[JBoss JIRA] (WFWIP-101) SNI wildcard mappings match multiple level of subdomain
by Jan Stourac (Jira)
[ https://issues.jboss.org/browse/WFWIP-101?page=com.atlassian.jira.plugin.... ]
Jan Stourac updated WFWIP-101:
------------------------------
Description:
Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]:
{quote}
Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
{quote}
As such, in case I have configured SNI mapping for:
{code}
.*\\.example\\.com
{code}
I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
{code}
test.example.com
another-test.example.com
{code}
although following should not be matched and default server-ssl-context shall be used instead:
{code}
two-sublevel.one-sublevel.example.com
{code}
Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
was:
Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]:
{quote}
Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
{quote}
As such, in case I have configured SNI mapping for '.*\\.example\\.com', I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
{code}
test.example.com
another-test.example.com
{code}
although following should not be matched and default server-ssl-context shall be used instead:
{code}
two-sublevel.one-sublevel.example.com
{code}
Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
> SNI wildcard mappings match multiple level of subdomain
> -------------------------------------------------------
>
> Key: WFWIP-101
> URL: https://issues.jboss.org/browse/WFWIP-101
> Project: WildFly WIP
> Issue Type: Bug
> Environment: Wildfly build with undertow and wildfly-core modules build from following sources:
> * https://github.com/stuartwdouglas/undertow/tree/sni
> * https://github.com/stuartwdouglas/wildfly-core/tree/sni
> Reporter: Pavel Jelinek
> Assignee: Stuart Douglas
> Priority: Major
> Labels: SNI
>
> Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]:
> {quote}
> Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
> {quote}
> As such, in case I have configured SNI mapping for:
> {code}
> .*\\.example\\.com
> {code}
> I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
> {code}
> test.example.com
> another-test.example.com
> {code}
> although following should not be matched and default server-ssl-context shall be used instead:
> {code}
> two-sublevel.one-sublevel.example.com
> {code}
> Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 3 months
[JBoss JIRA] (WFWIP-101) SNI wildcard mappings match multiple level of subdomain
by Jan Stourac (Jira)
[ https://issues.jboss.org/browse/WFWIP-101?page=com.atlassian.jira.plugin.... ]
Jan Stourac updated WFWIP-101:
------------------------------
Steps to Reproduce:
# get and unzip WildFly
# go to WildFly home and prepare keystores:
{code}
keytool -genkeypair -alias default-cert -keyalg RSA -keysize 1024 -validity 365 -keystore standalone/configuration/default.keystore.jks -dname "CN=default" -keypass secret -storepass secret
keytool -genkeypair -alias asterisk-cert -keyalg RSA -keysize 1024 -validity 365 -keystore standalone/configuration/asterisk.keystore.jks -dname "CN=asterisk" -keypass secret -storepass secret
{code}
# start server, connect to CLI and configure SNI mappings:
{code}
/subsystem=elytron/key-store=defaultKS:add(path=default.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS)
/subsystem=elytron/key-store=asteriskKS:add(path=asterisk.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS)
/subsystem=elytron/key-manager=defaultKM:add(key-store=defaultKS,algorithm="SunX509",credential-reference={clear-text=secret})
/subsystem=elytron/key-manager=asteriskKM:add(key-store=asteriskKS,algorithm="SunX509",credential-reference={clear-text=secret})
/subsystem=elytron/server-ssl-context=defaultSSC:add(key-manager=defaultKM,protocols=["TLSv1.2"])
/subsystem=elytron/server-ssl-context=asteriskSSC:add(key-manager=asteriskKM,protocols=["TLSv1.2"])
/subsystem=elytron/server-ssl-sni-context=sniSSC:add(default-ssl-context=defaultSSC, host-context-map={".*\\.example\\.com"=asteriskSSC})
batch
/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)
/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=sniSSC)
run-batch
reload
{code}
# check how SNI works e.g. via OpenSSL s_client tool:
{code}
openssl s_client -showcerts -connect localhost:8443 -servername first-sublevel.example.com
openssl s_client -showcerts -connect localhost:8443 -servername second-sublevel.first-sublevel.example.com
{code}
was:
# configure Undertow HTTPS listener with Elytron server-ssl-sni-context with SNI mapping
{code}
.*\\.example\\.com
{code}
# perform handshake with SNIHostName _twosublevel.onesublevel.example.com_
> SNI wildcard mappings match multiple level of subdomain
> -------------------------------------------------------
>
> Key: WFWIP-101
> URL: https://issues.jboss.org/browse/WFWIP-101
> Project: WildFly WIP
> Issue Type: Bug
> Environment: Wildfly build with undertow and wildfly-core modules build from following sources:
> * https://github.com/stuartwdouglas/undertow/tree/sni
> * https://github.com/stuartwdouglas/wildfly-core/tree/sni
> Reporter: Pavel Jelinek
> Assignee: Stuart Douglas
> Priority: Major
> Labels: SNI
>
> Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]:
> {quote}
> Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
> {quote}
> As such, in case I have configured SNI mapping for '.*\\.example\\.com', I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
> {code}
> test.example.com
> another-test.example.com
> {code}
> although following should not be matched and default server-ssl-context shall be used instead:
> {code}
> two-sublevel.one-sublevel.example.com
> {code}
> Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 3 months
[JBoss JIRA] (WFWIP-100) SNI - exact hostname match is not prefered to match with wildcart
by Jan Stourac (Jira)
[ https://issues.jboss.org/browse/WFWIP-100?page=com.atlassian.jira.plugin.... ]
Jan Stourac edited comment on WFWIP-100 at 1/30/19 7:01 AM:
------------------------------------------------------------
This issue is no longer present in current implementation. Checked with {{WildFly 15.0.0.Final}}. Closing as fixed.
Note - just for a future reference, here is more comprehensive reproduction list of steps:
# get and unzip WildFly
# go to WildFly home and prepare keystores:
{code}
keytool -genkeypair -alias default-cert -keyalg RSA -keysize 1024 -validity 365 -keystore standalone/configuration/default.keystore.jks -dname "CN=default" -keypass secret -storepass secret
keytool -genkeypair -alias exact-cert -keyalg RSA -keysize 1024 -validity 365 -keystore standalone/configuration/exact.keystore.jks -dname "CN=exact" -keypass secret -storepass secret
keytool -genkeypair -alias asterisk-cert -keyalg RSA -keysize 1024 -validity 365 -keystore standalone/configuration/asterisk.keystore.jks -dname "CN=asterisk" -keypass secret -storepass secret
{code}
# start server, connect to CLI and configure SNI mappings:
{code}
/subsystem=elytron/key-store=defaultKS:add(path=default.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS)
/subsystem=elytron/key-store=exactKS:add(path=exact.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS)
/subsystem=elytron/key-store=asteriskKS:add(path=asterisk.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS)
/subsystem=elytron/key-manager=defaultKM:add(key-store=defaultKS,algorithm="SunX509",credential-reference={clear-text=secret})
/subsystem=elytron/key-manager=exactKM:add(key-store=exactKS,algorithm="SunX509",credential-reference={clear-text=secret})
/subsystem=elytron/key-manager=asteriskKM:add(key-store=asteriskKS,algorithm="SunX509",credential-reference={clear-text=secret})
/subsystem=elytron/server-ssl-context=defaultSSC:add(key-manager=defaultKM,protocols=["TLSv1.2"])
/subsystem=elytron/server-ssl-context=exactSSC:add(key-manager=exactKM,protocols=["TLSv1.2"])
/subsystem=elytron/server-ssl-context=asteriskSSC:add(key-manager=asteriskKM,protocols=["TLSv1.2"])
/subsystem=elytron/server-ssl-sni-context=sniSSC:add(default-ssl-context=defaultSSC, host-context-map={"www\\.example\\.com"=exactSSC,".*\\.example\\.com"=asteriskSSC})
batch
/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)
/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=sniSSC)
run-batch
reload
{code}
# check how SNI works e.g. via OpenSSL s_client tool:
{code}
openssl s_client -showcerts -connect localhost:8443 -servername www.example.com
openssl s_client -showcerts -connect localhost:8443 -servername non-www.example.com
{code}
was (Author: jstourac):
This issue is no longer present in current implementation. Checked with {{WildFly 15.0.0.Final}}. Closing as fixed.
> SNI - exact hostname match is not prefered to match with wildcart
> -----------------------------------------------------------------
>
> Key: WFWIP-100
> URL: https://issues.jboss.org/browse/WFWIP-100
> Project: WildFly WIP
> Issue Type: Bug
> Environment: Wildfly build with undertow and wildfly-core modules build from following sources:
> * https://github.com/stuartwdouglas/undertow/tree/sni
> * https://github.com/stuartwdouglas/wildfly-core/tree/sni
> Reporter: Pavel Jelinek
> Assignee: Stuart Douglas
> Priority: Major
> Labels: SNI
>
> Client got peer certificate mapped by the more general mapping
> {code}
> .*\\.example\\.com
> {code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 3 months
[JBoss JIRA] (WFWIP-101) SNI wildcard mappings match multiple level of subdomain
by Jan Stourac (Jira)
[ https://issues.jboss.org/browse/WFWIP-101?page=com.atlassian.jira.plugin.... ]
Jan Stourac updated WFWIP-101:
------------------------------
Description:
Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]
{quote}
Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
{quote}
As such, in case I have configured SNI mapping for '.*\\.example\\.com', I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
{code}
test.example.com
another-test.example.com
{code}
although following should not be matched and default server-ssl-context shall be used instead:
{code}
two-sublevel.one-sublevel.example.com
{code}
Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
was:
Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]
{quote}
Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
{quote}
As such, in case I have configured SNI mapping for '
The client got peer certificate mapped by the mapping despite the wildcard matches more than one level of a subdomain.
> SNI wildcard mappings match multiple level of subdomain
> -------------------------------------------------------
>
> Key: WFWIP-101
> URL: https://issues.jboss.org/browse/WFWIP-101
> Project: WildFly WIP
> Issue Type: Bug
> Environment: Wildfly build with undertow and wildfly-core modules build from following sources:
> * https://github.com/stuartwdouglas/undertow/tree/sni
> * https://github.com/stuartwdouglas/wildfly-core/tree/sni
> Reporter: Pavel Jelinek
> Assignee: Stuart Douglas
> Priority: Major
> Labels: SNI
>
> Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]
> {quote}
> Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
> {quote}
> As such, in case I have configured SNI mapping for '.*\\.example\\.com', I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
> {code}
> test.example.com
> another-test.example.com
> {code}
> although following should not be matched and default server-ssl-context shall be used instead:
> {code}
> two-sublevel.one-sublevel.example.com
> {code}
> Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 3 months
[JBoss JIRA] (WFWIP-101) SNI wildcard mappings match multiple level of subdomain
by Jan Stourac (Jira)
[ https://issues.jboss.org/browse/WFWIP-101?page=com.atlassian.jira.plugin.... ]
Jan Stourac updated WFWIP-101:
------------------------------
Description:
Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]:
{quote}
Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
{quote}
As such, in case I have configured SNI mapping for '.*\\.example\\.com', I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
{code}
test.example.com
another-test.example.com
{code}
although following should not be matched and default server-ssl-context shall be used instead:
{code}
two-sublevel.one-sublevel.example.com
{code}
Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
was:
Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]
{quote}
Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
{quote}
As such, in case I have configured SNI mapping for '.*\\.example\\.com', I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
{code}
test.example.com
another-test.example.com
{code}
although following should not be matched and default server-ssl-context shall be used instead:
{code}
two-sublevel.one-sublevel.example.com
{code}
Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
> SNI wildcard mappings match multiple level of subdomain
> -------------------------------------------------------
>
> Key: WFWIP-101
> URL: https://issues.jboss.org/browse/WFWIP-101
> Project: WildFly WIP
> Issue Type: Bug
> Environment: Wildfly build with undertow and wildfly-core modules build from following sources:
> * https://github.com/stuartwdouglas/undertow/tree/sni
> * https://github.com/stuartwdouglas/wildfly-core/tree/sni
> Reporter: Pavel Jelinek
> Assignee: Stuart Douglas
> Priority: Major
> Labels: SNI
>
> Based on the [text from analasys|https://github.com/wildfly/wildfly-proposals/blob/master/securit...]:
> {quote}
> Wildcard names use * as a wildcard, and can only be used to match a single level of subdomain in much the same way as with wildcard certificates.
> {quote}
> As such, in case I have configured SNI mapping for '.*\\.example\\.com', I expect that this mapping is selected for any single level of subdomain of example.com although, in case of any extra subdomain, this mapping is not utilized. In other words, following hostnames should match:
> {code}
> test.example.com
> another-test.example.com
> {code}
> although following should not be matched and default server-ssl-context shall be used instead:
> {code}
> two-sublevel.one-sublevel.example.com
> {code}
> Current behaviour also matches also 'two-sublevel.one-sublevel.example.com'.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 3 months