Files
Groene AI b906bc5c09 Enforce single-component matching for SSL certificate wildcards
A '*' in an ssl_certificate user subject was constrained only by an
equal-slash-count check ("'*' must not represent a '/' in URI"). For CN
and "DNS:" SAN subjects there are no slashes, so the check was always
0 == 0 and did nothing. A user identified by '*.corp.example.com' was
therefore matched by any subject ending in '.corp.example.com',
including multi-label names like 'evil.deep.corp.example.com'. An
attacker able to obtain a CA-signed certificate for a deeper subdomain
could authenticate as the wildcard user.

Per RFC 6125 6.4.3 a wildcard must match exactly one component.
Generalize the separator to be type-aware: '.' for CN and "DNS:" SANs
(DNS label separator), '/' for "URI:" SANs (path separator, preserving
the previous behavior exactly). The matched span between the fixed
prefix and suffix must not contain the separator.

The candidate length is checked before computing the matched span so
its length cannot underflow when the prefix and suffix overlap on a
short candidate (e.g. pattern 'a*a', candidate 'a'), which also removes
a pre-existing overlap false positive. For URI SANs, "matched span has
no '/'" is equivalent to the previous equal-slash-count guard, so
existing URI wildcard behavior is unchanged.

Add integration tests covering DNS and CN wildcards (single-label
positive, multi-label bypass rejected) and a URI SAN whose matched
segment contains a dot (non-regression).
2026-06-25 12:29:07 +00:00

53 lines
3.2 KiB
Plaintext

-----BEGIN PRIVATE KEY-----
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDiD9qGRE0IyYWb
9XFfOABp4a5pJTave4gZmVVZORMKrCyjAZfiPV3UJ+XnVNIwRbgmSCNCyGPByJDM
hpyIckQaIYKknTMfcBZksDcKH3msLuj4agpPbxtyYbpDNHIjJHMvJRQXZY5mLMSJ
YrqwgpN2m36o5EWnF2GZ5QlbTSO1BhUusMejUGApyt/bkmy9mcog43gqOQaTqlWY
YKWxC3gOAukTA3lxNeSygutFdIowQ8VA5ZZfGyh4MW5ts5Z7WIzf4HQxvwc7Sx6I
hBVhRujTChYdhUPZb8daBypCfVIPOp2h5IfjLHZok+rx6BJ2Ouahkk1AI+NzU6Gq
iB5qKmM2dBgfvR0KYR7PtNahmgn7LwVlyhjGUlQtNNn5HUp71k7sZHsCP/O0owfG
11Ns79oHxv/XXp5PvjHtBix7a8XM8DrriYUtfBwBktwQY54FgxlPHui5dQgvR7BE
U/uEHSKrHZaDsYrw4KU8yZ5s03AIU+ZtBYE7KxjPSFTvbtOMQPi4O4LRoph/GmHy
LwYtQOpis4bdZdNK/GoBaiash4cewgRbv86UY46eaUbqrVxrxrET80RasOMdxdNk
Xyolwvkh5mc/cXPO8BbKiTlaVlc4lqf6Fw+xpWPfuN2idBIxIZFtxClJBSrHK3Je
8D4AtMOeJcG1mMhduJV/Bmrv/P9gQQIDAQABAoICAAJ/6jjAUp9t/GdGb6cZz0D8
eGhqI3mFjb5aGH5NLw8D6xX/6Aa12ti8MqTODoFfPDxnwVRvOymH5+Rb0cFRTYQS
JEHZEVUh7Py20Us8UJTwH2pDqIi/Ctk7FAFbNB7T895K2j7hbA2IlblS3jNybG5a
FRiZpnS05a7XIE04MkidqjZUEP9PAbr1EuBUgU1n+Or/5mjFvN8tKcNasFrXrIuP
vhVgSTmAivpzh73OwnJa5bx+VGkxl4MbmXHq/68+Qg+lvY2tM/+YjLBF6P9Mepme
rLKlphPGcnByHE44IOAlU9vb5znyjG4y4mTzmeiI3Xr2a1pZ8j1svJSqUt8l0A87
RqCbdeYZmgGNZU6xLiqnd71O23X2DBYzfRJ6fjNWZNLQgDj3lW3NuxvzluzFV0et
/mhi7L4yhX1USg4QfFgGEdp/T+B8HNcA5qiz3g1XZu2i1hEZRnlHYUwFE983SqhW
KQylYGNvFc7aP+E+J+RLBuidd8zOMAtdSC3vKfg1G0xICVb2gKga5J8qOn6/3voI
JYaUIaBwjDc72cpJEjnSbpvNlcFTffu+PD4eC/KlZMMmZmYweaoAY82bguzhAewd
uTiDaBoV2Lsvr3PT5LBor5ESDkBbYUvYyIP6YwWjEwCPTzK0p1RK0RJT95pPVdlq
95EQsZshLhBnXgDjQHuBAoIBAQD6Zq97CgtCZbyHraApSMWMCiXFqE/R+yFoVi5E
XXD7TSyhHk/VCkO8+wIG3VnE5R9r4FuDLEq5rKPE6gklMIxbKARWEidhEnqm2N7i
7EYHkSoTP/oCzqjhQ9hvIGlu3tzuThd6a0nSHENwjCVrJey2D2RENSrW6apwiH+m
y9pfPwS07p6bk2sDSvQ1cbHm58WFbmMfO4BjZJzIpYk3HeIFQQ36HXom5ep+Veiy
R45EkFM+kKrU6a40ADpF/aaaZzasTL7vYMS/jeyJQj/eGn3wTKJ2bLpxByrA81Kw
Powql2SZXmurHWOECOsvBZIi7y2HE1KAjb4KxuAbkevTI+OBAoIBAQDnHdlNAbQz
UBAMXJycNNLfySvhWWTRnVeoXQLjapwyDpYOq+C8aK7mjizlZD7pYuL+T5B+c+n0
bknYrH5fJSjbG4X6gJ/faJ/NeDPtdvMf9qLscfRMXH1wIMf8RpXzUqWYnLpVs66B
t+LeJyyCFHDhjn+wNdxTgjQANEOL2s9CK33a44d8SHmhXKnwq3fiAL/gtIHhtTbR
HOsKZ3YxOeCB5yBrfshm+XCSSGuyj+0O6HxWE4FzEuVCT2z/MR3oaDCrQU4NIvpm
NQhmG9O+mjnf1NiY3fKEGIkGeEOlHWhE0QsEQDbq8x4s0/WqKU3D/2pdWBBDAdlw
/QowsEo2btzBAoIBAG1pSOveK6VLhuFSAFWJsqfKF08SiC4cKTDJ11WP7rofsoyE
DiXsYkTE+NG/DmZ2JxCf69yZEd2njbeQ+4YAfJOoHJzvOb20sVsOD/Xff4n26AeZ
QMjRPAGR/5Qu+WK0hpyqCqA3GP5x0xXuZrs2ywOSHiGfiaR2XT7mpcBf+n77rjbQ
vQUFmRDLQ4HGuBFI3Im8/hq7iRHk+IzDp/0pVYUuM8lB8AnnFFs3doHPul5DIdyI
odx+btvR7aR/fLiiuMT4k8VM5ys7/ErNY9LMiJLjKWnNgHm6w/ejWlIgQmap2A8b
rrgKE12x9/GH4Z7aG26WBsqdJJjY5TumuwB7AgECggEBAL4Ot9Ix4oSIBIqF5mw2
rGtHvgQVRWlzYNCdnHB0DXrEr/Xktm16EMqchKMnquy2W0ETIRo8LFrMD4JVZ57K
qix1F9qGx/Iq0a9geCOBvDG+2wBiPapGLQl2i78UNN/iSTeVO06a8pjOJYzW3i0i
riluy+aWhFdQLX81e46ZI/OgXGES1yoHV66wyzeVaoK6ZxBcoKqCIVAZ3deyeWnF
1LA+51Q+8IJuAnrpf1daMHIgEY+ffsao9UtwkYvSUmv6sntCuvLmntBKMFv36ktF
/O3q1Svw6SxkGNrvL4GrC0H8PnkCbacMwvXOYKnMSZ0yf7+/WbAg5zWZgTXE42Kc
DIECggEBAKgq5l++ze6RTUZ3wu62bD7gT/SA6IDF9Gb5QG8pOTBK1vtQ3mhbiNko
wsg3VbMvxgEfJ7ExsfE8L6+7/9fJkQu3zoFP6C3dli/jL3hP8HSmFa6GYOVmEKV9
Kx7WDdmHtO34q1JurB8OPTiMVzYqwMP9n2ZSK2pbWPzW+/d+n2jfx2gJl2iDSSJQ
3YiMrVJCB4rzO3cnemXoKloTV8E7ETzFvrgJmi79Ukt4l4H6W3rjDPjdkhGCKbva
xZKU1AK48i5jB987K7Tcn9q7CRM51Ws5YF9BejVIAYYQNAi/xQgq28PodQgayLrz
p10qDVtVeDfAi4+M12NWY8oxn5UctiA=
-----END PRIVATE KEY-----