tls: client ECDSA detection during ClientHello.

include/envoy/ssl/context_config.h

@@ -88,6 +88,11 @@ class ClientContextConfig : public virtual ContextConfig {
    * @return The maximum number of session keys to store.
    */
   virtual size_t maxSessionKeys() const PURE;
+
+  /**
+   * @return const std::string& with the signature algorithms for the context.
+   */
+  virtual const std::string& sigalgs() const PURE;
 };
 
 typedef std::unique_ptr<ClientContextConfig> ClientContextConfigPtr;

source/common/ssl/context_config_impl.cc

@@ -252,11 +252,12 @@ unsigned ContextConfigImpl::tlsVersionFromProto(
 }
 
 ClientContextConfigImpl::ClientContextConfigImpl(
-    const envoy::api::v2::auth::UpstreamTlsContext& config,
+    const envoy::api::v2::auth::UpstreamTlsContext& config, absl::string_view sigalgs,
     Server::Configuration::TransportSocketFactoryContext& factory_context)
     : ContextConfigImpl(config.common_tls_context(), factory_context),
       server_name_indication_(config.sni()), allow_renegotiation_(config.allow_renegotiation()),
-      max_session_keys_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, max_session_keys, 1)) {
+      max_session_keys_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, max_session_keys, 1)),
+      sigalgs_(sigalgs) {
   // BoringSSL treats this as a C string, so embedded NULL characters will not
   // be handled correctly.
   if (server_name_indication_.find('\0') != std::string::npos) {

source/common/ssl/context_config_impl.h

@@ -91,30 +91,36 @@ class ContextConfigImpl : public virtual Ssl::ContextConfig {
 
 class ClientContextConfigImpl : public ContextConfigImpl, public ClientContextConfig {
 public:
-  explicit ClientContextConfigImpl(
-      const envoy::api::v2::auth::UpstreamTlsContext& config,
+  ClientContextConfigImpl(
+      const envoy::api::v2::auth::UpstreamTlsContext& config, absl::string_view sigalgs,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context);
-  explicit ClientContextConfigImpl(
+  ClientContextConfigImpl(
+      const envoy::api::v2::auth::UpstreamTlsContext& config,
+      Server::Configuration::TransportSocketFactoryContext& secret_provider_context)
+      : ClientContextConfigImpl(config, "", secret_provider_context) {}
+  ClientContextConfigImpl(
       const Json::Object& config,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context);
 
   // Ssl::ClientContextConfig
   const std::string& serverNameIndication() const override { return server_name_indication_; }
   bool allowRenegotiation() const override { return allow_renegotiation_; }
   size_t maxSessionKeys() const override { return max_session_keys_; }
+  const std::string& sigalgs() const override { return sigalgs_; }
 
 private:
   const std::string server_name_indication_;
   const bool allow_renegotiation_;
   const size_t max_session_keys_;
+  const std::string sigalgs_;
 };
 
 class ServerContextConfigImpl : public ContextConfigImpl, public ServerContextConfig {
 public:
-  explicit ServerContextConfigImpl(
+  ServerContextConfigImpl(
       const envoy::api::v2::auth::DownstreamTlsContext& config,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context);
-  explicit ServerContextConfigImpl(
+  ServerContextConfigImpl(
       const Json::Object& config,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context);
 

source/common/ssl/context_impl.cc

@@ -25,7 +25,8 @@ namespace Envoy {
 namespace Ssl {
 
 ContextImpl::ContextImpl(Stats::Scope& scope, const ContextConfig& config, TimeSource& time_source)
-    : scope_(scope), stats_(generateStats(scope)), time_source_(time_source) {
+    : scope_(scope), stats_(generateStats(scope)), time_source_(time_source),
+      tls_max_version_(config.maxProtocolVersion()) {
   const auto tls_certificates = config.tlsCertificates();
   tls_contexts_.resize(std::max(1UL, tls_certificates.size()));
 
@@ -527,6 +528,13 @@ ClientContextImpl::ClientContextImpl(Stats::Scope& scope, const ClientContextCon
     }
   }
 
+  if (!config.sigalgs().empty()) {
+    for (auto& ctx : tls_contexts_) {
+      int rc = SSL_CTX_set1_sigalgs_list(ctx.ssl_ctx_.get(), config.sigalgs().c_str());
+      RELEASE_ASSERT(rc == 1, "");
+    }
+  }
+
   if (max_session_keys_ > 0) {
     SSL_CTX_set_session_cache_mode(tls_contexts_[0].ssl_ctx_.get(), SSL_SESS_CACHE_CLIENT);
     SSL_CTX_sess_set_new_cb(
@@ -812,11 +820,125 @@ int ServerContextImpl::sessionTicketProcess(SSL*, uint8_t* key_name, uint8_t* iv
   }
 }
 
+bool ServerContextImpl::isClientEcdsaCapable(const SSL_CLIENT_HELLO* ssl_client_hello) {
+  CBS client_hello;
+  CBS_init(&client_hello, ssl_client_hello->client_hello, ssl_client_hello->client_hello_len);
+
+  uint16_t client_version;
+  if (!CBS_get_u16(&client_hello, &client_version)) {
+    return false;
+  }
+
+  // This is the TLSv1.3 case (TLSv1.2 on the wire and the supported_versions extensions present).
+  // We just need to loook at signature algorithms.
+  if (client_version == TLS1_2_VERSION && tls_max_version_ == TLS1_3_VERSION) {
+    // If the supported_versions extension is found then we assume that the client is competent
+    // enough that just checking the signature_algorithms is sufficient.
+    const uint8_t* supported_versions_data;
+    size_t supported_versions_len;
+    if (SSL_early_callback_ctx_extension_get(ssl_client_hello, TLSEXT_TYPE_supported_versions,
+                                             &supported_versions_data, &supported_versions_len)) {
+      const uint8_t* signature_algorithms_data;
+      size_t signature_algorithms_len;
+      if (SSL_early_callback_ctx_extension_get(ssl_client_hello, TLSEXT_TYPE_signature_algorithms,
+                                               &signature_algorithms_data,
+                                               &signature_algorithms_len)) {
+        CBS signature_algorithms_ext, signature_algorithms;
+        CBS_init(&signature_algorithms_ext, signature_algorithms_data, signature_algorithms_len);
+        if (!CBS_get_u16_length_prefixed(&signature_algorithms_ext, &signature_algorithms) ||
+            CBS_len(&signature_algorithms_ext) != 0) {
+          return false;
+        }
+
+        while (CBS_len(&signature_algorithms) > 0) {
+          uint16_t sigalg;
+          if (!CBS_get_u16(&signature_algorithms, &sigalg)) {
+            return false;
+          }
+
+          if (sigalg == SSL_SIGN_ECDSA_SECP256R1_SHA256) {
+            return true;
+          }
+        }
+      }
+
+      return false;
+    }
+  }
+
+  // Otherwise we are < TLSv1.3 and need to look at both the curves in the supported_groups for
+  // ECDSA and also for a compatible cipher suite. https://tools.ietf.org/html/rfc4492#section-5.1.1
+  const uint8_t* curvelist_data;
+  size_t curvelist_len;
+  if (!SSL_early_callback_ctx_extension_get(ssl_client_hello, TLSEXT_TYPE_supported_groups,
+                                            &curvelist_data, &curvelist_len)) {
+    return false;
+  }
+
+  CBS curvelist;
+  CBS_init(&curvelist, curvelist_data, curvelist_len);
+
+  bool p256_ok = false;
+  while (CBS_len(&curvelist) > 0) {
+    uint16_t named_curve;
+    if (!CBS_get_u16(&curvelist, &named_curve)) {
+      return false;
+    }
+
+    if (named_curve == 23 /* secp256r1 */) {
+      p256_ok = true;
+      break;
+    }
+  }
+
+  if (!p256_ok) {
+    return false;
+  }
+
+  // The client must have offered an ECDSA ciphersuite that we like.
+  CBS cipher_suites;
+  CBS_init(&cipher_suites, ssl_client_hello->cipher_suites, ssl_client_hello->cipher_suites_len);
+
+  while (CBS_len(&cipher_suites) > 0) {
+    uint16_t cipher_id;
+    if (!CBS_get_u16(&cipher_suites, &cipher_id)) {
+      return false;
+    }
+
+    const SSL_CIPHER* c = SSL_get_cipher_by_value(cipher_id);
+    if (c == nullptr) {
+      continue;
+    }
+
+    // Skip TLS 1.2 only ciphersuites unless the client supports it.
+    if (SSL_CIPHER_get_min_version(c) > client_version) {
+      continue;
+    }
+
+    if (SSL_CIPHER_get_auth_nid(c) == NID_auth_ecdsa) {
+      // All tls_context_ share the same set of enabled ciphers, so we can just look at the base
+      // context.
+      if (tls_contexts_[0].isCipherEnabled(c)) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
 enum ssl_select_cert_result_t
 ServerContextImpl::selectTlsContext(const SSL_CLIENT_HELLO* ssl_client_hello) {
-  // This is currently a nop, since we only have a single cert, but this is where we will implement
-  // the certificate selection logic in #1319.
-  RELEASE_ASSERT(SSL_set_SSL_CTX(ssl_client_hello->ssl, tls_contexts_[0].ssl_ctx_.get()) != nullptr,
+  const bool client_ecdsa_capable = isClientEcdsaCapable(ssl_client_hello);
+  // Fallback on first certificate.
+  const TlsContext* selected_ctx = &tls_contexts_[0];
+  for (const auto& ctx : tls_contexts_) {
+    if (client_ecdsa_capable == ctx.is_ecdsa_) {
+      selected_ctx = &ctx;
+      break;
+    }
+  }
+  RELEASE_ASSERT(SSL_set_SSL_CTX(ssl_client_hello->ssl, selected_ctx->ssl_ctx_.get()) != nullptr,
                  "");
   return ssl_select_cert_success;
 }
@@ -866,5 +988,16 @@ void ServerContextImpl::TlsContext::addClientValidationContext(
   }
 }
 
+bool ServerContextImpl::TlsContext::isCipherEnabled(const SSL_CIPHER* cipher) {
+  STACK_OF(SSL_CIPHER)* our_ciphers = SSL_CTX_get_ciphers(ssl_ctx_.get());
+  for (size_t j = 0; j < sk_SSL_CIPHER_num(our_ciphers); j++) {
+    const SSL_CIPHER* our_c = sk_SSL_CIPHER_value(our_ciphers, j);
+    if (SSL_CIPHER_get_id(our_c) == SSL_CIPHER_get_id(cipher)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 } // namespace Ssl
 } // namespace Envoy

source/common/ssl/context_impl.h

@@ -135,6 +135,7 @@ class ContextImpl : public virtual Context {
     std::string getCertChainFileName() const { return cert_chain_file_path_; };
     void addClientValidationContext(const CertificateValidationContextConfig& config,
                                     bool require_client_cert);
+    bool isCipherEnabled(const SSL_CIPHER* cipher);
   };
 
   // This is always non-empty, with the first context used for all new SSL
@@ -154,6 +155,7 @@ class ContextImpl : public virtual Context {
   std::string ca_file_path_;
   std::string cert_chain_file_path_;
   TimeSource& time_source_;
+  const unsigned tls_max_version_;
 };
 
 typedef std::shared_ptr<ContextImpl> ContextImplSharedPtr;
@@ -186,6 +188,7 @@ class ServerContextImpl : public ContextImpl, public ServerContext {
                          unsigned int inlen);
   int sessionTicketProcess(SSL* ssl, uint8_t* key_name, uint8_t* iv, EVP_CIPHER_CTX* ctx,
                            HMAC_CTX* hmac_ctx, int encrypt);
+  bool isClientEcdsaCapable(const SSL_CLIENT_HELLO* ssl_client_hello);
   // Select the TLS certificate context in SSL_CTX_set_select_certificate_cb() callback with
   // ClientHello details.
   enum ssl_select_cert_result_t selectTlsContext(const SSL_CLIENT_HELLO* ssl_client_hello);

test/config/utility.cc

@@ -400,6 +400,11 @@ void ConfigHelper::initializeTls(bool ecdsa_cert,
       TestEnvironment::runfilesPath("test/config/integration/certs/cacert.pem"));
   validation_context->add_verify_certificate_hash(TEST_CLIENT_CERT_HASH);
 
+  // We'll negotiate up to TLSv1.3, but it really depends on what the client
+  // sets.
+  common_tls_context.mutable_tls_params()->set_tls_maximum_protocol_version(
+      envoy::api::v2::auth::TlsParameters::TLSv1_3);
+
   auto* tls_certificate = common_tls_context.add_tls_certificates();
   if (ecdsa_cert) {
     tls_certificate->mutable_certificate_chain()->set_filename(