Files
Groene AIandClaude Opus 4.8 5746056d31 Reject empty-label matches for SSL certificate wildcards
The single-component wildcard check accepted an empty matched span: for a
user subject DNS:*.corp.example.com and a (malformed) certificate SAN
DNS:.corp.example.com the matched span is empty and contains no separator,
so the wildcard user was authenticated even though no label was matched.
extractAllSubjects stores any non-empty dNSName, so such a name is not
rejected before authentication.

Require the matched span to be non-empty for the DNS/CN ('.'-separator)
case. RFC 6125 6.4.3 requires '*' to match exactly one non-empty label.
URI SAN path segments ('/'-separator) may legitimately be empty, so the
URI case keeps its prior behavior (the matched-span-has-no-'/' rule remains
equivalent to the original count('/') guard).

Add empty-label negative cases (cert client10, CN and DNS SAN
.corp.example.com) to both the DNS and CN wildcard integration tests.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-06-25 14:01:03 +00:00

53 lines
3.2 KiB
Plaintext

-----BEGIN PRIVATE KEY-----
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQD3dDQLOkT5c1Lu
asM3GxEAjM/3l5VEkQ+MBxFOhzdUK41yF3KYFaTu4Kv+f43w9C6PkBL4twIxJZpV
aZjfRMW1PsFJdXDrHDxOLgU6MpROKgR0Fh06GG05kN8aCKiqOjOl0H6A4iBQCikl
0X9yD/PLmbNNmPoNkM+V30HMusSgHuC2vlvf87l7O+/L4t5d6/z+RRkoisCDdQuF
6MTMVbYPU/epeiwvLUaCGqrWL65ws010WYiepCqfEo6vckjDoGCK4fMmDqnMycgb
e4WCsBWa4TV9jnESKWrS8zhvNa8AqVowspE6es3A3Jz5Y0+KdaX0evqmEnIkiQ2D
YjpfT80ILEWeCWmWfYvGSv4yICYiS14JEUvrigDtCnL23QnyaYGMukMYpiN9mM98
pgQ8e7nRoGUyLlCd3LcR/17Jep7n9orPraVO5FBR9iuPQhljDaxfr7YTwBAiZBNB
bkclU4xbo2tc5yKD60b43EkC4g3fgt16ER8FELin7KROXe4g4wf1UH2aUn2eeKXt
V2BEkkVZPA/qQAQpJaOPlvhOzLDqD42dEmGn5GaBzlnx4ZkZxbSgSabt/k4jtFeZ
MenPN9gBHWPbC8JtPWA58E9Wduoj32KDolOkPNCqFGIEewwD2Hks0RU1dXM1yCzM
Ra+RkXrfiJsMBxGHAg7hCoW2jFTJgQIDAQABAoICAADUgvHvHSupzxCkZavL4hgd
O3ue9onf83RBSBCPkDBEE43LMw0xmeT7Vpe0XiGtklwqOWERl+7vUOEqA8tLHeoX
rWfxiO+1+kRldRWoKqfoOM16T0OVEO/nRYipovthYHqFJyPSgQr0XMWEZQE+bn9r
laQW5WRZzMjPEoeVJbtB3UK/A4bY3fGnk+HBsiRQz3Tbfsa3D/Ik80U3dfUM8Xmu
eujGniremSi5szfj7y8Fj/baD8pJ86gRf1kVSOCUoLbzOaNyRkWCSghAZzmm8pyb
Vlh0a6VPePefZ/b0taCFa5YOcaGncgTMYf+tbUxyFyIJbqleK5k7Jzh5DMgfR+Pw
4JIWdGmaW1QgC2hn6uEPiUZLVwpTT2lRR9eUUCOE87Ht1CFpZ5EXciRxuZlplI7Y
d9u5XJjK6WxYo8BlI6ZZ1jdUX0qkebYtae5yBNDxJ79qJDVQb+3ecZSyZXr1RCpo
7KylvPYIAbXqgQ9OBv84Db7XapuBATQlm774ruyyWsAnzsnq/IZjUpozXg5nnsJl
wHc5F1QD/4njslwr5uePq+Vo47La+cdWBmS1n36lJntnPI4kTNVBMhW4wWEPtcAk
UeU+6FYF4qE2PFAZM62oviX+IaFx6veU60baMdxOzmQAqSsvv2ZQTb71YLerCiem
9B99YKaxZpBIAfaHFQTRAoIBAQD+9xZqTykDoVec4/ZVQQkMKzOOHVPkvfSR/RjA
x+DgG8lqKncCZMVgCvIwhaqB5Ao2WTvjtmcPbtLzay3IYUfgHEKu1Hor7z/azxkW
PYpDeeKTDXOrraSldb+ZzNcu4HM2V88dGTJd/bWSuQXMD8W8FyBXMsxc8s0vPN62
Zl0y6Rze6U35syXoxGJXMS59SuKz+D4+FbSwVcK6CZmBycv06DAbvX7qfZnwjOVN
syluZ5qkXRKBM5Cf6ZE05WpIT4RjLoCMicJlDyQtb2JlraMOJljVOcSwgoTkTtzS
v+edPQhs82zzKyjI76g0SjsG52Jp754uhAiqXiTG7KSkyiOxAoIBAQD4dU+5fwiD
oEVYgRlIMqFEDEpgtYs6u8yOsH5gHzwBOjx7FfMuHcTYgSIVYUzMxeEAMBPTHpU0
tjNgvhPnK0Xo/Yfe+AP68dAlwz0ykJ5JjUFlMbBhuoIpghnopgr/693XZnuTbOz3
FkOxORMVfuS2cRUnK3WIhVHyVuuTkLv20pbgsxxPWRyU102QnGrzevbMLPOgD8JD
aezmu8XxtnlAd2KvVzGgpvjVW9Qb66SIvLf1PoyM1BBj3oRgv2wiO+4aNE6GNara
qWsdKRFUhcGCcvvsX0jxfidC0lXnK4cv3oI2LlU1ZybKI+wOeViq8vDgWDD7DdYA
QUxfpb2BT4bRAoIBAAq8zSzc+JU2jkIFN7KPcpoYl6s8gPP5K/uZ9RjpUgceJHVc
JHbtV4Kb82cnue6Oc/+l8me8nsp/mFK4CM2Piz9c8VH7kMmY4c+NOTk+jjwZPfmD
b4OjZHOzacZIYiePPErll8tZ7E0ZCjSLpjrZzzIEp1AEy6Z+czWyEo8L8JDcUGLy
4F3LtaT/4ERbxeFw7es2YSisMVfbxL+g994HaZd+z8fbSyUE9R60UFPdX7lOk6yo
XsciLM0PQRZBMyCoeKLUqoVAp/cplBR1xGcT0PIfm04fiLEGTiJvT81wV4i/sUMl
XUlAYA9WSHcrSSEZTYO4m6jJ1rOWE2ZtQOHPwYECggEBALscRbURqQzPh0nWt356
up4vj1fzgG3z/mI7IoErJJpcDC454pCJVLQj09I8G4VfREpK6rMkpgMzb8/cdcqy
+Qw02r0dFIpIz5OQzCanaL1Fhsk5uXZv6hRuaSqe2UvQipnsEQZ+kpqmBsaRkACx
Nnb7BI4iGXp9xK/3q6PO7O89uuhvmtNa7b5dwok0cwr4QKKU+8g/9fGk9QbyxGh7
HidhgU1BIhu1g1HSvRNly9w6G2Oy/lAUaF99tT3TCxFhBrhvSe+ivQ+9ZPBp/CYm
MQwXogdp3toXQmP9WTolusJfFLrO+9ai30B9+wkPc6oSGTsqz4BR9CbvBiBGBkg6
5vECggEAaqf9C9N5KhiCjUOy4EgU+rwGFZJMEIfeqrN7cPOPCwly4V0LvGZQH5pw
tgUljd+Nfis0maOzn4rAoLXmD5F1+Uhu+tgt4hDwfvUAyCGABs8BfJWj3owDuq+n
oXZLuQFemjHp7uPwQMtd1PzWiEr+42xKT5QVQrNleGT0LjTDWi/uf2wMrkzJQymW
4SL+CICzqVi15KE1QZMiTuP9R5znp6LkhUy9dJz3gg8VcOHAht623IF8OUjC3E2z
UkTU0fKhaJRdvX8EKf0XzTaj4/Bk5xYlEoSUXWsIhOUUrGmntRwSVhi3OoGIm6Aq
3RJmi2VS/pmfzWbg9l/Iud2H3EiFaw==
-----END PRIVATE KEY-----