Files
Groene AI b906bc5c09 Enforce single-component matching for SSL certificate wildcards
A '*' in an ssl_certificate user subject was constrained only by an
equal-slash-count check ("'*' must not represent a '/' in URI"). For CN
and "DNS:" SAN subjects there are no slashes, so the check was always
0 == 0 and did nothing. A user identified by '*.corp.example.com' was
therefore matched by any subject ending in '.corp.example.com',
including multi-label names like 'evil.deep.corp.example.com'. An
attacker able to obtain a CA-signed certificate for a deeper subdomain
could authenticate as the wildcard user.

Per RFC 6125 6.4.3 a wildcard must match exactly one component.
Generalize the separator to be type-aware: '.' for CN and "DNS:" SANs
(DNS label separator), '/' for "URI:" SANs (path separator, preserving
the previous behavior exactly). The matched span between the fixed
prefix and suffix must not contain the separator.

The candidate length is checked before computing the matched span so
its length cannot underflow when the prefix and suffix overlap on a
short candidate (e.g. pattern 'a*a', candidate 'a'), which also removes
a pre-existing overlap false positive. For URI SANs, "matched span has
no '/'" is equivalent to the previous equal-slash-count guard, so
existing URI wildcard behavior is unchanged.

Add integration tests covering DNS and CN wildcards (single-label
positive, multi-label bypass rejected) and a URI SAN whose matched
segment contains a dot (non-regression).
2026-06-25 12:29:07 +00:00

53 lines
3.2 KiB
Plaintext

-----BEGIN PRIVATE KEY-----
MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQC9M7f687WVgH4r
CzH1vJRguEp7p/+PNOuqhSLo+bBK15fObcj3Wi29nY9ilkK6I2+1IgY96dSWEwQV
8DWyZiFdDIHN4HTntDhL5MbK8BfVg/3g2nAw1iSPBqC7bf4CnbeozK4pRNNWPe1U
eDQ/XPc3YeMffGWbMev9aJ1QpIVK9GZYA4Fkc1Mk7p5jisFeABiLyD4IHFFvBUtH
ycp03h+jTy+NETrHEU0WyGm7RMuzwDB1bUYtK7r2l7mXVVfHp/l8/MANM+BbBEP2
lHVbPGUxL5CTayUXyNtvDKmiTlaUVmi+LWKUl4Dit8kk9fDncTVVWuLttBRI5WJz
+XOogCY9ndm21hEgXwlWlbYotbscjKyP9B9YLGakfsPS4PJbKgaF9Pqz0+681Ull
mQiG3XhrOjTM7usSoNV3khF9U0zfhrXwuGehJYZMaQmvAZiKrZx1jDXIHcthnCzh
zxYSHSqLHpNDkCmyLVEzWZZ0DKGCEfLsK1TCLcoM8/jMuiuZhhWAjbINrpBD3SSJ
sWUX6bxctEjJsrhlt4Z75gdD4ucMMOP6X5p4hXUFPlzbbvBftgms+7tlHBXN8wD1
XUskeYyyYnwKuN1WEMAt2K8EEWfIvY7A/0yh9JvEq2WDhB/Oz256hB+4m+I05X/+
/KBErPNRT0x7q69+XugtYR5HPuVyrQIDAQABAoICAFZDdOBZ6pIx5hSJA6vXYc1h
aTBNDhOEnOh/0EVpxmuxNXk8i/LfLli0NFJOUTkd/AoZa8Ah0zfjjqrT/R+MOiz7
DVnJO3QDMuHDerG/WxaSGhhBcAKMOFnvuywJv9UAhOLVA5k0VKkPDhzDu4qiP+MD
4fKSnJ7wWXkOEB/bCxz8Jod9farHfAKsOxIGixhpMcfVshavlp9oSgT+p6y2M7WZ
XoRSdTqbFEtNcAuel8OqXk3D10m0FQfmcItjsWSKHRHUCVpbqzDEVppf4MwK0tZk
qeXU5bIc9ZOBsfwa/JWgehwvhDFcjDqScgbEjaRwdNEoYavgPZlo4IUhGI8ccpI/
PiROBojaCyxWiIeRZs5Du5Rwt9a7fwWluo1LnphsbYgwkShb0MauHZORqaRS/ZcF
TMhRYEI7y2P7QLmYjqFg4cw0139z/AQFuoEd1kBGzqQq8HgvfTfOm3yBnFzhzF4V
g7BcDy0Z8eZtL3IWiR9E8qowr2sokDLlCWCYEXHm6Eztec5fG8LKT7iT/NJnBk3Z
s4j+3GFPB1B0tjzj5R0NHV0YDf4BQqc7R1RTBeZ/5xuB9rQgdDXlQjlXa+O5Ou9P
V8sPFbwq0fVp5CXO1oKqLPECKZ4y7TEEGGPG7YdtQoNIRNpC1RKESpF6obgnUHX4
tJj6g47zNEbBYPckC7hPAoIBAQDq/pwKRZ9KqyqcBFzrBKuxCFV1hIXmy7Dbo65W
1SR9X6ADSeDe8AmRWipdXsH2rMPpc8iVotMamEdRx9dl/m45qo+43/CRoN7Fg9Uh
xfNvIe7Lw7gbmWeUBOo9MB5TrGjIRzptrOOVnhFKqLqG5yLR1qnoD4smJ7f319my
2LSXdSWOi2cBzxafU5nSsgGPpKPrRsJyQJOpt3pms2/wNtUcBNvhbCPqR0macb0T
mrR3LkRRrkvDRNJJsh1X1TSFzchbxkx1Veu4pLb2mGVgC8caMIpGDil3CVpuOjvr
9kpo5B7T+/LdbWi+UUQQCldifVUbgvjchQkRwMZkd88vr9E/AoIBAQDOHTyKt8dY
TI3Gg34K8JC7niCBw4abAgERn2dRLhQIHT+EHCQErS9opwXzMYiUydzltIqwgKn3
TpheyCOx456oMBgP6veKyg0HrR34R5Hm2NiDvVkX+Xr19eo89RC7Gf12uPak3ejC
xuQFRjCgm0uXf8F/2ZZril1nmLrZE4nEXZuXzLlaRS5E2ZY33cNFMeI1dLByfGcU
12khD/OLLR7hevoAII/kDVbnmdEYwC3tO+RehMS97k+N37tI6iQMwdF05kHenVd3
Hbp9gpgJOGMc41IOpLUVYBt8AO1x4VDwCBXUsii5/ngjLklgvdg0v/0KXOZS2O9S
OVJMqO6U4VUTAoIBAQCxmT9g3AFpMzd+tiVrURpZL003BbMVHHhLZscJxQhQ4IZU
Ne+HTa5NdfFyo3y/6w4dT24W+PnGrbOo8PmvkbzIRElelZCA3y295MadQbebE/Af
e4mXAjcvvQ8ysz0YS8LdKkfUP8e4eb/jxuVBs0mzgSLjyWuGqJn26+ERs4m4tcZu
lpiA23vjahFlFTbs0qc310B5jKiMqagOGirNRwOEq39qPIpgMwRDfxZAzLj7IbJs
cOe9ajPrkntuuCl7vmxgP9vlCcyevY2xjLeBASW2e1zlWSqpVh5MFCLZUEgoQc+y
skV4Z4mz3EMuREKKouJBapieQMT778+AerPQ/HWNAoIBAQClBlOK3UoGMITzBCTO
rX20Og7c1qfXQ+uHKJGYNcRkGsbYB4/vDpp+t/vTkz0/o7/xSnQgjWOIVq04dhXe
P9iv4JHjbMV1ogB8vObZ+rOemNAB6oCC6YTBmXtKAwy6QTzm6YDQz7uk94lpj6Ev
dic3zVon+xasU8QlReuUEkijqC8Dgy6EUA+ToILdh/joVeA/3IXJpEEENtQ9XIAq
Vp36+nNf1rJebS+/jzATGQusfd+Crdq4Fy4q8Y8J+i2S6TvC1Pi4PFHjVTITe5Qv
Da6NWpRAlS9HRgO7bSKvoy8if9a6zUo+YLffsxedFWMeGPmIaokenAJBWxPBvSAI
o8FxAoIBAQDEVw5F4DzEVqmIvrv+77dm5gK/iAva90wyTvzWO4RjbcfAaSrDJFTl
CiVvMXx0892DY6tJzcWu4xPtFND3BlMXVOXyD6q6Mncq5K0IizE22isB3dhZ96R9
mCKiY+95ASYxpaMu2GHnNbAhZrSSxDmhI5Q6oSRWmGxHJYj6Ppz7dRn8dczkgTm7
Of5pOkCctrvXvinQ5OEr7wbFn3EXKtWcycIMPbNhRD5RcG+DN7OhrsnFCnjolmvT
feMITjUh1rkma5+e9F/rqSEcJX3+wYwd4Y2ZXicfP4uEEcFPVvuNuSwhH9Q/CKOa
O07EpYi+Gy19y8QOvaDeGYR1dOHQ0P1S
-----END PRIVATE KEY-----