AlinsRan commented on code in PR #2810:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2810#discussion_r3662348827
##########
internal/ssl/util.go:
##########
@@ -180,6 +180,77 @@ func NormalizeHosts(hosts []string) []string {
return normalized
}
+// HostsOverlap reports whether two SNI host patterns can both match a common
+// concrete hostname. It understands single-label wildcards ("*.example.com"
+// matches "app.example.com" but not "a.b.example.com"). Two distinct wildcards
+// never share a concrete host.
+func HostsOverlap(a, b string) bool {
Review Comment:
An exact host and a covering wildcard are not ambiguous, so I do not think
this should be treated as a conflict.
Gateway API prescribes the opposite handling. `Listener.TLS`: "The
GatewayClass MUST use the longest matching SNI out of all available
certificates for any TLS handshake." And v1.3 added the `OverlappingTLSConfig`
listener condition, whose own example is `foo.example.com` vs `*.example.com`:
controllers MUST detect that overlap and set a condition on both listeners —
the resources stay admitted and both keep working.
APISIX already behaves that way: a reversed exact SNI is a fully static
path, so `match_route` finds it in `hash_path` before it ever walks the tree
holding the wildcard prefixes. `app.example.com` gets its own certificate and
`other.example.com` gets the wildcard one, every time.
The cost of calling it a conflict is concrete: "wildcard cert plus a
dedicated cert for one subdomain" stops being expressible, and since
`ValidateUpdate` re-runs the full detection over the whole object, existing
Ingresses in that shape can no longer be edited at all after an upgrade — an
unrelated annotation change gets rejected, and the only way out is deleting the
other resource.
The case worth keeping is two objects carrying the *same* SNI: those land in
one `hash_path[sni_rev]` array and `sort_route` ties on both priority and
`path_org` length, so the winner is insertion order. Exact-key matching already
covers it, which is why I would leave that part as it is and drop the overlap
handling.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
