Changing the wildcard matching logic for client cert common names by mramezani95 · Pull Request #175 · sonic-net/sonic-restapi

mramezani95 · 2026-01-14T02:23:50Z

Microsoft ADO ID: 36341347

PR #168 added support for wildcard matching between client cert CNs and trusted CNs. This PR changes the wildcard matching logic based on a discussion with @qiluo-msft and @prsunny.

Changes:

Wildcard patterns starting with * but not *. (e.g., *example.sonic) are no longer valid. These patterns are skipped during the matching.
*. is not a valid trusted CN and will be skipped if present.
* must match one or more characters. For example, *.example.sonic will not match .example.sonic.

Note 1: Comparison is always case sensitive, but * can match both upper and lower case characters. For example, *.example.sonic matches TEST.example.sonic, but it does not match TEST.EXAMPLE.SONIC.

Note 2: Multi-level subdomain matching is allowed for wildcard patterns. For example, *.example.sonic matches test.example.sonic, sub.test.example.sonic, one.sub.test.example.sonic, and so on.

Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>

Copilot

Pull request overview

This PR refines the wildcard matching logic for client certificate Common Names (CNs) during authentication. The changes restrict wildcard patterns to be more secure and predictable by requiring that wildcard patterns start with *. (not just *) and only match single-level subdomains.

Changes:

Modified wildcard CN validation to reject patterns starting with * that don't follow the *. format (e.g., *test.sonic is no longer valid)
Updated wildcard matching to only match single-level subdomains by comparing dot counts between the pattern and client CN
Refactored the loop structure to validate wildcard patterns once per trusted CN rather than per certificate-CN pair
Updated test cases to validate the new single-level subdomain matching behavior and rejection of invalid wildcard patterns

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
go-server-server/go/auth.go	Implements stricter wildcard pattern validation and single-level subdomain matching logic
test/test_restapi.py	Updates test cases to verify new wildcard matching behavior, including rejection of multi-level subdomains and invalid wildcard patterns

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

go-server-server/go/auth.go

Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>

mssonicbld · 2026-01-14T02:32:28Z

/azp run

azure-pipelines · 2026-01-14T02:32:38Z

Azure Pipelines successfully started running 1 pipeline(s).

qiluo-msft · 2026-01-14T02:55:03Z

go-server-server/go/auth.go

+			continue;
+		}
+		for _, peercert := range r.TLS.PeerCertificates {
+			commonName := peercert.Subject.CommonName


commonName

nitpick: if commonName is empty string, return false early. Even we have a config with empty string in allowlist, we still need to return false. #WontFix

go-server-server/go/auth.go

…ew unit tests. Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>

mssonicbld · 2026-01-15T23:30:19Z

/azp run

azure-pipelines · 2026-01-15T23:30:28Z

Azure Pipelines successfully started running 1 pipeline(s).

prsunny · 2026-01-15T23:43:12Z

go-server-server/go/auth.go

+		is_wildcard := false
+		domain := name
+		if strings.HasPrefix(name, "*.") {
+			if len(name) < 3 {


what is this check for?

can you add a comment above the check?

This is to make sure that *. is not a valid trusted CN.

prsunny

lgtm, @qiluo-msft could you review/approve?

mssonicbld · 2026-01-15T23:57:04Z

Cherry-pick PR to 202505: #178

mssonicbld · 2026-01-15T23:57:26Z

Cherry-pick PR to 202511: #179

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching. Co-authored-by: mramezani95 <mramezani@microsoft.com>

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching. Signed-off-by: ayya <anirudh.ayya@nokia.com>

…nic-net#22233) Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching. Co-authored-by: mramezani95 <mramezani@microsoft.com> Signed-off-by: Lakshmi Yarramaneni <lakshmi@nexthop.ai>

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching. Signed-off-by: nnelluri-cisco <nnelluri@cisco.com>

Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *..

#### Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for `client_crt_cname` in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). ##### Work item tracking - Microsoft ADO **(number only)**: 36744821 #### How I did it Modified the YANG model pattern for `client_crt_cname` so that each CN can start with `*.`. #### How to verify it Run the updated restapi YANG tests.  #### Which release branch to backport (provide reason below if selected)  - [ ] 202305 - [ ] 202311 - [ ] 202405 - [x] 202411 - [x] 202505 - [x] 202511 #### Tested branch (Please provide the tested image version)  - [x] master  #### Description for the changelog  Updating restapi's YANG model to allow wildcard CNs in the `client_crt_cname` field.  #### Link to config_db schema for YANG module changes  https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#restapi

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching. Signed-off-by: Zhuohui Tan <zhuohui.tan@amd.com>

Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *.. Signed-off-by: Feng Pan <fenpan@microsoft.com>

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching. Signed-off-by: Ravali Yeluri (WIPRO LIMITED) <v-ryeluri@microsoft.com>

#### Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for `client_crt_cname` in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). ##### Work item tracking - Microsoft ADO **(number only)**: 36744821 #### How I did it Modified the YANG model pattern for `client_crt_cname` so that each CN can start with `*.`. #### How to verify it Run the updated restapi YANG tests.  #### Which release branch to backport (provide reason below if selected)  - [ ] 202305 - [ ] 202311 - [ ] 202405 - [x] 202411 - [x] 202505 - [x] 202511 #### Tested branch (Please provide the tested image version)  - [x] master  #### Description for the changelog  Updating restapi's YANG model to allow wildcard CNs in the `client_crt_cname` field.  #### Link to config_db schema for YANG module changes  https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#restapi

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching. Signed-off-by: Abhishek <abhishek@nexthop.ai>

Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *.. Signed-off-by: dprital <drorp@nvidia.com>

Description of PR Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication. Summary: Microsoft ADO ID: 36622838 This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Modified the wildcard matching logic for client cert CN names.

d9f9d76

Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>

prsunny requested a review from Copilot January 14, 2026 02:25

Copilot started reviewing on behalf of prsunny January 14, 2026 02:26 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

go-server-server/go/auth.go Show resolved Hide resolved

Fixed indentation.

8242338

Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>

qiluo-msft reviewed Jan 14, 2026

View reviewed changes

go-server-server/go/auth.go Show resolved Hide resolved

qiluo-msft reviewed Jan 14, 2026

View reviewed changes

go-server-server/go/auth.go Outdated Show resolved Hide resolved

Multi-level subdomains are now accepted for wildcard matches. Added n…

010d5dc

…ew unit tests. Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>

prsunny reviewed Jan 15, 2026

View reviewed changes

qiluo-msft approved these changes Jan 15, 2026

View reviewed changes

qiluo-msft merged commit 5c3f4b0 into sonic-net:master Jan 15, 2026
7 checks passed

prsunny added Request for 202505 Branch Approved for 202505 Branch Request for 202511 Branch Approved for 202511 Branch labels Jan 15, 2026

mssonicbld mentioned this pull request Jan 15, 2026

[action] [PR:175] Changing the wildcard matching logic for client cert common names #178

Merged

mssonicbld added the Created PR to 202505 Branch label Jan 15, 2026

mssonicbld mentioned this pull request Jan 15, 2026

[action] [PR:175] Changing the wildcard matching logic for client cert common names #179

Merged

mssonicbld added the Created PR to 202511 Branch label Jan 15, 2026

mssonicbld added Included in 202511 Branch and removed Created PR to 202511 Branch Created PR to 202505 Branch labels Jan 16, 2026

mssonicbld added the Included in 202505 Branch label Jan 16, 2026

mramezani95 mentioned this pull request Feb 3, 2026

Adding restapi client cert authentication tests sonic-net/sonic-mgmt#22222

Merged

12 tasks

mssonicbld mentioned this pull request Feb 3, 2026

[action] [PR:22222] Adding restapi client cert authentication tests sonic-net/sonic-mgmt#22233

Merged

12 tasks

mramezani95 mentioned this pull request Feb 11, 2026

Allowing wildcard client cert CNs in restapi's YANG model sonic-net/sonic-buildimage#25450

Merged

7 tasks

mssonicbld mentioned this pull request Feb 12, 2026

[action] [PR:25450] Allowing wildcard client cert CNs in restapi's YANG model sonic-net/sonic-buildimage#25474

Open

7 tasks

mssonicbld mentioned this pull request Feb 12, 2026

[action] [PR:25450] Allowing wildcard client cert CNs in restapi's YANG model sonic-net/sonic-buildimage#25475

Merged

7 tasks

Conversation

mramezani95 commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

mssonicbld commented Jan 14, 2026

Uh oh!

azure-pipelines bot commented Jan 14, 2026

Uh oh!

qiluo-msft Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Jan 15, 2026

Uh oh!

azure-pipelines bot commented Jan 15, 2026

Uh oh!

prsunny Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

prsunny Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

mramezani95 Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

prsunny left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mssonicbld commented Jan 15, 2026

Uh oh!

mssonicbld commented Jan 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

mramezani95 commented Jan 14, 2026 •

edited

Loading

qiluo-msft Jan 14, 2026 •

edited

Loading