Follow-up from #802.
CertCache.mint (cmd/clawpatrol/ca.go) caches one P-256 key + leaf
per SNI with no eviction and no case normalisation: handle() passes
the raw SNI while HostEndpoint lowercases, so EXAMPLE.COM and
example.com mint two entries. Wildcard endpoints already had an
agent-influenced name space; with unknown_host = "inspect" the whole
name space is agent-chosen. At roughly 1 to 1.5 KB per entry a million
distinct names is about 1 GB.
Separately, cached leaves have NotAfter = +30d and are never
re-minted, so a gateway up for more than 30 days serves expired leaves
for hosts it cached early.
Fix: lowercase the key, add an LRU bound (a few thousand entries is
plenty), and re-mint when the cached leaf is within a day of expiry.
Follow-up from #802.
CertCache.mint(cmd/clawpatrol/ca.go) caches one P-256 key + leafper SNI with no eviction and no case normalisation:
handle()passesthe raw SNI while
HostEndpointlowercases, soEXAMPLE.COMandexample.commint two entries. Wildcard endpoints already had anagent-influenced name space; with
unknown_host = "inspect"the wholename space is agent-chosen. At roughly 1 to 1.5 KB per entry a million
distinct names is about 1 GB.
Separately, cached leaves have
NotAfter = +30dand are neverre-minted, so a gateway up for more than 30 days serves expired leaves
for hosts it cached early.
Fix: lowercase the key, add an LRU bound (a few thousand entries is
plenty), and re-mint when the cached leaf is within a day of expiry.