v3 Status Handler CIDR ACL

[Nate Klingenstein]

I'm having trouble getting v3 to acknowledge a 0.0.0.0/0 CIDR ACL that I set for the status handler.  Here's what I've got:

[root at idp-load-1 jetty-base]# cat /opt/shibboleth-idp/conf/idp.properties | grep 128
idp.status.allowedAddresses = '0.0.0.0/0', '::1/128'

Packets are coming in:

20:41:24.739828 IP (tos 0x0, ttl 49, id 56866, offset 0, flags [DF], proto TCP (6), length 64)
    97-122-121-81.hlrn.qwest.net.57284 > ip-10-16-142-228.us-west-2.compute.internal.pcsync-https: Flags [S], cksum 0x84bb (correct), seq 2173866989, win 65535, options [mss 1452,nop,wscale 4,nop,nop,TS val 1753137100 ecr 0,sackOK,eol], length 0
20:41:24.739865 IP (tos 0x0, ttl 64, id 33798, offset 0, flags [DF], proto TCP (6), length 40)
    ip-10-16-142-228.us-west-2.compute.internal.pcsync-https > 97-122-121-81.hlrn.qwest.net.57284: Flags [R.], cksum 0x25d0 (correct), seq 0, ack 2173866990, win 0, length 0

The results on localhost:

[root at idp-load-1 jetty-base]# curl -kv https://localhost:8443/idp/status
* Hostname was NOT found in DNS cache
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* SSL connection using TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* Server certificate:
* 	subject: CN=localhost,OU=Middleware,O=Virginia Polytechnic Institute and State University,L=Blacksburg,ST=Virginia,C=US,DC=vt,DC=edu
* 	start date: Nov 01 17:39:39 2013 GMT
* 	expire date: Dec 01 17:39:39 2013 GMT
* 	common name: localhost
* 	issuer: CN=localhost,OU=Middleware,O=Virginia Polytechnic Institute and State University,L=Blacksburg,ST=Virginia,C=US,DC=vt,DC=edu
> GET /idp/status HTTP/1.1
> User-Agent: curl/7.36.0
> Host: localhost:8443
> Accept: */*
> 
< HTTP/1.1 200 OK
< Pragma: no-cache
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Cache-Control: no-cache
< Cache-Control: no-store
< Content-Type: text/plain; charset=UTF-8
< Content-Length: 377
* Server Jetty(9.2.1.v20140609) is not blacklisted
< Server: Jetty(9.2.1.v20140609)
< 
### Operating Environment Information
operating_system: Linux
operating_system_version: 3.10.42-52.145.amzn1.x86_64
operating_system_architecture: amd64
jdk_version: 1.7.0_55
available_cores: 1
used_memory: 34 MB
maximum_memory: 288 MB

### Identity Provider Information
idp_version: 3.0.0
start_time: 2014-07-01T20:30:12Z
current_time: 2014-07-01T20:32:02Z
uptime: 109790 ms

* Connection #0 to host localhost left intact
[root at idp-load-1 jetty-base]# curl -kv https://ec2-54-188-98-188.us-west-2.compute.amazonaws.com:8443/idp/status
* Hostname was NOT found in DNS cache
*   Trying 10.16.142.228...
* connect to 10.16.142.228 port 8443 failed: Connection refused
* Failed to connect to ec2-54-188-98-188.us-west-2.compute.amazonaws.com port 8443: Connection refused
* Closing connection 0
curl: (7) Failed to connect to ec2-54-188-98-188.us-west-2.compute.amazonaws.com port 8443: Connection refused


The results from here:

phlogios:~ ndk$ curl -kv https://ec2-54-188-98-188.us-west-2.compute.amazonaws.com:8443/idp/status
* About to connect() to ec2-54-188-98-188.us-west-2.compute.amazonaws.com port 8443 (#0)
*   Trying 54.188.98.188...
* Connection refused
* couldn't connect to host
* Closing connection #0
curl: (7) couldn't connect to host