shreemaan-abhishek opened a new pull request, #2810: URL: https://github.com/apache/apisix-ingress-controller/pull/2810
### Description Fixes two correctness gaps in the SSL conflict detector that let colliding TLS configurations be admitted for the same `GatewayProxy`. **1. Wildcard vs. exact host matching** Hosts were compared by exact string equality, so a covering wildcard and an exact host were never compared against each other, since `*.example.com` and `app.example.com` are indexed under different keys. APISIX resolves an exact SNI ahead of a covering wildcard (exact SNIs land in the radixtree `hash_path` and are matched before wildcard prefixes), so two objects whose hosts overlap only through a wildcard could both be admitted and then serve conflicting certificates for the same hostname at the data plane. - add `sslutil.HostsOverlap` / `ParentWildcard` (single-label wildcard semantics, matching APISIX's `*.` behavior) - for an exact host, also look up its covering wildcard key - for a wildcard host, enumerate TLS resources and filter by overlap (the exact-key host index can't answer a suffix query) - compare candidate mappings with `HostsOverlap` instead of string equality **2. mTLS client config ignored in the conflict key** The conflict key used only the server certificate hash, so two objects for the same host and server certificate but different mTLS client-verification config (`spec.client`) were treated as non-conflicting, leaving client-verification for that SNI nondeterministic. - add `ClientConfigHash` to `HostCertMapping` (digest of the CA secret reference, depth and `skip_mtls_uri_regex`; empty when no mTLS is configured) - treat a differing client config as a conflict too, in both the intra-resource and cross-resource checks `ClientConfigHash` keys on the CA secret reference (namespace/name) rather than the CA bytes: a `(namespace, name)` uniquely identifies one Secret, and this avoids an extra Secret read at admission time. ### Tests - unit tests for `HostsOverlap` / `ParentWildcard` - detector-level tests for wildcard/exact overlap (both directions) and differing mTLS config, each with a false-positive guard (non-overlapping hosts, identical mTLS) ### Checklist - [x] Did you explain what problem does this PR solve? Or what new features have been added? - [x] Have you added corresponding test cases? - [x] Have you modified the corresponding document? - [x] Is this PR backward compatible? **If it is not backward compatible, please discuss on the [mailing list](https://github.com/apache/apisix-ingress-controller#community) first** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
