Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature untrusted client certs #8248

Closed
wants to merge 20 commits into from
Closed

Feature untrusted client certs #8248

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
76db27e
Merge untrusted-client-cert support from previous PR#6760
Sep 16, 2019
fa49263
cert.proto doco update
Sep 16, 2019
ac64de9
Formatting corrections
owlbreeze Sep 17, 2019
7183a27
Fixed conn_manager_utility_test
owlbreeze Sep 17, 2019
b46e68f
Corrected spelling
owlbreeze Sep 18, 2019
651c486
Updated certificate_validation_context_config BUILD deps
owlbreeze Sep 18, 2019
068a96d
Corrected spelling
owlbreeze Sep 18, 2019
a2af86a
Added x-forwarded-untrusted-client-cert acronym XFUCC to tools/spelli…
owlbreeze Sep 18, 2019
38aa67c
Description tidy-up from code review
owlbreeze Sep 18, 2019
0b5d7f6
Rename verify_certificate_trust_chain to trust_chain_verification
owlbreeze Sep 18, 2019
701083e
Fixed formatting
owlbreeze Sep 18, 2019
8930a36
Added ssl_socket_test scenarios for trust_chain_verification modes
owlbreeze Sep 24, 2019
5d33098
Merge branch 'master' of https://github.com/jimini-lumox/envoy into f…
owlbreeze Oct 19, 2019
f5b063c
Merge branch 'master' of https://github.com/jimini-lumox/envoy into f…
owlbreeze Oct 20, 2019
28222fc
Changing routing based on client 'validated' checks to use new TlsCon…
owlbreeze Oct 28, 2019
2f197ad
Removed 'x-forwarded-untrusted-client-cert' unit-test
owlbreeze Oct 28, 2019
ec67893
Fix format
owlbreeze Oct 28, 2019
2f6a793
Merged master
owlbreeze Oct 29, 2019
1bf38c1
Add router tlscontextmatch test for 'validated' configuration
owlbreeze Nov 4, 2019
d1e9b83
Fix TlsContextMatch unit-test
owlbreeze Nov 5, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions api/envoy/api/v2/auth/cert.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,21 @@ message TlsSessionTicketKeys {
}

message CertificateValidationContext {

// Peer certificate verification mode.
enum TrustChainVerification {
// Perform default certificate verification (e.g., against CA / verification lists)
VERIFY_TRUST_CHAIN = 0;
// Connections where the certificate fails verification will be permitted.
// For HTTP connections, the certificate details will be unconditionally placed in the
// *x-forwarded-untrusted-client-cert* HTTP header.
ACCEPT_UNTRUSTED = 1;
// Connections will be permitted without certificate verification performed.
// For HTTP connections, the certificate details will be unconditionally placed in the
// *x-forwarded-untrusted-client-cert* HTTP header.
NOT_VERIFIED = 2;
}

// TLS certificate data containing certificate authority certificates to use in verifying
// a presented peer certificate (e.g. server certificate for clusters or client certificate
// for listeners). If not specified and a peer certificate is presented it will not be
Expand Down Expand Up @@ -279,6 +294,9 @@ message CertificateValidationContext {

// If specified, Envoy will not reject expired certificates.
bool allow_expired_certificate = 8;

// Certificate trust chain verification mode.
jimini-lumox marked this conversation as resolved.
Show resolved Hide resolved
TrustChainVerification trust_chain_verification = 9 [(validate.rules).enum.defined_only = true];
}

// TLS context shared by both client and server TLS contexts.
Expand Down
1 change: 1 addition & 0 deletions include/envoy/http/header_map.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,7 @@ class HeaderEntry {
HEADER_FUNC(Etag) \
HEADER_FUNC(Expect) \
HEADER_FUNC(ForwardedClientCert) \
HEADER_FUNC(ForwardedUntrustedClientCert) \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really want a new header field for untrusted client certificates? Can we just add Trusted=False in XFCC header to indicate that?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We had initially implemented this way, however had concerns over the potential for existing code to treat ForwardedClientCert as having passed validation.
An example of the routing we perform is as follows: - route to the intended service, iff have x-forwarded-client-cert header. (I guess a 'safe-regex_match' could alternatively be used to route based on 'Trusted=False/True'

"routes": [
{
"match": { "prefix": "/", "headers": [
{ "name": "x-forwarded-untrusted-client-cert", "present_match": true }
] },
"route": {
"cluster": "venue-edge-access-control",
"prefix_rewrite": "/api/cert/untrusted",
"host_rewrite": "venue-edge-access-control"
}
},
{
"match": { "prefix": "/", "headers": [
{ "name": "x-forwarded-client-cert", "present_match": true, "invert_match" : true }
] },
"route": {
"cluster": "venue-edge-access-control",
"prefix_rewrite": "/api/cert/untrusted",
"host_rewrite": "venue-edge-access-control"
}
},
{
"match": { "prefix": "/", "headers": [
{ "name": "x-forwarded-client-cert", "present_match": true },
{ "name": ":authority", "prefix_match": "service-actual-target-service" }
] },
"route": {
"cluster": "service-actual-target-service"
}
},
....

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@PiotrSikora thoughts on these headers and what other proxies might do.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jimini-lumox I see what your example try to address. Does it make more sense to have a route matcher based on presented client cert semantically rather than relying on XFCC/XFUCC header? Adding header and route matching can be orthogonal.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure I understand exactly, or how to achieve it using the route matcher. Below is a comment on our usage from the first cut of the PR (#5207). Do you know how we would use route matching to handle the scenarios (maybe it's easy, I'm not sure)

We use Envoy as an Edge Proxy to host services, with thousands of devices in venues on a private network.
We're using the Hash List as validation of clients, which will initially be empty ie - nothing to validate against.
Client Certs are currently self-signed (no PKI infrastructure available) - so there is nothing within the certificate to validate against.
If a client connects and its Cert Hash is in the list, it will be routed to its intended target service.
(eg: x-forwarded-client-cert header present & :authority header match)
If a client connects and its Cert Hash is not in the list (or there is no validation context yet), then it may be routed to an access-control-service.
(eg: x-forwarded-untrusted-client-cert header present & :authority header match)
Then the access-control-service controls whether a client is to be permitted, in which case the client hash will be added to the verify_certificate_hash list (using dynamic_resources from the Edge Proxy, so subsequent request is routed to the intended service).
Additionally we may not care if a client needs to be validated to reach certain other host services.

Copy link
Contributor Author

@jimini-lumox jimini-lumox Sep 25, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RouteMatch only uses http headers, so if I'm following you correctly:

  • always hoist headers into x-forwarded-client-cert (instead of using x-forwarded-untrusted-client-cert for either failed or unvalidated)
  • and,
    either add a field to the x-forwarded-client-cert to indicated that it passed/failed validation (eg Trusted=false)
    or add another http header that simply indicates whether the client was validated, so we can route based on this.
  • and then add a new RouteMatch field that can simplify the route matching rules for validation, eg something like:
  message RouteMatch {
    message CredentialMatchOptions {
        google.protobuf.BoolValue validated = 1;
        // can add further matches here - eg Issuer,Hash etc.
    }
    ...
    CredentialMatchOptions credentials = 11;
  }

then the matching would simplify to:

"routes": [
  {
    "match": { "prefix": "/", "credentials": { "validated": false } },
    "route": {
      "cluster": "venue-edge-access-control",
      ...
    }
  },
  {
    "match": { "prefix": "/", "credentials": { "validated": true },
               "headers": [ { "name": ":authority", "prefix_match": "service-actual-target-service" }
               ]
    },
    "route": {
      "cluster": "service-actual-target-service"
    }
  }
...

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The config example looks right, I think we should open another issue for this API proposal.

RouteMatch only uses http headers

This is how current implementation does but not a hard limitation. You can use the cert information directly from downstream connection and plumb it into RouteMatcher.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, so should I create a new PR that has this API proposal including the changes to route the required connection info through to the Route matching.
I was thinking that we could provide the StreamInfo through the route matching from which we can get the downstreamSslConnection info etc.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking that we could provide the StreamInfo through the route matching from which we can get the downstreamSslConnection info etc.

Exactly.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've raised PR #8453 with an initial cut of passing the connection stream_info through to the route matching.

HEADER_FUNC(ForwardedFor) \
HEADER_FUNC(ForwardedProto) \
HEADER_FUNC(GrpcAcceptEncoding) \
Expand Down
3 changes: 3 additions & 0 deletions include/envoy/ssl/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,4 +56,7 @@ envoy_cc_library(
envoy_cc_library(
name = "certificate_validation_context_config_interface",
hdrs = ["certificate_validation_context_config.h"],
deps = [
"@envoy_api//envoy/api/v2/auth:cert_cc",
],
)
7 changes: 7 additions & 0 deletions include/envoy/ssl/certificate_validation_context_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
#include <string>
#include <vector>

#include "envoy/api/v2/auth/cert.pb.h"
#include "envoy/common/pure.h"

namespace Envoy {
Expand Down Expand Up @@ -54,6 +55,12 @@ class CertificateValidationContextConfig {
* @return whether to ignore expired certificates (both too new and too old).
*/
virtual bool allowExpiredCertificate() const PURE;

/**
* @return client certificate validation configuration.
*/
virtual envoy::api::v2::auth::CertificateValidationContext_TrustChainVerification
trustChainVerification() const PURE;
};

using CertificateValidationContextConfigPtr = std::unique_ptr<CertificateValidationContextConfig>;
Expand Down
5 changes: 5 additions & 0 deletions include/envoy/ssl/connection.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,11 @@ class ConnectionInfo {
**/
virtual bool peerCertificatePresented() const PURE;

/**
* @return bool whether the peer certificate was validated.
**/
virtual bool peerCertificateValidated() const PURE;

/**
* @return std::string the URIs in the SAN field of the local certificate. Returns {} if there is
* no local certificate, or no SAN field, or no URI.
Expand Down
18 changes: 14 additions & 4 deletions source/common/http/conn_manager_utility.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,10 +291,11 @@ void ConnectionManagerUtility::mutateXfccRequestHeader(HeaderMap& request_header
if (config.forwardClientCert() == ForwardClientCertType::AlwaysForwardOnly) {
return;
}
// When Sanitize is set, or the connection is not mutual TLS, remove the XFCC header.
// When Sanitize is set, or the connection is not mutual TLS, remove the XFCC/XFUCC header.
if (config.forwardClientCert() == ForwardClientCertType::Sanitize ||
!(connection.ssl() && connection.ssl()->peerCertificatePresented())) {
request_headers.removeForwardedClientCert();
request_headers.removeForwardedUntrustedClientCert();
return;
}

Expand Down Expand Up @@ -362,10 +363,19 @@ void ConnectionManagerUtility::mutateXfccRequestHeader(HeaderMap& request_header

const std::string client_cert_details_str = absl::StrJoin(client_cert_details, ";");
if (config.forwardClientCert() == ForwardClientCertType::AppendForward) {
HeaderMapImpl::appendToHeader(request_headers.insertForwardedClientCert().value(),
client_cert_details_str);
HeaderMapImpl::appendToHeader(
connection.ssl()->peerCertificateValidated()
? request_headers.insertForwardedClientCert().value()
: request_headers.insertForwardedUntrustedClientCert().value(),
client_cert_details_str);
} else if (config.forwardClientCert() == ForwardClientCertType::SanitizeSet) {
request_headers.insertForwardedClientCert().value(client_cert_details_str);
if (connection.ssl()->peerCertificateValidated()) {
request_headers.insertForwardedClientCert().value(client_cert_details_str);
request_headers.removeForwardedUntrustedClientCert();
} else {
request_headers.removeForwardedClientCert();
request_headers.insertForwardedUntrustedClientCert().value(client_cert_details_str);
}
} else {
NOT_REACHED_GCOVR_EXCL_LINE;
}
Expand Down
1 change: 1 addition & 0 deletions source/common/http/headers.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,7 @@ class HeaderValues {
const LowerCaseString Etag{"etag"};
const LowerCaseString Expect{"expect"};
const LowerCaseString ForwardedClientCert{"x-forwarded-client-cert"};
const LowerCaseString ForwardedUntrustedClientCert{"x-forwarded-untrusted-client-cert"};
const LowerCaseString ForwardedFor{"x-forwarded-for"};
const LowerCaseString ForwardedHost{"x-forwarded-host"};
const LowerCaseString ForwardedProto{"x-forwarded-proto"};
Expand Down
3 changes: 2 additions & 1 deletion source/common/ssl/certificate_validation_context_config_impl.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,8 @@ CertificateValidationContextConfigImpl::CertificateValidationContextConfigImpl(
config.verify_certificate_hash().end()),
verify_certificate_spki_list_(config.verify_certificate_spki().begin(),
config.verify_certificate_spki().end()),
allow_expired_certificate_(config.allow_expired_certificate()) {
allow_expired_certificate_(config.allow_expired_certificate()),
trust_chain_verification_(config.trust_chain_verification()) {
if (ca_cert_.empty()) {
if (!certificate_revocation_list_.empty()) {
throw EnvoyException(fmt::format("Failed to load CRL from {} without trusted CA",
Expand Down
8 changes: 7 additions & 1 deletion source/common/ssl/certificate_validation_context_config_impl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@ class CertificateValidationContextConfigImpl : public CertificateValidationConte
return verify_certificate_spki_list_;
}
bool allowExpiredCertificate() const override { return allow_expired_certificate_; }
envoy::api::v2::auth::CertificateValidationContext_TrustChainVerification
trustChainVerification() const override {
return trust_chain_verification_;
}

private:
const std::string ca_cert_;
Expand All @@ -42,7 +46,9 @@ class CertificateValidationContextConfigImpl : public CertificateValidationConte
const std::vector<std::string> verify_certificate_hash_list_;
const std::vector<std::string> verify_certificate_spki_list_;
const bool allow_expired_certificate_;
const envoy::api::v2::auth::CertificateValidationContext_TrustChainVerification
trust_chain_verification_;
};

} // namespace Ssl
} // namespace Envoy
} // namespace Envoy
80 changes: 67 additions & 13 deletions source/extensions/transport_sockets/tls/context_impl.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,14 @@ bool cbsContainsU16(CBS& cbs, uint16_t n) {

} // namespace

int ContextImpl::sslCustomDataIndex() {
CONSTRUCT_ON_FIRST_USE(int, []() -> int {
int ssl_context_index = SSL_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
RELEASE_ASSERT(ssl_context_index >= 0, "");
return ssl_context_index;
}());
}

ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& config,
TimeSource& time_source)
: scope_(scope), stats_(generateStats(scope)), time_source_(time_source),
Expand Down Expand Up @@ -92,6 +100,19 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c
}

int verify_mode = SSL_VERIFY_NONE;
int verify_mode_validation_context = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT;

if (config.certificateValidationContext() != nullptr) {
envoy::api::v2::auth::CertificateValidationContext_TrustChainVerification verification =
config.certificateValidationContext()->trustChainVerification();
if (verification == envoy::api::v2::auth::CertificateValidationContext::ACCEPT_UNTRUSTED ||
verification == envoy::api::v2::auth::CertificateValidationContext::NOT_VERIFIED) {
verify_mode = SSL_VERIFY_PEER; // Ensure client-certs will be requested even if we have
// nothing to verify against
verify_mode_validation_context = SSL_VERIFY_PEER;
}
}

if (config.certificateValidationContext() != nullptr &&
!config.certificateValidationContext()->caCert().empty()) {
ca_file_path_ = config.certificateValidationContext()->caCertPath();
Expand Down Expand Up @@ -176,7 +197,7 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c
!config.certificateValidationContext()->verifySubjectAltNameList().empty()) {
verify_subject_alt_name_list_ =
config.certificateValidationContext()->verifySubjectAltNameList();
verify_mode = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
verify_mode = verify_mode_validation_context;
}

if (config.certificateValidationContext() != nullptr &&
Expand All @@ -193,7 +214,7 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c
}
verify_certificate_hash_list_.push_back(decoded);
}
verify_mode = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
verify_mode = verify_mode_validation_context;
}

if (config.certificateValidationContext() != nullptr &&
Expand All @@ -205,7 +226,7 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c
}
verify_certificate_spki_list_.emplace_back(decoded.begin(), decoded.end());
}
verify_mode = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
verify_mode = verify_mode_validation_context;
}

for (auto& ctx : tls_contexts_) {
Expand Down Expand Up @@ -372,6 +393,14 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c
SSL_CTX_set_options(ctx.ssl_ctx_.get(), SSL_OP_CIPHER_SERVER_PREFERENCE);
}

if (config.certificateValidationContext() != nullptr) {
allow_untrusted_certificate_ =
config.certificateValidationContext()->trustChainVerification() ==
envoy::api::v2::auth::CertificateValidationContext::ACCEPT_UNTRUSTED ||
config.certificateValidationContext()->trustChainVerification() ==
envoy::api::v2::auth::CertificateValidationContext::NOT_VERIFIED;
}

parsed_alpn_protocols_ = parseAlpnProtocols(config.alpnProtocols());

// To enumerate the required builtin ciphers, curves, algorithms, and
Expand Down Expand Up @@ -465,32 +494,55 @@ int ContextImpl::ignoreCertificateExpirationCallback(int ok, X509_STORE_CTX* ctx

int ContextImpl::verifyCallback(X509_STORE_CTX* store_ctx, void* arg) {
ContextImpl* impl = reinterpret_cast<ContextImpl*>(arg);
SSL* ssl = reinterpret_cast<SSL*>(
X509_STORE_CTX_get_ex_data(store_ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
ClientValidationStatus* clientValidationStatus = reinterpret_cast<ClientValidationStatus*>(
SSL_get_ex_data(ssl, ContextImpl::sslCustomDataIndex()));

if (impl->verify_trusted_ca_) {
int ret = X509_verify_cert(store_ctx);
if (clientValidationStatus) {
*clientValidationStatus =
ret == 1 ? ClientValidationStatus::Validated : ClientValidationStatus::Failed;
}

if (ret <= 0) {
impl->stats_.fail_verify_error_.inc();
return ret;
return impl->allow_untrusted_certificate_ ? 1 : ret;
}
}

SSL* ssl = reinterpret_cast<SSL*>(
X509_STORE_CTX_get_ex_data(store_ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
bssl::UniquePtr<X509> cert(SSL_get_peer_certificate(ssl));

const Network::TransportSocketOptions* transport_socket_options =
static_cast<const Network::TransportSocketOptions*>(SSL_get_app_data(ssl));
return impl->verifyCertificate(
ClientValidationStatus validated = impl->verifyCertificate(
cert.get(), transport_socket_options &&
!transport_socket_options->verifySubjectAltNameListOverride().empty()
? transport_socket_options->verifySubjectAltNameListOverride()
: impl->verify_subject_alt_name_list_);

if (clientValidationStatus) {
if (*clientValidationStatus == ClientValidationStatus::NotValidated) {
*clientValidationStatus = validated;
} else if (validated != ClientValidationStatus::NotValidated) {
*clientValidationStatus = validated;
}
}

return impl->allow_untrusted_certificate_ ? 1 : (validated != ClientValidationStatus::Failed);
}

int ContextImpl::verifyCertificate(X509* cert, const std::vector<std::string>& verify_san_list) {
if (!verify_san_list.empty() && !verifySubjectAltName(cert, verify_san_list)) {
stats_.fail_verify_san_.inc();
return 0;
ClientValidationStatus
ContextImpl::verifyCertificate(X509* cert, const std::vector<std::string>& verify_san_list) {
ClientValidationStatus validated = ClientValidationStatus::NotValidated;

if (!verify_san_list.empty()) {
if (!verifySubjectAltName(cert, verify_san_list)) {
stats_.fail_verify_san_.inc();
return ClientValidationStatus::Failed;
}
validated = ClientValidationStatus::Validated;
}

if (!verify_certificate_hash_list_.empty() || !verify_certificate_spki_list_.empty()) {
Expand All @@ -503,11 +555,13 @@ int ContextImpl::verifyCertificate(X509* cert, const std::vector<std::string>& v

if (!valid_certificate_hash && !valid_certificate_spki) {
stats_.fail_verify_cert_hash_.inc();
return 0;
return ClientValidationStatus::Failed;
}

validated = ClientValidationStatus::Validated;
}

return 1;
return validated;
}

void ContextImpl::incCounter(const Stats::StatName name, absl::string_view value) const {
Expand Down
12 changes: 11 additions & 1 deletion source/extensions/transport_sockets/tls/context_impl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ struct SslStats {
ALL_SSL_STATS(GENERATE_COUNTER_STRUCT, GENERATE_GAUGE_STRUCT, GENERATE_HISTOGRAM_STRUCT)
};

enum class ClientValidationStatus { NotValidated, NoClientCertificate, Validated, Failed };

class ContextImpl : public virtual Envoy::Ssl::Context {
public:
virtual bssl::UniquePtr<SSL> newSsl(const Network::TransportSocketOptions* options);
Expand Down Expand Up @@ -77,6 +79,12 @@ class ContextImpl : public virtual Envoy::Ssl::Context {

SslStats& stats() { return stats_; }

/**
* The global SSL-library index used for storing a pointer to the SslSocket
* class in the SSL instance, for retrieval in callbacks.
*/
static int sslCustomDataIndex();

// Ssl::Context
size_t daysUntilFirstCertExpires() const override;
Envoy::Ssl::CertificateDetailsPtr getCaCertInformation() const override;
Expand All @@ -100,7 +108,8 @@ class ContextImpl : public virtual Envoy::Ssl::Context {
// A SSL_CTX_set_cert_verify_callback for custom cert validation.
static int verifyCallback(X509_STORE_CTX* store_ctx, void* arg);

int verifyCertificate(X509* cert, const std::vector<std::string>& verify_san_list);
ClientValidationStatus verifyCertificate(X509* cert,
const std::vector<std::string>& verify_san_list);

/**
* Verifies certificate hash for pinning. The hash is a hex-encoded SHA-256 of the DER-encoded
Expand Down Expand Up @@ -161,6 +170,7 @@ class ContextImpl : public virtual Envoy::Ssl::Context {
std::vector<std::string> verify_subject_alt_name_list_;
std::vector<std::vector<uint8_t>> verify_certificate_hash_list_;
std::vector<std::vector<uint8_t>> verify_certificate_spki_list_;
bool allow_untrusted_certificate_{false};
Stats::Scope& scope_;
SslStats stats_;
std::vector<uint8_t> parsed_alpn_protocols_;
Expand Down
12 changes: 11 additions & 1 deletion source/extensions/transport_sockets/tls/ssl_socket.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,8 @@ SslSocket::SslSocket(Envoy::Ssl::ContextSharedPtr ctx, InitialState state,
ctx_(std::dynamic_pointer_cast<ContextImpl>(ctx)), state_(SocketState::PreHandshake) {
bssl::UniquePtr<SSL> ssl = ctx_->newSsl(transport_socket_options_.get());
ssl_ = ssl.get();
info_ = std::make_shared<SslSocketInfo>(std::move(ssl));
info_ = std::make_shared<SslSocketInfo>(std::move(ssl), ctx_);

if (state == InitialState::Client) {
SSL_set_connect_state(ssl_);
} else {
Expand Down Expand Up @@ -301,11 +302,20 @@ void SslSocket::shutdownSsl() {
}
}

SslSocketInfo::SslSocketInfo(bssl::UniquePtr<SSL> ssl, ContextImplSharedPtr ctx)
: ssl_(std::move(ssl)) {
SSL_set_ex_data(ssl_.get(), ctx->sslCustomDataIndex(), &(this->certificate_validation_status_));
}

bool SslSocketInfo::peerCertificatePresented() const {
bssl::UniquePtr<X509> cert(SSL_get_peer_certificate(ssl_.get()));
return cert != nullptr;
}

bool SslSocketInfo::peerCertificateValidated() const {
return certificate_validation_status_ == ClientValidationStatus::Validated;
}

std::vector<std::string> SslSocketInfo::uriSanLocalCertificate() const {
if (!cached_uri_san_local_certificate_.empty()) {
return cached_uri_san_local_certificate_;
Expand Down
Loading