| 1 | { |
| 2 | "comment": [ |
| 3 | "Gate 4. Hosts a sibling client belonging to team `acme` must refuse,", |
| 4 | "and the one it must reach. Doctrine §4.1.", |
| 5 | "", |
| 6 | "The gate counts connections, not errors: a refused host must cost zero", |
| 7 | "connection attempts. The redirect case is the exception the doctrine", |
| 8 | "calls out — a client has to reach an allowed host to be told to", |
| 9 | "redirect, so what is forbidden there is the follow-up hop." |
| 10 | ], |
| 11 | |
| 12 | "team": "acme", |
| 13 | |
| 14 | "refuse": [ |
| 15 | { "host": "acme-evil.docs.oficina.works", "why": "a different team label that merely starts with ours" }, |
| 16 | { "host": "acmex.docs.oficina.works", "why": "a longer label with ours as a prefix" }, |
| 17 | { "host": "acme.docs.oficina.works.evil", "why": "in evil, not in oficina.works, despite reading like it" }, |
| 18 | { "host": "evil.com", "why": "outside the suite domain entirely" }, |
| 19 | { "host": "docs.oficina.works", "why": "no team label at all" }, |
| 20 | { "host": "acme.team.docs.oficina.works", "why": "an extra label between team and app" }, |
| 21 | { "host": "ACME-EVIL.docs.oficina.works", "why": "case must not smuggle a different label through" }, |
| 22 | { "host": "acme..oficina.works", "why": "an empty app label counts as two labels but names no app" }, |
| 23 | { "host": "acme.-docs.oficina.works", "why": "a label may not begin with a hyphen" }, |
| 24 | { "host": "acme.docs-.oficina.works", "why": "a label may not end with a hyphen" }, |
| 25 | { "host": "acme.docs_.oficina.works", "why": "underscore is not a hostname character" }, |
| 26 | { "host": "acme.docs。evil.oficina.works", "why": "an ideographic full stop is not a label separator here, and IDNA normalisation could turn it into one later" }, |
| 27 | { "host": ".docs.oficina.works", "why": "an empty team label" } |
| 28 | ], |
| 29 | |
| 30 | "reach": [ |
| 31 | { "host": "acme.docs.oficina.works", "why": "our own team's Docs instance" }, |
| 32 | { "host": "acme.sheets.oficina.works", "why": "our own team's Sheets instance" }, |
| 33 | { "host": "acme.docs.oficina.works.", "why": "a fully-qualified trailing dot is the same host, and normalising it is the check's job — refusing it would break a legitimate caller" }, |
| 34 | { "host": "ACME.docs.oficina.works", "why": "hostnames are case-insensitive; our own host shouted is still ours" } |
| 35 | ], |
| 36 | |
| 37 | "redirect": { |
| 38 | "from": "acme.docs.oficina.works", |
| 39 | "to": "acme-evil.docs.oficina.works", |
| 40 | "why": "the first hop is legitimate; following the redirect is not" |
| 41 | } |
| 42 | } |
| 43 | |
amadan