also, testing this feature might require tinkering with network interfaces on the testing device in order to validate the IP address of the requesting client.

I have updated the issue description ( so that they show up as a checklist on project boards with sub-tasks ) with an acceptance criteria that reflects the discussion points.

m5nv commented 4 years ago

ip allow-list feature is now active in master; till better docs are prepared, the summary is that anyone planning on running npm run test-gateway will now have to run util/loopback-network.sh add script first. This script adds ip addresses used for allowlist testing on to your loopback device. This is a relatively safe operation even though sudo is needed. After the tests are run, the change can be reverted by running util/loopback-network.sh del.

The changes are not persistent. A reboot will restore loopback to its defaults.