Files
Groene AI b906bc5c09 Enforce single-component matching for SSL certificate wildcards
A '*' in an ssl_certificate user subject was constrained only by an
equal-slash-count check ("'*' must not represent a '/' in URI"). For CN
and "DNS:" SAN subjects there are no slashes, so the check was always
0 == 0 and did nothing. A user identified by '*.corp.example.com' was
therefore matched by any subject ending in '.corp.example.com',
including multi-label names like 'evil.deep.corp.example.com'. An
attacker able to obtain a CA-signed certificate for a deeper subdomain
could authenticate as the wildcard user.

Per RFC 6125 6.4.3 a wildcard must match exactly one component.
Generalize the separator to be type-aware: '.' for CN and "DNS:" SANs
(DNS label separator), '/' for "URI:" SANs (path separator, preserving
the previous behavior exactly). The matched span between the fixed
prefix and suffix must not contain the separator.

The candidate length is checked before computing the matched span so
its length cannot underflow when the prefix and suffix overlap on a
short candidate (e.g. pattern 'a*a', candidate 'a'), which also removes
a pre-existing overlap false positive. For URI SANs, "matched span has
no '/'" is equivalent to the previous equal-slash-count guard, so
existing URI wildcard behavior is unchanged.

Add integration tests covering DNS and CN wildcards (single-label
positive, multi-label bypass rejected) and a URI SAN whose matched
segment contains a dot (non-regression).
2026-06-25 12:29:07 +00:00

53 lines
3.2 KiB
Plaintext

-----BEGIN PRIVATE KEY-----
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDFjIzZ4Fydoxtj
0mS+UU+oBOgsxilo4jmg9rGyfdIVktQeeVkhrEzx1hGyKELPzbdeTpPf5lsEhcdZ
ShrkXnWVncuc8E/rqGcm0B0ss7LvqMcsPxnO6sf72MYAoxfpdnWapAq9ULo1P4DZ
2lH+imMiEkJBR4wIG9h53Q+l4XjG+oFlXxEeXegI3lLhkNKl+ba4cgE1+1wwFEuB
Bx9yBzsSW1rTnwd90JsoIUqL8A9dvP/8iAb0tPXRh3G53RceUBDHfrNlbFTKQbso
7tzLVLaf7XK50w8CqN16uZOvLe8cylOKJcH1CW4MzDGdpjF4JAQBMv9efFcNWMF1
1LoqB2yWQrI4ZCicDTpAG0P0qPzFytGQBGbRxhLVpjgIBrQTx6Bi31+LY8cwrm4s
9qy/uiZx3FP/8kDa+0CX+EdxqG3m2+m+0g5oq/QvRrUvjpxDyNbosGTPc2Rp6/hH
od+aRo1VAWPFjOcIvAK/cuupnI21/684RGivyunXLfdC5TPDTI4KQNDlb6jqRG3J
etZJqnXdZ4iE4ZsmDpRp4VEKO+igoM/HjJ/qzwPJ4pC/e/R7AJedP6IjRJMvvcgU
BOgQkXmBliPcVWnLA5Wcnk0mWPpwlspffAHTiwc64TD+NwRnGKsADTOZD4dCda3T
xv4JJAEzR7f9f6mx/+PC6KUhG23lzwIDAQABAoICAAK2XnwNWGgyWZ7CFZpcBnJ2
+B3JQ2n1FTfQZfnelWMGHD3Q37hBI+Cm1kuybCcV8CsY0W9KZpHbfl8LpUPhHM8x
lp6bLsBnFFzUOwT78KcuvjwCynQXWtM/6N67CTSDk7N3BiNkTNzh+CnFlXOfwHhd
dNBtpDlmRyTL3rpMgWUwrP8l0i0vD+UInG22wyr+kJOGvofYYYMoJtiThEsuAzx0
yadMhdn54m98yYe+A4//bNUG+cV5Xe4DDzzZ5saGmzxfUSTsMFvYkYfLLnfnkVxa
cm/6ZbiHy1wIg+5spzL81NnO5pNajkrEW6K0/0qNgAqTgdhxGkbiIuyJv7FHtHtz
eIBuK/vocssvH/ItcHZf+UpbgcnacYIwsow+igXJ1wtItQqnk3kz3dvCH36HYq4l
mcsDxKIxfp70alY9P5ww1SASWhVj+d8DyEXQWBzqaYDXRhqbmSpaYkq5OAT10046
rQv9EZdVF9jWDMKG+nvJW2af5kTxF9STC4G6eUVMndv4jxI0b+Lnt391Uuq8hm+z
MfP8busN6TBKX/7cGaxlo+GGvaEdT8g+mbpsdQSmI12etLXiAVSCQnUXSm6GwonG
g2/GD1wwxvOV2eYgwjSGGVpoB88JTAw/AN+4dCxkJGeJ8WZdDSACBQMJrWx/II3i
p/MKF0CjRnsWuhs08Lc9AoIBAQD5imoAaKCUvyPZGzHor9efg7exhox1Y5uR6E8C
SuqUSb/Q/aVC2PBf1XElMFrJwvsMFbppkk2QAFfOr6/HQ/IGBGoBfX9VST/wFYU2
1Aq+htlFJ9Pvd1cfxTdUpuNZtKrIlv/KSdSzt7ILJiXlDTnWlPRuKlNqi5JD/n2b
KE1ifdor02lgPGsOnZb6bWex4N4kJG/3O/zRvhl7oyqO+rgivBsloKLkyMSvO5RM
0sy/ALkg1zOGFXdwvh/3wf8tEsi+2ZxAF6RCn8T3CXvFOVmrHDFnNsGoyGCeOie2
xvIo3LkxnJM0ffdaBLxmA0CLF7c5PIGOMsomuqazDA3Fg/OdAoIBAQDKqZzKVeO7
/di2q9Pyzm3tMHKULI5FJ3vVm1485wFQsHSQcnyL9cItk9yWkhFUwau+qz+jDOvu
LCkbnezEVI2smeteG0w7VDab0SP6xbsMX+uKdClDB8hXFnDuy1JmTGRuNPJMbiWp
B8n2IpIQQw2VfXcCIj2keazu4UTwba07z6ElPfFpuchkNsGPPTH6hjvrJz4a592Q
B+bIggqzv3DqG064gjz6hhBskmBI8Uk3GzQjcLnFQilEp+RJN/LNOFbFBZrWvard
FcroOp2imHflH+HqoGBT1KzqyIscXUUNKsgcPFLHUH7kjqoH2R2x4subyD4mA237
E6tY3hW9lnFbAoIBAAFe6UYnTPqEMkY3CAcnMCAIMTIgcxUR/wDGLejtUGyQGyWi
vw2m82sTWRPDODxzfb2LQQLjctmfptvTyztk/CdcTtjDP7fQNzGybJDoiUaSpw7i
MR/Xn/rksnEcmZMckvOXIMCTtz9leuzkwMCJWg/7sXwJb3veWGdXNolrp0ErP8+N
0b5dlpj19KZbg35Opem86YCKK9FbIfiz5L/0UJ6gOeXzA/INyEbOJPpnDgjekCXG
CNprs8RCxxotTqGIwOGLgHg5qQVUq1hQDQYAUqXF+d9/RYEP2LgFycIPRbVDwSCs
o4JeTsWH0SEeU3RwJOmDk5KcZM/hppjFMC4tk2ECggEBALTLJR14C+asaYVkunrU
X0qGuuCm8vCMbbO8nBBWwFycXhByods2DdkdHF+SxTVIZQ9+tBGgOGVMLgv+Ebd/
+rdsxIU6cwJGeUT+CUvw05IRjA4C3MB4k+flFDBjYAn0wm9yemlmpeAqG6ihZI5v
UxH2UJGtvDIbfgPJIPgfz7gY3RhdLx1zaGrGUlyXahulXpTEeGoGSSjxc5eSMzvx
YCjo3YxKW13e9Y3180F/RyKK+TNYn9Fy2V/vKv+KkuczCG1RN7W0lFYQ1+feSrw/
qk3T6HWoRubiRrRY3YkbR7ucW9KcmfhHPjxlbRf9P7luqtc5hv/gdV/URzrLPLfa
GxsCggEAenaXk9oZN3tltd25mKuj/Ybtk0o1zBIlhfGkhVOoqZBWjD0HODmyBClw
VKKblBtd395tWQnqyB2k8eD/R5xMICbx93k5xWbHV1+FtJrG2cUGPW6BR9kHsufX
q5QN6NM1eyhi3YzhmLcErFJHEw08w1Fq+z+EFjDXtoP2eP8PNqZiu7HNZXgias8c
1IKFCjv1P9lShJF4NcadWrlrdiApKonTAySEA6OdZVWj4avMiQHpx4xm0Rh5G6mO
4UZOOaEZ2wedbqQEx0Rcy+3we+b2ejgfzuz5RIykuYIUyrJrHpSsgLfp40jIKVUE
xmeoVSu3+dXoaoq54TdIlmj5SvJPHw==
-----END PRIVATE KEY-----