support PQC supported ciphers and ECDH curves from envoy

gateway/configs/config-template.toml

@@ -252,11 +252,26 @@ key_path = "./listener-certs/default-listener.key"
 minimum_protocol_version = "TLS1_2"
 maximum_protocol_version = "TLS1_3"
 ciphers = "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,AES128-GCM-SHA256,AES128-SHA,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,AES256-GCM-SHA384,AES256-SHA"
+# Comma-separated ECDH curves for the TLS key exchange, most preferred first.
+# Defaults to the hybrid post-quantum group X25519MLKEM768 (FIPS 203 ML-KEM-768
+# + X25519) followed by classical curves X25519 and P-256, so key exchange
+# degrades gracefully to classical for peers that don't yet support the
+# hybrid group. An unsupported curve name is rejected by Envoy when it
+# applies the resulting config, not by this file.
+ecdh_curves = "X25519MLKEM768,X25519,P-256"
 
 [router.upstream.tls]
 minimum_protocol_version = "TLS1_2"
 maximum_protocol_version = "TLS1_3"
 ciphers = "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,AES128-GCM-SHA256,AES128-SHA,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,AES256-GCM-SHA384,AES256-SHA"
+# Comma-separated ECDH curves for the TLS key exchange, most preferred first.
+# Classical curves only by default. A hybrid post-quantum group (e.g.
+# "X25519MLKEM768", FIPS 203 ML-KEM-768 + X25519) can be prepended as an
+# explicit per-deployment opt-in once the deployed Envoy/BoringSSL build is
+# confirmed to support it -- an already-running Envoy that doesn't recognize
+# the curve name will NACK this config and keep serving its last-known-good
+# state instead of picking up any further changes.
+ecdh_curves = "X25519,P-256"
 trusted_cert_path = "/etc/ssl/certs/ca-certificates.crt"
 custom_certs_path = "./certificates"
 verify_host_name = true
@@ -336,6 +351,42 @@ allowed_ips = ["*", "127.0.0.1"]
 # Service port.
 enabled = false
 
+[policy_engine.admin.tls]
+# Starts a second, TLS-only admin listener on `port` below, serving the same
+# routes (/health, /xds_sync_status, /config_dump when enabled) as the
+# plaintext listener above. Off by default: no certificate is provisioned by
+# default, and the plaintext listener keeps working either way.
+enabled = false
+port = 9004
+cert_path = "./listener-certs/default-listener.crt"
+key_path = "./listener-certs/default-listener.key"
+# TLS version bounds, one of "TLS1_0", "TLS1_1", "TLS1_2", "TLS1_3". Same
+# vocabulary as router.downstream_tls/upstream_tls above for consistency
+# within this file, though enforced by a different TLS stack (Go's own
+# crypto/tls here, Envoy/BoringSSL there).
+minimum_protocol_version = "TLS1_2"
+maximum_protocol_version = "TLS1_3"
+# Comma-separated Go crypto/tls cipher suite names (e.g.
+# "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"), restricting which suites this
+# listener negotiates. Empty by default -- Go's own secure default set/order
+# applies. Only affects TLS 1.2 and below; TLS 1.3 suite selection is fixed
+# and not configurable in Go's crypto/tls. Note this is a different naming
+# scheme than router.downstream_tls's `ciphers` above (OpenSSL/BoringSSL
+# names like "ECDHE-ECDSA-AES128-GCM-SHA256") -- see crypto/tls.CipherSuites
+# for the names this listener accepts.
+ciphers = ""
+# Comma-separated TLS 1.3 key-exchange groups, most preferred first.
+# Classical curves only by default. A hybrid post-quantum group (e.g.
+# "X25519MLKEM768", FIPS 203 ML-KEM-768 + X25519) can be prepended as an
+# explicit opt-in once the clients reaching this listener are confirmed to
+# support it. This listener is served by this process's own Go crypto/tls
+# (1.23+ implements X25519MLKEM768 natively), not pushed as xDS config to a
+# separate Envoy process, so enabling it here does not carry the "already-
+# running peer NACKs the update" risk documented on router.downstream_tls's
+# ecdh_curves above -- TLS 1.3 negotiation just falls back to a later
+# classical entry in this same list for a client that doesn't offer it.
+ecdh_curves = "X25519,P-256"
+
 [policy_engine.admin.pprof]
 # Go runtime profiling (net/http/pprof) served on the admin server, off by default.
 # When profiling, also restrict admin.allowed_ips or reach it via port-forward.

gateway/docker-compose.yaml

@@ -62,13 +62,15 @@ services:
       # Policy Engine
       - "9002:9002"   # Admin API
       - "9003:9003"   # Metrics
+      - "9004:9004"   # Health
     env_file:
       - path: api-platform.env
         required: true
         format: raw
     volumes:
       - ./configs/config.toml:/etc/policy-engine/config.toml:ro
       - ./configs/llm-pricing/model_prices.json:/etc/policy-engine/llm-pricing/model_prices.json:ro
+      - ./gateway-controller/listener-certs:/etc/policy-engine/listener-certs:ro
     networks:
       - gateway-network
 

gateway/gateway-controller/pkg/config/config.go

@@ -564,7 +564,15 @@ type UpstreamTLS struct {
 	MinimumProtocolVersion string `koanf:"minimum_protocol_version"`
 	MaximumProtocolVersion string `koanf:"maximum_protocol_version"`
 	Ciphers                string `koanf:"ciphers"`
-	TrustedCertPath        string `koanf:"trusted_cert_path"`
+	// EcdhCurves is a comma-separated list of ECDH curves (e.g. "X25519,P-256"), most preferred
+	// first. Defaults to classical curves only — a hybrid post-quantum group (e.g.
+	// "X25519MLKEM768") can be added as the first preference, but only as an explicit opt-in per
+	// deployment: an already-running Envoy instance that doesn't recognize the curve name will
+	// NACK the xDS update and keep serving its last-known-good config, silently freezing that
+	// instance out of any further config changes until the operator fixes it. Confirm the
+	// deployed Envoy/BoringSSL build supports the group before enabling it.
+	EcdhCurves      string `koanf:"ecdh_curves"`
+	TrustedCertPath string `koanf:"trusted_cert_path"`
 	CustomCertsPath        string `koanf:"custom_certs_path"` // Directory containing custom trusted certificates
 	VerifyHostName         bool   `koanf:"verify_host_name"`
 	DisableSslVerification bool   `koanf:"disable_ssl_verification"`
@@ -594,6 +602,14 @@ type DownstreamTLS struct {
 	MinimumProtocolVersion string `koanf:"minimum_protocol_version"`
 	MaximumProtocolVersion string `koanf:"maximum_protocol_version"`
 	Ciphers                string `koanf:"ciphers"`
+	// EcdhCurves is a comma-separated list of ECDH curves (e.g. "X25519,P-256"), most preferred
+	// first. Defaults to classical curves only — a hybrid post-quantum group (e.g.
+	// "X25519MLKEM768") can be added as the first preference, but only as an explicit opt-in per
+	// deployment: an already-running Envoy instance that doesn't recognize the curve name will
+	// NACK the xDS update and keep serving its last-known-good config, silently freezing that
+	// instance out of any further config changes until the operator fixes it. Confirm the
+	// deployed Envoy/BoringSSL build supports the group before enabling it.
+	EcdhCurves string `koanf:"ecdh_curves"`
 }
 
 // VHostsConfig for vhosts configuration
@@ -989,13 +1005,15 @@ func defaultConfig() *Config {
 				MinimumProtocolVersion: "TLS1_2",
 				MaximumProtocolVersion: "TLS1_3",
 				Ciphers:                "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,AES128-GCM-SHA256,AES128-SHA,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,AES256-GCM-SHA384,AES256-SHA",
+				EcdhCurves:             "X25519,P-256",
 			},
 			GatewayHost: "*",
 			Upstream: RouterUpstream{
 				TLS: UpstreamTLS{
 					MinimumProtocolVersion: "TLS1_2",
 					MaximumProtocolVersion: "TLS1_3",
 					Ciphers:                "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,AES128-GCM-SHA256,AES128-SHA,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,AES256-GCM-SHA384,AES256-SHA",
+					EcdhCurves:             "X25519,P-256",
 					TrustedCertPath:        "/etc/ssl/certs/ca-certificates.crt",
 					CustomCertsPath:        "./certificates",
 					VerifyHostName:         true,
@@ -1570,6 +1588,11 @@ func (c *Config) validateTLSConfig() error {
 		}
 	}
 
+	// Validate ECDH curves
+	if err := validateEcdhCurves("router.upstream.tls.ecdh_curves", c.Router.Upstream.TLS.EcdhCurves); err != nil {
+		return err
+	}
+
 	// Validate trusted cert path if SSL verification is enabled
 	if !c.Router.Upstream.TLS.DisableSslVerification && c.Router.Upstream.TLS.TrustedCertPath == "" {
 		return fmt.Errorf("router.upstream.tls.trusted_cert_path is required when SSL verification is enabled")
@@ -1667,6 +1690,36 @@ func (c *Config) validateDownstreamTLSConfig() error {
 		}
 	}
 
+	// Validate ECDH curves
+	if err := validateEcdhCurves("router.downstream_tls.ecdh_curves", c.Router.DownstreamTLS.EcdhCurves); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// validateEcdhCurves validates the format of a comma-separated ecdh_curves config value.
+// It deliberately does not check curve names against a fixed allowlist — the set of curves
+// Envoy/BoringSSL accepts (including newer hybrid post-quantum groups such as
+// "X25519MLKEM768") evolves independently of this codebase, so Envoy itself is the source of
+// truth for which names are valid; an unsupported name is rejected when Envoy applies the
+// resulting listener/cluster config. fieldPath is used to prefix any returned error.
+func validateEcdhCurves(fieldPath, curves string) error {
+	if curves == "" {
+		return nil
+	}
+	// Basic validation: ensure curves don't contain invalid characters
+	if strings.Contains(curves, constants.CipherInvalidChars1) || strings.Contains(curves, constants.CipherInvalidChars2) {
+		return fmt.Errorf("%s contains invalid characters (use comma-separated values)", fieldPath)
+	}
+	if strings.TrimSpace(curves) == "" {
+		return fmt.Errorf("%s cannot be empty or whitespace only", fieldPath)
+	}
+	for _, curve := range strings.Split(curves, constants.CipherSuiteSeparator) {
+		if strings.TrimSpace(curve) == "" {
+			return fmt.Errorf("%s cannot contain an empty curve name (use comma-separated values)", fieldPath)
+		}
+	}
 	return nil
 }
 

gateway/gateway-controller/pkg/config/config_test.go

@@ -944,6 +944,37 @@ func TestConfig_ValidateTLSCiphers(t *testing.T) {
 	}
 }
 
+func TestConfig_ValidateUpstreamTLSEcdhCurves(t *testing.T) {
+	tests := []struct {
+		name        string
+		curves      string
+		wantErr     bool
+		errContains string
+	}{
+		{name: "Valid single curve", curves: "X25519", wantErr: false},
+		{name: "Valid multiple curves", curves: "X25519,P-256", wantErr: false},
+		{name: "Empty curves", curves: "", wantErr: false},
+		{name: "Curves with spaces", curves: "X25519, P-256", wantErr: false},
+		{name: "Hybrid post-quantum curve", curves: "X25519MLKEM768,SecP256r1MLKEM768,X25519,P-256", wantErr: false},
+		{name: "Empty entry", curves: "X25519,,P-256", wantErr: true, errContains: "empty curve name"},
+		{name: "Invalid separator character", curves: "X25519;P-256", wantErr: true, errContains: "invalid characters"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := validConfig()
+			cfg.Router.Upstream.TLS.EcdhCurves = tt.curves
+			err := cfg.Validate()
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
 func TestConfig_ValidateTLSTrustedCertPath(t *testing.T) {
 	cfg := validConfig()
 	cfg.Router.Upstream.TLS.DisableSslVerification = false
@@ -1724,6 +1755,42 @@ func TestConfig_ValidateDownstreamTLSConfig(t *testing.T) {
 	}
 }
 
+func TestConfig_ValidateDownstreamTLSEcdhCurves(t *testing.T) {
+	tests := []struct {
+		name        string
+		curves      string
+		wantErr     bool
+		errContains string
+	}{
+		{name: "Valid single curve", curves: "P-256", wantErr: false},
+		{name: "Valid multiple curves", curves: "X25519,P-256,P-384,P-521", wantErr: false},
+		{name: "Empty curves", curves: "", wantErr: false},
+		{name: "Hybrid post-quantum curve", curves: "X25519MLKEM768,X25519,P-256", wantErr: false},
+		{name: "Empty entry", curves: ",X25519", wantErr: true, errContains: "empty curve name"},
+		{name: "Invalid separator character", curves: "X25519|P-256", wantErr: true, errContains: "invalid characters"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := validConfig()
+			cfg.Router.HTTPSEnabled = true
+			cfg.Router.HTTPSPort = 8443
+			cfg.Router.DownstreamTLS.CertPath = "/path/to/cert.pem"
+			cfg.Router.DownstreamTLS.KeyPath = "/path/to/key.pem"
+			cfg.Router.DownstreamTLS.MinimumProtocolVersion = constants.TLSVersion12
+			cfg.Router.DownstreamTLS.MaximumProtocolVersion = constants.TLSVersion13
+			cfg.Router.DownstreamTLS.EcdhCurves = tt.curves
+			err := cfg.Validate()
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
 func TestConfig_Validate_CompleteValidConfig(t *testing.T) {
 	cfg := validConfig()
 	err := cfg.Validate()
@@ -1744,6 +1811,19 @@ func TestDefaultConfig(t *testing.T) {
 	assert.Equal(t, time.Duration(0), hcm.RequestHeadersTimeout, "default request_headers_timeout should be 0s (disabled)")
 	assert.Equal(t, 5*time.Minute, hcm.StreamIdleTimeout, "default stream_idle_timeout should be 5m")
 	assert.Equal(t, time.Hour, hcm.IdleTimeout, "default idle_timeout should be 1h")
+
+	// TLS 1.2-1.3 must be available by default on both upstream and downstream.
+	// ECDH curves default to classical only (X25519, P-256): prepending a hybrid
+	// post-quantum group is an explicit per-deployment opt-in (see the EcdhCurves
+	// field doc), not a default, because an already-running Envoy instance that
+	// doesn't recognize the curve name would NACK the xDS update rather than
+	// picking up the change.
+	assert.Equal(t, "TLS1_2", cfg.Router.DownstreamTLS.MinimumProtocolVersion)
+	assert.Equal(t, "TLS1_3", cfg.Router.DownstreamTLS.MaximumProtocolVersion)
+	assert.Equal(t, "X25519,P-256", cfg.Router.DownstreamTLS.EcdhCurves)
+	assert.Equal(t, "TLS1_2", cfg.Router.Upstream.TLS.MinimumProtocolVersion)
+	assert.Equal(t, "TLS1_3", cfg.Router.Upstream.TLS.MaximumProtocolVersion)
+	assert.Equal(t, "X25519,P-256", cfg.Router.Upstream.TLS.EcdhCurves)
 }
 
 func TestLoadConfig_HCMTimeouts(t *testing.T) {

gateway/gateway-controller/pkg/xds/translator.go

@@ -2293,6 +2293,7 @@ func (t *Translator) createUpstreamTLSContext(certificate []byte, address string
 					t.routerConfig.Upstream.TLS.MaximumProtocolVersion,
 				),
 				CipherSuites: t.parseCipherSuites(t.routerConfig.Upstream.TLS.Ciphers),
+				EcdhCurves:   t.parseCipherSuites(t.routerConfig.Upstream.TLS.EcdhCurves),
 			},
 		},
 	}
@@ -2438,6 +2439,12 @@ func (t *Translator) createDownstreamTLSContext() (*tlsv3.DownstreamTlsContext,
 		cipherSuites = t.parseCipherSuites(t.routerConfig.DownstreamTLS.Ciphers)
 	}
 
+	// Parse ECDH curves
+	var ecdhCurves []string
+	if t.routerConfig.DownstreamTLS.EcdhCurves != "" {
+		ecdhCurves = t.parseCipherSuites(t.routerConfig.DownstreamTLS.EcdhCurves)
+	}
+
 	// Create downstream TLS context
 	downstreamTLSContext := &tlsv3.DownstreamTlsContext{
 		CommonTlsContext: &tlsv3.CommonTlsContext{
@@ -2450,6 +2457,7 @@ func (t *Translator) createDownstreamTLSContext() (*tlsv3.DownstreamTlsContext,
 					t.routerConfig.DownstreamTLS.MaximumProtocolVersion,
 				),
 				CipherSuites: cipherSuites,
+				EcdhCurves:   ecdhCurves,
 			},
 			AlpnProtocols: []string{constants.ALPNProtocolHTTP2, constants.ALPNProtocolHTTP11},
 		},
@@ -2474,7 +2482,8 @@ func (t *Translator) createTLSProtocolVersion(version string) tlsv3.TlsParameter
 	}
 }
 
-// parseCipherSuites splits and trims cipher suite string into array
+// parseCipherSuites splits and trims a comma-separated string into an array.
+// Used for both cipher suite lists and ECDH curve lists.
 func (t *Translator) parseCipherSuites(ciphers string) []string {
 	if ciphers == "" {
 		return nil

gateway/gateway-controller/pkg/xds/translator_test.go

@@ -2352,13 +2352,15 @@ func TestTranslator_CreateSDSCluster(t *testing.T) {
 func TestTranslator_CreateUpstreamTLSContext(t *testing.T) {
 	logger := createTestLogger()
 	routerCfg := testRouterConfig()
+	routerCfg.Upstream.TLS.EcdhCurves = "X25519,P-256"
 	cfg := testConfig()
 	translator := NewTranslator(logger, routerCfg, nil, cfg)
 
 	// Test with no certificate
 	tlsContext := translator.createUpstreamTLSContext(nil, "example.com")
 	assert.NotNil(t, tlsContext)
 	assert.Equal(t, "example.com", tlsContext.Sni)
+	assert.Equal(t, []string{"X25519", "P-256"}, tlsContext.CommonTlsContext.TlsParams.EcdhCurves)
 
 	// Test with certificate
 	certPem := []byte("-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----")

gateway/gateway-runtime/Dockerfile

@@ -21,7 +21,7 @@
 
 # Envoy base image version — referenced by all stages that derive from envoyproxy/envoy.
 # Update here to bump Envoy across python-deps, debug, and production stages.
-ARG ENVOY_VERSION=v1.38.3
+ARG ENVOY_VERSION=v1.39.0
 
 # Stage 1: Builder Base
 FROM --platform=$BUILDPLATFORM golang:1.26.5-bookworm AS builder-base