feature: proxy mTLS support (#4037)

feature: proxy mTLS support implementation based on net.Client and net.CertReloader

Added test cases by ai and validated the code that it is testing as
expected.

---------

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

Author: szuecs

config/config.go

@@ -251,9 +251,11 @@ type Config struct {
 	EnableAdvancedValidation  bool   `yaml:"enable-advanced-validation"`
 
 	// TLS client certs
-	ClientKeyFile  string            `yaml:"client-tls-key"`
-	ClientCertFile string            `yaml:"client-tls-cert"`
-	Certificates   []tls.Certificate `yaml:"-"`
+	ClientKeyFile             string            `yaml:"client-tls-key"`
+	ClientCertFile            string            `yaml:"client-tls-cert"`
+	ClientCertRefreshInterval time.Duration     `yaml:"client-tls-cert-refresh-interval"`
+	Certificates              []tls.Certificate `yaml:"-"`
+	EnableMTLS                bool              `yaml:"enable-mtls"`
 
 	// TLS version
 	TLSMinVersion string             `yaml:"tls-min-version"`
@@ -629,6 +631,9 @@ func NewConfig() *Config {
 	// TLS client certs
 	flag.StringVar(&cfg.ClientKeyFile, "client-tls-key", "", "TLS Key file for backend connections, multiple keys may be given comma separated - the order must match the certs")
 	flag.StringVar(&cfg.ClientCertFile, "client-tls-cert", "", "TLS certificate files for backend connections, multiple keys may be given comma separated - the order must match the keys")
+	flag.DurationVar(&cfg.ClientCertRefreshInterval, "client-tls-cert-refresh-interval", 0, "How often to reload client TLS certificate and key files for backend connections. Defaults to 5 minutes if certificate files are set.")
+	// MTLS
+	flag.BoolVar(&cfg.EnableMTLS, "enable-mtls", false, "Enables MTLS support in the proxy. It uses -client-tls-cert and -client-tls-key as files and rotates the client cert every -client-tls-cert-refresh-interval time.Duration. It only supports one cert and one key file!")
 
 	// TLS version
 	flag.StringVar(&cfg.TLSMinVersion, "tls-min-version", defaultMinTLSVersion, "minimal TLS Version to be used in server, proxy and client connections")
@@ -838,7 +843,8 @@ func (c *Config) ParseArgs(progname string, args []string) error {
 	c.ResponseSizeBuckets, _ = c.parseHistogramBuckets(c.ResponseSizeBucketsString, metrics.DefaultResponseSizeBuckets)
 	c.RequestSizeBuckets, _ = c.parseHistogramBuckets(c.RequestSizeBucketsString, metrics.DefaultRequestSizeBuckets)
 
-	if c.ClientKeyFile != "" && c.ClientCertFile != "" {
+	// static client certs
+	if !c.EnableMTLS && c.ClientKeyFile != "" && c.ClientCertFile != "" {
 		certsFiles := strings.Split(c.ClientCertFile, ",")
 		keyFiles := strings.Split(c.ClientKeyFile, ",")
 
@@ -1190,13 +1196,20 @@ func (c *Config) ToOptions() skipper.Options {
 		options.ProxyFlags |= proxy.PatchPath
 	}
 
+	// static client certs
 	if len(c.Certificates) > 0 {
 		options.ClientTLS = &tls.Config{
 			Certificates: c.Certificates,
 			MinVersion:   c.getMinTLSVersion(),
 		}
 	}
 
+	// mtls support
+	options.EnableMTLS = c.EnableMTLS
+	options.ClientCertFile = c.ClientCertFile
+	options.ClientKeyFile = c.ClientKeyFile
+	options.ClientCertRefreshInterval = c.ClientCertRefreshInterval
+
 	var wrappers []func(handler http.Handler) http.Handler
 	options.CustomHttpHandlerWrap = func(handler http.Handler) http.Handler {
 		for _, wrapper := range wrappers {

proxy/proxy.go

@@ -361,6 +361,24 @@ type Params struct {
 	// ClientTLS configuration to connect to Backends
 	ClientTLS *tls.Config
 
+	// ClientCertFile is the path to a PEM-encoded client certificate for mTLS to backends.
+	// Must be set together with ClientKeyFile. When set, GetClientCertificate is used for cert rotation.
+	ClientCertFile string
+
+	// ClientKeyFile is the path to a PEM-encoded private key for mTLS to backends.
+	// Must be set together with ClientCertFile.
+	ClientKeyFile string
+
+	// ClientCertRefreshInterval is how often ClientCertFile/ClientKeyFile are re-read.
+	// Defaults to 5 minutes if zero.
+	ClientCertRefreshInterval time.Duration
+
+	// EnableMTLS enables MTLS support in the proxy if we have
+	// ClientCertFile, ClientKeyFile and uses
+	// ClientCertRefreshInterval to update rotated x509 cert from
+	// the provided files.
+	EnableMTLS bool
+
 	// OpenTracing contains parameters related to OpenTracing instrumentation. For default values
 	// check OpenTracingParams
 	OpenTracing *OpenTracingParams
@@ -477,6 +495,7 @@ type Proxy struct {
 	clientTLS                *tls.Config
 	hostname                 string
 	onPanicSometimes         rate.Sometimes
+	cr                       *snet.CertReloader
 }
 
 // proxyError is used to wrap errors during proxying and to indicate
@@ -845,6 +864,26 @@ func WithParams(p Params) *Proxy {
 		}
 	}
 
+	log := &logging.DefaultLog{}
+	var cr *snet.CertReloader
+	if p.EnableMTLS && p.ClientCertFile != "" && p.ClientKeyFile != "" {
+		interval := p.ClientCertRefreshInterval
+		if interval == 0 {
+			interval = 5 * time.Minute
+		}
+		var err error
+		cr, err = snet.NewCertReloader(p.ClientCertFile, p.ClientKeyFile, interval, log)
+		if err != nil {
+			log.Errorf("Failed to initialize cert reloader in proxy: %v", err)
+			os.Exit(2)
+		} else {
+			if tr.TLSClientConfig == nil {
+				tr.TLSClientConfig = &tls.Config{}
+			}
+			tr.TLSClientConfig.GetClientCertificate = cr.GetClientCertificate
+		}
+	}
+
 	m := p.Metrics
 	if m == nil {
 		m = metrics.Default
@@ -897,7 +936,7 @@ func WithParams(p Params) *Proxy {
 		maxLoops:                 p.MaxLoopbacks,
 		breakers:                 p.CircuitBreakers,
 		limiters:                 p.RateLimiters,
-		log:                      &logging.DefaultLog{},
+		log:                      log,
 		accessLogger:             p.AccessLogger,
 		defaultHTTPStatus:        defaultHTTPStatus,
 		tracing:                  newProxyTracing(p.OpenTracing),
@@ -908,6 +947,7 @@ func WithParams(p Params) *Proxy {
 		clientTLS:                tr.TLSClientConfig,
 		hostname:                 hostname,
 		onPanicSometimes:         rate.Sometimes{First: 3, Interval: 1 * time.Minute},
+		cr:                       cr,
 	}
 }
 
@@ -1866,6 +1906,9 @@ func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 func (p *Proxy) Close() error {
 	close(p.quit)
 	p.registry.Close()
+	if p.cr != nil {
+		p.cr.Close()
+	}
 	return nil
 }