consistentAddress still too much restrictive

[Guillaume Rousse]

Hello list.

The service providers offers two counter-measure against cookie theft, 
by checking each client requests source address against source address 
at IdP authentication time (checkAddress) or against source address at 
SP session initialisation time (consistentAddress). While 
consistentAddress is considered less likely to block legitimate access, 
it is still too strict for NATed clients whose IP address is not 
constant across the whole session, while still remaining in the same 
network, ie:
- 81.194.30.204
- 81.194.30.205
- 81.194.30.206

A quick look at the code show than a strict string comparaison is used, ie:
if (!XMLString::equals(saddr, client_addr)) {
     m_log.warn("client address mismatch, client (%s), session (%s)", 
client_addr, saddr);
     throw RetryableProfileException...
}

A netmask-based comparaison would allows SP admin to introduce a bit 
more flexibility for defining consistency level, by discriminating 
host-only address changes from network address changes.

To allow for such a change, one can imagine a a new 
consistentAddressNetMask attribute, defaulting to "255.255.255.255/32", 
which would be only considered when consistentAddress attribute is true.

Would such a change considered as acceptable ? I could try to submit a 
patch, despite my poor C++ skills...

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20180418/b1fd618c/attachment.p7s>