Files
firezone/website/src
Thomas Eizinger 42a13789b1 fix(connlib): match exact domains before wildcard ones (#6809)
Currently, the order in which connlib matches against the patterns of
DNS resources is not specified. We simply iterate over all patterns and
take the first one that matches. Due to the iteration order of
`HashMap`s, this also isn't deterministic.

With this patch, we introduce a defined order in which we attempt to
match a particular domain against the defined DNS resources:

- Resources without wildcards are always prioritised over wildcard
domains
- Single-char wildcards (`?`) take priority over label wildcards (`*`)
- Label wildcards (`*`) take priority over catch-all wildcards (`**`)

By matching against the DNS resources in a defined order, we ensure that
DNS resources that overlap always resolve to the most specific resource.

---------

Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Reactor Scram <ReactorScram@users.noreply.github.com>
2024-09-26 00:10:37 +00:00
..