Add new TLS options sigalgs() and client-sigalgs()

[MrAnno]

This PR adds 2 new TLS options, which make it possible to restrict which signature/hash pairs can be used in digital signatures.

This is a TLS extension specified by RFC5246:
https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1

sigalgs:

This sets the supported signature algorithms for TLSv1.2 and TLSv1.3.
For clients this value is used directly for the supported signature
algorithms extension. For servers it is used to determine which
signature algorithms to support.

client-sigalgs:

This sets the supported signature algorithms associated with client
authentication for TLSv1.2 and TLSv1.3. For servers the value is used
in the signature_algorithms field of a CertificateRequest message.
For clients it is used to determine which signature algorithm to use
with the client certificate.

Example config:

source {
	network(port(4444) transport(tls)
		tls(
			pkcs12-file("/home/anno/Work/syslog-ng/tls/localhost.p12")
			peer-verify(yes)
			client-sigalgs("RSA-PSS+SHA256:ed25519")
		)
	);
};

destination {
	network("localhost" port(4444) transport(tls)
		tls(
			pkcs12-file("/home/anno/Work/syslog-ng/tls/localhost.p12")
			peer-verify(yes)
			sigalgs("RSA-PSS+SHA256:ed25519")
		)
	);
};

Partially resolves #3993

[kira-syslogng]

Build SUCCESS

[kira-syslogng]

Build SUCCESS

[kira-syslogng]

Build SUCCESS

[OverOrion]

LGTM, tested:

Signature Hash Algorithms (2 algorithms)
    Signature Algorithm: rsa_pss_rsae_sha256 (0x0804)
    Signature Algorithm: ed25519 (0x0807)

[mohitvaid]

@MrAnno @gaborznagy is this change applicable for MQTT TLS as well?

[MrAnno]

Unfortunately, the MQTT source/destination uses a library (paho.mqtt.c), which does not support restricting sigalgs.
The best way to add support to the MQTT driver for this is asking them to either make it possible to freely configure an OpenSSL context or just add support for sigalgs restriction as we did.

https://github.com/eclipse/paho.mqtt.c

[mohitvaid]

How about supporting the ecdh-curve-list? I will follow up with paho separately.

paho discussion: eclipse-paho/paho.mqtt.c#1226

[MrAnno]

The same is true for ecdh-curve-list(): it is supported in standard network drivers, but not in MQTT/HTTP.

Supporting it in the HTTP destination is possible, let us know if you need it by opening a feature request .