tls: Add support for matching against OtherName SAN type

api/envoy/extensions/transport_sockets/tls/v3/common.proto

@@ -314,13 +314,29 @@ message SubjectAltNameMatcher {
     DNS = 2;
     URI = 3;
     IP_ADDRESS = 4;
+    OTHER_NAME = 5;
   }
 
   // Specification of type of SAN. Note that the default enum value is an invalid choice.
   SanType san_type = 1 [(validate.rules).enum = {defined_only: true not_in: 0}];
 
   // Matcher for SAN value.
+  //
+  // The string matching for OTHER_NAME SAN values depends on their ASN.1 type:
+  //
+  //          * OBJECT: Validated against its dotted numeric notation (e.g., "1.2.3.4")
+  //          * BOOLEAN: Validated against strings "true" or "false"
+  //          * INTEGER/ENUMERATED: Validated against a string containing the integer value
+  //          * NULL: Validated against an empty string
+  //          * Other types: Validated directly against the string value
   type.matcher.v3.StringMatcher matcher = 2 [(validate.rules).message = {required: true}];
+
+  // OID Value which is required if OTHER_NAME SAN type is used.
+  // For example, UPN OID is 1.3.6.1.4.1.311.20.2.3
+  // (Reference: http://oid-info.com/get/1.3.6.1.4.1.311.20.2.3).
+  //
+  // If set for SAN types other than OTHER_NAME, it will be ignored.
+  string oid = 3;
 }
 
 // [#next-free-field: 18]

changelogs/current.yaml

@@ -258,6 +258,12 @@ new_features:
   change: |
     Added :ref:`bypass_overload_manager <envoy_v3_api_field_config.listener.v3.Listener.bypass_overload_manager>`
     to bypass the overload manager for a listener. When set to true, the listener will not be subject to overload protection.
+- area: tls
+  change: |
+    added support to match against ``OtherName`` SAN Type under :ref:`match_typed_subject_alt_names
+    <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>`.
+    An additional field ``oid`` is added to :ref:`SubjectAltNameMatcher
+    <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.SubjectAltNameMatcher>` to support this change.
 
 deprecated:
 - area: tracing

source/common/ssl/certificate_validation_context_config_impl.cc

@@ -100,6 +100,7 @@ CertificateValidationContextConfigImpl::getSubjectAltNameMatchers(
   }
   // Handle deprecated string type san matchers without san type specified, by
   // creating a matcher for each supported type.
+  // Note: This does not handle otherName type
   for (const envoy::type::matcher::v3::StringMatcher& matcher : config.match_subject_alt_names()) {
     static constexpr std::array<
         envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SanType, 4>

source/common/tls/cert_validator/san_matcher.cc

@@ -18,6 +18,11 @@ bool StringSanMatcher::match(const GENERAL_NAME* general_name) const {
   if (general_name->type != general_name_type_) {
     return false;
   }
+  if (general_name->type == GEN_OTHERNAME) {
+    if (OBJ_cmp(general_name->d.otherName->type_id, general_name_oid_.get())) {
+      return false;
+    }
+  }
   // For DNS SAN, if the StringMatcher type is exact, we have to follow DNS matching semantics.
   const std::string san = Utility::generalNameAsString(general_name);
   return general_name->type == GEN_DNS &&
@@ -32,7 +37,7 @@ SanMatcherPtr createStringSanMatcher(
     Server::Configuration::CommonFactoryContext& context) {
   // Verify that a new san type has not been added.
   static_assert(envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SanType_MAX ==
-                4);
+                5);
 
   switch (matcher.san_type()) {
     PANIC_ON_PROTO_ENUM_SENTINEL_VALUES;
@@ -44,6 +49,15 @@ SanMatcherPtr createStringSanMatcher(
     return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher.matcher(), context)};
   case envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::IP_ADDRESS:
     return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_IPADD, matcher.matcher(), context)};
+  case envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::OTHER_NAME: {
+    // Invalid/Empty OID returns a nullptr from OBJ_txt2obj
+    bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj(matcher.oid().c_str(), 0));
+    if (oid == nullptr) {
+      return nullptr;
+    }
+    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher.matcher(),
+                                                            context, std::move(oid))};
+  }
   case envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SAN_TYPE_UNSPECIFIED:
     PANIC("unhandled value");
   }

source/common/tls/cert_validator/san_matcher.h

@@ -35,12 +35,15 @@ class StringSanMatcher : public SanMatcher {
   bool match(const GENERAL_NAME* general_name) const override;
   ~StringSanMatcher() override = default;
   StringSanMatcher(int general_name_type, envoy::type::matcher::v3::StringMatcher matcher,
-                   Server::Configuration::CommonFactoryContext& context)
-      : general_name_type_(general_name_type), matcher_(matcher, context) {}
+                   Server::Configuration::CommonFactoryContext& context,
+                   bssl::UniquePtr<ASN1_OBJECT>&& general_name_oid = nullptr)
+      : general_name_type_(general_name_type), matcher_(matcher, context),
+        general_name_oid_(std::move(general_name_oid)) {}
 
 private:
   const int general_name_type_;
   const Matchers::StringMatcherImpl<envoy::type::matcher::v3::StringMatcher> matcher_;
+  bssl::UniquePtr<ASN1_OBJECT> general_name_oid_;
 };
 
 SanMatcherPtr createStringSanMatcher(

source/common/tls/utility.cc

@@ -226,6 +226,36 @@ std::string Utility::generalNameAsString(const GENERAL_NAME* general_name) {
     }
     break;
   }
+  case GEN_OTHERNAME:
+    ASN1_TYPE* value = general_name->d.otherName->value;
+    if (value == nullptr) {
+      break;
+    }
+    switch (value->type) {
+    case V_ASN1_NULL:
+      break;
+    case V_ASN1_BOOLEAN:
+      san = value->value.boolean ? "true" : "false";
+      break;
+    case V_ASN1_ENUMERATED:
+      san = std::to_string(ASN1_ENUMERATED_get(value->value.enumerated));
+      break;
+    case V_ASN1_INTEGER:
+      san = std::to_string(ASN1_INTEGER_get(value->value.integer));
+      break;
+    case V_ASN1_OBJECT: {
+      char tmp_obj[256]; // OID Max length
+      if (OBJ_obj2txt(tmp_obj, 256, value->value.object, 1) < 0) {
+        break;
+      }
+      san.assign(tmp_obj);
+      break;
+    }
+    default:
+      str = value->value.asn1_string;
+      san.assign(reinterpret_cast<const char*>(ASN1_STRING_data(str)), ASN1_STRING_length(str));
+      break;
+    }
   }
   return san;
 }

test/common/tls/cert_validator/default_validator_test.cc

@@ -47,6 +47,134 @@ TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameDNSMatched) {
   EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
 }
 
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameOtherNameMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example.com)raw"));
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.4.1.311.20.2.3", 0));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameOtherNameBooleanTypeMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_multiple_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.5.5.7.8.7", 0));
+  matcher.MergeFrom(TestUtility::createExactMatcher("true"));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameOtherNameEnumeratedTypeMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_multiple_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.4.1.311.20.2.1", 0));
+  matcher.MergeFrom(TestUtility::createExactMatcher("5"));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameOtherNameIntegerTypeMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_multiple_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.5.5.7.8.3", 0));
+  matcher.MergeFrom(TestUtility::createExactMatcher("5464"));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameOtherNameObjectTypeMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_multiple_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.5.2.2", 0));
+  matcher.MergeFrom(TestUtility::createExactMatcher("1.3.6.1.4.1.311.20.2.3"));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameOtherNameNullTypeMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_multiple_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.4.1.311.20.2.3", 0));
+  matcher.MergeFrom(TestUtility::createExactMatcher(""));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameDnsAndOtherNameMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_dns_and_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example.com)raw"));
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.4.1.311.20.2.3", 0));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher, context)});
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameOtherNameIncorrectOidMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example.com)raw"));
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.4.1.311.20.2.2", 0));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_FALSE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
+TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameOtherNameIncorrectValueMatched) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
+  bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
+      "{{ test_rundir }}/test/common/tls/test_data/san_othername_cert.pem"));
+  envoy::type::matcher::v3::StringMatcher matcher;
+  matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example.net)raw"));
+  bssl::UniquePtr<ASN1_OBJECT> oid(OBJ_txt2obj("1.3.6.1.4.1.311.20.2.3", 0));
+  std::vector<SanMatcherPtr> subject_alt_name_matchers;
+  subject_alt_name_matchers.push_back(SanMatcherPtr{
+      std::make_unique<StringSanMatcher>(GEN_OTHERNAME, matcher, context, std::move(oid))});
+  EXPECT_FALSE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
+}
+
 TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameIncorrectTypeMatched) {
   NiceMock<Server::Configuration::MockServerFactoryContext> context;
 

test/common/tls/cert_validator/san_matcher_test.cc

@@ -30,6 +30,10 @@ TEST(SanMatcherConfigTest, TestValidSanType) {
     envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher san_matcher;
     san_matcher.mutable_matcher()->set_exact("foo.example");
     san_matcher.set_san_type(san_type);
+    if (san_type ==
+        envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::OTHER_NAME) {
+      san_matcher.set_oid("1.3.6.1.4.1.311.20.2.3"); // Set dummy OID
+    }
     if (san_type == envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::
                         SAN_TYPE_UNSPECIFIED) {
       EXPECT_DEATH(createStringSanMatcher(san_matcher, context), "unhandled value");
@@ -42,6 +46,17 @@ TEST(SanMatcherConfigTest, TestValidSanType) {
   }
 }
 
+// Verify that setting Invalid OID for OtherName SAN results in a panic.
+TEST(SanMatcherConfigTest, TestInvalidOidOtherNameSanType) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+  envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher san_matcher;
+  san_matcher.mutable_matcher()->set_exact("foo.example");
+  san_matcher.set_oid("1.3.6.1.4.1.311.20.2.ffff");
+  san_matcher.set_san_type(
+      envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::OTHER_NAME);
+  EXPECT_EQ(createStringSanMatcher(san_matcher, context), nullptr);
+}
+
 TEST(SanMatcherConfigTest, UnspecifiedSanType) {
   NiceMock<Server::Configuration::MockServerFactoryContext> context;
   envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher san_matcher;

test/common/tls/test_data/README.md

@@ -29,6 +29,12 @@ There are 15 identities:
 - **SAN With URI**: It has the certificate *san_uri_cert.pem*, which is signed
   by the **CA** using the config *san_uri_cert.cfg*. The certificate has SAN
   field of URI type. *san_uri_key.pem* is its private key.
+- **SAN With OtherName**: It has the certificate *san_othername_cert.pem*, which is signed
+  by the **CA** using the config *san_othername_cert.cfg*. The certificate has SAN
+  field of OtherName(UPN) type. *san_othername_key.pem* is its private key.
+- **SAN With OtherName and DNS**: It has the certificate *san_othername_cert.pem*, which is signed
+  by the **CA** using the config *san_dns_and_othername_cert.cfg*. The certificate has two SAN
+  fields, one DNS and one OtherName(UPN) type. *san_dns_and_othername_key.pem* is its private key.
 - **Password-protected**: The password-protected certificate *password_protected_cert.pem*,
   using the config *san_uri_cert.cfg*. *password_protected_key.pem* is
   its private key encrypted using the password supplied in *password_protected_password.txt*.

test/common/tls/test_data/certs.sh

@@ -234,6 +234,18 @@ generate_x509_cert san_uri ca
 generate_rsa_key san_ip
 generate_x509_cert san_ip ca
 
+# Generate san_othername_cert.pem.
+generate_rsa_key san_othername
+generate_x509_cert san_othername ca
+
+# Generate san_dns_and_othername_cert.pem.
+generate_rsa_key san_multiple_othername
+generate_x509_cert san_multiple_othername ca
+
+# Generate san_dns_and_othername_cert.pem.
+generate_rsa_key san_dns_and_othername
+generate_x509_cert san_dns_and_othername ca
+
 # Concatenate san_ip_cert.pem and Test Intermediate CA (intermediate_ca_cert.pem) to create valid certificate chain.
 cat san_ip_cert.pem intermediate_ca_cert.pem > san_ip_chain.pem
 

test/common/tls/test_data/san_dns_and_othername_cert.cfg

@@ -0,0 +1,37 @@
+[req]
+distinguished_name = req_distinguished_name
+req_extensions = v3_req
+
+[req_distinguished_name]
+countryName = US
+countryName_default = US
+stateOrProvinceName = California
+stateOrProvinceName_default = California
+localityName = San Francisco
+localityName_default = San Francisco
+organizationName = Lyft
+organizationName_default = Lyft
+organizationalUnitName = Lyft Engineering
+organizationalUnitName_default = Lyft Engineering
+commonName = Test Server
+commonName_default = Test Server
+commonName_max  = 64
+
+[v3_req]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage = clientAuth, serverAuth
+subjectAltName = @alt_names
+subjectKeyIdentifier = hash
+
+[v3_ca]
+basicConstraints = critical, CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage = clientAuth, serverAuth
+subjectAltName = @alt_names
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
+
+[alt_names]
+DNS.1 = server1.example.com
+otherName.1 = 1.3.6.1.4.1.311.20.2.3;UTF8:server1.example.com