Skip to content

Changing the wildcard matching logic for client cert common names - #175

Merged
qiluo-msft merged 3 commits into
sonic-net:masterfrom
mramezani95:mramezani/client_cert_wildcard_matching_fix
Jan 15, 2026
Merged

Changing the wildcard matching logic for client cert common names#175
qiluo-msft merged 3 commits into
sonic-net:masterfrom
mramezani95:mramezani/client_cert_wildcard_matching_fix

Conversation

@mramezani95

@mramezani95 mramezani95 commented Jan 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Microsoft ADO ID: 36341347

PR #168 added support for wildcard matching between client cert CNs and trusted CNs. This PR changes the wildcard matching logic based on a discussion with @qiluo-msft and @prsunny.

Changes:

  1. Wildcard patterns starting with * but not *. (e.g., *example.sonic) are no longer valid. These patterns are skipped during the matching.
  2. *. is not a valid trusted CN and will be skipped if present.
  3. * must match one or more characters. For example, *.example.sonic will not match .example.sonic.

Note 1: Comparison is always case sensitive, but * can match both upper and lower case characters. For example, *.example.sonic matches TEST.example.sonic, but it does not match TEST.EXAMPLE.SONIC.

Note 2: Multi-level subdomain matching is allowed for wildcard patterns. For example, *.example.sonic matches test.example.sonic, sub.test.example.sonic, one.sub.test.example.sonic, and so on.

@mramezani95
Modified the wildcard matching logic for client cert CN names.
d9f9d76 
Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
@prsunny
prsunny requested a review from Copilot January 14, 2026 02:25
Copilot AI reviewed Jan 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR refines the wildcard matching logic for client certificate Common Names (CNs) during authentication. The changes restrict wildcard patterns to be more secure and predictable by requiring that wildcard patterns start with *. (not just *) and only match single-level subdomains.

Changes:

  • Modified wildcard CN validation to reject patterns starting with * that don't follow the *. format (e.g., *test.sonic is no longer valid)
  • Updated wildcard matching to only match single-level subdomains by comparing dot counts between the pattern and client CN
  • Refactored the loop structure to validate wildcard patterns once per trusted CN rather than per certificate-CN pair
  • Updated test cases to validate the new single-level subdomain matching behavior and rejection of invalid wildcard patterns

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
go-server-server/go/auth.go Implements stricter wildcard pattern validation and single-level subdomain matching logic
test/test_restapi.py Updates test cases to verify new wildcard matching behavior, including rejection of multi-level subdomains and invalid wildcard patterns

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread go-server-server/go/auth.go
@mramezani95
Fixed indentation.
8242338 
Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
@mssonicbld

mssonicbld commented Jan 14, 2026

Copy link
Copy Markdown

/azp run

@azure-pipelines

azure-pipelines Bot commented Jan 14, 2026

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

qiluo-msft
qiluo-msft reviewed Jan 14, 2026
View reviewed changes
Comment thread go-server-server/go/auth.go
continue;
}
for _, peercert := range r.TLS.PeerCertificates {
commonName := peercert.Subject.CommonName

@qiluo-msft qiluo-msft Jan 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

commonName

nitpick: if commonName is empty string, return false early. Even we have a config with empty string in allowlist, we still need to return false. #WontFix

qiluo-msft
qiluo-msft reviewed Jan 14, 2026
View reviewed changes
Comment thread go-server-server/go/auth.go
qiluo-msft
qiluo-msft reviewed Jan 14, 2026
View reviewed changes
Comment thread go-server-server/go/auth.go Outdated
@mramezani95
Multi-level subdomains are now accepted for wildcard matches. Added n…
010d5dc 
…ew unit tests.

Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
@mssonicbld

mssonicbld commented Jan 15, 2026

Copy link
Copy Markdown

/azp run

@azure-pipelines

azure-pipelines Bot commented Jan 15, 2026

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

prsunny
prsunny reviewed Jan 15, 2026
View reviewed changes
Comment thread go-server-server/go/auth.go
is_wildcard := false
domain := name
if strings.HasPrefix(name, "*.") {
if len(name) < 3 {

@prsunny prsunny Jan 15, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is this check for?

@prsunny prsunny Jan 15, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you add a comment above the check?

@mramezani95 mramezani95 Jan 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is to make sure that *. is not a valid trusted CN.

prsunny
prsunny reviewed Jan 15, 2026
View reviewed changes

@prsunny prsunny left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, @qiluo-msft could you review/approve?

@qiluo-msft
qiluo-msft merged commit 5c3f4b0 into sonic-net:master Jan 15, 2026
7 checks passed
@mssonicbld mssonicbld mentioned this pull request Jan 15, 2026
Merged
@mssonicbld

mssonicbld commented Jan 15, 2026

Copy link
Copy Markdown

Cherry-pick PR to 202505: #178

@mssonicbld mssonicbld mentioned this pull request Jan 15, 2026
Merged
@mssonicbld

mssonicbld commented Jan 15, 2026

Copy link
Copy Markdown

Cherry-pick PR to 202511: #179

mssonicbld added a commit to mssonicbld/sonic-buildimage that referenced this pull request Feb 12, 2026
@mssonicbld
Allowing wildcard client cert CNs in restapi's YANG model
8dc4ac5 
<!--
     Please make sure you've read and understood our contributing guidelines:
     https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md

     ** Make sure all your commits include a signature generated with `git commit -s` **

     If this is a bug fix, make sure your description includes "fixes #xxxx", or
     "closes #xxxx" or "resolves #xxxx"

     Please provide the following information:
-->

#### Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for `client_crt_cname` in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

##### Work item tracking
- Microsoft ADO **(number only)**: 36744821

#### How I did it
Modified the YANG model pattern for `client_crt_cname` so that each CN can start with `*.`.

#### How to verify it
Run the updated restapi YANG tests.

<!--
If PR needs to be backported, then the PR must be tested against the base branch and the earliest backport release branch and provide tested image version on these two branches. For example, if the PR is requested for master, 202211 and 202012, then the requester needs to provide test results on master and 202012.
-->

#### Which release branch to backport (provide reason below if selected)

<!--
- Note we only backport fixes to a release branch, *not* features!
- Please also provide a reason for the backporting below.
- e.g.
- [x] 202006
-->

- [ ] 202305
- [ ] 202311
- [ ] 202405
- [x] 202411
- [x] 202505
- [x] 202511

#### Tested branch (Please provide the tested image version)

<!--
- Please provide tested image version
- e.g.
- [x] 20201231.100
-->

- [x] master <!-- image version 1 -->

#### Description for the changelog
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->
Updating restapi's YANG model to allow wildcard CNs in the `client_crt_cname` field.

<!--
 Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.
-->

#### Link to config_db schema for YANG module changes
<!--
Provide a link to config_db schema for the table for which YANG model
is defined
Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md
-->
https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#restapi
@mssonicbld mssonicbld mentioned this pull request Feb 12, 2026
Merged
7 tasks
anilal-amd pushed a commit to anilal-amd/anilal-forked-sonic-mgmt that referenced this pull request Feb 19, 2026
@mramezani95 @ztan-amd
Adding restapi client cert authentication tests (sonic-net#22222)
d27b5ac 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: Zhuohui Tan <zhuohui.tan@amd.com>
FengPan-Frank pushed a commit to FengPan-Frank/sonic-buildimage that referenced this pull request Mar 6, 2026
@mramezani95 @FengPan-Frank
Allowing wildcard client cert CNs for restapi. (sonic-net#25450)
5abd831 
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

Work item tracking
Microsoft ADO (number only): 36744821
How I did it
Modified the YANG model pattern for client_crt_cname so that each CN can start with *..

Signed-off-by: Feng Pan <fenpan@microsoft.com>
vmittal-msft pushed a commit to sonic-net/sonic-buildimage that referenced this pull request Mar 16, 2026
@mssonicbld
Allowing wildcard client cert CNs in restapi's YANG model (#25475)
41bcfce 
<!--
     Please make sure you've read and understood our contributing guidelines:
     https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md

     ** Make sure all your commits include a signature generated with `git commit -s` **

     If this is a bug fix, make sure your description includes "fixes #xxxx", or
     "closes #xxxx" or "resolves #xxxx"

     Please provide the following information:
-->

#### Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for `client_crt_cname` in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

##### Work item tracking
- Microsoft ADO **(number only)**: 36744821

#### How I did it
Modified the YANG model pattern for `client_crt_cname` so that each CN can start with `*.`.

#### How to verify it
Run the updated restapi YANG tests.

<!--
If PR needs to be backported, then the PR must be tested against the base branch and the earliest backport release branch and provide tested image version on these two branches. For example, if the PR is requested for master, 202211 and 202012, then the requester needs to provide test results on master and 202012.
-->

#### Which release branch to backport (provide reason below if selected)

<!--
- Note we only backport fixes to a release branch, *not* features!
- Please also provide a reason for the backporting below.
- e.g.
- [x] 202006
-->

- [ ] 202305
- [ ] 202311
- [ ] 202405
- [x] 202411
- [x] 202505
- [x] 202511

#### Tested branch (Please provide the tested image version)

<!--
- Please provide tested image version
- e.g.
- [x] 20201231.100
-->

- [x] master <!-- image version 1 -->

#### Description for the changelog
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->
Updating restapi's YANG model to allow wildcard CNs in the `client_crt_cname` field.

<!--
 Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.
-->

#### Link to config_db schema for YANG module changes
<!--
Provide a link to config_db schema for the table for which YANG model
is defined
Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md
-->
https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#restapi
dprital pushed a commit to sonic-net/sonic-buildimage that referenced this pull request Mar 19, 2026
@mramezani95 @dprital
Allowing wildcard client cert CNs for restapi. (#25450)
0097815 
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

Work item tracking
Microsoft ADO (number only): 36744821
How I did it
Modified the YANG model pattern for client_crt_cname so that each CN can start with *..

Signed-off-by: dprital <drorp@nvidia.com>
venu-nexthop pushed a commit to venu-nexthop/sonic-mgmt that referenced this pull request Mar 19, 2026
@mramezani95 @venu-nexthop
Adding restapi client cert authentication tests (sonic-net#22222)
51ca6d9 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.
selldinesh pushed a commit to selldinesh/sonic-mgmt that referenced this pull request Apr 1, 2026
@mramezani95 @selldinesh
Adding restapi client cert authentication tests (sonic-net#22222)
8027783 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: selldinesh <dinesh.sellappan@keysight.com>
albertovillarreal-keys pushed a commit to albertovillarreal-keys/sonic-mgmt that referenced this pull request Apr 3, 2026
@mramezani95 @albertovillarreal-keys
Adding restapi client cert authentication tests (sonic-net#22222)
35f8ab0 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.
rraghav-cisco pushed a commit to rraghav-cisco/sonic-mgmt that referenced this pull request Apr 20, 2026
@mramezani95 @rraghav-cisco
Adding restapi client cert authentication tests (sonic-net#22222)
1e02aff 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: Raghavendran Ramanathan <rraghav@cisco.com>
mhchann pushed a commit to mhchann/sonic-buildimage that referenced this pull request May 7, 2026
@mramezani95 @mhchann
Allowing wildcard client cert CNs for restapi. (sonic-net#25450)
ee5c255 
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

Work item tracking
Microsoft ADO (number only): 36744821
How I did it
Modified the YANG model pattern for client_crt_cname so that each CN can start with *..

Signed-off-by: mhchann <mhchann082@gmail.com>
selldinesh pushed a commit to selldinesh/sonic-mgmt that referenced this pull request Jun 11, 2026
@mramezani95 @selldinesh
Adding restapi client cert authentication tests (sonic-net#22222)
f7ee67e 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: selldinesh <dinesh.sellappan@keysight.com>
roger530-ho pushed a commit to roger530-ho/sonic-buildimage that referenced this pull request Jun 23, 2026
@mramezani95 @roger530-ho
Allowing wildcard client cert CNs for restapi. (sonic-net#25450)
fcd0ee4 
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

Work item tracking
Microsoft ADO (number only): 36744821
How I did it
Modified the YANG model pattern for client_crt_cname so that each CN can start with *..
xdqi pushed a commit to canonical/sonic-buildimage that referenced this pull request Jul 6, 2026
@mramezani95
Allowing wildcard client cert CNs for restapi. (sonic-net#25450)
7b9591f 
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

Work item tracking
Microsoft ADO (number only): 36744821
How I did it
Modified the YANG model pattern for client_crt_cname so that each CN can start with *..
ssithaia-ebay pushed a commit to ssithaia-ebay/sflow-yang-sonic-mgmt that referenced this pull request Jul 21, 2026
@mramezani95 @ssithaia-ebay
Adding restapi client cert authentication tests (sonic-net#22222)
1b31038 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: ssithaia-ebay <ssithaian@ebay.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@prsunny prsunny prsunny left review comments
Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@qiluo-msft qiluo-msft qiluo-msft approved these changes

Assignees

No one assigned

Labels

Approved for 202505 Branch Approved for 202511 Branch Included in 202505 Branch Included in 202511 Branch Request for 202505 Branch Request for 202511 Branch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@mramezani95 @mssonicbld @qiluo-msft @prsunny