mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AI
27c393ef80
A DNS label or CN never contains a slash, but the single-label rule only
forbade '.' in the matched wildcard span. Since extractAllSubjects stores
raw non-empty dNSName/CN strings without validation, a configured subject
'DNS:*.corp.example.com' matched a certificate SAN 'DNS:foo/bar.corp.example.com'
(matched span 'foo/bar' has no '.'), and a slash-containing CN wildcard matched
a deeper name. The original slash-count guard rejected these; the single-label
rewrite had dropped that guard for the DNS/CN branch.
For a DNS label (a CN or a 'DNS:' SAN), the matched span must now be a single
non-empty component containing neither '.' nor '/'. Other SANs ('URI:' or
configured without a recognized prefix) keep the original rule (only '/'
forbidden), which is identical to the slash-count guard, so URI matching is
unchanged.
Adds regression certificate client12 (CN and DNS SAN both
'foo/bar.corp.example.com') and negative cases to the DNS and CN wildcard
single-label tests.
34 lines
2.0 KiB
Plaintext
34 lines
2.0 KiB
Plaintext
-----BEGIN CERTIFICATE-----
|
|
MIIFrzCCA5egAwIBAgIUBfEMZ1Z/4weV13ryVA9qyNTPJHcwDQYJKoZIhvcNAQEL
|
|
BQAwUjELMAkGA1UEBhMCUlUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
|
|
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAwwCY2EwHhcNMjYwNjI1
|
|
MTU0OTA1WhcNMzYwNjIyMTU0OTA1WjBoMQswCQYDVQQGEwJSVTETMBEGA1UECAwK
|
|
U29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMSEw
|
|
HwYDVQQDDBhmb28vYmFyLmNvcnAuZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEB
|
|
AQUAA4ICDwAwggIKAoICAQCfOOwJdWD8cNcwGzeK4ItsVXBFavj5tjB3t3AJuDtD
|
|
E99gFhwOIiakDjtK7/8W95NHs8ui8JG6BbBhIA8ZqhvN3Kws6yccKAXpdTQNMHTo
|
|
o6802QmtYDEX+eNKCaVPQylg8NPypFf6I3GqTFKXaPiFPlu5Yjc/xFiqL8U6TonG
|
|
03aQ6JHAhPTe003NhSQ9HbFHwx0C6JWCZZOoUGAKSB/PRpMs5mYlqJMeYVKS41tB
|
|
7OQ+jP4uy2SgJ3EdhQ1ugBsqMskWqXTo5k9Ck5bq1oDTp/Rd1TH2JWO0Jes52bIR
|
|
UORPUqsXKnmvGbeXaDMvOwTuLRgaykBRj42vvoEsnYOFbKqX5B/uiGECdAPmEEP6
|
|
8vlnyRVM6orzQcHBWDKkITvqeL/GCc3PHJjYogRYMUGzvmJv+ELL0Vmwc1tx0TIH
|
|
TZx9WamzEgyZVJ/Du+hHe2XUarJ6flWiCFmv7RuR8FT9yGXwxDx+BZaamV8sWMt8
|
|
yGsurow334ANQibvVt8bJS30v19WQ8c2SU7NSeI+l25/6nDHrur45zud8nncBsHU
|
|
Hybp+fBATEqjcAztkoUYlF7OhFhT4TE0211sBbAJ1G8Cd50Izt1uDWqHxc+v2tmj
|
|
q//ZrwQ1JcBVxpIHOcLs1bUH90vXhvp57yVvK3/Zd739+q1E2RzjKsMc1Qk9HqpM
|
|
LQIDAQABo2cwZTAjBgNVHREEHDAaghhmb28vYmFyLmNvcnAuZXhhbXBsZS5jb20w
|
|
HQYDVR0OBBYEFBn0cMG6aQMbscqTMQKvfUDqCUBMMB8GA1UdIwQYMBaAFIkqPV1J
|
|
g3SNb4y7TEVCuhtkWZClMA0GCSqGSIb3DQEBCwUAA4ICAQBnqY+2rc6P09qTrCle
|
|
BzonZy9Bh5lH3k5EU5r8mCSbpM/N8GIV0uqKSZt9Es+utDTVOAzhT8fJ6Yz8Y8xR
|
|
XaZhYx7hm3NpdKQSZbkeDXSE0xeDdFDEPtp4rP8Z6K6j7iemB0MSF8Ft4viAj2fO
|
|
uxwOhnI64r5VNxp23E9AjKjIrQ1sN/ba0bLb1dmgaRL9OOdhoqsAoXk2LlGyYBlf
|
|
ZhcCjsB2btOZOJgi/lZDgkkw5isVbkTKNhriVYt6ZUcZYDaqCYb1lmRV2hGZBHcL
|
|
+4IAnJzlYGHvXUhsRMrzCPS5t+s5vANcSw9zDiLaP2EFY1RofaYhqMoWyxCxQilT
|
|
bek/KOUT+PexxhGS1UWOYZ1XZmRcKBMJWT3T3NMqGOmHA2Cfu3e+5IEXoTqtq6D+
|
|
yNifBMHf7Xeq/jh4Jq4F1vPdmlQ4TQa8tzn47I1pjXXzsZzAyVk9934lEY3j6I+0
|
|
LGqzv/ARv9cX9gnoogmwAtBTec3ui8WnKOSMZI45pAqyogAIHcTe/MdU2zfdLU7Q
|
|
6WIm3d6o3FVg9VOAMWTBe1l6XALlTjYNHqp9JDzIt8Z4sNojFhHGZ6O8NM+a75Io
|
|
Dm04E1UMJuY+3O7RoihZ2PneZA5SNmLTzLzSPzK5su8rIEC/1Ok5gIs36gRLmkVp
|
|
f/HxEm9IHrBkVygUQN5rQhn/9g==
|
|
-----END CERTIFICATE-----
|