mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
A DNS label or CN never contains a slash, but the single-label rule only
forbade '.' in the matched wildcard span. Since extractAllSubjects stores
raw non-empty dNSName/CN strings without validation, a configured subject
'DNS:*.corp.example.com' matched a certificate SAN 'DNS:foo/bar.corp.example.com'
(matched span 'foo/bar' has no '.'), and a slash-containing CN wildcard matched
a deeper name. The original slash-count guard rejected these; the single-label
rewrite had dropped that guard for the DNS/CN branch.
For a DNS label (a CN or a 'DNS:' SAN), the matched span must now be a single
non-empty component containing neither '.' nor '/'. Other SANs ('URI:' or
configured without a recognized prefix) keep the original rule (only '/'
forbidden), which is identical to the slash-count guard, so URI matching is
unchanged.
Adds regression certificate client12 (CN and DNS SAN both
'foo/bar.corp.example.com') and negative cases to the DNS and CN wildcard
single-label tests.
53 lines
3.2 KiB
Plaintext
53 lines
3.2 KiB
Plaintext
-----BEGIN PRIVATE KEY-----
|
|
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCfOOwJdWD8cNcw
|
|
GzeK4ItsVXBFavj5tjB3t3AJuDtDE99gFhwOIiakDjtK7/8W95NHs8ui8JG6BbBh
|
|
IA8ZqhvN3Kws6yccKAXpdTQNMHToo6802QmtYDEX+eNKCaVPQylg8NPypFf6I3Gq
|
|
TFKXaPiFPlu5Yjc/xFiqL8U6TonG03aQ6JHAhPTe003NhSQ9HbFHwx0C6JWCZZOo
|
|
UGAKSB/PRpMs5mYlqJMeYVKS41tB7OQ+jP4uy2SgJ3EdhQ1ugBsqMskWqXTo5k9C
|
|
k5bq1oDTp/Rd1TH2JWO0Jes52bIRUORPUqsXKnmvGbeXaDMvOwTuLRgaykBRj42v
|
|
voEsnYOFbKqX5B/uiGECdAPmEEP68vlnyRVM6orzQcHBWDKkITvqeL/GCc3PHJjY
|
|
ogRYMUGzvmJv+ELL0Vmwc1tx0TIHTZx9WamzEgyZVJ/Du+hHe2XUarJ6flWiCFmv
|
|
7RuR8FT9yGXwxDx+BZaamV8sWMt8yGsurow334ANQibvVt8bJS30v19WQ8c2SU7N
|
|
SeI+l25/6nDHrur45zud8nncBsHUHybp+fBATEqjcAztkoUYlF7OhFhT4TE0211s
|
|
BbAJ1G8Cd50Izt1uDWqHxc+v2tmjq//ZrwQ1JcBVxpIHOcLs1bUH90vXhvp57yVv
|
|
K3/Zd739+q1E2RzjKsMc1Qk9HqpMLQIDAQABAoICABYP9BznZ9Xy6M5gpxSWQptz
|
|
R0hHJ1KqnRKpl1uxbHzB7yzIQ4Dt2H7Y/fxHPwh2q7C+yBO+0+J70VHT+GOs/4dJ
|
|
8Y2T0+qB3TfZJqpBMaHetHNVM5MThhn1ZTooFgDipIQrOqMfhJVDfgeD5dnXEMCd
|
|
wGXypwct9L84OVL3+P1U5dP0deXARpHto5U7wqa5S4xPC+EQS08zNf+Xi4dBMS8u
|
|
b0xEbJkBP8lw4Nk7qbR717CXJs1jH4FVlcXqXs8V7y2stdJvDqUK7Kaj/sBxko5B
|
|
conh9bdOvP8EVhDBCnx9wfT/1ncySoQpwxe2t4ju26MJGpLzvW/PvWlBs3J0LPoC
|
|
2Npiab3XS6006UE4xMQxcNeaU/4Oqma91m/ka0MbIdUDmyLECEO+lW2bY3vYK23n
|
|
Z/mkop/dB0hUGb2FwB6r/KqNlvCD8RruidszHE8XnLti+1AJ8ek90dqC+u3J0qDh
|
|
cxa03b2WZyWdrbRPxQcjeiTtWeChpzE+nDovjYfLwggxeVJHCAqOJj2dBBDusKaA
|
|
h8f5Wsy4kuf+5BXAvQyy68c813/Y/HxKy7Ye0LbhsZIURTwFDmrhssuhCescRpxt
|
|
rx36W1SnEjoceCoGiw1Yn+6H9q9f3lWhwNL99G9G07hdTQSttS2vvwYFYFkC44SS
|
|
QI8f3SatYvCC3M1GvhFdAoIBAQDZBvCHhPmbIEiNKnBKQ26J84kTIfWiWeHTDiPW
|
|
C4IL2fKVnXXID3qZelcK2uC/8ESnsapzY0s3pYKyGewRFtt6bIDEYqt/G+nK5MgI
|
|
e+KNIIUsDiHCo7OnwMiQ9DFb3peGBTg39xmaOe1blJK6bobYNtEvsMfiGyOKUF3F
|
|
SzaUDfW4hvvJqwUAUyzNULvHcxbnfrgPg1MvKKe0OSoFvff35BC1ccepRvCDaUat
|
|
nUB8rZ5r28a/mPNuopEKYq5PBbkN+qofnEWPXzayht1URaIcg6O54bA7DqswBNtw
|
|
mlvqU90YDtoOkkJLxNrvXadnurDzNPpDqtgkHdA90qEJjb23AoIBAQC70JyHbGgc
|
|
79xrOFim2gqAZF0ynxFoJaOt3zvjUmtXEZ7gc6IeMbFgcJBlUXZwA3wIZraPjL+d
|
|
0MhB6p7+1zECUBSmmdKimMMrNn6BvKz9DDH2bQH0ccOI9raRBvbmX30eqTkZUyos
|
|
XPx9jL/5CwqA19wrszW0YpqtSBH7zvFNDJoz0rGwbLeGImVV0LAX9vqVVP8K7kGE
|
|
xwc4Pu3qC5JoQWgQdht7HXxPnedEVf5roaIMC6rdP4NNnc9JhBmFa0vxBNl/jA+I
|
|
QK02EGYVjzBIGTNWuZyqe9YOQ73KsmmHlaAA//xoJSP2k4a4Y04iQ/xTWwwEQWYY
|
|
VQPOy+6cDQU7AoIBAQDMi8XXdHTsyBiZNA5xb+yXCHmBFti0E5LLoOAVtPL0yI3i
|
|
hW2lCTG7xZqUGIcLYCDVDJZh+ovB/rSXt+bOlIR3dhxG+9g3DM/k8ou1s01rReM+
|
|
CnO3RyLkUMa4F+8Nb1XQcsrxtGrk+QPE9Nr164Yb8k5mbG93o6xziBtY//KIyD93
|
|
k4FsKUular8nI5hX+xjzRnOj61pTcDXfnqEEmG9FrCYzXPGZkcrNkEOVDkjhOaG+
|
|
dn1zx2xoMcAR0cAHqpUnn8EH2fmVj1+2E3Y3HwoTZd7CKvw2LTUbJPjNwC4xRKl1
|
|
K0pJwX/Kedb/E33cPhDYqG3XqQXdxFuoaQRuRLExAoIBAFcQAT+VtT2UwyzA1fei
|
|
o7OY0ssgicUpjZKQJQbfsfqOpIOPlttAVeVKyOTuumR6eQi79Gze5gSWP/6ucD3a
|
|
K1HTJX+FVusgvXhOrp4dhGNZP9/n8DwMcIQROdhIzjNEmI+aCmn+71HZWQIqOOON
|
|
hrTrW5i2XnLcMq+Y9R0xdRIugVz8knoiK4D2eNsq/jZduxN2bzP19lFCocolAcy4
|
|
yImjqEXZOiv8IyAVJpu68VGbf67tyar+QjO8r9Z4cgwzDOURRnGlz51tvd2OBISB
|
|
9/O0GuRc7o7pEPVT2asYwWqkpaNRBwSQEve+s3jOL+4abeGGFy/x0Q3+euFmD5ov
|
|
PvkCggEBAK1MkZ9mjJqL0+NCb4Bhs3mnjZUBWuS4Q3/zrXSMVRt3XQKCkQTsnO6s
|
|
nKZyVgB8d5Fd0mODrROshkXFwRPlNsIX5IauEDZjFki3tle9exgO0wWINzKvd45d
|
|
UIh4xTAuiQmEBuuecxL/8aKUE6oW7i8v/fGoqK/2vHrIx7mZ1Fl7bLNbRnYZH7mG
|
|
RYkUJTuyecv8XnVmmHzY2UFy1CPm+pMtWq3iDs4a2FivRJcbmDy8KHgoT3zwlVqQ
|
|
/Owy2qKgrRJKvITRJpztGC+LdtDr1JaTUB5lISbmCdyYXn6MzFqWaLOJdX0R2ML0
|
|
PKtoyN+AxDHIBnbcLRCAr7Zh0W06xuw=
|
|
-----END PRIVATE KEY-----
|