You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "anilaws (via GitHub)" <gi...@apache.org> on 2023/05/18 19:07:09 UTC
[GitHub] [apisix] anilaws opened a new issue, #9509: help request: not able to bypass MTLS based on regular expression matching against URI
anilaws opened a new issue, #9509:
URL: https://github.com/apache/apisix/issues/9509
### Description
**Goal** : Have two routes, one should be protected using tls and one should be unprotected
**Issue**: client certificate is being asked for every URI request
- Deployed apisix on eks using helm
- created ssl object using the curl mentioned in the document https://apisix.apache.org/docs/apisix/next/tutorials/client-to-apisix-mtls/
- when i check the ssl created using admin API, looks fine to me
```
{
"value": {
"validity_end": 1694303999,
"client": {
"ca": "-----BEGIN CERTIFICATE-----\nCA\n-----END CERTIFICATE-----",
"depth": 20,
"skip_mtls_uri_regex": [
"/anything.*"
]
},
"status": 1,
"id": "1",
"cert": "-----BEGIN CERTIFICATE-----\nservercert-----\nEND CERTIFICATE-----",
"type": "server",
"key": "server cert key"
"snis": [
"test.domain.com"
],
"update_time": 1684429122,
"create_time": 1684428603,
"validity_start": 1660003200
},
"key": "/apisix/ssls/1",
"modifiedIndex": 4331,
"createdIndex": 4326
}
```
- if you notice the response above , key section doesnt have -----BEGIN RSA PRIVATE KEY----- in the beginning and -----END RSA PRIVATE KEY----- at the end.
**- I have noticed that if i create ssl using admin API i have option to input CA CERT where as using dashboard i cant input CA cert**
- If i input the certificate and private key using dashboard, i was able to see -----BEGIN RSA PRIVATE KEY----- in the beginning and -----END RSA PRIVATE KEY----- at the end of the key section of SSL object
- curl -X GET -v https://test.domain.com/anything/foo/bar --cacert ca.crt gives me error
696397 SSL_do_handshake() failed (SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate) while SSL handshaking
- curl -X GET -v --cert clientcert --cert-type P12 https://test.domain.com/anything/foo/bar works
### Environment
- APISIX version (run `apisix version`): 3.3.0
- Operating system (run `uname -a`): Linux apisix-67b9ff86c7-fnpsd 5.15.93-55.139.amzn2.x86_64 #1 SMP Tue Feb 14 21:47:11 UTC 2023 x86_64 GNU/Linux
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`): nginx version: openresty/1.21.4.1
built by gcc 10.2.1 20210110 (Debian 10.2.1-6
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`): etcd_version":"3.5.0
- APISIX Dashboard version, if relevant: 3.0.0
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`):
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1559062787
@anilaws, there is a test case covering this situation (skip_mtls_uri_regex).
https://github.com/apache/apisix/blob/0545a17b4198fcaa2210bd6406e9871dd09883e8/t/node/client-mtls.t#L509-L592
It has just been merged to master but hasn't yet been released. So if your installation method isn't a [local source code manual build](https://apisix.apache.org/docs/apisix/next/building-apisix/) then it might not work.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anilaws commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "anilaws (via GitHub)" <gi...@apache.org>.
anilaws commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1554688398
@shreemaan-abhishek Thanks for your response
I have changed the URI to /anything.* and i have "skip_mtls_uri_regex": ["/anything.*"] in the ssl but i am still getting error SSL_do_handshake() failed (SSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate) while SSL handshaking
Request
`curl -X GET -v https://test.domain.com/anything/foo/bar --cacert ca.crt`
route confg:
`{"key":"/apisix/routes/1","modifiedIndex":4608,"createdIndex":4608,"value":{"update_time":1684506577,"uri":"/anything.*","priority":0,"id":"1","create_time":1684506577,"status":1,"upstream":{"type":"roundrobin","scheme":"http","pass_host":"pass","nodes":{"httpbin.org":1},"hash_on":"vars"}}}`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anilaws commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "anilaws (via GitHub)" <gi...@apache.org>.
anilaws commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1557827991
@shreemaan-abhishek can you please let me know if you notice anything wrong with the config?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] tao12345666333 commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "tao12345666333 (via GitHub)" <gi...@apache.org>.
tao12345666333 commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1655942661
Yes, ApisixTls don't have this skip_mtls_uri_regex field
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1554506584
Can you share the route configuration as well?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1554661514
Your uri (`/*`) will match all routes and APISIX will demand mTLS on all of them, that's why the SSL handshake fails.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Sn0rt commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "Sn0rt (via GitHub)" <gi...@apache.org>.
Sn0rt commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1647581938
> @shreemaan-abhishek Please let me know when this feature has been released, Thanks for your help
> @shreemaan-abhishek Please let me know when this feature has been released, Thanks for your help
hi can you test release 3.4 ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1655937307
@tao12345666333, does the ingress controller need any update?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1657006175
Is it on the roadmap?
On Fri, 28 Jul 2023 at 21:51, Jintao Zhang ***@***.***> wrote:
> Yes, ApisixTls don't have this skip_mtls_uri_regex field
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/apache/apisix/issues/9509#issuecomment-1655942661>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AOV6RSFOEJUCE3XAEPBBOSTXSPPPTANCNFSM6AAAAAAYG26Y4I>
> .
> You are receiving this because you were assigned.Message ID:
> ***@***.***>
>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anilaws commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "anilaws (via GitHub)" <gi...@apache.org>.
anilaws commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1566431223
@shreemaan-abhishek Please let me know when this feature has been released, Thanks for your help
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anilaws commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "anilaws (via GitHub)" <gi...@apache.org>.
anilaws commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1554647570
route has been created using the example from this doc - https://apisix.apache.org/docs/apisix/next/tutorials/client-to-apisix-mtls/
```
curl http://127.0.0.1:9180/apisix/admin/routes/1 \
-H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"uri": "/*",
"upstream": {
"nodes": {
"httpbin.org": 1
}
}
}'
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anilaws commented on issue #9509: help request: not able to bypass MTLS based on regular expression matching against URI
Posted by "anilaws (via GitHub)" <gi...@apache.org>.
anilaws commented on issue #9509:
URL: https://github.com/apache/apisix/issues/9509#issuecomment-1650800117
is there a way that i can achieve this using ingress controller?
Created below route using ingress controller
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
name: test-route
spec:
http:
- name: rule1
match:
paths:
- /test/*
upstreams:
- name: test-upstream
plugins:
- name: proxy-rewrite
enable: true
config:
regex_uri:
- "^/test(.*)"
- "/$1"
trying to create tls using ingress controller
apiVersion: apisix.apache.org/v2
kind: ApisixTls
metadata:
name: apiqa-tls
spec:
hosts:
- test.com
secret:
name: apiqa-server-secret
namespace: test
client:
caSecret:
name: apiqa-client-secret
namespace: test
depth: 10
skip_mtls_uri_regex:
- "/test.*"
getting error error validating data: ValidationError(ApisixTls.spec.client): unknown field "skip_mtls_uri_regex" in org.apache.apisix.v2.ApisixTls.spec.client
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org