AccessControl variable SourceAddress

[andresquijano]

Hi,

I want to be able to store on each user app as a custom attribute the IP range they will be calling the proxies, in order to use that value inside an AccessControl policy, something like:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AccessControl async="false" continueOnError="false" enabled="true" name="IP-Access-Control">
    <DisplayName>IP Access Control</DisplayName>
    <IPRules noRuleMatchAction="DENY">
        <MatchRule action="ALLOW">
            <SourceAddress mask="32">{verifyapikey.Verify-API-Key.ip-range}</SourceAddress>
        </MatchRule>
    </IPRules>
</AccessControl>

But that doesn't work. Is it possible to use a variable reference in that policy? I saw on another question that the proposed answer was to use a JS callout, but that answer was to only check for ip equality, and I would like to have the flexibility of CIDR notation (i.e. use masks a la /24) without having to manually implement it in JS.

Thanks

[dchiesa1]

I understand the question.

Sadly, The SourceAddress is not dynamically specifiable.

There is an outstanding request in the backlog for the capability you seek: b/67167219

Do you have an enterprise account? If so, you may be able to raise the importance of this request by speaking with your sales contact.

[andresquijano]

Thanks for your reply Dino. We are in procurement for an enterprise account, so not for the time being.

I managed to work around this using a Javascript policy:

var ip = context.getVariable('proxy.client.ip'); 

var mask = context.getVariable('verifyapikey.Verify-API-Key.iprange');

if (!inSubNet(ip, mask)) {
  throw new Error("Illegal IP: " + ip);
}

[DineshPalanivel]

Hello Dino

Is there any movement on the bug b/67167219? I have a similar requirement.

[ssvaidyanathan]

https://docs.apigee.com/api-platform/reference/policies/access-control-policy#deny-using-variables

[DineshPalanivel]

Unfortunately it won't work for a dynamic list of IPs. Example: We might have a varying list of IPs in KVMs and how do we handle that scenario?

[dknezic]

Use a javascript policy to implement the needed custom logic to suit how you're storing this in the KVM