[release-4.13] OCPBUGS-86710: Strip X-SSL-* headers for plain HTTP by MrSanketkumar · Pull Request #808 · openshift/router

MrSanketkumar · 2026-06-29T18:04:21Z

Vulnerability: CVE-2026-46579 - mTLS client certificate spoofing via HTTP header injection

Fix: Prevents unauthenticated spoofing of mutual TLS client identities by stripping X-SSL-Client-* headers from HTTP requests before they reach backends.

Changes:

Adds `ROUTER_MUTUAL_TLS_HEADER_FILTER` environment variable (default: `true`)
Strips all 12 X-SSL headers in HTTP frontends: `public`, `fe_sni`, `fe_no_sni`
Secure by default - header stripping enabled unless explicitly disabled

Backport of : #807

Summary by CodeRabbit

Bug Fixes
- Improved security by removing client certificate identity headers from requests when mutual TLS is not in use.
- Applied this protection across plain HTTP and TLS-based routes to reduce the risk of header spoofing.

openshift-ci-robot · 2026-06-29T18:04:28Z

@MrSanketkumar: This pull request references Jira Issue OCPBUGS-86710, which is invalid:

expected dependent Jira Issue OCPBUGS-86711 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Vulnerability: CVE-2026-46579 - mTLS client certificate spoofing via HTTP header injection

Fix: Prevents unauthenticated spoofing of mutual TLS client identities by stripping X-SSL-Client-* headers from HTTP requests before they reach backends.

Changes:

Adds `ROUTER_MUTUAL_TLS_HEADER_FILTER` environment variable (default: `true`)

Strips all 12 X-SSL headers in HTTP frontends: `public`, `fe_sni`, `fe_no_sni`

Secure by default - header stripping enabled unless explicitly disabled

Backport of : #807

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-06-29T18:04:29Z

Walkthrough

The HAProxy config template adds http-request del-header rules for X-SSL and related X-SSL-Client-*/X-SSL-Issuer headers in the plain HTTP, TLS SNI, and TLS non-SNI frontends. Each block is guarded by ROUTER_MUTUAL_TLS_HEADER_FILTER (defaulting to true).

Changes

mTLS Header Stripping

Layer / File(s)	Summary
X-SSL header deletion across all three frontends `images/router/haproxy/conf/haproxy-config.template`	Adds identical `ROUTER_MUTUAL_TLS_HEADER_FILTER`-guarded `http-request del-header` blocks to the plain HTTP (line 228), TLS SNI (line 341), and TLS non-SNI (line 453) frontends, stripping `X-SSL` and all `X-SSL-Client-*`/`X-SSL-Issuer` headers.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: stripping X-SSL-* headers from plain HTTP requests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes the HAProxy template; no Ginkgo specs or *_test.go files were added or modified, so no unstable test titles are present.
Test Structure And Quality	✅ Passed	PR only changes the HAProxy config template; no Ginkgo test code or cluster tests were added, so this checklist doesn’t apply.
Microshift Test Compatibility	✅ Passed	This PR only updates the HAProxy template; no new Ginkgo tests or MicroShift-unsupported APIs/features are added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The PR only modifies an HAProxy template; no .go/.feature test files or Ginkgo constructs were added, so SNO test compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The change only updates HAProxy header-stripping logic in a config template; no deployment manifests, controllers, or scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	Only the HAProxy config template changed; no main/init/TestMain/setup stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR only updates an HAProxy config template; no new Ginkgo e2e tests or test dirs were added, so this compatibility check is not applicable.
No-Weak-Crypto	✅ Passed	Only header-stripping logic was added; no new weak ciphers, custom crypto, or secret comparisons were introduced.
Container-Privileges	✅ Passed	Changed files only adjust HAProxy template/CI Dockerfiles; no privileged, hostNetwork, or allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	The patch only strips X-SSL headers; it adds no new logging or capture paths that would expose sensitive data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

MrSanketkumar · 2026-06-29T18:07:21Z

@coderabbitai review

coderabbitai · 2026-06-29T18:07:28Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@images/router/haproxy/conf/haproxy-config.template`:
- Around line 228-243: The mutual-TLS header stripping in the
haproxy-config.template blocks is only enabled when isTrue(env(..., "true"))
evaluates true, which can silently disable the mitigation for malformed
non-empty values. Update the ROUTER_MUTUAL_TLS_HEADER_FILTER check so the filter
stays enabled by default unless the variable is explicitly set to a recognized
false value, and reuse the same logic in the other matching header-filter
sections to keep behavior consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8a255777-f969-4646-a1b0-fe7515d3114b

📥 Commits

Reviewing files that changed from the base of the PR and between 1ee499a and e9972b3.

📒 Files selected for processing (1)

images/router/haproxy/conf/haproxy-config.template

coderabbitai · 2026-06-29T18:11:30Z

+  # Strip off X-SSL* headers for plain HTTP if not explicitly disabled.
+  # This prevents unauthenticated spoofing of mutual TLS client identities.
+  {{- if isTrue (env "ROUTER_MUTUAL_TLS_HEADER_FILTER" "true") }}
+  http-request del-header X-SSL
+  http-request del-header X-SSL-Client-CN
+  http-request del-header X-SSL-Client-DER
+  http-request del-header X-SSL-Client-DN
+  http-request del-header X-SSL-Client-NotAfter
+  http-request del-header X-SSL-Client-NotBefore
+  http-request del-header X-SSL-Client-SHA1
+  http-request del-header X-SSL-Client-Serial
+  http-request del-header X-SSL-Client-Subject
+  http-request del-header X-SSL-Client-Verify
+  http-request del-header X-SSL-Client-Version
+  http-request del-header X-SSL-Issuer
+  {{- end }}


🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Keep the filter enabled on malformed env values.

isTrue(env(..., "true")) is only secure-by-default when the variable is unset. If ROUTER_MUTUAL_TLS_HEADER_FILTER is set to any non-empty typo, env() returns that value and isTrue() falls back to false, which silently disables the CVE mitigation without an explicit opt-out.

Suggested fix

- {{- if isTrue (env "ROUTER_MUTUAL_TLS_HEADER_FILTER" "true") }} + {{- $mtlsHeaderFilter := firstMatch "(?i:true|false)" (env "ROUTER_MUTUAL_TLS_HEADER_FILTER") "true" }} + {{- if isTrue $mtlsHeaderFilter }}

Also applies to: 341-357, 453-469

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@images/router/haproxy/conf/haproxy-config.template` around lines 228 - 243, The mutual-TLS header stripping in the haproxy-config.template blocks is only enabled when isTrue(env(..., "true")) evaluates true, which can silently disable the mitigation for malformed non-empty values. Update the ROUTER_MUTUAL_TLS_HEADER_FILTER check so the filter stays enabled by default unless the variable is explicitly set to a recognized false value, and reuse the same logic in the other matching header-filter sections to keep behavior consistent.

MrSanketkumar · 2026-06-30T04:10:19Z

/test e2e-aws-serial

MrSanketkumar · 2026-06-30T08:39:14Z

/test e2e-aws-serial

MrSanketkumar · 2026-07-01T13:44:31Z

/test e2e-aws-serial

MrSanketkumar · 2026-07-01T17:01:09Z

/retest-required

Miciah · 2026-07-07T15:23:29Z

This is a clean cherry-pick of #807.

/approve
/lgtm

This is a medium-risk backport. The assessment for the release-4.21 backport #795 (comment) applies equally to the release-4.13 backport.

/label backport-risk-assessed

openshift-ci · 2026-07-07T15:27:32Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

UdayYendva · 2026-07-08T07:22:25Z

I’ve created a cluster using the PR that includes the merged fix from PR #808. The corresponding ClusterVersion is: 4.13.0-0-2026-07-08-062155-test-ci-ln-483dc62-latest

oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.13.0-0-2026-07-08-062155-test-ci-ln-483dc62-latest   True        False         10m     Cluster version is 4.13.0-0-2026-07-08-062155-test-ci-ln-483dc62-latest
Now using project "openshift-ingress" on server "https://api.ci-ln-nx25ys2-76ef8.aws-4.ci.openshift.org:6443".
oc get pods
NAME                              READY   STATUS    RESTARTS   AGE
router-default-7b9fc4548b-mzbfq   1/1     Running   0          27m
router-default-7b9fc4548b-q54bs   1/1     Running   0          27m

After inspecting one of the pods, I confirmed that the latest changes from the PR are present in the Router , SNI and NO SNI code paths, Therefore succesfully indicating that the fix has been successfully deployed
These are the changes from the PR are correctly reflected in the running ingress/router pods.

oc rsh pods/router-default-7b9fc4548b-mzbfq
sh-5.1$ cat haproxy
haproxy-config.template  haproxy.config           
sh-5.1$ cat haproxy-config.template

These are the same changes that were introduced in #808

  # Strip off X-SSL* headers for plain HTTP if not explicitly disabled.
  # This prevents unauthenticated spoofing of mutual TLS client identities.
  {{- if isTrue (env "ROUTER_MUTUAL_TLS_HEADER_FILTER" "true") }}
  http-request del-header X-SSL
  http-request del-header X-SSL-Client-CN
  http-request del-header X-SSL-Client-DER
  http-request del-header X-SSL-Client-DN
  http-request del-header X-SSL-Client-NotAfter
  http-request del-header X-SSL-Client-NotBefore
  http-request del-header X-SSL-Client-SHA1
  http-request del-header X-SSL-Client-Serial
  http-request del-header X-SSL-Client-Subject
  http-request del-header X-SSL-Client-Verify
  http-request del-header X-SSL-Client-Version
  http-request del-header X-SSL-Issuer
  {{- end }}

/Verified by ci

openshift-ci-robot · 2026-07-08T07:22:37Z

@UdayYendva: This PR has been marked as verified by ci.

Details

In response to this:

I’ve created a cluster using the PR that includes the merged fix from PR #808. The corresponding ClusterVersion is: 4.13.0-0-2026-07-08-062155-test-ci-ln-483dc62-latest
oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.13.0-0-2026-07-08-062155-test-ci-ln-483dc62-latest   True        False         10m     Cluster version is 4.13.0-0-2026-07-08-062155-test-ci-ln-483dc62-latest
Now using project "openshift-ingress" on server "https://api.ci-ln-nx25ys2-76ef8.aws-4.ci.openshift.org:6443".
oc get pods
NAME                              READY   STATUS    RESTARTS   AGE
router-default-7b9fc4548b-mzbfq   1/1     Running   0          27m
router-default-7b9fc4548b-q54bs   1/1     Running   0          27m
After inspecting one of the pods, I confirmed that the latest changes from the PR are present in the Router , SNI and NO SNI code paths, Therefore succesfully indicating that the fix has been successfully deployed
These are the changes from the PR are correctly reflected in the running ingress/router pods.
oc rsh pods/router-default-7b9fc4548b-mzbfq
sh-5.1$ cat haproxy
haproxy-config.template  haproxy.config           
sh-5.1$ cat haproxy-config.template 
These are the same changes that were introduced in #808

  # Strip off X-SSL* headers for plain HTTP if not explicitly disabled.
  # This prevents unauthenticated spoofing of mutual TLS client identities.
  {{- if isTrue (env "ROUTER_MUTUAL_TLS_HEADER_FILTER" "true") }}
  http-request del-header X-SSL
  http-request del-header X-SSL-Client-CN
  http-request del-header X-SSL-Client-DER
  http-request del-header X-SSL-Client-DN
  http-request del-header X-SSL-Client-NotAfter
  http-request del-header X-SSL-Client-NotBefore
  http-request del-header X-SSL-Client-SHA1
  http-request del-header X-SSL-Client-Serial
  http-request del-header X-SSL-Client-Subject
  http-request del-header X-SSL-Client-Verify
  http-request del-header X-SSL-Client-Version
  http-request del-header X-SSL-Issuer
  {{- end }}

/Verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

MrSanketkumar · 2026-07-10T05:27:56Z

/test e2e-aws-serial

MrSanketkumar · 2026-07-10T20:14:44Z

/retest-required

MrSanketkumar · 2026-07-11T17:32:13Z

/test e2e-aws-serial

openshift-ci · 2026-07-11T21:03:32Z

@MrSanketkumar: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-serial	`e9972b3`	link	true	`/test e2e-aws-serial`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

OCPBUGS-86710: Strip X-SSL-* headers for plain HTTP

e9972b3

MrSanketkumar mentioned this pull request Jun 29, 2026

[release-4.12] OCPBUGS-86709: Strip X-SSL-* headers for plain HTTP #809

Open

openshift-ci Bot requested review from Miciah and knobunc June 29, 2026 18:06

coderabbitai Bot reviewed Jun 29, 2026

View reviewed changes

MrSanketkumar mentioned this pull request Jul 1, 2026

[release-4.13] OCPBUGS-86710: Add configuration override for X-SSL strip openshift/cluster-ingress-operator#1493

Open

openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jul 7, 2026

openshift-ci Bot assigned melvinjoseph86, rhamini3 and Miciah Jul 7, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 7, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 7, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 8, 2026

Uh oh!

Conversation

MrSanketkumar commented Jun 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jun 29, 2026

Uh oh!

coderabbitai Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

MrSanketkumar commented Jun 29, 2026

Uh oh!

coderabbitai Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

MrSanketkumar commented Jun 30, 2026

Uh oh!

MrSanketkumar commented Jun 30, 2026

Uh oh!

MrSanketkumar commented Jul 1, 2026

Uh oh!

MrSanketkumar commented Jul 1, 2026

Uh oh!

Miciah commented Jul 7, 2026

Uh oh!

openshift-ci Bot commented Jul 7, 2026

Uh oh!

UdayYendva commented Jul 8, 2026

Uh oh!

openshift-ci-robot commented Jul 8, 2026

Uh oh!

MrSanketkumar commented Jul 10, 2026

Uh oh!

MrSanketkumar commented Jul 10, 2026

Uh oh!

MrSanketkumar commented Jul 11, 2026

Uh oh!

openshift-ci Bot commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

MrSanketkumar commented Jun 29, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading