Ex: Re: AccessByIPAddress with IPv6 addresses

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Monday, October 19, 2020 5:22 AM
> 
> The library we use does not accept brackets. Jetty exposed them in some
> cases but I thought it had been fixed. There's a very long thread about it in
> https://github.com/eclipse/jetty.project/issues/1503

Hmm. It appears jetty added the configuration parameter org.eclipse.jetty.util.HostPort.STRIP_IPV6 to control whether or not text versions of IPv6 addresses contain square brackets or not. Unfortunately though, it appears that new feature is only in the 10.x series under development, not the released 9.4 series :(.

Unless I misunderstand the RFC's, enclosing string IPv6 addresses in square brackets is not only permissible, but required in some cases such as when a port is included.

It looks like the library does support IPv6 addresses enclosed in square brackets, but only when using forUriString to parse them as opposed to forString. Annoyingly, the former *requires* square brackets, whereas the latter must not have them.

So where does this leave the idp? I don't think there is any work around with the current released version, so IPv6 access control is basically completely broken with production releases of jetty?

It seems this behavior violates the general  principle of "Be liberal in what you accept, and conservative in what you send", given square brackets may or may not be present in a string representation of an IPv6 address, both of them should be successfully parsed.

The "fix" in jetty doesn't always remove the brackets, it just lets the user choose whether or not to have them. So even when 10.x is released, there might be some other application hosted on the same instance of jetty requiring the brackets which would still leave the idp broken.

Would you recommend opening a ticket with the upstream Google library to complain? Or would you be open to having the IDP strip the brackets from the string literal before passing them to the library? That would be pretty simple. Or have it call forUriString rather than forString if the first character is a bracket. I might just do this for now one way or the other so I can actually have things work pending a final outcome 8-/.

Thanks...