From 9202f110ab0fed589f909d690596e8c0065a3edc Mon Sep 17 00:00:00 2001 From: Lewis Marshall Date: Sun, 8 Mar 2015 21:24:09 +0000 Subject: [PATCH] Fix wildcard TLS domain detection As per RFC 2818 [0], a CN of *.dokku.me will only match direct subdomains of dokku.me, not sub-subdomains like www.test.dokku.me, but Dokku currently enables TLS for subdomains of all levels. I have changed the regex from .*\.dokku\.me to [^.]*\.dokku\.me so TLS is only enabled for direct subdomains. [0] - http://tools.ietf.org/html/rfc2818#section-3.1 Signed-off-by: Lewis Marshall --- plugins/nginx-vhosts/commands | 4 ++-- tests/unit/nginx-vhosts.bats | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/plugins/nginx-vhosts/commands b/plugins/nginx-vhosts/commands index 98a5a2e43..e7fa81a13 100755 --- a/plugins/nginx-vhosts/commands +++ b/plugins/nginx-vhosts/commands @@ -52,13 +52,13 @@ EOF SSL_HOSTNAME=$(openssl x509 -in $SSL_INUSE/server.crt -noout -subject | tr '/' '\n' | grep CN= | cut -c4-) if [[ -n "$SSL_HOSTNAME" ]]; then - SSL_HOSTNAME_REGEX=$(echo "$SSL_HOSTNAME" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g') + SSL_HOSTNAME_REGEX=$(echo "$SSL_HOSTNAME" | sed 's|\.|\\.|g' | sed 's/\*/\[^\.\]\*/g') [[ -z "$(egrep "^${SSL_HOSTNAME_REGEX}$" $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME" >> $VHOST_PATH fi SSL_HOSTNAME_ALT=$(openssl x509 -in $SSL_INUSE/server.crt -noout -text | grep --after-context=1 '509v3 Subject Alternative Name:' | tail -n 1 | sed -e "s/[[:space:]]*DNS://g" | tr ',' '\n' || true) if [[ -n "$SSL_HOSTNAME_ALT" ]]; then - SSL_HOSTNAME_ALT_REGEX=$(echo "$SSL_HOSTNAME_ALT" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g') + SSL_HOSTNAME_ALT_REGEX=$(echo "$SSL_HOSTNAME_ALT" | sed 's|\.|\\.|g' | sed 's/\*/\[^\.\]\*/g') [[ -z "$(egrep "^${SSL_HOSTNAME_ALT_REGEX}$" $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME_ALT" >> $VHOST_PATH fi diff --git a/tests/unit/nginx-vhosts.bats b/tests/unit/nginx-vhosts.bats index 8855c45ee..f3440cc9f 100644 --- a/tests/unit/nginx-vhosts.bats +++ b/tests/unit/nginx-vhosts.bats @@ -65,9 +65,11 @@ assert_http_success() { setup_test_tls_wildcard add_domain "wildcard1.dokku.me" add_domain "wildcard2.dokku.me" + add_domain "www.test.dokku.me" deploy_app assert_ssl_domain "wildcard1.dokku.me" assert_ssl_domain "wildcard2.dokku.me" + assert_nonssl_domain "www.test.dokku.me" } @test "nginx:build-config (with SSL CN mismatch)" {