Issue with AccesValidationPlugin HasClientCertValidator

[Luc-Bonade]

It seems there is an issue when using "cp:otoroshi.plugins.clientcert.HasClientCertValidator" with Otoroshi 1.5.0-alapha.18.

When I configurer my Service Descriptor with

  plugins:
    enabled: {{ default .Values.apiLibHelm.forceIncommingCertificat .Values.forceIncommingCertificat }}
    refs:
      - cp:otoroshi.plugins.clientcert.HasClientCertValidator
    config: {}
    excluded:
      - ^/actuator/healthfull$
      - /actuator/prometheus
  accessValidator:
    enabled: false
    refs: []
    config: {}
    excludedPatterns: []

Evry query to the service i get the folowing answer :

HTTP/1.1 400 Bad Request
Otoroshi-Error: true
Otoroshi-Error-Msg: bad request
Otoroshi-State-Resp: --
Date: Fri, 18 Jun 2021 12:27:17 GMT
Content-Type: application/json
Content-Length: 32

{"Otoroshi-Error":"bad request"}

It append on excluded or not path and with and without certificat.

I first try the mTLS AccesValidator with Otoroshi 1.5.0.alpha.14, and I had à similar issue with the slight différence that using excluded pattern disable entirely the AccesValidator. As it's a behavior on an old version it may be irrevelant but usefull for the issue analysis.

Of course the service is exposed by Otoroshi on htttps.

[Luc-Bonade]

Since i open the issue, i manager to have GatewayEvent on request, the client cert part is empty.
I have the issue with the vip and also when calling the worker directely.

Using curl directly on a worker i get the folowing the handshake log

{code}

• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.2 (IN), TLS handshake, Certificate (11):
• TLSv1.2 (IN), TLS handshake, Server key exchange (12):
• TLSv1.2 (IN), TLS handshake, Server finished (14):
• TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
• TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.2 (OUT), TLS handshake, Finished (20):
• TLSv1.2 (IN), TLS handshake, Finished (20):
• SSL connection using TLSv1.2 / XXXXXXXX
  {code}

If i am wright It seems that the worker doesn't ask for the ClientCert.
Perhaps i have missed a configuration Option, on the Otoroshi cluster or on the service descriptor.

[mathieuancelin]

Hello @Luc-Bonade

my first guess is that you did not enable mtls on your otoroshi instance. It is not enabled by default as it makes the TLS handshake way heavier. Just add in your env :

HTTPS_WANT_CLIENT_AUTH=true 
SSL_OUTSIDE_CLIENT_AUTH=Want

[Luc-Bonade]

@mathieuancelin, for other users who may have the same issue, adding the two environnement variable solve my issue.

Thanks