fix: use valid ip mask in api keys when remote address is ipv6 (#2695)

coadler · web-flow · commit a494489ffac7 · 2022-06-27T20:31:18.000Z
diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go
@@ -172,10 +172,11 @@ func ExtractAPIKey(db database.Store, oauth *OAuth2Configs) func(http.Handler) h
 				if remoteIP == nil {
 					remoteIP = net.IPv4(0, 0, 0, 0)
 				}
+				bitlen := len(remoteIP) * 8
 				key.IPAddress = pqtype.Inet{
 					IPNet: net.IPNet{
 						IP:   remoteIP,
-						Mask: remoteIP.DefaultMask(),
+						Mask: net.CIDRMask(bitlen, bitlen),
 					},
 					Valid: true,
 				}
diff --git a/coderd/users.go b/coderd/users.go
@@ -815,14 +815,15 @@ func (api *API) createAPIKey(rw http.ResponseWriter, r *http.Request, params dat
 	if ip == nil {
 		ip = net.IPv4(0, 0, 0, 0)
 	}
+	bitlen := len(ip) * 8
 	key, err := api.Database.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
 		ID:              keyID,
 		UserID:          params.UserID,
 		LifetimeSeconds: params.LifetimeSeconds,
 		IPAddress: pqtype.Inet{
 			IPNet: net.IPNet{
 				IP:   ip,
-				Mask: ip.DefaultMask(),
+				Mask: net.CIDRMask(bitlen, bitlen),
 			},
 			Valid: true,
 		},

Original file line number	Diff line number	Diff line change
`@@ -172,10 +172,11 @@ func ExtractAPIKey(db database.Store, oauth *OAuth2Configs) func(http.Handler) h`
`172`	`172`	`if remoteIP == nil {`
`173`	`173`	`remoteIP = net.IPv4(0, 0, 0, 0)`
`174`	`174`	`}`
	`175`	`+ bitlen := len(remoteIP) * 8`
`175`	`176`	`key.IPAddress = pqtype.Inet{`
`176`	`177`	`IPNet: net.IPNet{`
`177`	`178`	`IP: remoteIP,`
`178`		`- Mask: remoteIP.DefaultMask(),`
	`179`	`+ Mask: net.CIDRMask(bitlen, bitlen),`
`179`	`180`	`},`
`180`	`181`	`Valid: true,`
`181`	`182`	`}`