AccessByIPAddress with IPv6 addresses

[Cantor, Scott]

On 10/19/20, 2:47 PM, "users on behalf of Paul B. Henson" <users-bounces at shibboleth.net on behalf of henson at cpp.edu> wrote:

>    So where does this leave the idp? I don't think there is any work around with the current released version, so IPv6
> access control is basically completely broken with production releases of jetty?

I am 99% sure Jetty fixed this on the branch, but in any event you'd have to build a Java filter that exposes the value correctly I think for the time being if that's not true.

> It seems this behavior violates the general  principle of "Be liberal in what you accept, and conservative in what you
> send", given square brackets may or may not be present in a string representation of an IPv6 address, both of them
> should be successfully parsed.

I actually passionately reject that entire philosophy, and where security software is concerned, it's not even a question, I think it's a horrible idea. This would be a really great way to open a hole in the access control because once you start allowing "other stuff" it's super-common to come up with exploits you don't expect.

>    The "fix" in jetty doesn't always remove the brackets, it just lets the user choose whether or not to have them. So even
> when 10.x is released, there might be some other application hosted on the same instance of jetty requiring the
> brackets which would still leave the idp broken.

That isn't terribly common anymore. Docker has pretty well killed off the multi-application servlet container, and it wasn't really breathing too well to start with.

> Would you recommend opening a ticket with the upstream Google library to complain? Or would you be open to
> having the IDP strip the brackets from the string literal before passing them to the library?

I guess I considered the whole thing closed once Jetty fixed their code. I really did not think it was a 10.x thing. That would seem to be something needing confirmation.

-- Scott