Fix IP fencing

[finishes #99446152]

Signed-off-by: Jenny Chou <[email protected]>

Moving IPs to ENV variable

Signed-off-by: Sid Ho <[email protected]>
Signed-off-by: Jenny Chou <[email protected]>
Signed-off-by: Sid Ho <[email protected]>
Signed-off-by: Jenny Chou <[email protected]>

Author: sidho

.gitignore

@@ -25,3 +25,5 @@ manifest.yml
 cf-cli.deb
 
 coverage
+
+config/ips.yml

app/controllers/application_controller.rb

@@ -1,15 +1,22 @@
 class ApplicationController < ActionController::Base
   protect_from_forgery
-  before_filter :boxed
   before_filter :require_login
+  before_filter :boxed
 
   def require_login
-    redirect_to '/login' unless session[:logged_in]
+    mapper = IpFencer.new(hydrate_ips)
+    redirect_to '/login' unless session[:logged_in] || mapper.authorized?(request.remote_ip)
   end
 
-  # Adds an outer container element around any yielded HTML.
-  # TODO: Get rid of this. We shouldn't toggle an HTML wrapping in the controller.
   def boxed
     @boxed = true
   end
+
+  def hydrate_ips
+    ips = ENV['IP_WHITELIST'].split(',')
+
+    ips.map do |ip|
+      IPAddr.new(ip)
+    end
+  end
 end

app/models/ip_fencer.rb

@@ -0,0 +1,19 @@
+class IpFencer
+  def initialize (authorized_ips)
+    @authorized_ips = authorized_ips
+  end
+
+  def authorized?(ip_address_string)
+    begin
+      ip_address = IPAddr.new(ip_address_string)
+      return @authorized_ips.any? { |ip| ip.include? ip_address }
+
+    rescue
+
+      Rails.logger.debug "Rescued from exception while authenticating IP: '#{ip_address_string}'"
+      return false
+    end
+  end
+
+  alias_method :includes?, :authorized?
+end

db/seeds.rb

@@ -10,5 +10,6 @@ if [[ "$TRAVIS_BRANCH" == "master" ]]; then
   git checkout .
   cf set-env whiteboard-acceptance OKTA_SSO_TARGET_URL $OKTA_SSO_TARGET_URL
   cf set-env whiteboard-acceptance OKTA_CERT_FINGERPRINT $OKTA_CERT_FINGERPRINT
+  cf set-env whiteboard-acceptance IP_WHITELIST $IP_WHITELIST
   bundle exec rake SPACE=whiteboard cf:deploy:staging
 fi

script/deploy-staging.sh

@@ -1,31 +1,47 @@
 require 'rails_helper'
 
 describe 'Authenticating', type: :feature do
-  describe 'Logging In' do
+  describe 'Logging Out' do
     before do
       log_in_to_okta('[email protected]')
+      visit '/login'
+      click_on 'Log in with Okta'
     end
 
     it 'allows you to log in and view the dashboard' do
-      visit '/login'
-      expect(page).to have_content('Log in with Okta')
-      click_on 'Log in with Okta'
       expect(page).to have_content('Whiteboard')
-      expect(page).to have_content('Choose a Standup'.upcase)
+      click_on 'Log Out'
+      expect(page).to have_content('You have been logged out.')
     end
   end
 
-  describe 'Logging Out' do
-    before do
-      log_in_to_okta('[email protected]')
-      visit '/login'
-      click_on 'Log in with Okta'
+  context 'from a non-whitelisted ip' do
+    describe 'Logging In' do
+      before do
+        log_in_to_okta('[email protected]')
+      end
+
+      it 'allows you to log in and view the dashboard' do
+        visit '/login'
+        expect(page).to have_content('Log in with Okta')
+        click_on 'Log in with Okta'
+        expect(page).to have_content('Whiteboard')
+        expect(page).to have_content('Choose a Standup'.upcase)
+      end
     end
+  end
 
-    it 'allows you to login and view the dashboard' do
-      expect(page).to have_content('Whiteboard')
-      click_on 'Log Out'
-      expect(page).to have_content('You have been logged out.')
+  context 'from a whitelisted ip' do
+    describe 'logging in' do
+      before do
+        page.driver.header('X-Forwarded-For', '50.194.143.46')
+      end
+
+      it 'should not force user to authenticate' do
+        visit '/'
+        expect(page).not_to have_content('Log in with Okta')
+        expect(page).to have_content('Choose a Standup'.upcase)
+      end
     end
   end
 end

spec/features/authentication_spec.rb

@@ -0,0 +1,19 @@
+require 'rails_helper'
+
+describe IpFencer do
+  describe '#authorized?' do
+    let(:validIp1) { IPAddr.new('127.0.0.8') }
+    let(:validIp2) { IPAddr.new('168.2.1.3') }
+    let(:authorized_ips) { [validIp1, validIp2] }
+    let(:mapper) { IpFencer.new(authorized_ips) }
+
+    it 'can tell if a ip is authorized' do
+      expect(mapper.authorized?('127.0.0.8')).to eq true
+      expect(mapper.authorized?('168.2.1.3')).to eq true
+    end
+
+    it 'returns false with an invalid address' do
+      expect(mapper.authorized?('100.255.13.88')).to eq false
+    end
+  end
+end