feat(kubeovn-webhook): add client-certificate verification, off by default - #2698

#!/bin/bash
set -eu
printf '%s\n' '--- main.go outline/context ---'
wc -l packages/system/kubeovn-webhook/images/kubeovn-webhook/main.go
cat -n packages/system/kubeovn-webhook/images/kubeovn-webhook/main.go | sed -n '1,125p'
printf '%s\n' '--- values.yaml ---'
cat -n packages/system/kubeovn-webhook/values.yaml | sed -n '1,70p'
printf '%s\n' '--- related symbols/usages ---'
rg -n --glob '*.go' 'seenClientIssuers|logClientCert|ClientAuth|client-ca-file|failurePolicy|RequireAndVerifyClientCert|RequestClientCert' packages/system/kubeovn-webhook
printf '%s\n' '--- manifests/config references ---'
rg -n 'client-ca-file|failurePolicy|AdmissionConfiguration|kubeConfigFile|kubeovn-webhook' packages/system/kubeovn-webhook

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
p = Path("packages/system/kubeovn-webhook/images/kubeovn-webhook/main.go")
text = p.read_text()
for term in ("seenClientIssuers", "logClientCert", "ClientAuth"):
    print(f"--- occurrences of {term} ---")
    for i, line in enumerate(text.splitlines(), 1):
        if term in line:
            print(f"{i}: {line}")
PY
printf '%s\n' '--- repository metadata for this component ---'
git ls-files packages/system/kubeovn-webhook
printf '%s\n' '--- comments and configuration mentioning certificate validation ---'
rg -n -i 'certificate|issuer|verify|trust|ca bundle|ca-file|client auth' packages/system/kubeovn-webhook

#!/bin/bash
set -eu
printf '%s\n' '--- webhook exposure and TLS arguments ---'
cat -n packages/system/kubeovn-webhook/templates/service.yaml
cat -n packages/system/kubeovn-webhook/templates/deployment.yaml | sed -n '35,75p'
cat -n packages/system/kubeovn-webhook/templates/mutatingwebhookconfiguration.yaml | sed -n '1,45p'
printf '%s\n' '--- related network policy and service references ---'
rg -n -i 'kubeovn-webhook|namespace-annotation-webhook|NetworkPolicy|network policy' packages/system/kubeovn-webhook packages/system/kubeovn
printf '%s\n' '--- chart values/schema references ---'
rg -n 'clientCAFile|client-ca-file' packages/system

#!/bin/bash
set -eu
if ! command -v go >/dev/null 2>&1; then
  echo "go unavailable"
  exit 0
fi
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
cat >"$tmpdir/main.go" <<'EOF'
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"math/big"
	"net"
	"time"
)

func cert(subject, issuer pkix.Name, ca bool, key *ecdsa.PrivateKey, parent *x509.Certificate, parentKey *ecdsa.PrivateKey) (tls.Certificate, *x509.Certificate) {
	now := time.Now()
	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1), Subject: subject, Issuer: issuer,
		NotBefore: now.Add(-time.Minute), NotAfter: now.Add(time.Hour),
		KeyUsage: x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true, IsCA: ca,
	}
	if ca { tmpl.KeyUsage |= x509.KeyUsageCertSign }
	if parent == nil { parent, parentKey = tmpl, key }
	der, err := x509.CreateCertificate(rand.Reader, tmpl, parent, &key.PublicKey, parentKey)
	if err != nil { panic(err) }
	c, err := x509.ParseCertificate(der)
	if err != nil { panic(err) }
	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}, c
}

func main() {
	caKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	caName := pkix.Name{CommonName: "trusted-ca"}
	caTLS, ca := cert(caName, caName, true, caKey, nil, nil)
	_ = caTLS
	clientKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	// This client certificate is self-signed and has a deliberately chosen issuer.
	clientName := pkix.Name{CommonName: "attacker"}
	clientTLS, client := cert(clientName, caName, false, clientKey, ca, caKey)

	serverKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	serverTLS, _ := cert(pkix.Name{CommonName: "server"}, pkix.Name{CommonName: "server"}, false, serverKey, nil, nil)

	for _, auth := range []tls.ClientAuthType{tls.RequestClientCert, tls.RequireAndVerifyClientCert} {
		cfg := &tls.Config{Certificates: []tls.Certificate{serverTLS}, ClientAuth: auth}
		if auth == tls.RequireAndVerifyClientCert {
			cfg.ClientCAs = x509.NewCertPool()
			cfg.ClientCAs.AddCert(ca)
		}
		ln, err := tls.Listen("tcp", "127.0.0.1:0", cfg)
		if err != nil { panic(err) }
		done := make(chan string, 1)
		go func() {
			conn, err := ln.Accept()
			if err != nil { done <- "accept error: " + err.Error(); return }
			tc := conn.(*tls.Conn)
			err = tc.Handshake()
			if err != nil { done <- "server handshake error: " + err.Error(); return }
			state := tc.ConnectionState()
			issuer := "<none>"
			if len(state.PeerCertificates) > 0 { issuer = state.PeerCertificates[0].Issuer.String() }
			done <- fmt.Sprintf("auth=%v issuer=%q verified_chains=%d", auth, issuer, len(state.VerifiedChains))
			conn.Close()
		}()
		clientCfg := &tls.Config{InsecureSkipVerify: true, Certificates: []tls.Certificate{clientTLS}} // probe only
		conn, err := tls.Dial("tcp", ln.Addr().String(), clientCfg)
		if err == nil { conn.Close() }
		fmt.Println(<-done)
		ln.Close()
	}
	_ = pem.Block{}
}
EOF
(cd "$tmpdir" && go run main.go)

#!/bin/bash
set -eu
printf '%s\n' '--- local Go API documentation ---'
CGO_ENABLED=0 go doc crypto/tls.ClientAuthType

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
cat >"$tmpdir/main.go" <<'EOF'
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"math/big"
	"net"
	"time"
)

func makeCert(name, issuer string, ca bool, parent *x509.Certificate, parentKey *ecdsa.PrivateKey) (tls.Certificate, *x509.Certificate, *ecdsa.PrivateKey) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil { panic(err) }
	now := time.Now()
	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{CommonName: name},
		Issuer: pkix.Name{CommonName: issuer},
		NotBefore: now.Add(-time.Minute), NotAfter: now.Add(time.Hour),
		KeyUsage: x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true, IsCA: ca,
	}
	if ca { tmpl.KeyUsage |= x509.KeyUsageCertSign }
	if parent == nil { parent, parentKey = tmpl, key }
	der, err := x509.CreateCertificate(rand.Reader, tmpl, parent, &key.PublicKey, parentKey)
	if err != nil { panic(err) }
	cert, err := x509.ParseCertificate(der)
	if err != nil { panic(err) }
	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}, cert, key
}

func main() {
	trustedTLS, trustedCA, trustedKey := makeCert("trusted-ca", "trusted-ca", true, nil, nil)
	_ = trustedTLS
	attackerTLS, _, _ := makeCert("attacker", "attacker-chosen-issuer", false, nil, nil)
	serverTLS, _, _ := makeCert("server", "server", false, nil, nil)

	for _, auth := range []tls.ClientAuthType{tls.RequestClientCert, tls.RequireAndVerifyClientCert} {
		cfg := &tls.Config{Certificates: []tls.Certificate{serverTLS}, ClientAuth: auth}
		if auth == tls.RequireAndVerifyClientCert {
			cfg.ClientCAs = x509.NewCertPool()
			cfg.ClientCAs.AddCert(trustedCA)
		}
		ln, err := tls.Listen("tcp", "127.0.0.1:0", cfg)
		if err != nil { panic(err) }
		result := make(chan string, 1)
		go func() {
			conn, err := ln.Accept()
			if err != nil { result <- "accept error: " + err.Error(); return }
			tc := conn.(*tls.Conn)
			err = tc.Handshake()
			if err != nil { result <- "server handshake error: " + err.Error(); return }
			state := tc.ConnectionState()
			issuer := "<none>"
			if len(state.PeerCertificates) > 0 { issuer = state.PeerCertificates[0].Issuer.String() }
			result <- fmt.Sprintf("auth=%v issuer=%q verified_chains=%d", auth, issuer, len(state.VerifiedChains))
			conn.Close()
		}()
		clientCfg := &tls.Config{InsecureSkipVerify: true, Certificates: []tls.Certificate{attackerTLS}} // probe only
		conn, dialErr := tls.Dial("tcp", ln.Addr().String(), clientCfg)
		if dialErr == nil { conn.Close() }
		fmt.Printf("client_error=%v; %s\n", dialErr, <-result)
		ln.Close()
	}
	_ = net.IPv4(127, 0, 0, 1)
	_ = pem.Block{}
	_ = trustedKey
}
EOF
(cd "$tmpdir" && CGO_ENABLED=0 go run main.go)

#!/bin/bash
set -eu
printf '%s\n' '--- target file ---'
sed -n '1,180p' packages/system/kubeovn-webhook/images/kubeovn-webhook/main.go
printf '%s\n' '--- related configuration and references ---'
rg -n -C 4 'seenClientIssuers|RequestClientCert|ClientAuth|issuer|observation|observation mode' \
  packages/system/kubeovn-webhook
printf '%s\n' '--- repository status summary ---'
git diff --stat

#!/bin/bash
set -eu
printf '%s\n' '--- Go TLS documentation ---'
go doc crypto/tls.ClientAuthType
go doc crypto/tls.Config.ClientAuth
printf '%s\n' '--- standalone TLS behavior probe ---'
cat > /tmp/request-client-cert-probe.go <<'GO'
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"math/big"
	"net"
	"sync"
	"time"
)

func cert(issuer string) (tls.Certificate, error) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return tls.Certificate{}, err
	}
	template := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "client"},
		Issuer:                pkix.Name{CommonName: issuer},
		NotBefore:             time.Now().Add(-time.Minute),
		NotAfter:              time.Now().Add(time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
	}
	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
	if err != nil {
		return tls.Certificate{}, err
	}
	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
	if err != nil {
		return tls.Certificate{}, err
	}
	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})
	return tls.X509KeyPair(certPEM, keyPEM)
}

func main() {
	serverCert, err := cert("server")
	if err != nil {
		panic(err)
	}
	for _, mode := range []tls.ClientAuthType{
		tls.RequestClientCert,
		tls.RequireAndVerifyClientCert,
	} {
		clientCert, err := cert("attacker-" + mode.String())
		if err != nil {
			panic(err)
		}
		serverConn, clientConn := net.Pipe()
		server := tls.Server(serverConn, &tls.Config{
			Certificates: []tls.Certificate{serverCert},
			ClientAuth:   mode,
		})
		client := tls.Client(clientConn, &tls.Config{
			InsecureSkipVerify: true,
			Certificates:       []tls.Certificate{clientCert},
		})
		var wg sync.WaitGroup
		wg.Add(1)
		go func() {
			defer wg.Done()
			_ = server.Handshake()
		}()
		clientErr := client.Handshake()
		wg.Wait()
		peerCount := len(server.ConnectionState().PeerCertificates)
		issuer := "<none>"
		if peerCount > 0 {
			issuer = server.ConnectionState().PeerCertificates[0].Issuer.String()
		}
		fmt.Printf("mode=%s client_handshake=%v peer_certificates=%d issuer=%q\n",
			mode, clientErr, peerCount, issuer)
		server.Close()
		client.Close()
	}
}
GO
go run /tmp/request-client-cert-probe.go
rm -f /tmp/request-client-cert-probe.go

#!/bin/bash
set -eu
cat > /tmp/request-client-cert-probe.go <<'GO'
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"math/big"
	"net"
	"sync"
	"time"
)

func cert(issuer string) (tls.Certificate, error) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return tls.Certificate{}, err
	}
	template := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{CommonName: "client"},
		Issuer: pkix.Name{CommonName: issuer},
		NotBefore: time.Now().Add(-time.Minute),
		NotAfter:  time.Now().Add(time.Hour),
		KeyUsage:  x509.KeyUsageDigitalSignature,
		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
	}
	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
	if err != nil {
		return tls.Certificate{}, err
	}
	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
	if err != nil {
		return tls.Certificate{}, err
	}
	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})
	return tls.X509KeyPair(certPEM, keyPEM)
}

func main() {
	serverCert, err := cert("server")
	if err != nil {
		panic(err)
	}
	for _, mode := range []tls.ClientAuthType{
		tls.RequestClientCert,
		tls.RequireAndVerifyClientCert,
	} {
		clientCert, err := cert("attacker-" + mode.String())
		if err != nil {
			panic(err)
		}
		serverConn, clientConn := net.Pipe()
		server := tls.Server(serverConn, &tls.Config{
			Certificates: []tls.Certificate{serverCert},
			ClientAuth:   mode,
		})
		client := tls.Client(clientConn, &tls.Config{
			InsecureSkipVerify: true,
			Certificates:       []tls.Certificate{clientCert},
		})
		var wg sync.WaitGroup
		wg.Add(1)
		go func() {
			defer wg.Done()
			_ = server.Handshake()
		}()
		clientErr := client.Handshake()
		wg.Wait()
		peerCount := len(server.ConnectionState().PeerCertificates)
		issuer := "<none>"
		if peerCount > 0 {
			issuer = server.ConnectionState().PeerCertificates[0].Issuer.String()
		}
		fmt.Printf("mode=%s client_handshake=%v peer_certificates=%d issuer=%q\n",
			mode, clientErr, peerCount, issuer)
		server.Close()
		client.Close()
	}
}
GO
CGO_ENABLED=0 go run /tmp/request-client-cert-probe.go
rm -f /tmp/request-client-cert-probe.go

#!/bin/bash
set -eu
cat > /tmp/request-client-cert-probe.go <<'GO'
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"math/big"
	"net"
	"sync"
	"time"
)

func cert(name string) (tls.Certificate, error) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return tls.Certificate{}, err
	}
	template := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject:      pkix.Name{CommonName: name},
		NotBefore:    time.Now().Add(-time.Minute),
		NotAfter:     time.Now().Add(time.Hour),
		KeyUsage:     x509.KeyUsageDigitalSignature,
		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
	}
	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
	if err != nil {
		return tls.Certificate{}, err
	}
	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
	if err != nil {
		return tls.Certificate{}, err
	}
	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})
	return tls.X509KeyPair(certPEM, keyPEM)
}

func main() {
	serverCert, err := cert("server")
	if err != nil {
		panic(err)
	}
	for i := 0; i < 3; i++ {
		issuerName := fmt.Sprintf("untrusted-issuer-%d", i)
		clientCert, err := cert(issuerName)
		if err != nil {
			panic(err)
		}
		serverConn, clientConn := net.Pipe()
		server := tls.Server(serverConn, &tls.Config{
			Certificates: []tls.Certificate{serverCert},
			ClientAuth:   tls.RequestClientCert,
		})
		client := tls.Client(clientConn, &tls.Config{
			InsecureSkipVerify: true,
			Certificates:       []tls.Certificate{clientCert},
		})
		var wg sync.WaitGroup
		wg.Add(1)
		go func() {
			defer wg.Done()
			if err := server.Handshake(); err != nil {
				panic(err)
			}
		}()
		if err := client.Handshake(); err != nil {
			panic(err)
		}
		_ = client.Close()
		wg.Wait()
		state := server.ConnectionState()
		fmt.Printf("issuer=%q peer_certificates=%d\n",
			state.PeerCertificates[0].Issuer.String(), len(state.PeerCertificates))
		_ = server.Close()
	}
}
GO
CGO_ENABLED=0 go run /tmp/request-client-cert-probe.go
rm -f /tmp/request-client-cert-probe.go