Feature: mtls filters by szuecs · Pull Request #4044 · zalando/skipper

szuecs · 2026-06-01T21:50:35Z

feature: mtlsSAN(), mtlsSanCIDR(), mtlsSanDNS(), mtlsSanIP(), mtlsSanURI() filters
feature: mtlsIssuerDN() filter
feature: mtlsCN() filter
feature: mtlsAuthn() filter
doc: document mtls authnz filters
test: benchmarks

ref: closing #3295

feature: mtlsIssuerDN() filter feature: mtlsCN() filter feature: mtlsAuthn() filter doc: document mtls authnz filters Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

fix: linter finding in test Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

…ntegration Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

… used to validate in coming client certificates. Configuration is able to load system CAs first and append given PEM encoded CA files or we load only given PEM encoded CA files or if nil we load system CAs. Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

…, because we care about the identity of the client and not the identity of the CA Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

szuecs · 2026-06-03T18:46:05Z

Given that auth should be fast, I will also provide 4 more filters for mtlsSAN to have them special, for example if you use SPIFFE/SPIRE, you do not want to check DNS or IP in SAN.

…sSanDNS(), mtlsSanIP(), mtlsSandURI() Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

szuecs · 2026-06-03T19:40:44Z

e634e6e has the 4 new filters

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

szuecs · 2026-06-03T20:12:01Z

Local test without CA loaded, so empty pool it can not validate certs:

% ./bin/skipper -inline-routes='r: * -> mtlsAuthn() -> status(201) -> <shunt>' -address :9002                                                                     feature/mTLS-filters
[APP]INFO[0000] Expose metrics in format: "codahale"
[APP]INFO[0000] enable swarm: false
[APP]INFO[0000] Replacing tee filter specification
[APP]INFO[0000] Replacing teenf filter specification
[APP]INFO[0000] Replacing teeResponse filter specification
[APP]INFO[0000] route settings, reset, route: r: * -> mtlsAuthn() -> status(201) -> <shunt>
[APP]INFO[0000] route settings received, id: 1
[APP]INFO[0000] support listener on :9911
[APP]INFO[0000] route settings applied, id: 1
[APP]INFO[0000] Dataclients are updated once, first load complete
[APP]INFO[0000] Listen on :9002
[APP]INFO[0000] TLS settings not found, defaulting to HTTP
::1 - - [03/Jun/2026:22:10:26 +0200] "GET /foo HTTP/1.1" 401 0 "-" "curl/7.49.0" 0 localhost:9002 - -

client call sent with no cert:

% curl http://localhost:9002/foo -v
*   Trying ::1...
* Connected to localhost (::1) port 9002 (#0)
> GET /foo HTTP/1.1
> Host: localhost:9002
> User-Agent: curl/7.49.0
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Server: Skipper
< Www-Authenticate: localhost:9002
< Date: Wed, 03 Jun 2026 20:10:26 GMT
< Transfer-Encoding: chunked
<
* Connection #0 to host localhost left intact

We can see good default behaviour and no panic, so integration seems also fine

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

MustafaSaber · 2026-06-04T13:39:58Z

+Example:
+
+```
+* -> mtlsAuthn() ->  mtlsSAN("spiffe://my-service.example/app1") -> "http://10.2.5.21:8080";


wrong filter example

MustafaSaber · 2026-06-04T13:40:19Z

+* -> mtlsAuthn() ->  mtlsCN("My CA") -> "http://10.2.5.21:8080";
+```
+
+### mtlsSAN


I guess this should be removed and use other filters

It depends, if someone wants to allow a mix of it, but yeah we could also argue to use a filter chain instead.
I agree will delete it later.

fix: support multiple CA files in config Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

…o it Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

szuecs · 2026-06-05T10:20:14Z

@MustafaSaber I can't reply to your message directly so doing it here:
it's fixed

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

github-actions Bot added the enhancement label Jun 1, 2026

szuecs force-pushed the feature/mTLS-filters branch from 878795b to d35f4f6 Compare June 2, 2026 11:32

github-actions Bot added the documentation label Jun 2, 2026

feature: mtlsSAN() filter

144a2b8

feature: mtlsIssuerDN() filter feature: mtlsCN() filter feature: mtlsAuthn() filter doc: document mtls authnz filters Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

szuecs force-pushed the feature/mTLS-filters branch from e07710c to 144a2b8 Compare June 2, 2026 20:22

szuecs added the major moderate risk, for example new API, small filter changes that have no risk like refactoring or logs label Jun 2, 2026

szuecs marked this pull request as ready for review June 2, 2026 20:23

fix merge conflict errors

b44bc2a

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

szuecs mentioned this pull request Jun 3, 2026

Skipper mTLS support #1780

Open

szuecs added 4 commits June 3, 2026 10:54

fix: copy audit log flag from spec to filter

79a559c

fix: linter finding in test Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

make sure agents run linter

86db1a5

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

feature: mtlsSAN() support URI lookup that we need for SPIFFE/SPIRE i…

c0dc74d

…ntegration Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

feature: SPIFFE/SPIRE authz filter mtlsSAN()

aa7e7f4

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

vlktna self-requested a review June 3, 2026 16:28

shyamz-22 reviewed Jun 3, 2026

View reviewed changes

Comment thread filters/tls/mtls.go Outdated

vlktna reviewed Jun 3, 2026

View reviewed changes

Comment thread filters/tls/mtls.go Outdated

shyamz-22 reviewed Jun 3, 2026

View reviewed changes

Comment thread filters/tls/mtls.go

Comment thread filters/tls/mtls.go

Comment thread filters/tls/mtls.go Outdated

MustafaSaber reviewed Jun 3, 2026

View reviewed changes

Comment thread docs/reference/filters.md

Comment thread filters/tls/mtls.go

Comment thread filters/tls/mtls.go

Comment thread docs/reference/filters.md

szuecs added 4 commits June 3, 2026 20:08

fix: review finding: we should not check issuer but subject of a cert…

1cb6f47

…, because we care about the identity of the client and not the identity of the CA Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

fix: use only leaf cet to validate mtls authnz filters

2b37804

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

fix: no peer certs respond with 401

5b1b092

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

split mtlsSAN() filters into 4 specialized filters mtlsSanCIDR(), mtl…

e634e6e

…sSanDNS(), mtlsSanIP(), mtlsSandURI() Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

fix: config tests

e0371d5

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

szuecs added 2 commits June 3, 2026 23:25

fix: tests in proxy, because of the changed behavior of mtlsSAN()

0e413c5

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

comment unused

a41cc71

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

a4180p reviewed Jun 4, 2026

View reviewed changes

Comment thread filters/tls/mtls.go Outdated

Comment thread filters/tls/mtls.go Outdated

Comment thread filters/tls/mtls.go Outdated

a4180p reviewed Jun 4, 2026

View reviewed changes

Comment thread config/config.go Outdated

a4180p reviewed Jun 4, 2026

View reviewed changes

Comment thread config/config.go Outdated

a4180p reviewed Jun 4, 2026

View reviewed changes

Comment thread filters/tls/mtls.go

a4180p reviewed Jun 4, 2026

View reviewed changes

Comment thread filters/tls/mtls.go Outdated

MustafaSaber reviewed Jun 4, 2026

View reviewed changes

szuecs added 2 commits June 5, 2026 09:39

fix: use map[] instead of sync.Map

87a836b

fix: support multiple CA files in config Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

refactor: remove mtlsSAN() and fix all tests and benchmarls related t…

63b7f13

…o it Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

fix: build

129d3ed

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

Conversation

szuecs commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

szuecs commented Jun 3, 2026

Uh oh!

szuecs commented Jun 3, 2026

Uh oh!

szuecs commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MustafaSaber Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

MustafaSaber Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

szuecs Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

szuecs commented Jun 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

szuecs commented Jun 1, 2026 •

edited

Loading

szuecs commented Jun 3, 2026 •

edited

Loading