Abbreviated IPv6 address format and CIDR support for acl

Description

We are actively polling the status handlers of the Service Providers in our federation. Therefore, we instruct deployers to add the IP addresses of our polling host. However, if possible we would rather like to have them configure a range of IPs instead of single IP addresses. Therefore, support for the CIDR notation would be great. For the Identity Provider this already has been possible for a while.

Also, we noted that abbreviated IPv6 addresses are not accepted. This means that
2001:620:0:0:0:0:0:1234 will be accepted
whereas
2001:620::::::1234 won't.

Environment

None

Activity

Scott Cantor 
February 14, 2012 at 6:11 PM

Closing with documentation added.

Scott Cantor 
October 17, 2011 at 5:46 PM

I did not base anything on the GPL-licensed code suggested above (just stating that for the record).

CIDR implementation based on bitset STL template. All address parsing delegated to OS via getaddrinfo. Includes enhancement to support IPv6 in the TCPListener.

http://svn.shibboleth.net/view/cpp-sp?rev=3530&view=rev
http://svn.shibboleth.net/view/cpp-sp?rev=3531&view=rev

Likely will run into some portability issues, particularly on Solaris, but this is working for OS X and Windows for now.

Former user 
September 9, 2011 at 7:51 AM

For the records: "2001:620::::::1234" isn't a valid IPv6 address ("::", which is used for zero compression, may only appear once).

I suggest to canonicalize IPv6 addresses to the format which is recommended in section 4 of http://www.ietf.org/rfc/rfc5952.txt before doing comparisons.

Tom Poage 
March 10, 2011 at 5:18 PM
(edited)

FWIW, APR has routines apr_ipsubnet_create() and apr_ipsubnet_test(). The routines support IPv4 and IPv6, and are used (at least) by Apache httpd mod_authz_host.

Adding APR to the mix might make things considerably more messy for some systems.

Tom Poage 
March 10, 2011 at 4:53 PM
(edited)

Fixed

Details

Assignee

Reporter

Original estimate

Components

Fix versions

Created December 14, 2010 at 7:29 AM
Updated June 24, 2021 at 3:03 PM
Resolved October 17, 2011 at 5:46 PM