ssl: add support for SNI.

docs/configuration/listeners/stats.rst

@@ -17,6 +17,7 @@ Every listener has a statistics tree rooted at *listener.<address>.* with the fo
  ssl.handshake, Counter, Total successful TLS connection handshakes
  ssl.session_reused, Counter, Total successful TLS session resumptions
  ssl.no_certificate, Counter, Total successul TLS connections with no client certificate
+ ssl.fail_no_sni_match, Counter, Total TLS connections that were rejected because of missing SNI match
  ssl.fail_verify_no_cert, Counter, Total TLS connections that failed because of missing client certificate
  ssl.fail_verify_error, Counter, Total TLS connections that failed CA verification
  ssl.fail_verify_san, Counter, Total TLS connections that failed SAN verification

include/envoy/ssl/context_manager.h

@@ -24,9 +24,20 @@ class ContextManager {
 
  /**
  * Builds a ServerContext from a ServerContextConfig.
+ * The skip_context_update parameter is used for fast-path (avoiding lock & context looup)x
+ * on listeners with a single filter chain and no SNI restrictions.
  */
- virtual ServerContextPtr createSslServerContext(Stats::Scope& scope,
- ServerContextConfig& config) PURE;
+ virtual ServerContextPtr createSslServerContext(const std::string& listener_name,
+ const std::vector<std::string>& server_names,
+ Stats::Scope& scope, ServerContextConfig& config,
+ bool skip_context_update) PURE;
+
+ /**
+ * Find ServerContext for a given listener and server_name.
+ * @return ServerContext or nullptr in case there is no match.
+ */
+ virtual ServerContext* findSslServerContext(const std::string& listener_name,
+ const std::string& server_name) PURE;
 
  /**
  * @return the number of days until the next certificate being managed will expire.

source/common/ssl/BUILD

@@ -56,6 +56,7 @@ envoy_cc_library(
  "//include/envoy/stats:stats_interface",
  "//include/envoy/stats:stats_macros",
  "//source/common/common:assert_lib",
+ "//source/common/common:empty_string",
  "//source/common/common:hex_lib",
  ],
 )

source/common/ssl/context_impl.cc

@@ -28,8 +28,8 @@ int ContextImpl::sslContextIndex() {
 }
 
 ContextImpl::ContextImpl(ContextManagerImpl& parent, Stats::Scope& scope, ContextConfig& config)
- : parent_(parent), ctx_(SSL_CTX_new(TLS_method())), scope_(scope),
- stats_(generateStats(scope)) {
+ : parent_(parent), ctx_(SSL_CTX_new(TLS_method())), scope_(scope), stats_(generateStats(scope)),
+ ecdh_curves_(config.ecdhCurves()) {
  RELEASE_ASSERT(ctx_);
 
  int rc = SSL_CTX_set_ex_data(ctx_.get(), sslContextIndex(), this);
@@ -40,8 +40,8 @@ ContextImpl::ContextImpl(ContextManagerImpl& parent, Stats::Scope& scope, Contex
  fmt::format("Failed to initialize cipher suites {}", config.cipherSuites()));
  }
 
- if (!SSL_CTX_set1_curves_list(ctx_.get(), config.ecdhCurves().c_str())) {
- throw EnvoyException(fmt::format("Failed to initialize ECDH curves {}", config.ecdhCurves()));
+ if (!SSL_CTX_set1_curves_list(ctx_.get(), ecdh_curves_.c_str())) {
+ throw EnvoyException(fmt::format("Failed to initialize ECDH curves {}", ecdh_curves_));
  }
 
  int verify_mode = SSL_VERIFY_NONE;
@@ -355,10 +355,20 @@ bssl::UniquePtr<SSL> ClientContextImpl::newSsl() const {
  return ssl_con;
 }
 
-ServerContextImpl::ServerContextImpl(ContextManagerImpl& parent, Stats::Scope& scope,
- ServerContextConfig& config, Runtime::Loader& runtime)
- : ContextImpl(parent, scope, config), runtime_(runtime),
+ServerContextImpl::ServerContextImpl(ContextManagerImpl& parent, const std::string& listener_name,
+ const std::vector<std::string>& server_names,
+ Stats::Scope& scope, ServerContextConfig& config,
+ bool skip_context_update, Runtime::Loader& runtime)
+ : ContextImpl(parent, scope, config), listener_name_(listener_name),
+ server_names_(server_names), skip_context_update_(skip_context_update), runtime_(runtime),
  session_ticket_keys_(config.sessionTicketKeys()) {
+ SSL_CTX_set_select_certificate_cb(
+ ctx_.get(), [](const SSL_CLIENT_HELLO* client_hello) -> ssl_select_cert_result_t {
+ ContextImpl* context_impl = static_cast<ContextImpl*>(
+ SSL_CTX_get_ex_data(SSL_get_SSL_CTX(client_hello->ssl), sslContextIndex()));
+ return dynamic_cast<ServerContextImpl*>(context_impl)->processClientHello(client_hello);
+ });
+
  if (!config.caCertFile().empty()) {
  bssl::UniquePtr<STACK_OF(X509_NAME)> list(SSL_load_client_CA_file(config.caCertFile().c_str()));
  if (nullptr == list) {
@@ -404,7 +414,7 @@ ServerContextImpl::ServerContextImpl(ContextManagerImpl& parent, Stats::Scope& s
  int rc = EVP_DigestInit(&md, EVP_sha256());
  RELEASE_ASSERT(rc == 1);
 
- // Hash the CommonName/SANs in the server certificate. This makes sure that
+ // Hash the CommonName/SANs of the server certificate. This makes sure that
  // sessions can only be resumed to a certificate for the same name, but allows
  // resuming to unique certs in the case that different Envoy instances each have
  // their own certs.
@@ -469,12 +479,77 @@ ServerContextImpl::ServerContextImpl(ContextManagerImpl& parent, Stats::Scope& s
  RELEASE_ASSERT(rc == 1);
  }
 
+ // Hash configured SNIs for this context, so that sessions cannot be resumed across different
+ // filter chains, even when using the same server certificate.
+ for (const auto& name : server_names_) {
+ rc = EVP_DigestUpdate(&md, name.data(), name.size());
+ RELEASE_ASSERT(rc == 1);
+ }
+
  rc = EVP_DigestFinal(&md, session_context_buf, &session_context_len);
  RELEASE_ASSERT(rc == 1);
  rc = SSL_CTX_set_session_id_context(ctx_.get(), session_context_buf, session_context_len);
  RELEASE_ASSERT(rc == 1);
 }
 
+ssl_select_cert_result_t
+ServerContextImpl::processClientHello(const SSL_CLIENT_HELLO* client_hello) {
+ if (skip_context_update_) {
+ return ssl_select_cert_success;
+ }
+
+ std::string server_name;
+ const uint8_t* data;
+ size_t len;
+
+ if (SSL_early_callback_ctx_extension_get(client_hello, TLSEXT_TYPE_server_name, &data, &len)) {
+ // Based on BoringSSL's ext_sni_parse_clienthello().
+ // Match on empty SNI instead of rejecting connection in case we cannot process the extension.
+ CBS extension;
+ CBS_init(&extension, data, len);
+ CBS server_name_list, host_name;
+ uint8_t name_type;
+ if (CBS_get_u16_length_prefixed(&extension, &server_name_list) &&
+ CBS_get_u8(&server_name_list, &name_type) &&
+ CBS_get_u16_length_prefixed(&server_name_list, &host_name) &&
+ CBS_len(&server_name_list) == 0 && CBS_len(&extension) == 0 &&
+ name_type == TLSEXT_NAMETYPE_host_name && CBS_len(&host_name) != 0 &&
+ CBS_len(&host_name) <= TLSEXT_MAXLEN_host_name && !CBS_contains_zero_byte(&host_name)) {
+ server_name.assign(reinterpret_cast<const char*>(CBS_data(&host_name)), CBS_len(&host_name));
+ }
+ }
+
+ ServerContext* new_ctx = parent_.findSslServerContext(listener_name_, server_name);
+
+ // Reject connection if we didn't find a match.
+ if (new_ctx == nullptr) {
+ stats_.fail_no_sni_match_.inc();
+ return ssl_select_cert_error;
+ }
+
+ // Update context if it changed.
+ if (new_ctx != this) {
+ ServerContextImpl* new_impl = dynamic_cast<ServerContextImpl*>(new_ctx);
+ new_impl->updateConnectionContext(client_hello->ssl);
+ }
+
+ return ssl_select_cert_success;
+}
+
+void ServerContextImpl::updateConnectionContext(SSL* ssl) {
+ ASSERT(ctx_);
+
+ SSL_set_SSL_CTX(ssl, ctx_.get());
+ ASSERT(SSL_CTX_get_ex_data(ctx_.get(), sslContextIndex()) == this);
+
+ // Update SSL-level settings and parameters that are inherited from SSL_CTX during SSL_new().
+ SSL_set_verify(ssl, SSL_CTX_get_verify_mode(ctx_.get()), SSL_CTX_get_verify_callback(ctx_.get()));
+
+ int rc = SSL_set1_curves_list(ssl, ecdh_curves_.c_str());
+ ASSERT(rc == 1);
+ UNREFERENCED_PARAMETER(rc);
+}
+
 int ServerContextImpl::sessionTicketProcess(SSL*, uint8_t* key_name, uint8_t* iv,
  EVP_CIPHER_CTX* ctx, HMAC_CTX* hmac_ctx, int encrypt) {
  const EVP_MD* hmac = EVP_sha256();

source/common/ssl/context_impl.h

@@ -27,6 +27,7 @@ namespace Ssl {
  COUNTER(handshake) \
  COUNTER(session_reused) \
  COUNTER(no_certificate) \
+ COUNTER(fail_no_sni_match) \
  COUNTER(fail_verify_no_cert) \
  COUNTER(fail_verify_error) \
  COUNTER(fail_verify_san) \
@@ -42,8 +43,6 @@ struct SslStats {
 
 class ContextImpl : public virtual Context {
 public:
- ~ContextImpl() { parent_.releaseContext(this); }
-
  virtual bssl::UniquePtr<SSL> newSsl() const;
 
  /**
@@ -119,11 +118,13 @@ class ContextImpl : public virtual Context {
  bssl::UniquePtr<X509> cert_chain_;
  std::string ca_file_path_;
  std::string cert_chain_file_path_;
+ const std::string ecdh_curves_;
 };
 
 class ClientContextImpl : public ContextImpl, public ClientContext {
 public:
  ClientContextImpl(ContextManagerImpl& parent, Stats::Scope& scope, ClientContextConfig& config);
+ ~ClientContextImpl() { parent_.releaseClientContext(this); }
 
  bssl::UniquePtr<SSL> newSsl() const override;
 
@@ -133,19 +134,28 @@ class ClientContextImpl : public ContextImpl, public ClientContext {
 
 class ServerContextImpl : public ContextImpl, public ServerContext {
 public:
- ServerContextImpl(ContextManagerImpl& parent, Stats::Scope& scope, ServerContextConfig& config,
+ ServerContextImpl(ContextManagerImpl& parent, const std::string& listener_name,
+ const std::vector<std::string>& server_names, Stats::Scope& scope,
+ ServerContextConfig& config, bool skip_context_update,
  Runtime::Loader& runtime);
+ ~ServerContextImpl() { parent_.releaseServerContext(this, listener_name_, server_names_); }
 
 private:
+ ssl_select_cert_result_t processClientHello(const SSL_CLIENT_HELLO* client_hello);
+ void updateConnectionContext(SSL* ssl);
+
  int alpnSelectCallback(const unsigned char** out, unsigned char* outlen, const unsigned char* in,
  unsigned int inlen);
  int sessionTicketProcess(SSL* ssl, uint8_t* key_name, uint8_t* iv, EVP_CIPHER_CTX* ctx,
  HMAC_CTX* hmac_ctx, int encrypt);
 
+ const std::string listener_name_;
+ const std::vector<std::string> server_names_;
+ const bool skip_context_update_;
  Runtime::Loader& runtime_;
  std::vector<uint8_t> parsed_alt_alpn_protocols_;
  const std::vector<ServerContextConfig::SessionTicketKey> session_ticket_keys_;
 };
 
-} // Ssl
-} // Envoy
+} // namespace Ssl
+} // namespace Envoy

source/common/ssl/context_manager_impl.cc

@@ -1,18 +1,54 @@
 #include "common/ssl/context_manager_impl.h"
 
 #include <functional>
-#include <mutex>
+#include <shared_mutex>
 
 #include "common/common/assert.h"
+#include "common/common/empty_string.h"
 #include "common/ssl/context_impl.h"
 
 namespace Envoy {
 namespace Ssl {
 
 ContextManagerImpl::~ContextManagerImpl() { ASSERT(contexts_.empty()); }
 
-void ContextManagerImpl::releaseContext(Context* context) {
- std::unique_lock<std::mutex> lock(contexts_lock_);
+void ContextManagerImpl::releaseClientContext(ClientContext* context) {
+ std::unique_lock<std::shared_timed_mutex> lock(contexts_lock_);
+
+ // context may not be found, in the case that a subclass of Context throws
+ // in it's constructor. In that case the context did not get added, but
+ // the destructor of Context will run and call releaseContext().
+ contexts_.remove(context);
+}
+
+void ContextManagerImpl::releaseServerContext(ServerContext* context,
+ const std::string& listener_name,
+ const std::vector<std::string>& server_names) {
+ std::unique_lock<std::shared_timed_mutex> lock(contexts_lock_);
+
+ // Remove mappings.
+ auto& listener_map_exact = map_exact_[listener_name];
+ if (server_names.empty()) {
+ auto ctx = listener_map_exact.find(EMPTY_STRING);
+ if (ctx != listener_map_exact.end() && ctx->second == context) {
+ listener_map_exact.erase(ctx);
+ }
+ } else {
+ auto& listener_map_wildcard = map_wildcard_[listener_name];
+ for (const auto& name : server_names) {
+ if (name.size() > 2 && name[0] == '*' && name[1] == '.') {
+ auto ctx = listener_map_wildcard.find(name);
+ if (ctx != listener_map_wildcard.end() && ctx->second == context) {
+ listener_map_wildcard.erase(ctx);
+ }
+ } else {
+ auto ctx = listener_map_exact.find(name);
+ if (ctx != listener_map_exact.end() && ctx->second == context) {
+ listener_map_exact.erase(ctx);
+ }
+ }
+ }
+ }
 
  // context may not be found, in the case that a subclass of Context throws
  // in it's constructor. In that case the context did not get added, but
@@ -22,23 +58,79 @@ void ContextManagerImpl::releaseContext(Context* context) {
 
 ClientContextPtr ContextManagerImpl::createSslClientContext(Stats::Scope& scope,
  ClientContextConfig& config) {
-
  ClientContextPtr context(new ClientContextImpl(*this, scope, config));
- std::unique_lock<std::mutex> lock(contexts_lock_);
+ std::unique_lock<std::shared_timed_mutex> lock(contexts_lock_);
  contexts_.emplace_back(context.get());
  return context;
 }
 
-ServerContextPtr ContextManagerImpl::createSslServerContext(Stats::Scope& scope,
- ServerContextConfig& config) {
- ServerContextPtr context(new ServerContextImpl(*this, scope, config, runtime_));
- std::unique_lock<std::mutex> lock(contexts_lock_);
+ServerContextPtr ContextManagerImpl::createSslServerContext(
+ const std::string& listener_name, const std::vector<std::string>& server_names,
+ Stats::Scope& scope, ServerContextConfig& config, bool skip_context_update) {
+ ServerContextPtr context(new ServerContextImpl(*this, listener_name, server_names, scope, config,
+ skip_context_update, runtime_));
+ std::unique_lock<std::shared_timed_mutex> lock(contexts_lock_);
  contexts_.emplace_back(context.get());
+
+ // Save mappings.
+ if (server_names.empty()) {
+ map_exact_[listener_name][EMPTY_STRING] = context.get();
+ } else {
+ for (const auto& name : server_names) {
+ if (name.size() > 2 && name[0] == '*' && name[1] == '.') {
+ map_wildcard_[listener_name][name] = context.get();
+ } else {
+ map_exact_[listener_name][name] = context.get();
+ }
+ }
+ }
+
  return context;
 }
 
+ServerContext* ContextManagerImpl::findSslServerContext(const std::string& listener_name,
+ const std::string& server_name) {
+ // Find Ssl::ServerContext to use. The algorithm for "www.example.com" is as follows:
+ // 1. Try exact match on domain, i.e. "www.example.com"
+ // 2. Try exact match on wildcard, i.e. "*.example.com"
+ // 3. Try "no SNI" match, i.e. ""
+ // 4. Return no context and reject connection.
+
+ // TODO(PiotrSikora): make this lockless.
+ std::shared_lock<std::shared_timed_mutex> lock(contexts_lock_);
+ auto& listener_map_exact = map_exact_[listener_name];
+ auto ctx = listener_map_exact.find(server_name);
+ if (ctx != listener_map_exact.end()) {
+ return ctx->second;
+ }
+
+ // Try to construct and match wildcard domain.
+ // Theoretically, 5 is the minimum legal domain length for the wildcard certificate (i.e. *.a.b).
+ if (server_name.size() >= 5) {
+ size_t pos = server_name.find('.');
+ if (pos > 0) {
+ size_t rpos = server_name.rfind('.');
+ if (rpos > pos + 1 && rpos != server_name.size() - 1) {
+ std::string wildcard = '*' + server_name.substr(pos);
+ auto& listener_map_wildcard = map_wildcard_[listener_name];
+ auto ctx = listener_map_wildcard.find(wildcard);
+ if (ctx != listener_map_wildcard.end()) {
+ return ctx->second;
+ }
+ }
+ }
+ }
+
+ ctx = listener_map_exact.find(EMPTY_STRING);
+ if (ctx != listener_map_exact.end()) {
+ return ctx->second;
+ }
+
+ return nullptr;
+}
+
 size_t ContextManagerImpl::daysUntilFirstCertExpires() {
- std::unique_lock<std::mutex> lock(contexts_lock_);
+ std::shared_lock<std::shared_timed_mutex> lock(contexts_lock_);
  size_t ret = std::numeric_limits<int>::max();
  for (Context* context : contexts_) {
  ret = std::min<size_t>(context->daysUntilFirstCertExpires(), ret);
@@ -47,7 +139,7 @@ size_t ContextManagerImpl::daysUntilFirstCertExpires() {
 }
 
 void ContextManagerImpl::iterateContexts(std::function<void(Context&)> callback) {
- std::unique_lock<std::mutex> lock(contexts_lock_);
+ std::unique_lock<std::shared_timed_mutex> lock(contexts_lock_);
  for (Context* context : contexts_) {
  callback(*context);
  }