Allowing wildcard client cert CNs in restapi's YANG model - #25450
Merged
qiluo-msft merged 1 commit intoFeb 12, 2026
Merged
qiluo-msft merged 1 commit into
qiluo-msft merged 1 commit into
Conversation
Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the sonic-restapi YANG model to permit wildcard client certificate CN entries (e.g., *.example.com) to align with recent wildcard CN matching support in related components, and expands the YANG model test vectors accordingly.
Changes:
- Update
client_crt_cnameYANGpatternto allow an optional*.prefix per CN entry. - Extend restapi YANG model test configs with additional valid/invalid wildcard CN cases.
- Update the restapi YANG test expectations to match the new test vectors.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/sonic-yang-models/yang-models/sonic-restapi.yang | Broadens client_crt_cname validation regex to accept *.-prefixed CNs. |
| src/sonic-yang-models/tests/yang_model_tests/tests_config/restapi.json | Adds new test configurations covering wildcard CN acceptance/rejection. |
| src/sonic-yang-models/tests/yang_model_tests/tests/restapi.json | Adds/renames test expectation entries for the new wildcard CN cases. |
prsunny
approved these changes
Feb 12, 2026
prsunny
added
Request for 202505 Branch
Approved for 202505 Branch
Request for 202511 Branch
Approved for 202511 Branch
YANG
7 tasks
Collaborator
|
Cherry-pick PR to 202505: #25474 |
7 tasks
Collaborator
|
Cherry-pick PR to 202511: #25475 |
6 tasks
FengPan-Frank
pushed a commit
to FengPan-Frank/sonic-buildimage
that referenced
this pull request
Mar 6, 2026
Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *.. Signed-off-by: Feng Pan <fenpan@microsoft.com>
dprital
pushed a commit
that referenced
this pull request
Mar 19, 2026
Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *.. Signed-off-by: dprital <drorp@nvidia.com>
mhchann
pushed a commit
to mhchann/sonic-buildimage
that referenced
this pull request
May 7, 2026
Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *.. Signed-off-by: mhchann <mhchann082@gmail.com>
roger530-ho
pushed a commit
to roger530-ho/sonic-buildimage
that referenced
this pull request
Jun 23, 2026
Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *..
xdqi
pushed a commit
to canonical/sonic-buildimage
that referenced
this pull request
Jul 6, 2026
Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *..
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for
client_crt_cnamein restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).Work item tracking
How I did it
Modified the YANG model pattern for
client_crt_cnameso that each CN can start with*..How to verify it
Run the updated restapi YANG tests.
Which release branch to backport (provide reason below if selected)
Tested branch (Please provide the tested image version)
Description for the changelog
Updating restapi's YANG model to allow wildcard CNs in the
client_crt_cnamefield.Link to config_db schema for YANG module changes
https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#restapi