Skip to content

Commit 5abd831

Browse files
mramezani95FengPan-Frank
mramezani95
authored and
FengPan-Frank
committed
Allowing wildcard client cert CNs for restapi. (#25450)
Why I did it sonic-net/sonic-restapi#168 and sonic-net/sonic-restapi#175 add support for wildcard CN matching in sonic-gnmi. The pattern for client_crt_cname in restapi's YANG model needs to be updated accordingly (to allow for wildcard CNs). Work item tracking Microsoft ADO (number only): 36744821 How I did it Modified the YANG model pattern for client_crt_cname so that each CN can start with *.. Signed-off-by: Feng Pan <fenpan@microsoft.com>
1 parent 74339aa commit 5abd831

File tree

3 files changed

+177
-7
lines changed

3 files changed

+177
-7
lines changed

‎src/sonic-yang-models/tests/yang_model_tests/tests/restapi.json‎

Lines changed: 42 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,48 @@
77
"desc": "RESTAPI TABLE_WITH_INCORRECT_CLIENT failure.",
88
"eStrKey": "Pattern"
99
},
10-
"RESTAPI_TABLE_WITH_VALID_CONFIG": {
11-
"desc": "RESTAPI TABLE WITH VALID CONFIG."
10+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_1": {
11+
"desc": "RESTAPI TABLE_WITH_INCORRECT_WILDCARD_CLIENT_1 failure.",
12+
"eStrKey": "Pattern"
13+
},
14+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_2": {
15+
"desc": "RESTAPI TABLE_WITH_INCORRECT_WILDCARD_CLIENT_2 failure.",
16+
"eStrKey": "Pattern"
17+
},
18+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_3": {
19+
"desc": "RESTAPI TABLE_WITH_INCORRECT_WILDCARD_CLIENT_3 failure.",
20+
"eStrKey": "Pattern"
21+
},
22+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_4": {
23+
"desc": "RESTAPI TABLE_WITH_INCORRECT_WILDCARD_CLIENT_4 failure.",
24+
"eStrKey": "Pattern"
25+
},
26+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_5": {
27+
"desc": "RESTAPI TABLE_WITH_INCORRECT_WILDCARD_CLIENT_5 failure.",
28+
"eStrKey": "Pattern"
29+
},
30+
"RESTAPI_TABLE_WITH_VALID_CONFIG_1": {
31+
"desc": "RESTAPI TABLE WITH VALID CONFIG (1)."
32+
},
33+
"RESTAPI_TABLE_WITH_VALID_CONFIG_2": {
34+
"desc": "RESTAPI TABLE WITH VALID CONFIG (2)."
35+
},
36+
"RESTAPI_TABLE_WITH_VALID_CONFIG_3": {
37+
"desc": "RESTAPI TABLE WITH VALID CONFIG (3)."
38+
},
39+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_1": {
40+
"desc": "RESTAPI TABLE WITH MULTIPLE CERTS (1)."
41+
},
42+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_2": {
43+
"desc": "RESTAPI TABLE WITH MULTIPLE CERTS (2)."
44+
},
45+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_3": {
46+
"desc": "RESTAPI TABLE WITH MULTIPLE CERTS (3)."
47+
},
48+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_4": {
49+
"desc": "RESTAPI TABLE WITH MULTIPLE CERTS (4)."
1250
},
13-
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS": {
14-
"desc": "RESTAPI TABLE WITH MULTIPLE CERTS."
51+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_5": {
52+
"desc": "RESTAPI TABLE WITH MULTIPLE CERTS (5)."
1553
}
1654
}

‎src/sonic-yang-models/tests/yang_model_tests/tests_config/restapi.json‎

Lines changed: 134 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,67 @@
2323
}
2424
}
2525
},
26-
"RESTAPI_TABLE_WITH_VALID_CONFIG": {
26+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_1": {
27+
"sonic-restapi:sonic-restapi": {
28+
"sonic-restapi:RESTAPI": {
29+
"certs": {
30+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
31+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
32+
"server_key": "/etc/sonic/credentials/restapiserver.key",
33+
"client_crt_cname": "*client.sonic.net"
34+
}
35+
}
36+
}
37+
},
38+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_2": {
39+
"sonic-restapi:sonic-restapi": {
40+
"sonic-restapi:RESTAPI": {
41+
"certs": {
42+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
43+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
44+
"server_key": "/etc/sonic/credentials/restapiserver.key",
45+
"client_crt_cname": "*.*.client.sonic.net"
46+
}
47+
}
48+
}
49+
},
50+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_3": {
51+
"sonic-restapi:sonic-restapi": {
52+
"sonic-restapi:RESTAPI": {
53+
"certs": {
54+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
55+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
56+
"server_key": "/etc/sonic/credentials/restapiserver.key",
57+
"client_crt_cname": "client.*.sonic.net"
58+
}
59+
}
60+
}
61+
},
62+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_4": {
63+
"sonic-restapi:sonic-restapi": {
64+
"sonic-restapi:RESTAPI": {
65+
"certs": {
66+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
67+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
68+
"server_key": "/etc/sonic/credentials/restapiserver.key",
69+
"client_crt_cname": "client.sonic.net.*"
70+
}
71+
}
72+
}
73+
},
74+
"RESTAPI_TABLE_WITH_INCORRECT_WILDCARD_CLIENT_5": {
75+
"sonic-restapi:sonic-restapi": {
76+
"sonic-restapi:RESTAPI": {
77+
"certs": {
78+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
79+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
80+
"server_key": "/etc/sonic/credentials/restapiserver.key",
81+
"client_crt_cname": "cli*ent.sonic.net"
82+
}
83+
}
84+
}
85+
},
86+
"RESTAPI_TABLE_WITH_VALID_CONFIG_1": {
2787
"sonic-restapi:sonic-restapi": {
2888
"sonic-restapi:RESTAPI": {
2989
"certs": {
@@ -35,7 +95,31 @@
3595
}
3696
}
3797
},
38-
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS": {
98+
"RESTAPI_TABLE_WITH_VALID_CONFIG_2": {
99+
"sonic-restapi:sonic-restapi": {
100+
"sonic-restapi:RESTAPI": {
101+
"certs": {
102+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
103+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
104+
"server_key": "/etc/sonic/credentials/restapiserver.key",
105+
"client_crt_cname": "*.client.sonic.net"
106+
}
107+
}
108+
}
109+
},
110+
"RESTAPI_TABLE_WITH_VALID_CONFIG_3": {
111+
"sonic-restapi:sonic-restapi": {
112+
"sonic-restapi:RESTAPI": {
113+
"certs": {
114+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
115+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
116+
"server_key": "/etc/sonic/credentials/restapiserver.key",
117+
"client_crt_cname": "*.net"
118+
}
119+
}
120+
}
121+
},
122+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_1": {
39123
"sonic-restapi:sonic-restapi": {
40124
"sonic-restapi:RESTAPI": {
41125
"certs": {
@@ -46,5 +130,53 @@
46130
}
47131
}
48132
}
133+
},
134+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_2": {
135+
"sonic-restapi:sonic-restapi": {
136+
"sonic-restapi:RESTAPI": {
137+
"certs": {
138+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
139+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
140+
"server_key": "/etc/sonic/credentials/restapiserver.key",
141+
"client_crt_cname": "*.client.sonic.net,clientds.prod.net"
142+
}
143+
}
144+
}
145+
},
146+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_3": {
147+
"sonic-restapi:sonic-restapi": {
148+
"sonic-restapi:RESTAPI": {
149+
"certs": {
150+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
151+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
152+
"server_key": "/etc/sonic/credentials/restapiserver.key",
153+
"client_crt_cname": "client.sonic.net,*.clientds.prod.net"
154+
}
155+
}
156+
}
157+
},
158+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_4": {
159+
"sonic-restapi:sonic-restapi": {
160+
"sonic-restapi:RESTAPI": {
161+
"certs": {
162+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
163+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
164+
"server_key": "/etc/sonic/credentials/restapiserver.key",
165+
"client_crt_cname": "*.client.sonic.net,*.com"
166+
}
167+
}
168+
}
169+
},
170+
"RESTAPI_TABLE_WITH_MULTIPLE_CERTS_5": {
171+
"sonic-restapi:sonic-restapi": {
172+
"sonic-restapi:RESTAPI": {
173+
"certs": {
174+
"ca_crt": "/etc/sonic/credentials/ame_root.pem",
175+
"server_crt": "/etc/sonic/credentials/restapiserver.crt",
176+
"server_key": "/etc/sonic/credentials/restapiserver.key",
177+
"client_crt_cname": "*.client.sonic.net,test.client.sonic.io,*.com"
178+
}
179+
}
180+
}
49181
}
50182
}

‎src/sonic-yang-models/yang-models/sonic-restapi.yang‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ module sonic-restapi {
4545

4646
leaf client_crt_cname {
4747
type string {
48-
pattern '([a-zA-Z0-9_\-\.]+,)*([a-zA-Z0-9_\-\.]+)';
48+
pattern '((\*\.)?[a-zA-Z0-9_\-\.]+,)*((\*\.)?[a-zA-Z0-9_\-\.]+)';
4949
}
5050
description "Client cert name.";
5151
}

0 commit comments

Comments
 (0)