Fix wildcard TLS domain detection

As per RFC 2818 [0], a CN of *.dokku.me will only match direct
subdomains of dokku.me, not sub-subdomains like www.test.dokku.me, but
Dokku currently enables TLS for subdomains of all levels.

I have changed the regex from .*\.dokku\.me to [^.]*\.dokku\.me so TLS
is only enabled for direct subdomains.

[0] - http://tools.ietf.org/html/rfc2818#section-3.1

Signed-off-by: Lewis Marshall <lewis@lmars.net>
This commit is contained in:
Lewis Marshall
2015-03-08 21:24:09 +00:00
parent a4d79e2de9
commit 9202f110ab
2 changed files with 4 additions and 2 deletions

View File

@@ -65,9 +65,11 @@ assert_http_success() {
setup_test_tls_wildcard
add_domain "wildcard1.dokku.me"
add_domain "wildcard2.dokku.me"
add_domain "www.test.dokku.me"
deploy_app
assert_ssl_domain "wildcard1.dokku.me"
assert_ssl_domain "wildcard2.dokku.me"
assert_nonssl_domain "www.test.dokku.me"
}
@test "nginx:build-config (with SSL CN mismatch)" {