Support "Internet" as a valid IP address in the config file

[jemrobinson]

✅ Checklist

• I have searched open and closed issues for duplicates.
• This is a request for a new feature in the Data Safe Haven or an upgrade to an existing feature.
• The feature is still missing in the latest version.
• I have read through the documentation.
• This isn't an open-ended question (open a discussion if it is).

🍓 Suggested change

Support "Internet" as a valid IP address in the config file

🚂 How could this be done?

[JimMadge]

@jemrobinson You've made an infinite loop 🤯

[JimMadge]

As the config values are parsed as IP ranges, can we use something like * or 0.0.0.0/0?

[JimMadge]

For the user IP address ranges,

data-safe-haven/data_safe_haven/infrastructure/programs/declarative_sre.py

Lines 144 to 163 in eede40f

	# Deploy networking
	networking = SRENetworkingComponent(
	"sre_networking",
	self.stack_name,
	SRENetworkingProps(
	dns_private_zones=dns.private_zones,
	dns_server_ip=dns.ip_address,
	dns_virtual_network=dns.virtual_network,
	location=self.config.azure.location,
	resource_group_name=resource_group.name,
	shm_fqdn=shm_fqdn,
	shm_location=shm_location,
	shm_resource_group_name=self.context.resource_group_name,
	shm_subscription_id=shm_subscription_id,
	shm_zone_name=shm_fqdn,
	sre_name=self.config.name,
	user_public_ip_ranges=self.config.sre.research_user_ip_addresses,
	),
	tags=self.tags,
	)

data-safe-haven/data_safe_haven/infrastructure/programs/sre/networking.py

Lines 119 to 130 in eede40f

	network.SecurityRuleArgs(
	access=network.SecurityRuleAccess.ALLOW,
	description="Allow inbound connections from users over the internet.",
	destination_address_prefix=SREIpRanges.application_gateway.prefix,
	destination_port_ranges=[Ports.HTTP, Ports.HTTPS],
	direction=network.SecurityRuleDirection.INBOUND,
	name="AllowUsersInternetInbound",
	priority=NetworkingPriorities.AUTHORISED_EXTERNAL_USER_IPS,
	protocol=network.SecurityRuleProtocol.TCP,
	source_address_prefixes=props.user_public_ip_ranges,
	source_port_range="*",
	),

The Pulumi Azure Native parameter source_address_prefixes should accept IP addresses, CIDR ranges, '*' and Azure tags.

Our config validation will reject anything but IPV4 addresses or IPV4 address ranges.

[JimMadge]

0.0.0.0/0 works, but that may be more permissive than we would want.