Skip to content

{AppService} Add ip-address validation #12312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qwordy merged 1 commit into from
Feb 28, 2020
Merged

{AppService} Add ip-address validation #12312

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/azure-cli/azure/cli/command_modules/appservice/_params.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
from ._completers import get_hostname_completion_list
from ._constants import FUNCTIONS_VERSIONS_FUNCTIONAPP, RUNTIME_TO_IMAGE_FUNCTIONAPP
from ._validators import (validate_timeout_value, validate_site_create, validate_asp_create,
validate_add_vnet, validate_front_end_scale_factor, validate_ase_create)
validate_add_vnet, validate_front_end_scale_factor, validate_ase_create, validate_ip_address)


AUTH_TYPES = {
Expand Down Expand Up @@ -556,7 +556,7 @@ def load_arguments(self, _):
c.argument('description', help='Description of the access restriction rule')
c.argument('action', arg_type=get_enum_type(ACCESS_RESTRICTION_ACTION_TYPES),
help="Allow or deny access")
c.argument('ip_address', help="IP address or CIDR range")
c.argument('ip_address', help="IP address or CIDR range", validator=validate_ip_address)
c.argument('vnet_name', help="vNet name")
c.argument('subnet', help="Subnet name (requires vNet name) or subnet resource id")
c.argument('ignore_missing_vnet_service_endpoint',
Expand All @@ -570,7 +570,7 @@ def load_arguments(self, _):
c.argument('name', arg_type=webapp_name_arg_type)
c.argument('rule_name', options_list=['--rule-name', '-r'],
help='Name of the access restriction to remove')
c.argument('ip_address', help="IP address or CIDR range")
c.argument('ip_address', help="IP address or CIDR range", validator=validate_ip_address)
c.argument('vnet_name', help="vNet name")
c.argument('subnet', help="Subnet name (requires vNet name) or subnet resource id")
c.argument('scm_site', help='True if access restriction should be removed from scm site',
Expand Down
20 changes: 20 additions & 0 deletions src/azure-cli/azure/cli/command_modules/appservice/_validators.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,3 +162,23 @@ def validate_asp_sku(cmd, namespace):
if res.get('properties').get('hostingEnvironment') is not None:
raise CLIError("Only pricing tier 'Isolated' is allowed in this app service plan. Use this link to "
"learn more: https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans")


def validate_ip_address(namespace):
if namespace.ip_address is not None:
# IPv6
if ':' in namespace.ip_address:
Copy link
Member

@yungezz yungezz Feb 24, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just curious, is there existing python lib for ip address validation?

Copy link
Contributor Author

@madsd madsd Feb 27, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @yungezz. There is an ipaddress library (https://docs.python.org/3/library/ipaddress.html) and I had also evaluated it, but did not find it fit for the purpose. For a simple validation and ensuring that a single IP is converted to a CIDR, the code in this PR should handle it.

if namespace.ip_address.count(':') > 1:
if '/' not in namespace.ip_address:
namespace.ip_address = namespace.ip_address + '/128'
return
return
# IPv4
elif '.' in namespace.ip_address:
if namespace.ip_address.count('.') == 3:
if '/' not in namespace.ip_address:
namespace.ip_address = namespace.ip_address + '/32'
return
return

raise CLIError('Invalid IP address')
2 changes: 1 addition & 1 deletion src/azure-cli/azure/cli/command_modules/appservice/access_restrictions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ def add_webapp_access_restriction(
configs = get_site_configs(cmd, resource_group_name, name, slot)

if (ip_address and subnet) or (not ip_address and not subnet):
raise CLIError('Usage error: --subnet | --ip_address')
raise CLIError('Usage error: --subnet | --ip-address')

# get rules list
access_rules = configs.scm_ip_security_restrictions if scm_site else configs.ip_security_restrictions
Expand Down
Loading