Skip to content

Changing the wildcard matching logic for client cert common names#175

Merged
qiluo-msft merged 3 commits intosonic-net:masterfrom
mramezani95:mramezani/client_cert_wildcard_matching_fix
Jan 15, 2026
Merged

Changing the wildcard matching logic for client cert common names#175
qiluo-msft merged 3 commits intosonic-net:masterfrom
mramezani95:mramezani/client_cert_wildcard_matching_fix

Conversation

@mramezani95
Copy link
Contributor

@mramezani95 mramezani95 commented Jan 14, 2026 •
edited
Loading

Microsoft ADO ID: 36341347

PR #168 added support for wildcard matching between client cert CNs and trusted CNs. This PR changes the wildcard matching logic based on a discussion with @qiluo-msft and @prsunny.

Changes:

  1. Wildcard patterns starting with * but not *. (e.g., *example.sonic) are no longer valid. These patterns are skipped during the matching.
  2. *. is not a valid trusted CN and will be skipped if present.
  3. * must match one or more characters. For example, *.example.sonic will not match .example.sonic.

Note 1: Comparison is always case sensitive, but * can match both upper and lower case characters. For example, *.example.sonic matches TEST.example.sonic, but it does not match TEST.EXAMPLE.SONIC.

Note 2: Multi-level subdomain matching is allowed for wildcard patterns. For example, *.example.sonic matches test.example.sonic, sub.test.example.sonic, one.sub.test.example.sonic, and so on.

@mramezani95
Modified the wildcard matching logic for client cert CN names.
d9f9d76 
Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
@prsunny prsunny requested a review from Copilot January 14, 2026 02:25
Copilot AI reviewed Jan 14, 2026
View reviewed changes
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR refines the wildcard matching logic for client certificate Common Names (CNs) during authentication. The changes restrict wildcard patterns to be more secure and predictable by requiring that wildcard patterns start with *. (not just *) and only match single-level subdomains.

Changes:

  • Modified wildcard CN validation to reject patterns starting with * that don't follow the *. format (e.g., *test.sonic is no longer valid)
  • Updated wildcard matching to only match single-level subdomains by comparing dot counts between the pattern and client CN
  • Refactored the loop structure to validate wildcard patterns once per trusted CN rather than per certificate-CN pair
  • Updated test cases to validate the new single-level subdomain matching behavior and rejection of invalid wildcard patterns

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
go-server-server/go/auth.go Implements stricter wildcard pattern validation and single-level subdomain matching logic
test/test_restapi.py Updates test cases to verify new wildcard matching behavior, including rejection of multi-level subdomains and invalid wildcard patterns

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@mramezani95
Fixed indentation.
8242338 
Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
@mssonicbld
Copy link

mssonicbld commented Jan 14, 2026

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 14, 2026

Azure Pipelines successfully started running 1 pipeline(s).

qiluo-msft
qiluo-msft reviewed Jan 14, 2026
View reviewed changes
go-server-server/go/auth.go
continue;
}
for _, peercert := range r.TLS.PeerCertificates {
commonName := peercert.Subject.CommonName
Copy link

@qiluo-msft qiluo-msft Jan 14, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

commonName

nitpick: if commonName is empty string, return false early. Even we have a config with empty string in allowlist, we still need to return false. #WontFix

qiluo-msft
qiluo-msft reviewed Jan 14, 2026
View reviewed changes
qiluo-msft
qiluo-msft reviewed Jan 14, 2026
View reviewed changes
@mramezani95
Multi-level subdomains are now accepted for wildcard matches. Added n…
010d5dc 
…ew unit tests.

Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
@mssonicbld
Copy link

mssonicbld commented Jan 15, 2026

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 15, 2026

Azure Pipelines successfully started running 1 pipeline(s).

prsunny
prsunny reviewed Jan 15, 2026
View reviewed changes
go-server-server/go/auth.go
is_wildcard := false
domain := name
if strings.HasPrefix(name, "*.") {
if len(name) < 3 {
Copy link
Collaborator

@prsunny prsunny Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is this check for?

Copy link
Collaborator

@prsunny prsunny Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you add a comment above the check?

Copy link
Contributor Author

@mramezani95 mramezani95 Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is to make sure that *. is not a valid trusted CN.

prsunny
prsunny reviewed Jan 15, 2026
View reviewed changes
Copy link
Collaborator

@prsunny prsunny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, @qiluo-msft could you review/approve?

@qiluo-msft qiluo-msft merged commit 5c3f4b0 into sonic-net:master Jan 15, 2026
7 checks passed
@mssonicbld mssonicbld mentioned this pull request Jan 15, 2026
Merged
@mssonicbld
Copy link

mssonicbld commented Jan 15, 2026

Cherry-pick PR to 202505: #178

@mssonicbld mssonicbld mentioned this pull request Jan 15, 2026
Merged
@mssonicbld
Copy link

mssonicbld commented Jan 15, 2026

Cherry-pick PR to 202511: #179

@mramezani95 mramezani95 mentioned this pull request Feb 3, 2026
Merged
12 tasks
prsunny pushed a commit to sonic-net/sonic-mgmt that referenced this pull request Feb 3, 2026
@mramezani95
Adding restapi client cert authentication tests (#22222)
1122a69 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.
mssonicbld pushed a commit to mssonicbld/sonic-mgmt that referenced this pull request Feb 3, 2026
@mramezani95 @mssonicbld
Adding restapi client cert authentication tests (sonic-net#22222)
db13a66 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.
@mssonicbld mssonicbld mentioned this pull request Feb 3, 2026
Merged
12 tasks
vmittal-msft pushed a commit to sonic-net/sonic-mgmt that referenced this pull request Feb 3, 2026
@mssonicbld @mramezani95
Adding restapi client cert authentication tests (#22222) (#22233)
e966810 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Co-authored-by: mramezani95 <mramezani@microsoft.com>
abhishek-nexthop pushed a commit to nexthop-ai/sonic-mgmt that referenced this pull request Feb 6, 2026
@mramezani95 @abhishek-nexthop
Adding restapi client cert authentication tests (sonic-net#22222)
afaa4d9 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.
Anirudh-nokia pushed a commit to Anirudh-nokia/sonic-mgmt-fork that referenced this pull request Feb 6, 2026
@mramezani95 @Anirudh-nokia
Adding restapi client cert authentication tests (sonic-net#22222)
9e98636 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: ayya <anirudh.ayya@nokia.com>
@mramezani95 mramezani95 mentioned this pull request Feb 11, 2026
Merged
7 tasks
lakshmi-nexthop pushed a commit to lakshmi-nexthop/sonic-mgmt that referenced this pull request Feb 11, 2026
@mssonicbld @mramezani95 @lakshmi-nexthop
Adding restapi client cert authentication tests (sonic-net#22222) (so…
0f7f79c 
…nic-net#22233)

Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Co-authored-by: mramezani95 <mramezani@microsoft.com>
Signed-off-by: Lakshmi Yarramaneni <lakshmi@nexthop.ai>
nnelluri-cisco pushed a commit to nnelluri-cisco/sonic-mgmt that referenced this pull request Feb 12, 2026
@mramezani95 @nnelluri-cisco
Adding restapi client cert authentication tests (sonic-net#22222)
c6f2768 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: nnelluri-cisco <nnelluri@cisco.com>
qiluo-msft pushed a commit to sonic-net/sonic-buildimage that referenced this pull request Feb 12, 2026
@mramezani95
Allowing wildcard client cert CNs for restapi. (#25450)
a7d963a 
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

Work item tracking
Microsoft ADO (number only): 36744821
How I did it
Modified the YANG model pattern for client_crt_cname so that each CN can start with *..
mssonicbld added a commit to mssonicbld/sonic-buildimage that referenced this pull request Feb 12, 2026
@mssonicbld
Allowing wildcard client cert CNs in restapi's YANG model
de8bf3e 
<!--
     Please make sure you've read and understood our contributing guidelines:
     https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md

     ** Make sure all your commits include a signature generated with `git commit -s` **

     If this is a bug fix, make sure your description includes "fixes #xxxx", or
     "closes #xxxx" or "resolves #xxxx"

     Please provide the following information:
-->

#### Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for `client_crt_cname` in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

##### Work item tracking
- Microsoft ADO **(number only)**: 36744821

#### How I did it
Modified the YANG model pattern for `client_crt_cname` so that each CN can start with `*.`.

#### How to verify it
Run the updated restapi YANG tests.

<!--
If PR needs to be backported, then the PR must be tested against the base branch and the earliest backport release branch and provide tested image version on these two branches. For example, if the PR is requested for master, 202211 and 202012, then the requester needs to provide test results on master and 202012.
-->

#### Which release branch to backport (provide reason below if selected)

<!--
- Note we only backport fixes to a release branch, *not* features!
- Please also provide a reason for the backporting below.
- e.g.
- [x] 202006
-->

- [ ] 202305
- [ ] 202311
- [ ] 202405
- [x] 202411
- [x] 202505
- [x] 202511

#### Tested branch (Please provide the tested image version)

<!--
- Please provide tested image version
- e.g.
- [x] 20201231.100
-->

- [x] master <!-- image version 1 -->

#### Description for the changelog
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->
Updating restapi's YANG model to allow wildcard CNs in the `client_crt_cname` field.

<!--
 Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.
-->

#### Link to config_db schema for YANG module changes
<!--
Provide a link to config_db schema for the table for which YANG model
is defined
Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md
-->
https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#restapi
@mssonicbld mssonicbld mentioned this pull request Feb 12, 2026
Open
7 tasks
mssonicbld added a commit to mssonicbld/sonic-buildimage that referenced this pull request Feb 12, 2026
@mssonicbld
Allowing wildcard client cert CNs in restapi's YANG model
8dc4ac5 
<!--
     Please make sure you've read and understood our contributing guidelines:
     https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md

     ** Make sure all your commits include a signature generated with `git commit -s` **

     If this is a bug fix, make sure your description includes "fixes #xxxx", or
     "closes #xxxx" or "resolves #xxxx"

     Please provide the following information:
-->

#### Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for `client_crt_cname` in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

##### Work item tracking
- Microsoft ADO **(number only)**: 36744821

#### How I did it
Modified the YANG model pattern for `client_crt_cname` so that each CN can start with `*.`.

#### How to verify it
Run the updated restapi YANG tests.

<!--
If PR needs to be backported, then the PR must be tested against the base branch and the earliest backport release branch and provide tested image version on these two branches. For example, if the PR is requested for master, 202211 and 202012, then the requester needs to provide test results on master and 202012.
-->

#### Which release branch to backport (provide reason below if selected)

<!--
- Note we only backport fixes to a release branch, *not* features!
- Please also provide a reason for the backporting below.
- e.g.
- [x] 202006
-->

- [ ] 202305
- [ ] 202311
- [ ] 202405
- [x] 202411
- [x] 202505
- [x] 202511

#### Tested branch (Please provide the tested image version)

<!--
- Please provide tested image version
- e.g.
- [x] 20201231.100
-->

- [x] master <!-- image version 1 -->

#### Description for the changelog
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->
Updating restapi's YANG model to allow wildcard CNs in the `client_crt_cname` field.

<!--
 Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.
-->

#### Link to config_db schema for YANG module changes
<!--
Provide a link to config_db schema for the table for which YANG model
is defined
Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md
-->
https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#restapi
@mssonicbld mssonicbld mentioned this pull request Feb 12, 2026
Merged
7 tasks
anilal-amd pushed a commit to anilal-amd/anilal-forked-sonic-mgmt that referenced this pull request Feb 19, 2026
@mramezani95 @ztan-amd
Adding restapi client cert authentication tests (sonic-net#22222)
d27b5ac 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: Zhuohui Tan <zhuohui.tan@amd.com>
FengPan-Frank pushed a commit to FengPan-Frank/sonic-buildimage that referenced this pull request Mar 6, 2026
@mramezani95 @FengPan-Frank
Allowing wildcard client cert CNs for restapi. (sonic-net#25450)
5abd831 
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

Work item tracking
Microsoft ADO (number only): 36744821
How I did it
Modified the YANG model pattern for client_crt_cname so that each CN can start with *..

Signed-off-by: Feng Pan <fenpan@microsoft.com>
ravaliyel pushed a commit to ravaliyel/sonic-mgmt that referenced this pull request Mar 12, 2026
@mramezani95 @ravaliyel
Adding restapi client cert authentication tests (sonic-net#22222)
90cf745 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: Ravali Yeluri (WIPRO LIMITED) <v-ryeluri@microsoft.com>
vmittal-msft pushed a commit to sonic-net/sonic-buildimage that referenced this pull request Mar 16, 2026
@mssonicbld
Allowing wildcard client cert CNs in restapi's YANG model (#25475)
41bcfce 
<!--
     Please make sure you've read and understood our contributing guidelines:
     https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md

     ** Make sure all your commits include a signature generated with `git commit -s` **

     If this is a bug fix, make sure your description includes "fixes #xxxx", or
     "closes #xxxx" or "resolves #xxxx"

     Please provide the following information:
-->

#### Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for `client_crt_cname` in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

##### Work item tracking
- Microsoft ADO **(number only)**: 36744821

#### How I did it
Modified the YANG model pattern for `client_crt_cname` so that each CN can start with `*.`.

#### How to verify it
Run the updated restapi YANG tests.

<!--
If PR needs to be backported, then the PR must be tested against the base branch and the earliest backport release branch and provide tested image version on these two branches. For example, if the PR is requested for master, 202211 and 202012, then the requester needs to provide test results on master and 202012.
-->

#### Which release branch to backport (provide reason below if selected)

<!--
- Note we only backport fixes to a release branch, *not* features!
- Please also provide a reason for the backporting below.
- e.g.
- [x] 202006
-->

- [ ] 202305
- [ ] 202311
- [ ] 202405
- [x] 202411
- [x] 202505
- [x] 202511

#### Tested branch (Please provide the tested image version)

<!--
- Please provide tested image version
- e.g.
- [x] 20201231.100
-->

- [x] master <!-- image version 1 -->

#### Description for the changelog
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->
Updating restapi's YANG model to allow wildcard CNs in the `client_crt_cname` field.

<!--
 Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.
-->

#### Link to config_db schema for YANG module changes
<!--
Provide a link to config_db schema for the table for which YANG model
is defined
Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md
-->
https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#restapi
abhishek-nexthop pushed a commit to nexthop-ai/sonic-mgmt that referenced this pull request Mar 17, 2026
@mramezani95 @abhishek-nexthop
Adding restapi client cert authentication tests (sonic-net#22222)
678e36b 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.

Signed-off-by: Abhishek <abhishek@nexthop.ai>
dprital pushed a commit to sonic-net/sonic-buildimage that referenced this pull request Mar 19, 2026
@mramezani95 @dprital
Allowing wildcard client cert CNs for restapi. (#25450)
0097815 
Why I did it
sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs).

Work item tracking
Microsoft ADO (number only): 36744821
How I did it
Modified the YANG model pattern for client_crt_cname so that each CN can start with *..

Signed-off-by: dprital <drorp@nvidia.com>
venu-nexthop pushed a commit to venu-nexthop/sonic-mgmt that referenced this pull request Mar 19, 2026
@mramezani95 @venu-nexthop
Adding restapi client cert authentication tests (sonic-net#22222)
51ca6d9 
Description of PR
Adding some restapi sonic-mgmt tests to verify the Common Name (CN) matching logic during client cert authentication.

Summary:
Microsoft ADO ID: 36622838
This PR adds some test cases to verify the CN matching logic during client cert authentication with the restapi service. The CN matching logic was changed in sonic-net/sonic-restapi#175 to support wildcard matching.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@prsunny prsunny prsunny left review comments

Copilot code review Copilot Copilot left review comments

@qiluo-msft qiluo-msft qiluo-msft approved these changes

Assignees

No one assigned

Labels

Approved for 202505 Branch Approved for 202511 Branch Included in 202505 Branch Included in 202511 Branch Request for 202505 Branch Request for 202511 Branch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@mramezani95 @mssonicbld @qiluo-msft @prsunny