Skip to content

Commit 89af32f

Browse files
eshitachandwanieshitachandwani
authored
xds: Add SNI related field in handshake info (grpc#8965)
This PR is part of [A101 ](https://github.com/grpc/proposal/blob/master/A101-SNI-setting-and-SNI-SAN-validation.md) implementation. This PR does the following changes: 1. Add `sni` and `autoSniSanValidation` field to handshake info. 2. Change the TLS config building to add SNI if env variable is true (currently false by default so will not be set), and `sni` is present (currently set as empty in handshake so will not be set). 3. Change verify function to match SANs against SNI if set and env variable and `autoSniSanValidation` is true (currently set to false by default). 4. Set `sni` to empty and `autoSniSanValidation` to false by default when creating handshake info in `clusterimpl` 5. Adds tests to verify the happy and failure cases of handshake. In the next PR : 1. Will decide between hostname and SNI from CDS update in `clusterimpl` balancer. 2. Add end to end tests to verify the SNI flow. RELEASE NOTES: None
1 parent 45a3304 commit 89af32f

File tree

6 files changed

+189
-61
lines changed

6 files changed

+189
-61
lines changed

‎credentials/xds/xds_client_test.go‎

Lines changed: 92 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ import (
3535
"google.golang.org/grpc/credentials/tls/certprovider"
3636
icredentials "google.golang.org/grpc/internal/credentials"
3737
xdsinternal "google.golang.org/grpc/internal/credentials/xds"
38+
"google.golang.org/grpc/internal/envconfig"
3839
"google.golang.org/grpc/internal/grpctest"
3940
"google.golang.org/grpc/internal/testutils"
4041
"google.golang.org/grpc/internal/xds/matcher"
@@ -219,7 +220,7 @@ func makeRootProvider(t *testing.T, caPath string) *fakeProvider {
219220

220221
// newTestContextWithHandshakeInfo returns a copy of parent with HandshakeInfo
221222
// context value added to it.
222-
func newTestContextWithHandshakeInfo(parent context.Context, root, identity certprovider.Provider, sanExactMatch string) context.Context {
223+
func newTestContextWithHandshakeInfo(parent context.Context, root, identity certprovider.Provider, sanExactMatch, sni string, validateSANUsingSNI bool) context.Context {
223224
// Creating the HandshakeInfo and adding it to the attributes is very
224225
// similar to what the CDS balancer would do when it intercepts calls to
225226
// NewSubConn().
@@ -228,7 +229,7 @@ func newTestContextWithHandshakeInfo(parent context.Context, root, identity cert
228229
sms = []matcher.StringMatcher{matcher.NewExactStringMatcher(sanExactMatch, false)}
229230
}
230231
var hiPtr atomic.Pointer[xdsinternal.HandshakeInfo]
231-
info := xdsinternal.NewHandshakeInfo(root, identity, sms, false)
232+
info := xdsinternal.NewHandshakeInfo(root, identity, sms, false, sni, validateSANUsingSNI)
232233
hiPtr.Store(info)
233234
addr := xdsinternal.SetHandshakeInfo(resolver.Address{}, &hiPtr)
234235

@@ -302,7 +303,7 @@ func (s) TestClientCredsInvalidHandshakeInfo(t *testing.T) {
302303

303304
pCtx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
304305
defer cancel()
305-
ctx := newTestContextWithHandshakeInfo(pCtx, nil, &fakeProvider{}, "")
306+
ctx := newTestContextWithHandshakeInfo(pCtx, nil, &fakeProvider{}, "", "", false)
306307
if _, _, err := creds.ClientHandshake(ctx, authority, nil); err == nil {
307308
t.Fatal("ClientHandshake succeeded without root certificate provider in HandshakeInfo")
308309
}
@@ -339,7 +340,7 @@ func (s) TestClientCredsProviderFailure(t *testing.T) {
339340
t.Run(test.desc, func(t *testing.T) {
340341
ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
341342
defer cancel()
342-
ctx = newTestContextWithHandshakeInfo(ctx, test.rootProvider, test.identityProvider, "")
343+
ctx = newTestContextWithHandshakeInfo(ctx, test.rootProvider, test.identityProvider, "", "", false)
343344
if _, _, err := creds.ClientHandshake(ctx, authority, nil); err == nil || !strings.Contains(err.Error(), test.wantErr) {
344345
t.Fatalf("ClientHandshake() returned error: %q, wantErr: %q", err, test.wantErr)
345346
}
@@ -353,6 +354,7 @@ func (s) TestClientCredsSuccess(t *testing.T) {
353354
desc string
354355
handshakeFunc testHandshakeFunc
355356
handshakeInfoCtx func(ctx context.Context) context.Context
357+
enableSNIFlag bool
356358
}{
357359
{
358360
desc: "fallback",
@@ -367,27 +369,59 @@ func (s) TestClientCredsSuccess(t *testing.T) {
367369
desc: "TLS",
368370
handshakeFunc: testServerTLSHandshake,
369371
handshakeInfoCtx: func(ctx context.Context) context.Context {
370-
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), nil, defaultTestCertSAN)
372+
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), nil, defaultTestCertSAN, "", false)
371373
},
372374
},
373375
{
374376
desc: "mTLS",
375377
handshakeFunc: testServerMutualTLSHandshake,
376378
handshakeInfoCtx: func(ctx context.Context) context.Context {
377-
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/server1_cert.pem", "x509/server1_key.pem"), defaultTestCertSAN)
379+
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/server1_cert.pem", "x509/server1_key.pem"), defaultTestCertSAN, "", false)
378380
},
379381
},
380382
{
381383
desc: "mTLS with no acceptedSANs specified",
382384
handshakeFunc: testServerMutualTLSHandshake,
383385
handshakeInfoCtx: func(ctx context.Context) context.Context {
384-
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/server1_cert.pem", "x509/server1_key.pem"), "")
386+
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/server1_cert.pem", "x509/server1_key.pem"), "", "", false)
385387
},
386388
},
389+
{
390+
desc: "TLS with SNI",
391+
handshakeFunc: testServerTLSHandshake,
392+
handshakeInfoCtx: func(ctx context.Context) context.Context {
393+
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), nil, "bad-match", defaultTestCertSAN, true)
394+
},
395+
enableSNIFlag: true,
396+
},
397+
{
398+
desc: "TLS with SNI, env variable disabled, AutoSniSanValidation enabled",
399+
handshakeFunc: testServerTLSHandshake,
400+
handshakeInfoCtx: func(ctx context.Context) context.Context {
401+
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), nil, defaultTestCertSAN, "bad-sni", true)
402+
},
403+
},
404+
{
405+
desc: "TLS with SNI, env variable enabled but AutoSniSanValidation disabled",
406+
handshakeFunc: testServerTLSHandshake,
407+
handshakeInfoCtx: func(ctx context.Context) context.Context {
408+
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), nil, defaultTestCertSAN, "bad-sni", false)
409+
},
410+
enableSNIFlag: true,
411+
},
412+
{
413+
desc: "TLS with empty SNI, env variable enabled, AutoSniSanValidation enabled",
414+
handshakeFunc: testServerTLSHandshake,
415+
handshakeInfoCtx: func(ctx context.Context) context.Context {
416+
return newTestContextWithHandshakeInfo(ctx, makeRootProvider(t, "x509/server_ca_cert.pem"), nil, defaultTestCertSAN, "", true)
417+
},
418+
enableSNIFlag: true,
419+
},
387420
}
388421

389422
for _, test := range tests {
390423
t.Run(test.desc, func(t *testing.T) {
424+
testutils.SetEnvConfig(t, &envconfig.XDSSNIEnabled, test.enableSNIFlag)
391425
ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
392426
defer cancel()
393427
ts := newTestServerWithHandshakeFunc(ctx, test.handshakeFunc)
@@ -444,7 +478,7 @@ func (s) TestClientCredsHandshakeTimeout(t *testing.T) {
444478

445479
sCtx, sCancel := context.WithTimeout(context.Background(), defaultTestShortTimeout)
446480
defer sCancel()
447-
ctx = newTestContextWithHandshakeInfo(sCtx, makeRootProvider(t, "x509/server_ca_cert.pem"), nil, defaultTestCertSAN)
481+
ctx = newTestContextWithHandshakeInfo(sCtx, makeRootProvider(t, "x509/server_ca_cert.pem"), nil, defaultTestCertSAN, "", false)
448482
if _, _, err := creds.ClientHandshake(ctx, authority, conn); err == nil {
449483
t.Fatal("ClientHandshake() succeeded when expected to timeout")
450484
}
@@ -467,11 +501,14 @@ func (s) TestClientCredsHandshakeTimeout(t *testing.T) {
467501
// TestClientCredsHandshakeFailure verifies different handshake failure cases.
468502
func (s) TestClientCredsHandshakeFailure(t *testing.T) {
469503
tests := []struct {
470-
desc string
471-
handshakeFunc testHandshakeFunc
472-
rootProvider certprovider.Provider
473-
san string
474-
wantErr string
504+
desc string
505+
handshakeFunc testHandshakeFunc
506+
rootProvider certprovider.Provider
507+
san string
508+
sni string
509+
validateSANUsingSNI bool
510+
enableSNIFlag bool
511+
wantErr string
475512
}{
476513
{
477514
desc: "cert validation failure",
@@ -487,10 +524,49 @@ func (s) TestClientCredsHandshakeFailure(t *testing.T) {
487524
san: "bad-san",
488525
wantErr: "do not match any of the accepted SANs",
489526
},
527+
{
528+
desc: "SNI SAN mismatch",
529+
handshakeFunc: testServerTLSHandshake,
530+
rootProvider: makeRootProvider(t, "x509/server_ca_cert.pem"),
531+
sni: "bad-sni",
532+
validateSANUsingSNI: true,
533+
wantErr: "do not match the SNI",
534+
enableSNIFlag: true,
535+
},
536+
{
537+
desc: "SNI set, AutoSniSanValidation disabled with SAN mismatch",
538+
handshakeFunc: testServerTLSHandshake,
539+
rootProvider: makeRootProvider(t, "x509/server_ca_cert.pem"),
540+
sni: defaultTestCertSAN,
541+
san: "bad-san",
542+
validateSANUsingSNI: false,
543+
wantErr: "do not match any of the accepted SANs",
544+
enableSNIFlag: true,
545+
},
546+
{
547+
desc: "SNI set with SAN mismatch and AutoSniSanValidation enabled, environment variable disabled",
548+
handshakeFunc: testServerTLSHandshake,
549+
rootProvider: makeRootProvider(t, "x509/server_ca_cert.pem"),
550+
sni: defaultTestCertSAN,
551+
san: "bad-san",
552+
validateSANUsingSNI: true,
553+
wantErr: "do not match any of the accepted SANs",
554+
},
555+
{
556+
desc: "SNI empty, AutoSniSanValidation enabled with SAN mismatch",
557+
handshakeFunc: testServerTLSHandshake,
558+
rootProvider: makeRootProvider(t, "x509/server_ca_cert.pem"),
559+
sni: "",
560+
san: "bad-san",
561+
validateSANUsingSNI: true,
562+
wantErr: "do not match any of the accepted SANs",
563+
enableSNIFlag: true,
564+
},
490565
}
491566

492567
for _, test := range tests {
493568
t.Run(test.desc, func(t *testing.T) {
569+
testutils.SetEnvConfig(t, &envconfig.XDSSNIEnabled, test.enableSNIFlag)
494570
ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
495571
defer cancel()
496572
ts := newTestServerWithHandshakeFunc(ctx, test.handshakeFunc)
@@ -508,7 +584,7 @@ func (s) TestClientCredsHandshakeFailure(t *testing.T) {
508584
}
509585
defer conn.Close()
510586

511-
ctx = newTestContextWithHandshakeInfo(ctx, test.rootProvider, nil, test.san)
587+
ctx = newTestContextWithHandshakeInfo(ctx, test.rootProvider, nil, test.san, test.sni, test.validateSANUsingSNI)
512588
if _, _, err := creds.ClientHandshake(ctx, authority, conn); err == nil || !strings.Contains(err.Error(), test.wantErr) {
513589
t.Fatalf("ClientHandshake() returned %q, wantErr %q", err, test.wantErr)
514590
}
@@ -542,7 +618,7 @@ func (s) TestClientCredsProviderSwitch(t *testing.T) {
542618
// Create a root provider which will fail the handshake because it does not
543619
// use the correct trust roots.
544620
root1 := makeRootProvider(t, "x509/client_ca_cert.pem")
545-
handshakeInfo := xdsinternal.NewHandshakeInfo(root1, nil, []matcher.StringMatcher{matcher.NewExactStringMatcher(defaultTestCertSAN, false)}, false)
621+
handshakeInfo := xdsinternal.NewHandshakeInfo(root1, nil, []matcher.StringMatcher{matcher.NewExactStringMatcher(defaultTestCertSAN, false)}, false, "", false)
546622
// We need to repeat most of what newTestContextWithHandshakeInfo() does
547623
// here because we need access to the underlying HandshakeInfo so that we
548624
// can update it before the next call to ClientHandshake().
@@ -569,7 +645,7 @@ func (s) TestClientCredsProviderSwitch(t *testing.T) {
569645
// Create a new root provider which uses the correct trust roots. And update
570646
// the HandshakeInfo with the new provider.
571647
root2 := makeRootProvider(t, "x509/server_ca_cert.pem")
572-
handshakeInfo = xdsinternal.NewHandshakeInfo(root2, nil, []matcher.StringMatcher{matcher.NewExactStringMatcher(defaultTestCertSAN, false)}, false)
648+
handshakeInfo = xdsinternal.NewHandshakeInfo(root2, nil, []matcher.StringMatcher{matcher.NewExactStringMatcher(defaultTestCertSAN, false)}, false, "", false)
573649
// Update the existing pointer, which address attribute will continue to
574650
// point to.
575651
hiPtr.Store(handshakeInfo)

‎credentials/xds/xds_server_test.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ func (s) TestServerCredsInvalidHandshakeInfo(t *testing.T) {
123123
t.Fatalf("NewServerCredentials(%v) failed: %v", opts, err)
124124
}
125125

126-
info := xdsinternal.NewHandshakeInfo(&fakeProvider{}, nil, nil, false)
126+
info := xdsinternal.NewHandshakeInfo(&fakeProvider{}, nil, nil, false, "", false)
127127
conn := newWrappedConn(nil, info, time.Time{})
128128
if _, _, err := creds.ServerHandshake(conn); err == nil {
129129
t.Fatal("ServerHandshake succeeded without identity certificate provider in HandshakeInfo")
@@ -159,7 +159,7 @@ func (s) TestServerCredsProviderFailure(t *testing.T) {
159159
}
160160
for _, test := range tests {
161161
t.Run(test.desc, func(t *testing.T) {
162-
info := xdsinternal.NewHandshakeInfo(test.rootProvider, test.identityProvider, nil, false)
162+
info := xdsinternal.NewHandshakeInfo(test.rootProvider, test.identityProvider, nil, false, "", false)
163163
conn := newWrappedConn(nil, info, time.Time{})
164164
if _, _, err := creds.ServerHandshake(conn); err == nil || !strings.Contains(err.Error(), test.wantErr) {
165165
t.Fatalf("ServerHandshake() returned error: %q, wantErr: %q", err, test.wantErr)
@@ -235,7 +235,7 @@ func (s) TestServerCredsHandshakeTimeout(t *testing.T) {
235235
// Create a test server which uses the xDS server credentials created above
236236
// to perform TLS handshake on incoming connections.
237237
ts := newTestServerWithHandshakeFunc(ctx, func(rawConn net.Conn) handshakeResult {
238-
hi := xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/client_ca_cert.pem"), makeIdentityProvider(t, "x509/server2_cert.pem", "x509/server2_key.pem"), nil, true)
238+
hi := xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/client_ca_cert.pem"), makeIdentityProvider(t, "x509/server2_cert.pem", "x509/server2_key.pem"), nil, true, "", false)
239239

240240
// Create a wrapped conn which can return the HandshakeInfo created
241241
// above with a very small deadline.
@@ -287,7 +287,7 @@ func (s) TestServerCredsHandshakeFailure(t *testing.T) {
287287
ts := newTestServerWithHandshakeFunc(ctx, func(rawConn net.Conn) handshakeResult {
288288
// Create a HandshakeInfo which has a root provider which does not match
289289
// the certificate sent by the client.
290-
hi := xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/client2_cert.pem", "x509/client2_key.pem"), nil, true)
290+
hi := xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/client2_cert.pem", "x509/client2_key.pem"), nil, true, "", false)
291291

292292
// Create a wrapped conn which can return the HandshakeInfo and
293293
// configured deadline to the xDS credentials' ServerHandshake()
@@ -368,7 +368,7 @@ func (s) TestServerCredsHandshakeSuccess(t *testing.T) {
368368
// created above to perform TLS handshake on incoming connections.
369369
ts := newTestServerWithHandshakeFunc(ctx, func(rawConn net.Conn) handshakeResult {
370370
// Create a HandshakeInfo with information from the test table.
371-
hi := xdsinternal.NewHandshakeInfo(test.rootProvider, test.identityProvider, nil, test.requireClientCert)
371+
hi := xdsinternal.NewHandshakeInfo(test.rootProvider, test.identityProvider, nil, test.requireClientCert, "", false)
372372

373373
// Create a wrapped conn which can return the HandshakeInfo and
374374
// configured deadline to the xDS credentials' ServerHandshake()
@@ -448,7 +448,7 @@ func (s) TestServerCredsProviderSwitch(t *testing.T) {
448448
if cnt == 1 {
449449
// Create a HandshakeInfo which has a root provider which does not match
450450
// the certificate sent by the client.
451-
hi = xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/client2_cert.pem", "x509/client2_key.pem"), nil, true)
451+
hi = xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/client2_cert.pem", "x509/client2_key.pem"), nil, true, "", false)
452452

453453
// Create a wrapped conn which can return the HandshakeInfo and
454454
// configured deadline to the xDS credentials' ServerHandshake()
@@ -462,7 +462,7 @@ func (s) TestServerCredsProviderSwitch(t *testing.T) {
462462
return handshakeResult{}
463463
}
464464

465-
hi = xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/client_ca_cert.pem"), makeIdentityProvider(t, "x509/server1_cert.pem", "x509/server1_key.pem"), nil, true)
465+
hi = xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/client_ca_cert.pem"), makeIdentityProvider(t, "x509/server1_cert.pem", "x509/server1_key.pem"), nil, true, "", false)
466466

467467
// Create a wrapped conn which can return the HandshakeInfo and
468468
// configured deadline to the xDS credentials' ServerHandshake()

‎internal/credentials/xds/handshake_info.go‎

Lines changed: 35 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
"google.golang.org/grpc/credentials/tls/certprovider"
3333
"google.golang.org/grpc/internal"
3434
"google.golang.org/grpc/internal/credentials/spiffe"
35+
"google.golang.org/grpc/internal/envconfig"
3536
"google.golang.org/grpc/internal/xds/matcher"
3637
"google.golang.org/grpc/resolver"
3738
)
@@ -55,6 +56,8 @@ func (hi *HandshakeInfo) Equal(other *HandshakeInfo) bool {
5556
if hi.rootProvider != other.rootProvider ||
5657
hi.identityProvider != other.identityProvider ||
5758
hi.requireClientCert != other.requireClientCert ||
59+
hi.sni != other.sni ||
60+
hi.validateSANUsingSNI != other.validateSANUsingSNI ||
5861
len(hi.sanMatchers) != len(other.sanMatchers) {
5962
return false
6063
}
@@ -86,20 +89,24 @@ func HandshakeInfoFromAttributes(attr *attributes.Attributes) *atomic.Pointer[Ha
8689
type HandshakeInfo struct {
8790
// All fields written at init time and read only after that, so no
8891
// synchronization needed.
89-
rootProvider certprovider.Provider
90-
identityProvider certprovider.Provider
91-
sanMatchers []matcher.StringMatcher // Only on the client side.
92-
requireClientCert bool // Only on server side.
92+
rootProvider certprovider.Provider
93+
identityProvider certprovider.Provider
94+
sanMatchers []matcher.StringMatcher // Only on the client side.
95+
requireClientCert bool // Only on server side.
96+
sni string // Only on client side, used for Server Name Indication in TLS handshake.
97+
validateSANUsingSNI bool // Only on client side, indicates whether to perform validation of SANs based on SNI value.
9398
}
9499

95100
// NewHandshakeInfo returns a new handshake info configured with the provided
96101
// options.
97-
func NewHandshakeInfo(rootProvider certprovider.Provider, identityProvider certprovider.Provider, sanMatchers []matcher.StringMatcher, requireClientCert bool) *HandshakeInfo {
102+
func NewHandshakeInfo(rootProvider certprovider.Provider, identityProvider certprovider.Provider, sanMatchers []matcher.StringMatcher, requireClientCert bool, sni string, validateSANUsingSNI bool) *HandshakeInfo {
98103
return &HandshakeInfo{
99-
rootProvider: rootProvider,
100-
identityProvider: identityProvider,
101-
sanMatchers: sanMatchers,
102-
requireClientCert: requireClientCert,
104+
rootProvider: rootProvider,
105+
identityProvider: identityProvider,
106+
sanMatchers: sanMatchers,
107+
requireClientCert: requireClientCert,
108+
sni: sni,
109+
validateSANUsingSNI: validateSANUsingSNI,
103110
}
104111
}
105112

@@ -154,6 +161,10 @@ func (hi *HandshakeInfo) ClientSideTLSConfig(ctx context.Context) (*tls.Config,
154161
}
155162
cfg.Certificates = km.Certs
156163
}
164+
165+
if envconfig.XDSSNIEnabled && hi.sni != "" {
166+
cfg.ServerName = hi.sni
167+
}
157168
return cfg, nil
158169
}
159170

@@ -200,7 +211,21 @@ func (hi *HandshakeInfo) buildVerifyFunc(km *certprovider.KeyMaterial, isClient
200211
if _, err := certs[0].Verify(opts); err != nil {
201212
return err
202213
}
203-
// The SANs sent by the MeshCA are encoded as SPIFFE IDs. We need to
214+
215+
// If XDSSNIEnabled and AutoSNISANValidation are both true and the SNI is
216+
// non-empty, validate only DNS SANs against the SNI. Otherwise, fallback to
217+
// validating all received SANs against the control plane provided SAN
218+
// matchers.
219+
if envconfig.XDSSNIEnabled && hi.validateSANUsingSNI && hi.sni != "" {
220+
// Verify SAN of leaf certificate with SNI using exact DNS matcher.
221+
for _, san := range certs[0].DNSNames {
222+
if dnsMatch(hi.sni, san) {
223+
return nil
224+
}
225+
}
226+
return fmt.Errorf("xds: received DNS SANs: %v do not match the SNI: %v", certs[0].DNSNames, hi.sni)
227+
}
228+
// The SANs sent by the xDS control plane are encoded as SPIFFE IDs. We need to
204229
// only look at the SANs on the leaf cert.
205230
if cert := certs[0]; !hi.MatchingSANExists(cert) {
206231
// TODO: Print the complete certificate once the x509 package

0 commit comments

Comments
 (0)