TLS: Add CurvePreferences (to enable kyber768) (#3991)

Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>

infra/conf/transport_internet.go

@@ -456,6 +456,7 @@ type TLSConfig struct {
 	RejectUnknownSNI                     bool             `json:"rejectUnknownSni"`
 	PinnedPeerCertificateChainSha256     *[]string        `json:"pinnedPeerCertificateChainSha256"`
 	PinnedPeerCertificatePublicKeySha256 *[]string        `json:"pinnedPeerCertificatePublicKeySha256"`
+	CurvePreferences                     *StringList      `json:"curvePreferences"`
 	MasterKeyLog                         string           `json:"masterKeyLog"`
 }
 
@@ -478,6 +479,9 @@ func (c *TLSConfig) Build() (proto.Message, error) {
 	if c.ALPN != nil && len(*c.ALPN) > 0 {
 		config.NextProtocol = []string(*c.ALPN)
 	}
+	if c.CurvePreferences != nil && len(*c.CurvePreferences) > 0 {
+		config.CurvePreferences = []string(*c.CurvePreferences)
+	}
 	config.EnableSessionResumption = c.EnableSessionResumption
 	config.DisableSystemRoot = c.DisableSystemRoot
 	config.MinVersion = c.MinVersion

transport/internet/tls/config.go

@@ -344,6 +344,10 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
 		config.ServerName = sn
 	}
 
+	if len(c.CurvePreferences) > 0 {
+		config.CurvePreferences = ParseCurveName(c.CurvePreferences)
+	}
+
 	if len(config.NextProtos) == 0 {
 		config.NextProtos = []string{"h2", "http/1.1"}
 	}
@@ -429,3 +433,23 @@ func ConfigFromStreamSettings(settings *internet.MemoryStreamConfig) *Config {
 	}
 	return config
 }
+
+func ParseCurveName(curveNames []string) []tls.CurveID {
+	curveMap := map[string]tls.CurveID{
+		"curvep256":             tls.CurveP256,
+		"curvep384":             tls.CurveP384,
+		"curvep521":             tls.CurveP521,
+		"x25519":                tls.X25519,
+		"x25519kyber768draft00": 0x6399,
+	}
+
+	var curveIDs []tls.CurveID
+	for _, name := range curveNames {
+		if curveID, ok := curveMap[strings.ToLower(name)]; ok {
+			curveIDs = append(curveIDs, curveID)
+		} else {
+			errors.LogWarning(context.Background(), "unsupported curve name: "+name)
+		}
+	}
+	return curveIDs
+}

transport/internet/tls/config.proto

@@ -84,4 +84,7 @@ message Config {
   repeated bytes pinned_peer_certificate_public_key_sha256 = 14;
 
   string master_key_log = 15;
+
+  // Lists of string as CurvePreferences values.
+  repeated string curve_preferences = 16;
 }