mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AI
27c393ef80
A DNS label or CN never contains a slash, but the single-label rule only
forbade '.' in the matched wildcard span. Since extractAllSubjects stores
raw non-empty dNSName/CN strings without validation, a configured subject
'DNS:*.corp.example.com' matched a certificate SAN 'DNS:foo/bar.corp.example.com'
(matched span 'foo/bar' has no '.'), and a slash-containing CN wildcard matched
a deeper name. The original slash-count guard rejected these; the single-label
rewrite had dropped that guard for the DNS/CN branch.
For a DNS label (a CN or a 'DNS:' SAN), the matched span must now be a single
non-empty component containing neither '.' nor '/'. Other SANs ('URI:' or
configured without a recognized prefix) keep the original rule (only '/'
forbidden), which is identical to the slash-count guard, so URI matching is
unchanged.
Adds regression certificate client12 (CN and DNS SAN both
'foo/bar.corp.example.com') and negative cases to the DNS and CN wildcard
single-label tests.
29 lines
1.7 KiB
Plaintext
29 lines
1.7 KiB
Plaintext
-----BEGIN CERTIFICATE REQUEST-----
|
|
MIIErTCCApUCAQAwaDELMAkGA1UEBhMCUlUxEzARBgNVBAgMClNvbWUtU3RhdGUx
|
|
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEhMB8GA1UEAwwYZm9v
|
|
L2Jhci5jb3JwLmV4YW1wbGUuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
|
|
CgKCAgEAnzjsCXVg/HDXMBs3iuCLbFVwRWr4+bYwd7dwCbg7QxPfYBYcDiImpA47
|
|
Su//FveTR7PLovCRugWwYSAPGaobzdysLOsnHCgF6XU0DTB06KOvNNkJrWAxF/nj
|
|
SgmlT0MpYPDT8qRX+iNxqkxSl2j4hT5buWI3P8RYqi/FOk6JxtN2kOiRwIT03tNN
|
|
zYUkPR2xR8MdAuiVgmWTqFBgCkgfz0aTLOZmJaiTHmFSkuNbQezkPoz+LstkoCdx
|
|
HYUNboAbKjLJFql06OZPQpOW6taA06f0XdUx9iVjtCXrOdmyEVDkT1KrFyp5rxm3
|
|
l2gzLzsE7i0YGspAUY+Nr76BLJ2DhWyql+Qf7ohhAnQD5hBD+vL5Z8kVTOqK80HB
|
|
wVgypCE76ni/xgnNzxyY2KIEWDFBs75ib/hCy9FZsHNbcdEyB02cfVmpsxIMmVSf
|
|
w7voR3tl1Gqyen5VoghZr+0bkfBU/chl8MQ8fgWWmplfLFjLfMhrLq6MN9+ADUIm
|
|
71bfGyUt9L9fVkPHNklOzUniPpduf+pwx67q+Oc7nfJ53AbB1B8m6fnwQExKo3AM
|
|
7ZKFGJRezoRYU+ExNNtdbAWwCdRvAnedCM7dbg1qh8XPr9rZo6v/2a8ENSXAVcaS
|
|
BznC7NW1B/dL14b6ee8lbyt/2Xe9/fqtRNkc4yrDHNUJPR6qTC0CAwEAAaAAMA0G
|
|
CSqGSIb3DQEBCwUAA4ICAQBq1OE0uLFei6+lvGfH/k1Y2ZW51OuumHKfsR9bbE6c
|
|
AFXsQlujlZ4xcyoGunjljPwgINakyZ0sBRLBAOp2bpj/GQbUqYkfT0/B66a8YNhl
|
|
tZoxVGpoDhHFKiuTfiVaUhIM36fvB2IMPTw+Es6WLt3SKo1AJXD5Ug0vXYb7CCmR
|
|
NWSAlLWm3lcUccC+a0lyr0JIINfpO86XouGt7mDzFNE6R5QFK5DF3BhTU3oVnRD1
|
|
8JrP1u6kHRcjb9fH/6xYOEj11NyZOUs8OHldPn1BktEB5xtG0x4TOhLOYzZIipCN
|
|
uYu33QY+69RsPBjPZhLK34RiO2YgOFFNU2kbBPFWwN0nwuZQ+MAmrGUloxajHCIs
|
|
tjik9xfSGkB/FwkMnb1OLhTByih+uMD6nnlvHoO6soCK88/oyV8/HUMCl4gzs9C/
|
|
usJYy5IzkxEF3xT2AOpJJ4bydA2mSZ9M2OQJ8fuT4+xSveiZATeh+Ngnz85Ao5op
|
|
Ke3rsduAyhd6vMPez/P5+RChp4ipWl7saRZ5HehqNXsAUIvtdxmbQISZpOJyTUU5
|
|
yzZ47CtyhRMR0rbTw/TlmVY0hGA+7SrggJh0WxFtTtZ0gZJdE26nedvL17BURdkF
|
|
7hbMIqAAZN1TYIbtxuEkySojLj1KEGTUoc22YAW1ZMPpqumo7zZrhxk0edwN92al
|
|
2Q==
|
|
-----END CERTIFICATE REQUEST-----
|