Support For Extended TLS Settings #41645

kfaseela · 2022-10-26T13:20:13Z

Describe the feature request

We are looking into configuring additional TLS settings in ingress and egress (currently we use basically the defaults).
As per the analysis, it would have been nice if Istio allows configuring more attributes beyond the cipher suite list.
For eg., we must be able to configure elliptic curves (ECDH parameters). Fortunately, Envoy has support for this, but in Istio it is not exposed yet(so there is a way to do this currently with EnvoyFilter). We will also need to configure the signature schemes (e.g. rsa_pkcs1_sha256, rsa_pss_rsae_sha256, ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384). Unfortunately, signature scheme is not configurable in Envoy either, and will initiate a separate request for the same in Envoy.

There have been different efforts/discussions in Istio in similar lines. Please see below:

So, the requirements:

Support ‘ecdh_curves’ at the Gateway: https://istio.io/latest/docs/reference/config/networking/gateway/#ServerTLSSettings
Support ‘ecdh_curves’ in DestinationRule: https://istio.io/latest/docs/reference/config/networking/destination-rule/#ClientTLSSettings.
ClientTLSSettings currenlty miss the ability to configure TLS versions, and cipher suites (needs EnvoyFilters). It would be a good opportunity to add them too. (This PR seems to be addressing cipher suites part.)
Should we also support it for the Sidecar (Ingress Listener) ?https://istio.io/latest/docs/reference/config/networking/sidecar/#IstioIngressListener ==> This is just for completeness, and currently cannot find a requirement for this.

Describe alternatives you've considered

As Envoy supports some of these params already, we can configure the same using EnvoyFilters. However, it would be nice to have these supported using Istio standard APIs

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: gateway-tls-curves
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:

applyTo: FILTER_CHAIN
match:
context: GATEWAY
listener:
name: "0.0.0.0_8443"
patch:
operation: MERGE
value:
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
common_tls_context:
tls_params:
ecdh_curves:
- P-256
- X25519

Affected product area (please put an X in all that apply)

[ ] Ambient
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[X] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

kfaseela · 2022-10-26T13:23:43Z

cc @howardjohn @ramaraochavali

hzxuzhonghu · 2022-10-27T07:08:08Z

This requirement makes me think about should we introduce extensions API in istio, these APIs can iterate quickly and we do not need to guarantee their compatibility. Like ratelimit, it is long there, but without much progress

ramaraochavali · 2022-10-27T12:47:54Z

How is extension API different from Envoy filters?

zirain · 2022-10-28T00:57:35Z

one case for RateLimit is apply to a specify route, simply refer to an VS will not be right.

it's avaliable for kubernetes Gateway API, as HTTPRoute is first class.

hzxuzhonghu · 2022-10-28T01:46:14Z

How is extension API different from Envoy filters?
It is user faced API, then we can translate it to xds, but not guarantee it could not change in the future, just like k8s deployment once resides in extensions API group, now they are migrated to apps group.

kfaseela · 2022-11-02T08:37:15Z

As per offline discussion with @howardjohn the API PR(istio/api#2014) can be rebased and taken forward.

kfaseela · 2023-03-08T08:24:57Z

Just an update that finally the proposal that was accepted and the implementation that got merged - is to have a global MeshConfig for ecdh curves settings for all non ISTIO_MUTUAL tls traffic.

anannaya · 2023-04-22T03:07:36Z

@kfaseela we are running with istio version 1.13.2. i tried envoyfilter with ecdh curves which did not work for me. Is there any limitations in envoyfilter as well?

kfaseela · 2023-04-22T07:48:29Z

@kfaseela we are running with istio version 1.13.2. i tried envoyfilter with ecdh curves which did not work for me. Is there any limitations in envoyfilter as well?

We have not faced any problems using the EnvoyFilter. Istio support for ecdhCurves in MeshConfig is already merged, just in case you want to try

anannaya · 2023-04-22T08:19:36Z

@kfaseela Thanks for replying . Yes. We do have a plan to upgrade soon . Timeebeing would like unblock the issue, Do you see any issue in Envoyfilter ?

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"annotations":{},"name":"gateway-tls-curves","namespace":"istio-system"},"spec":{"configPatches":[{"applyTo":"FILTER_CHAIN","match":{"context":"GATEWAY","listener":{"name":"0.0.0.0_8443"}},"patch":{"operation":"MERGE","value":{"transport_socket":{"name":"envoy.transport_sockets.tls","typed_config":{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext","common_tls_context":{"tls_params":{"ecdh_curves":["P-256","X25519","secp384r1","secp256r1"]}}}}}}}],"workloadSelector":{"labels":{"istio":"ingressgateway"}}}}
  creationTimestamp: "2023-04-21T11:18:29Z"
  generation: 3
  name: gateway-tls-curves
  namespace: istio-system
  resourceVersion: "475778794"
  uid: 1c0c0e24-9326-431c-b6f7-a267de249d37
spec:
  configPatches:
  - applyTo: FILTER_CHAIN
    match:
      context: GATEWAY
      listener:
        name: 0.0.0.0_8443
    patch:
      operation: MERGE
      value:
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
            common_tls_context:
              tls_params:
                ecdh_curves:
                - P-256
                - X25519
                - secp384r1
                - secp256r1
  workloadSelector:
    labels:
      istio: ingressgateway

kfaseela · 2023-04-22T08:25:35Z

At a high level, the filter looks good. Make sure the label used in workloadselector matches with the gateway label.(might be different based on the Istio installation method)

anannaya · 2023-04-22T08:29:38Z

P-256 and X25519 works, Rest all fails in handshake

/usr/bin/curl -vvv  --curves secp384r1  https://xxxx.xom
*   Trying 18.214.248.70:443...
* Connected to xxxxx.com (18.214.248.70) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure
(base) kubernetes ananayak(k8s: qaus1-ai-eks) $

kfaseela · 2023-04-22T08:41:18Z

P-256 and X25519 works, Rest all fails in handshake

/usr/bin/curl -vvv  --curves secp384r1  https://xxxx.xom
*   Trying 18.214.248.70:443...
* Connected to xxxxx.com (18.214.248.70) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure
(base) kubernetes ananayak(k8s: qaus1-ai-eks) $

Those are the default curves on envoy, did u check if the filter is really applied? What are the labels present on your gateway?

anannaya · 2023-04-22T08:56:43Z

Yes. I see this error in ingress pods when i enable the debug , Anything extra configuration required in istio 1.13.2 to support ecdh configuration ?

{"level":"warning","time":"2023-04-21T11:45:36.557704Z","scope":"envoy config","msg":"gRPC config for type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret rejected: Failed to initialize ECDH curves P-256:X25519:secp384r1:secp256r1"}

kfaseela · 2023-04-22T09:27:48Z

Yes. I see this error in ingress pods when i enable the debug , Anything extra configuration required in istio 1.13.2 to support ecdh configuration ?
{"level":"warning","time":"2023-04-21T11:45:36.557704Z","scope":"envoy config","msg":"gRPC config for type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret rejected: Failed to initialize ECDH curves P-256:X25519:secp384r1:secp256r1"}

I have not used the config with 1.13 before. Tried only with 1.16 I guess

anannaya · 2023-04-22T09:30:13Z

We do use extra ciphersuits at the gateway would that be causing any issue here ?

  - hosts:
    - '*'
    port:
      name: https-default
      number: 443
      protocol: HTTPS
    tls:
      cipherSuites:
      - ECDHE-ECDSA-AES256-GCM-SHA384
      - ECDHE-RSA-AES256-GCM-SHA384
      - ECDHE-ECDSA-CHACHA20-POLY1305
      - ECDHE-RSA-CHACHA20-POLY1305
      - ECDHE-ECDSA-AES128-GCM-SHA256
      - ECDHE-RSA-AES128-GCM-SHA256
      credentialName: star-xxxxxxx-com-certs
      minProtocolVersion: TLSV1_2
      mode: SIMPLE

kfaseela · 2023-04-22T09:36:32Z

Yes. I see this error in ingress pods when i enable the debug , Anything extra configuration required in istio 1.13.2 to support ecdh configuration ?
{"level":"warning","time":"2023-04-21T11:45:36.557704Z","scope":"envoy config","msg":"gRPC config for type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret rejected: Failed to initialize ECDH curves P-256:X25519:secp384r1:secp256r1"}

Right now not with my laptop, but I think the name recognized by envoy is P-384 instead of secp384r1. I would have to check in detail tomorrow.

kfaseela · 2023-04-22T09:43:40Z

I just see the set of supported ECDH curves in envoy as
"P-224",
"P-256",
"P-521",
"P-384",
"X25519",
"CECPQ2",

anannaya · 2023-04-22T10:40:59Z

@kfaseela Yes working now. Thank you so much for help.

anannaya · 2023-04-24T04:50:30Z

@kfaseela Need one more help, With TLS1.3 works and 1.2 fails with ECDH cipher ? Is there any configuration we need here .

/usr/bin/curl -vvv --ciphers  ECDHE-ECDSA-AES256-GCM-SHA384   --curves secp384r1  https://MASKED
*   Trying 3.210.109.135:443...
* Connected to MASKED (cc) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
* Cipher selection: ECDHE-ECDSA-AES256-GCM-SHA384
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: C=US; ST=California; L=San Jose; O=Cisco Systems, Inc.; CN=*.MASKED
*  start date: Jan  9 00:00:00 2023 GMT
*  expire date: Jan 31 23:59:59 2024 GMT
*  subjectAltName: host "MASKED" matched cert's "*.MASKED
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS RSA SHA256 2020 CA1
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing


/usr/bin/curl -vvv --ciphers  ECDHE-ECDSA-AES256-GCM-SHA384   --tlsv1.2 --tls-max 1.2  --curves secp384r1  https://MASKED
*   Trying 3.210.109.135:443...
* Connected to MASKED (3.210.109.135) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
* Cipher selection: ECDHE-ECDSA-AES256-GCM-SHA384
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure

kfaseela · 2023-04-24T08:50:25Z

@kfaseela Need one more help, With TLS1.3 works and 1.2 fails with ECDH cipher ? Is there any configuration we need here .

/usr/bin/curl -vvv --ciphers  ECDHE-ECDSA-AES256-GCM-SHA384   --curves secp384r1  https://MASKED
*   Trying 3.210.109.135:443...
* Connected to MASKED (cc) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
* Cipher selection: ECDHE-ECDSA-AES256-GCM-SHA384
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: C=US; ST=California; L=San Jose; O=Cisco Systems, Inc.; CN=*.MASKED
*  start date: Jan  9 00:00:00 2023 GMT
*  expire date: Jan 31 23:59:59 2024 GMT
*  subjectAltName: host "MASKED" matched cert's "*.MASKED
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS RSA SHA256 2020 CA1
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing


/usr/bin/curl -vvv --ciphers  ECDHE-ECDSA-AES256-GCM-SHA384   --tlsv1.2 --tls-max 1.2  --curves secp384r1  https://MASKED
*   Trying 3.210.109.135:443...
* Connected to MASKED (3.210.109.135) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
* Cipher selection: ECDHE-ECDSA-AES256-GCM-SHA384
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure

is TLS 1.2 working for you without ecdh curves?

anannaya · 2023-04-24T09:03:16Z

@kfaseela yes. it works with TLS1.2 without curves . I am suspecting it is something to do with external digicert cerificate which we have at ingress layer created using RSA. envoyproxy/envoy#8983??

/usr/bin/curl -vvv --ciphers  ECDHE-RSA-AES256-GCM-SHA384  --tlsv1.2 --tls-max 1.2   https://MASKED
*   Trying 18.214.248.70:443...
* Connected to MASKED (18.214.248.70) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
* Cipher selection: ECDHE-RSA-AES256-GCM-SHA384
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN: server accepted h2
* Server certificate:
*  subject: C=US; ST=California; L=San Jose; O=Cisco Systems, Inc.; CN=*.MASKED
*  start date: Jan  9 00:00:00 2023 GMT
*  expire date: Jan 31 23:59:59 2024 GMT
*  subjectAltName: host "MASKED" matched cert's "*.MASKED"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS RSA SHA256 2020 CA1
*  SSL certificate verify ok.

istio-policy-bot added area/networking area/security kind/enhancement labels Oct 26, 2022

kfaseela self-assigned this Nov 3, 2022

jewertow mentioned this issue Nov 3, 2022

Support configuring TLS min/max version and elliptic curves #41772

Closed

kfaseela mentioned this issue Nov 3, 2022

Add ecdh_curves support istio/api#2543

Merged

kfaseela mentioned this issue Nov 11, 2022

[WIP] support ecdh_curves in TLS Settings for external traffic #41948

Closed

FestiveKyle mentioned this issue Nov 14, 2022

Work to get Tracker Compliant canada-ca/tracker#3553

Closed

3 tasks

kfaseela mentioned this issue Feb 8, 2023

Ecdh curves support for non ISTIO_MUTUAL traffic #43207

Merged

istio-testing closed this as completed in istio/api#2543 Feb 17, 2023

kfaseela reopened this Feb 21, 2023

istio-testing closed this as completed in #43207 Mar 8, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support For Extended TLS Settings #41645

Support For Extended TLS Settings #41645

kfaseela commented Oct 26, 2022 •

edited

kfaseela commented Oct 26, 2022

hzxuzhonghu commented Oct 27, 2022

ramaraochavali commented Oct 27, 2022

zirain commented Oct 28, 2022

hzxuzhonghu commented Oct 28, 2022

kfaseela commented Nov 2, 2022

kfaseela commented Mar 8, 2023

anannaya commented Apr 22, 2023

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023 •

edited

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023 •

edited

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023 •

edited

kfaseela commented Apr 22, 2023

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023

anannaya commented Apr 24, 2023

kfaseela commented Apr 24, 2023

anannaya commented Apr 24, 2023 •

edited

Support For Extended TLS Settings #41645

Support For Extended TLS Settings #41645

Comments

kfaseela commented Oct 26, 2022 • edited

kfaseela commented Oct 26, 2022

hzxuzhonghu commented Oct 27, 2022

ramaraochavali commented Oct 27, 2022

zirain commented Oct 28, 2022

hzxuzhonghu commented Oct 28, 2022

kfaseela commented Nov 2, 2022

kfaseela commented Mar 8, 2023

anannaya commented Apr 22, 2023

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023 • edited

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023 • edited

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023 • edited

kfaseela commented Apr 22, 2023

kfaseela commented Apr 22, 2023

anannaya commented Apr 22, 2023

anannaya commented Apr 24, 2023

kfaseela commented Apr 24, 2023

anannaya commented Apr 24, 2023 • edited

kfaseela commented Oct 26, 2022 •

edited

anannaya commented Apr 22, 2023 •

edited

anannaya commented Apr 22, 2023 •

edited

anannaya commented Apr 22, 2023 •

edited

anannaya commented Apr 24, 2023 •

edited