security: Allow passing CurvePreferences in advancedtls (grpc#9292)

This PR adds a passthrough for `tls.Config.CurvePreferences` in
`advancedtls.Options`.

RELEASE NOTES:
* Add passthrough for `tls.Config.CurvePreferences` in
`advancedtls.Options`.

Author: gtcooke94

security/advancedtls/advancedtls.go

@@ -221,6 +221,9 @@ type Options struct {
 	// ciphersuites. TLS 1.3 ciphersuites are not configurable. If nil, a
 	// safe default list is used.
 	CipherSuites []uint16
+	// CurvePreferences contains the elliptic curves that will be used during the
+	// key exchange, in preference order. If empty, the default will be used.
+	CurvePreferences []tls.CurveID
 	// serverNameOverride is for testing only and only relevant on the client
 	// side. If set to a non-empty string, it will override the virtual host
 	// name of authority (e.g. :authority header field) in requests and the
@@ -278,6 +281,7 @@ func (o *Options) clientConfig() (*tls.Config, error) {
 		MinVersion:         o.MinTLSVersion,
 		MaxVersion:         o.MaxTLSVersion,
 		CipherSuites:       o.CipherSuites,
+		CurvePreferences:   o.CurvePreferences,
 	}
 	// Propagate root-certificate-related fields in tls.Config.
 	switch {
@@ -363,10 +367,11 @@ func (o *Options) serverConfig() (*tls.Config, error) {
 		clientAuth = tls.RequireAnyClientCert
 	}
 	config := &tls.Config{
-		ClientAuth:   clientAuth,
-		MinVersion:   o.MinTLSVersion,
-		MaxVersion:   o.MaxTLSVersion,
-		CipherSuites: o.CipherSuites,
+		ClientAuth:       clientAuth,
+		MinVersion:       o.MinTLSVersion,
+		MaxVersion:       o.MaxTLSVersion,
+		CipherSuites:     o.CipherSuites,
+		CurvePreferences: o.CurvePreferences,
 	}
 	// Propagate root-certificate-related fields in tls.Config.
 	switch {

security/advancedtls/advancedtls_test.go

@@ -161,6 +161,7 @@ func (s) TestClientOptionsConfigSuccessCases(t *testing.T) {
 		MinVersion             uint16
 		MaxVersion             uint16
 		cipherSuites           []uint16
+		curvePreferences       []tls.CurveID
 	}{
 		{
 			desc:                   "Use system default if no fields in RootCertificateOptions is specified",
@@ -187,6 +188,13 @@ func (s) TestClientOptionsConfigSuccessCases(t *testing.T) {
 				tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
 			},
 		},
+		{
+			desc: "CurvePreferences plumbing through client options",
+			curvePreferences: []tls.CurveID{
+				tls.X25519,
+				tls.CurveP256,
+			},
+		},
 	}
 	for _, test := range tests {
 		test := test
@@ -198,6 +206,7 @@ func (s) TestClientOptionsConfigSuccessCases(t *testing.T) {
 				MinTLSVersion:    test.MinVersion,
 				MaxTLSVersion:    test.MaxVersion,
 				CipherSuites:     test.cipherSuites,
+				CurvePreferences: test.curvePreferences,
 			}
 			clientConfig, err := clientOptions.clientConfig()
 			if err != nil {
@@ -232,6 +241,9 @@ func (s) TestClientOptionsConfigSuccessCases(t *testing.T) {
 			if diff := cmp.Diff(clientConfig.CipherSuites, test.cipherSuites); diff != "" {
 				t.Errorf("cipherSuites diff (-want +got):\n%s", diff)
 			}
+			if diff := cmp.Diff(clientConfig.CurvePreferences, test.curvePreferences); diff != "" {
+				t.Errorf("curvePreferences diff (-want +got):\n%s", diff)
+			}
 		})
 	}
 }
@@ -317,6 +329,7 @@ func (s) TestServerOptionsConfigSuccessCases(t *testing.T) {
 		MinVersion             uint16
 		MaxVersion             uint16
 		cipherSuites           []uint16
+		curvePreferences       []tls.CurveID
 	}{
 		{
 			desc:                   "Use system default if no fields in RootCertificateOptions is specified",
@@ -367,6 +380,19 @@ func (s) TestServerOptionsConfigSuccessCases(t *testing.T) {
 			},
 			MinVersion: tls.VersionTLS12,
 		},
+		{
+			desc: "CurvePreferences plumbing through server options",
+			IdentityOptions: IdentityCertificateOptions{
+				Certificates: []tls.Certificate{},
+			},
+			RootOptions: RootCertificateOptions{
+				RootCertificates: x509.NewCertPool(),
+			},
+			curvePreferences: []tls.CurveID{
+				tls.X25519,
+				tls.CurveP256,
+			},
+		},
 	}
 	for _, test := range tests {
 		test := test
@@ -379,6 +405,7 @@ func (s) TestServerOptionsConfigSuccessCases(t *testing.T) {
 				MinTLSVersion:     test.MinVersion,
 				MaxTLSVersion:     test.MaxVersion,
 				CipherSuites:      test.cipherSuites,
+				CurvePreferences:  test.curvePreferences,
 			}
 			serverConfig, err := serverOptions.serverConfig()
 			if err != nil {
@@ -395,6 +422,9 @@ func (s) TestServerOptionsConfigSuccessCases(t *testing.T) {
 			if diff := cmp.Diff(serverConfig.CipherSuites, test.cipherSuites); diff != "" {
 				t.Errorf("cipherSuites diff (-want +got):\n%s", diff)
 			}
+			if diff := cmp.Diff(serverConfig.CurvePreferences, test.curvePreferences); diff != "" {
+				t.Errorf("curvePreferences diff (-want +got):\n%s", diff)
+			}
 		})
 	}
 }