amadan
edge: disclose the handshake-posture cost of the apps-domain wildcard
Round-2 review catch, and the honest kind: fix round 1 SAID this was disclosed and it was only ever in the task report — no source file carried it. With *.<apps-domain> in the parent set, a stranger's one-label unknown host under the apps domain now completes the TLS handshake (certFor serves the wildcard before HostPolicy is ever consulted) and reaches the ordinary 404 / -fallback 302, where before it failed at the handshake because autocert's policy refuses a name that is not a registry route. Nothing is disclosed that a routed host does not already disclose, and every per-ACCOUNT parent has had this property since wildcards landed — but it is a real change on a steering deployment, so it sits beside the CT-log cost in the gating paragraph rather than in a review thread. Comment only; gofmt, build, vet and the steering tests clean.
1 file changed,
+12
−0
internal/edge/wildcard.go+12 −0
diff --git a/internal/edge/wildcard.go b/internal/edge/wildcard.go| index bfc128ca3..34d21e482 100644 |
| --- a/internal/edge/wildcard.go |
| +++ b/internal/edge/wildcard.go |
| @@ -724,6 +724,18 @@ func newWildcardFromEnv(e *Edge, cache autocert.Cache) *wildcardManager { |
| // entry, and a change to which cert their existing one-label hosts are |
| // served from) is not something a dormant feature gets to do. |
| // |
| + // One posture change to state outright, because it is what this parent |
| + // COSTS: a stranger's one-label unknown host under the apps domain |
| + // (anything.<apps-domain>) now COMPLETES the TLS handshake — certFor |
| + // serves the wildcard before HostPolicy is ever consulted — and reaches |
| + // the ordinary unknown-host answer, a 404 or a -fallback 302. Before this |
| + // parent existed it failed at the handshake instead, because autocert's |
| + // policy refuses a name that is not a registry route. Nothing is |
| + // disclosed that a routed host does not already disclose, and every |
| + // per-ACCOUNT parent has had exactly this property since wildcards |
| + // landed — but it is a real change on a steering deployment and belongs |
| + // here beside the CT-log entry, not only in a review thread. |
| + // |
| // The parent is derived from e.steeringHost, NOT from this function's own |
| // appsDomain read: New() normalized the environment once (edge.go, |
| // steeringProbeHostFromEnv — which trims a trailing dot, and the Getenv |