Add header for client root ca DN (ssl_c_r_dn) (#659)

* feat(haproxy): add header for client root ca DN * fix(haproxy): delete headers when non-mtls * test: fix unit tests * test: fix acceptance tests
cloudfoundry · May 7, 2024 · a98372d · a98372d
1 parent ed2d099
commit a98372d
Show file tree

Hide file tree

Showing 5 changed files with 35 additions and 0 deletions.
diff --git a/acceptance-tests/xfcc_test.go b/acceptance-tests/xfcc_test.go
@@ -111,6 +111,7 @@ var _ = Describe("forwarded_client_cert", func() {
 		"X-SSL-Client-Subject-Cn": "app.mycert.com",
 		"X-SSL-Client-Issuer-Dn":  "ACME inc, USA",
 		"X-SSL-Client-Issuer-Cn":  "mycert.com",
+		"X-SSL-Client-Root-CA-DN": "/C=Palau/O=Pete's Café",
 		"X-SSL-Client-Notbefore":  "Wednesday",
 		"X-SSL-Client-Notafter":   "Thursday",
 		"X-SSL-Client-Cert":       "ABC",
@@ -304,6 +305,7 @@ func checkXFCCHeadersMatchCert(expectedCert *x509.Certificate, headers http.Head
 	Expect(base64Decode(headers.Get("X-SSL-Client-Subject-Dn"))).To(Equal("/C=Vatican City/O=Víkî's Vergnügungspark/CN=haproxy.client"))
 	Expect(base64Decode(headers.Get("X-SSL-Client-Subject-CN"))).To(Equal("haproxy.client"))
 	Expect(base64Decode(headers.Get("X-SSL-Client-Issuer-Dn"))).To(Equal("/C=Palau/O=Pete's Café"))
+	Expect(base64Decode(headers.Get("X-SSL-Client-Root-CA-DN"))).To(Equal("/C=Palau/O=Pete's Café"))
 	Expect(headers.Get("X-SSL-Client-Notbefore")).To(Equal(expectedCert.NotBefore.UTC().Format("060102150405Z"))) //YYMMDDhhmmss[Z]
 	Expect(headers.Get("X-SSL-Client-Notafter")).To(Equal(expectedCert.NotAfter.UTC().Format("060102150405Z")))   //YYMMDDhhmmss[Z]
 

diff --git a/jobs/haproxy/spec b/jobs/haproxy/spec
@@ -410,6 +410,8 @@ properties:
 
             - X-SSL-Client-Issuer-DN: Contains the base64-encoded issuer distinguished name of the client certificate
 
+            - X-SSL-Client-Root-CA-DN: X-SSL-Client-Root-CA-DN: Contains base64-encoded subject DN of the root CA which signed the client certificate
+
             - X-SSL-Client-NotBefore: Contains the start date of the client certificate in YYMMDDhhmmss[Z] format.
 
             - X-SSL-Client-NotAfter: Contains the expiration date of the client certificate in YYMMDDhhmmss[Z] format.

diff --git a/jobs/haproxy/templates/haproxy.config.erb b/jobs/haproxy/templates/haproxy.config.erb
@@ -530,6 +530,7 @@ frontend https-in
     http-request del-header X-SSL-Client-Issuer-DN
     http-request del-header X-SSL-Client-NotBefore
     http-request del-header X-SSL-Client-NotAfter
+    http-request del-header X-SSL-Client-Root-CA-DN
   <%- when :non_mtls_only -%>
     http-request del-header X-Forwarded-Client-Cert if ! { ssl_c_used }
     http-request del-header X-SSL-Client            if ! { ssl_c_used }
@@ -540,6 +541,7 @@ frontend https-in
     http-request del-header X-SSL-Client-Issuer-DN  if ! { ssl_c_used }
     http-request del-header X-SSL-Client-NotBefore  if ! { ssl_c_used }
     http-request del-header X-SSL-Client-NotAfter   if ! { ssl_c_used }
+    http-request del-header X-SSL-Client-Root-CA-DN if ! { ssl_c_used }
   <%- when :non_route_service_only -%>
     acl route_service_request hdr(X-Cf-Proxy-Signature) -m found
     http-request del-header X-Forwarded-Client-Cert if !route_service_request
@@ -551,6 +553,7 @@ frontend https-in
     http-request del-header X-SSL-Client-Issuer-DN  if !route_service_request
     http-request del-header X-SSL-Client-NotBefore  if !route_service_request
     http-request del-header X-SSL-Client-NotAfter   if !route_service_request
+    http-request del-header X-SSL-Client-Root-CA-DN if !route_service_request
   <%- end -%>
 
   <%- if write_mtls_headers -%>
@@ -564,10 +567,12 @@ frontend https-in
     http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn]            if { ssl_c_used }
     http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)]        if { ssl_c_used }
     http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn]            if { ssl_c_used }
+    http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn]            if { ssl_c_used }
     <%- else %>
     http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn,base64]     if { ssl_c_used }
     http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }
     http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn,base64]     if { ssl_c_used }
+    http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn,base64]     if { ssl_c_used }
     <%- end %>
   <%- end -%>
 
@@ -683,6 +688,7 @@ frontend wss-in
     http-request del-header X-SSL-Client-Issuer-DN
     http-request del-header X-SSL-Client-NotBefore
     http-request del-header X-SSL-Client-NotAfter
+    http-request del-header X-SSL-Client-Root-CA-DN
   <%- when :non_mtls_only -%>
     http-request del-header X-Forwarded-Client-Cert if ! { ssl_c_used }
     http-request del-header X-SSL-Client            if ! { ssl_c_used }
@@ -693,6 +699,7 @@ frontend wss-in
     http-request del-header X-SSL-Client-Issuer-DN  if ! { ssl_c_used }
     http-request del-header X-SSL-Client-NotBefore  if ! { ssl_c_used }
     http-request del-header X-SSL-Client-NotAfter   if ! { ssl_c_used }
+    http-request del-header X-SSL-Client-Root-CA-DN if ! { ssl_c_used }
   <%- when :non_route_service_only -%>
     acl route_service_request hdr(X-Cf-Proxy-Signature) -m found
     http-request del-header X-Forwarded-Client-Cert if !route_service_request
@@ -704,6 +711,7 @@ frontend wss-in
     http-request del-header X-SSL-Client-Issuer-DN  if !route_service_request
     http-request del-header X-SSL-Client-NotBefore  if !route_service_request
     http-request del-header X-SSL-Client-NotAfter   if !route_service_request
+    http-request del-header X-SSL-Client-Root-CA-DN if !route_service_request
   <%- end -%>
 
   <%- if write_mtls_headers -%>
@@ -717,10 +725,12 @@ frontend wss-in
     http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn]            if { ssl_c_used }
     http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)]        if { ssl_c_used }
     http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn]            if { ssl_c_used }
+    http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn]            if { ssl_c_used }
     <%- else %>
     http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn,base64]     if { ssl_c_used }
     http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }
     http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn,base64]     if { ssl_c_used }
+    http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn,base64]     if { ssl_c_used }
     <%- end %>
   <%- end -%>
 

diff --git a/spec/haproxy/templates/haproxy_config/frontend_https_spec.rb b/spec/haproxy/templates/haproxy_config/frontend_https_spec.rb
@@ -189,6 +189,7 @@
         expect(frontend_https).to include('http-request del-header X-SSL-Client-Issuer-DN')
         expect(frontend_https).to include('http-request del-header X-SSL-Client-NotBefore')
         expect(frontend_https).to include('http-request del-header X-SSL-Client-NotAfter')
+        expect(frontend_https).to include('http-request del-header X-SSL-Client-Root-CA-DN')
       end
 
       it 'does not add mTLS headers' do
@@ -214,6 +215,7 @@
           expect(frontend_https).to include('http-request del-header X-SSL-Client-Issuer-DN  if ! { ssl_c_used }')
           expect(frontend_https).to include('http-request del-header X-SSL-Client-NotBefore  if ! { ssl_c_used }')
           expect(frontend_https).to include('http-request del-header X-SSL-Client-NotAfter   if ! { ssl_c_used }')
+          expect(frontend_https).to include('http-request del-header X-SSL-Client-Root-CA-DN if ! { ssl_c_used }')
         end
 
         it 'does not add mTLS headers' do
@@ -234,6 +236,7 @@
         expect(frontend_https).to include('http-request del-header X-SSL-Client-Issuer-DN')
         expect(frontend_https).to include('http-request del-header X-SSL-Client-NotBefore')
         expect(frontend_https).to include('http-request del-header X-SSL-Client-NotAfter')
+        expect(frontend_https).to include('http-request del-header X-SSL-Client-Root-CA-DN')
       end
 
       it 'does not add mTLS headers' do
@@ -256,6 +259,7 @@
           expect(frontend_https).to include('http-request del-header X-SSL-Client-Issuer-DN')
           expect(frontend_https).to include('http-request del-header X-SSL-Client-NotBefore')
           expect(frontend_https).to include('http-request del-header X-SSL-Client-NotAfter')
+          expect(frontend_https).to include('http-request del-header X-SSL-Client-Root-CA-DN')
         end
 
         it 'writes mTLS headers when mTLS is used' do
@@ -268,6 +272,7 @@
           expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn,base64]     if { ssl_c_used }')
           expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }')
           expect(frontend_https).to include('http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn,base64]     if { ssl_c_used }')
+          expect(frontend_https).to include('http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn,base64]     if { ssl_c_used }')
         end
 
         context 'when ha_proxy.legacy_xfcc_header_mapping is true' do
@@ -279,6 +284,7 @@
             expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn]            if { ssl_c_used }')
             expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)]        if { ssl_c_used }')
             expect(frontend_https).to include('http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn]            if { ssl_c_used }')
+            expect(frontend_https).to include('http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn]            if { ssl_c_used }')
           end
         end
       end
@@ -300,6 +306,7 @@
         expect(frontend_https).to include('http-request del-header X-SSL-Client-Issuer-DN  if !route_service_request')
         expect(frontend_https).to include('http-request del-header X-SSL-Client-NotBefore  if !route_service_request')
         expect(frontend_https).to include('http-request del-header X-SSL-Client-NotAfter   if !route_service_request')
+        expect(frontend_https).to include('http-request del-header X-SSL-Client-Root-CA-DN if !route_service_request')
       end
 
       it 'does not add mTLS headers' do
@@ -326,6 +333,7 @@
           expect(frontend_https).to include('http-request del-header X-SSL-Client-Issuer-DN  if !route_service_request')
           expect(frontend_https).to include('http-request del-header X-SSL-Client-NotBefore  if !route_service_request')
           expect(frontend_https).to include('http-request del-header X-SSL-Client-NotAfter   if !route_service_request')
+          expect(frontend_https).to include('http-request del-header X-SSL-Client-Root-CA-DN if !route_service_request')
         end
 
         it 'overwrites mTLS headers when mTLS is used' do
@@ -338,6 +346,7 @@
           expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn,base64]     if { ssl_c_used }')
           expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }')
           expect(frontend_https).to include('http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn,base64]     if { ssl_c_used }')
+          expect(frontend_https).to include('http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn,base64]     if { ssl_c_used }')
         end
 
         context 'when ha_proxy.legacy_xfcc_header_mapping is true' do
@@ -353,6 +362,7 @@
             expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn]            if { ssl_c_used }')
             expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)]        if { ssl_c_used }')
             expect(frontend_https).to include('http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn]            if { ssl_c_used }')
+            expect(frontend_https).to include('http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn]            if { ssl_c_used }')
           end
         end
       end

diff --git a/spec/haproxy/templates/haproxy_config/frontend_wss_spec.rb b/spec/haproxy/templates/haproxy_config/frontend_wss_spec.rb
@@ -164,6 +164,7 @@
         expect(frontend_wss).not_to include('http-request del-header X-SSL-Client-Issuer-DN')
         expect(frontend_wss).not_to include('http-request del-header X-SSL-Client-NotBefore')
         expect(frontend_wss).not_to include('http-request del-header X-SSL-Client-NotAfter')
+        expect(frontend_wss).not_to include('http-request del-header X-SSL-Client-Root-CA-DN')
       end
 
       it 'does not add mTLS headers' do
@@ -187,6 +188,7 @@
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-Issuer-DN')
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotBefore')
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotAfter')
+        expect(frontend_wss).to include('http-request del-header X-SSL-Client-Root-CA-DN')
       end
 
       it 'does not add mTLS headers' do
@@ -212,6 +214,7 @@
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-Issuer-DN  if ! { ssl_c_used }')
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotBefore  if ! { ssl_c_used }')
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotAfter   if ! { ssl_c_used }')
+          expect(frontend_wss).to include('http-request del-header X-SSL-Client-Root-CA-DN if ! { ssl_c_used }')
         end
 
         it 'does not add mTLS headers' do
@@ -232,6 +235,7 @@
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-Issuer-DN')
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotBefore')
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotAfter')
+        expect(frontend_wss).to include('http-request del-header X-SSL-Client-Root-CA-DN')
       end
 
       it 'does not add mTLS headers' do
@@ -254,6 +258,7 @@
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-Issuer-DN')
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotBefore')
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotAfter')
+          expect(frontend_wss).to include('http-request del-header X-SSL-Client-Root-CA-DN')
         end
 
         it 'writes mTLS headers when mTLS is used' do
@@ -266,6 +271,7 @@
           expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn,base64]     if { ssl_c_used }')
           expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }')
           expect(frontend_wss).to include('http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn,base64]     if { ssl_c_used }')
+          expect(frontend_wss).to include('http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn,base64]     if { ssl_c_used }')
         end
 
         context 'when ha_proxy.legacy_xfcc_header_mapping is true' do
@@ -277,6 +283,7 @@
             expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn]            if { ssl_c_used }')
             expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)]        if { ssl_c_used }')
             expect(frontend_wss).to include('http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn]            if { ssl_c_used }')
+            expect(frontend_wss).to include('http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn]            if { ssl_c_used }')
           end
         end
       end
@@ -298,6 +305,7 @@
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-Issuer-DN  if !route_service_request')
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotBefore  if !route_service_request')
         expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotAfter   if !route_service_request')
+        expect(frontend_wss).to include('http-request del-header X-SSL-Client-Root-CA-DN if !route_service_request')
       end
 
       it 'does not add mTLS headers' do
@@ -324,6 +332,7 @@
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-Issuer-DN  if !route_service_request')
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotBefore  if !route_service_request')
           expect(frontend_wss).to include('http-request del-header X-SSL-Client-NotAfter   if !route_service_request')
+          expect(frontend_wss).to include('http-request del-header X-SSL-Client-Root-CA-DN if !route_service_request')
         end
 
         it 'overwrites mTLS headers when mTLS is used' do
@@ -336,6 +345,7 @@
           expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn,base64]     if { ssl_c_used }')
           expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }')
           expect(frontend_wss).to include('http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn,base64]     if { ssl_c_used }')
+          expect(frontend_wss).to include('http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn,base64]     if { ssl_c_used }')
         end
 
         context 'when ha_proxy.legacy_xfcc_header_mapping is true' do
@@ -351,6 +361,7 @@
             expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn]            if { ssl_c_used }')
             expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)]        if { ssl_c_used }')
             expect(frontend_wss).to include('http-request set-header X-SSL-Client-Issuer-DN  %{+Q}[ssl_c_i_dn]            if { ssl_c_used }')
+            expect(frontend_wss).to include('http-request set-header X-SSL-Client-Root-CA-DN %{+Q}[ssl_c_r_dn]            if { ssl_c_used }')
           end
         end
       end