Infra/lemur
5
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Reworked sensitive domain name and restriction logic (#878)

Browse Source 
* This is a fix for a potential security issue; the old code had edge
  cases with unexpected behavior.
* LEMUR_RESTRICTED_DOMAINS is no more, instead LEMUR_WHITELISTED_DOMAINS
  is a list of *allowed* domain name patterns. Per discussion in PR #600
* Domain restrictions are now checked everywhere: in domain name-like
  CN (common name) values and SAN DNSNames, including raw CSR requests.
* Common name values that contain a space are exempt, since they cannot
  be valid domain names.
This commit is contained in:
Marti Raudsepp
2017-08-17 05:24:49 +03:00
committed by kevgliss
parent 466df367e6
commit 7762d6ed52
10 changed files with 197 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/administration.rst
View File

@ -70,11 +70,18 @@ Basic Configuration
Specifies whether to allow certificates created by Lemur to expire on weekends. Default is True.
.. data:: LEMUR_RESTRICTED_DOMAINS
.. data:: LEMUR_WHITELISTED_DOMAINS
:noindex:
This allows the administrator to mark a subset of domains or domains matching a particular regex as
*restricted*. This means that only an administrator is allows to issue the domains in question.
List of regular expressions for domain restrictions; if the list is not empty, normal users can only issue
certificates for domain names matching at least one pattern on this list. Administrators are exempt from this
restriction.
Cerificate common name is matched against these rules *if* it does not contain a space. SubjectAltName DNS names
are always matched against these rules.
Take care to write patterns in such way to not allow the `*` wildcard character inadvertently. To match a `.`
character, it must be escaped (as `\.`).
.. data:: LEMUR_TOKEN_SECRET
:noindex: