Abbreviated IPv6 address format and CIDR support for acl
Description
Environment
Activity
Scott Cantor February 14, 2012 at 6:11 PM
Closing with documentation added.
Scott Cantor October 17, 2011 at 5:46 PM
I did not base anything on the GPL-licensed code suggested above (just stating that for the record).
CIDR implementation based on bitset STL template. All address parsing delegated to OS via getaddrinfo. Includes enhancement to support IPv6 in the TCPListener.
http://svn.shibboleth.net/view/cpp-sp?rev=3530&view=rev
http://svn.shibboleth.net/view/cpp-sp?rev=3531&view=rev
Likely will run into some portability issues, particularly on Solaris, but this is working for OS X and Windows for now.

Former user September 9, 2011 at 7:51 AM
For the records: "2001:620::::::1234" isn't a valid IPv6 address ("::", which is used for zero compression, may only appear once).
I suggest to canonicalize IPv6 addresses to the format which is recommended in section 4 of http://www.ietf.org/rfc/rfc5952.txt before doing comparisons.

Tom Poage March 10, 2011 at 5:18 PM(edited)
FWIW, APR has routines apr_ipsubnet_create() and apr_ipsubnet_test(). The routines support IPv4 and IPv6, and are used (at least) by Apache httpd mod_authz_host.
Adding APR to the mix might make things considerably more messy for some systems.

Tom Poage March 10, 2011 at 4:53 PM(edited)
Possible implementation:
http://www.sfr-fresh.com/unix/misc/commoncpp2-1.8.1.tar.gz:a/commoncpp2-1.8.1/src/cidr.cpp
Details
Details
Assignee
Reporter

We are actively polling the status handlers of the Service Providers in our federation. Therefore, we instruct deployers to add the IP addresses of our polling host. However, if possible we would rather like to have them configure a range of IPs instead of single IP addresses. Therefore, support for the CIDR notation would be great. For the Identity Provider this already has been possible for a while.
Also, we noted that abbreviated IPv6 addresses are not accepted. This means that
2001:620:0:0:0:0:0:1234 will be accepted
whereas
2001:620::::::1234 won't.