Support for Gateway FrontendTLS

internal/controller/nginx/config/http/config.go

@@ -123,8 +123,11 @@ type Return struct {
 type SSL struct {
 	Protocols           string
 	Ciphers             string
+	ClientCertificate   string
+	VerifyClient        string
 	Certificates        []string
 	CertificateKeys     []string
+	RequireVerifiedCert bool
 	PreferServerCiphers bool
 }
 

internal/controller/nginx/config/servers.go

@@ -222,18 +222,29 @@ func buildHTTPSSL(ssl *dataplane.SSL) *http.SSL {
 	certs := make([]string, 0, len(ssl.KeyPairIDs))
 	keys := make([]string, 0, len(ssl.KeyPairIDs))
 
+	var sslCertificateID string
+
 	for _, id := range ssl.KeyPairIDs {
 		pemFile := generatePEMFileName(id)
 		certs = append(certs, pemFile)
 		keys = append(keys, pemFile)
 	}
 
+	// ClientCertBundleID can be empty for mode: AllowInsecureFallback
+	// In this case, we don't want to generate an ID.
+	if ssl.ClientCertBundleID != "" {
+		sslCertificateID = generateCertBundleFileName(ssl.ClientCertBundleID)
+	}
+
 	return &http.SSL{
 		Certificates:        certs,
 		CertificateKeys:     keys,
 		Protocols:           ssl.Protocols,
 		Ciphers:             ssl.Ciphers,
 		PreferServerCiphers: ssl.PreferServerCiphers,
+		ClientCertificate:   sslCertificateID,
+		VerifyClient:        string(ssl.VerifyClient),
+		RequireVerifiedCert: ssl.RequireVerifiedCert,
 	}
 }
 

internal/controller/nginx/config/servers_template.go

@@ -29,6 +29,16 @@ server {
         {{- if $s.SSL.PreferServerCiphers }}
     ssl_prefer_server_ciphers on;
         {{- end }}
+        {{- if $s.SSL.ClientCertificate }}
+    ssl_client_certificate {{ $s.SSL.ClientCertificate }};
+        {{- end }}
+        {{- if $s.SSL.VerifyClient }}
+    ssl_verify_client {{ $s.SSL.VerifyClient }};
+        {{- end }}
+        {{- if $s.SSL.RequireVerifiedCert }}
+    ssl_verify_depth 4;
+    error_page 495 496 = @frontend_tls_verify_failed;
+        {{- end }}
     {{- else }}
     ssl_reject_handshake on;
     {{- end }}
@@ -41,6 +51,11 @@ server {
         {{- if $.RewriteClientIP.Recursive}}
     real_ip_recursive on;
         {{- end }}
+        {{- if and $s.SSL $s.SSL.RequireVerifiedCert }}
+    location @frontend_tls_verify_failed {
+        return 444;
+    }
+        {{- end}}
 }
     {{- else if $s.IsDefaultHTTP }}
 server {
@@ -87,6 +102,16 @@ server {
           {{- if $s.SSL.PreferServerCiphers }}
     ssl_prefer_server_ciphers on;
           {{- end }}
+          {{- if $s.SSL.ClientCertificate }}
+    ssl_client_certificate {{ $s.SSL.ClientCertificate }};
+          {{- end }}
+          {{- if $s.SSL.VerifyClient }}
+    ssl_verify_client {{ $s.SSL.VerifyClient }};
+          {{- end }}
+          {{- if $s.SSL.RequireVerifiedCert }}
+    ssl_verify_depth 4;
+    error_page 495 496 = @frontend_tls_verify_failed;
+          {{- end }}
 
           {{- if $s.MisdirectedRequestVars }}
     if ({{ $s.MisdirectedRequestVars.SNIVar }} != {{ $s.MisdirectedRequestVars.HostVar }}) {
@@ -120,6 +145,12 @@ server {
         {{- end}}
         {{- if $.RewriteClientIP.Recursive}}
     real_ip_recursive on;
+        {{- end }}
+
+         {{- if and $s.SSL $s.SSL.RequireVerifiedCert }}
+    location @frontend_tls_verify_failed {
+        return 444;
+    }
         {{- end }}
 
         {{ range $l := $s.Locations }}

internal/controller/nginx/config/servers_test.go

@@ -6785,3 +6785,233 @@ func TestExistingExactPathSet(t *testing.T) {
 		})
 	}
 }
+
+func TestBuildHTTPSSLFrontendTLS(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                      string
+		ssl                       *dataplane.SSL
+		expectedClientCertificate string
+		expectedVerifyClient      string
+		expectedRequireVerified   bool
+	}{
+		{
+			name: "frontend TLS disabled by default",
+			ssl: &dataplane.SSL{
+				KeyPairIDs: []dataplane.SSLKeyPairID{"test-keypair"},
+			},
+			expectedClientCertificate: "",
+			expectedVerifyClient:      "",
+			expectedRequireVerified:   false,
+		},
+		{
+			name: "frontend TLS client certificate verification enabled",
+			ssl: &dataplane.SSL{
+				KeyPairIDs:          []dataplane.SSLKeyPairID{"test-keypair"},
+				ClientCertBundleID:  dataplane.CertBundleID("test-ca-bundle"),
+				VerifyClient:        "optional_no_ca",
+				RequireVerifiedCert: true,
+			},
+			expectedClientCertificate: generateCertBundleFileName(dataplane.CertBundleID("test-ca-bundle")),
+			expectedVerifyClient:      "optional_no_ca",
+			expectedRequireVerified:   true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			g := NewWithT(t)
+
+			result := buildHTTPSSL(test.ssl)
+
+			g.Expect(result.ClientCertificate).To(Equal(test.expectedClientCertificate))
+			g.Expect(result.VerifyClient).To(Equal(test.expectedVerifyClient))
+			g.Expect(result.RequireVerifiedCert).To(Equal(test.expectedRequireVerified))
+			g.Expect(result.Certificates).To(Equal([]string{generatePEMFileName(dataplane.SSLKeyPairID("test-keypair"))}))
+			g.Expect(result.CertificateKeys).To(Equal([]string{generatePEMFileName(dataplane.SSLKeyPairID("test-keypair"))}))
+		})
+	}
+}
+
+func TestExecuteServers_FrontendTLS(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		ssl             *dataplane.SSL
+		name            string
+		expectedPresent []string
+		expectedAbsent  []string
+		isDefault       bool
+	}{
+		{
+			name:      "frontend TLS disabled",
+			isDefault: false,
+			ssl: &dataplane.SSL{
+				KeyPairIDs: []dataplane.SSLKeyPairID{"test-keypair"},
+			},
+			expectedPresent: []string{
+				"ssl_certificate /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;",
+			},
+			expectedAbsent: []string{
+				"ssl_client_certificate ",
+				"ssl_verify_client ",
+				"ssl_verify_depth ",
+				"error_page 495 496 = @frontend_tls_verify_failed;",
+				"location @frontend_tls_verify_failed {",
+				"return 444;",
+			},
+		},
+		{
+			name:      "frontend TLS enabled",
+			isDefault: false,
+			ssl: &dataplane.SSL{
+				KeyPairIDs:          []dataplane.SSLKeyPairID{"test-keypair"},
+				ClientCertBundleID:  dataplane.CertBundleID("test-ca-bundle"),
+				VerifyClient:        dataplane.SSLVerifyClientOn,
+				RequireVerifiedCert: true,
+			},
+			expectedPresent: []string{
+				"ssl_certificate /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_client_certificate " + generateCertBundleFileName(dataplane.CertBundleID("test-ca-bundle")) + ";",
+				"ssl_verify_client on;",
+				"ssl_verify_depth ",
+				"error_page 495 496 = @frontend_tls_verify_failed;",
+				"location @frontend_tls_verify_failed {",
+				"return 444;",
+			},
+		},
+		{
+			name:      "frontend TLS enabled, with mode: AllowInsecureFallback",
+			isDefault: false,
+			ssl: &dataplane.SSL{
+				KeyPairIDs:   []dataplane.SSLKeyPairID{"test-keypair"},
+				VerifyClient: dataplane.SSLVerifyClientOptionalNoCA,
+			},
+			expectedPresent: []string{
+				"ssl_certificate /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_verify_client optional_no_ca;",
+			},
+			expectedAbsent: []string{
+				"ssl_verify_depth ",
+				"ssl_client_certificate ",
+				"error_page 495 496 = @frontend_tls_verify_failed;",
+				"location @frontend_tls_verify_failed {",
+				"return 444;",
+			},
+		},
+		{
+			name:      "default SSL server without frontend TLS",
+			isDefault: true,
+			ssl: &dataplane.SSL{
+				KeyPairIDs: []dataplane.SSLKeyPairID{"test-keypair"},
+			},
+			expectedPresent: []string{
+				"listen 8443 ssl default_server;",
+				"ssl_certificate /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;",
+			},
+			expectedAbsent: []string{
+				"ssl_client_certificate ",
+				"ssl_verify_client ",
+				"ssl_verify_depth ",
+				"error_page 495 496 = @frontend_tls_verify_failed;",
+				"location @frontend_tls_verify_failed {",
+				"return 444;",
+			},
+		},
+		{
+			name:      "default SSL server with frontend TLS enabled",
+			isDefault: true,
+			ssl: &dataplane.SSL{
+				KeyPairIDs:          []dataplane.SSLKeyPairID{"test-keypair"},
+				ClientCertBundleID:  dataplane.CertBundleID("test-ca-bundle"),
+				VerifyClient:        dataplane.SSLVerifyClientOn,
+				RequireVerifiedCert: true,
+			},
+			expectedPresent: []string{
+				"listen 8443 ssl default_server;",
+				"ssl_certificate /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_client_certificate " + generateCertBundleFileName(dataplane.CertBundleID("test-ca-bundle")) + ";",
+				"ssl_verify_client on;",
+				"ssl_verify_depth ",
+				"error_page 495 496 = @frontend_tls_verify_failed;",
+				"location @frontend_tls_verify_failed {",
+				"return 444;",
+			},
+			expectedAbsent: []string{},
+		},
+		{
+			name:      "default SSL server with frontend TLS in AllowInsecureFallback mode",
+			isDefault: true,
+			ssl: &dataplane.SSL{
+				KeyPairIDs:   []dataplane.SSLKeyPairID{"test-keypair"},
+				VerifyClient: dataplane.SSLVerifyClientOptionalNoCA,
+			},
+			expectedPresent: []string{
+				"listen 8443 ssl default_server;",
+				"ssl_certificate /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;",
+				"ssl_verify_client optional_no_ca;",
+			},
+			expectedAbsent: []string{
+				"ssl_client_certificate ",
+				"ssl_verify_depth ",
+				"error_page 495 496 = @frontend_tls_verify_failed;",
+				"location @frontend_tls_verify_failed {",
+				"return 444;",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			g := NewWithT(t)
+
+			var server dataplane.VirtualServer
+			if test.isDefault {
+				server = dataplane.VirtualServer{
+					IsDefault: true,
+					Port:      8443,
+					SSL:       test.ssl,
+				}
+			} else {
+				server = dataplane.VirtualServer{
+					Hostname: "example.com",
+					Port:     8443,
+					SSL:      test.ssl,
+				}
+			}
+
+			conf := dataplane.Configuration{
+				SSLServers: []dataplane.VirtualServer{server},
+			}
+
+			gen := GeneratorImpl{}
+			results := gen.executeServers(conf, &policiesfakes.FakeGenerator{}, alwaysFalseKeepAliveChecker)
+
+			var httpData string
+			for _, res := range results {
+				if res.dest == httpConfigFile {
+					httpData = string(res.data)
+					break
+				}
+			}
+
+			g.Expect(httpData).NotTo(BeEmpty())
+
+			for _, sub := range test.expectedPresent {
+				g.Expect(httpData).To(ContainSubstring(sub))
+			}
+			for _, sub := range test.expectedAbsent {
+				g.Expect(httpData).NotTo(ContainSubstring(sub))
+			}
+		})
+	}
+}