xds: change clusterimpl to add SNI to handshake info (#9016)

This PR is the final PR for implementation of [gRFC
A101](https://github.com/grpc/proposal/blob/master/A101-SNI-setting-and-SNI-SAN-validation.md)

This PR does the following : 
- Change NewSubconn in ClusterImpl to add the hostname to attribute of
the address so that it can be propagated to the ClientHandshake and
retrieved there to decide the SNI which can be either DNS Hostname or
endpoint Hostname if `AutoHostSni` is set , or the SNI received from
control plane. This is done because each endpoint can have a different
hostname. It is not a config that can be used across all endpoints of
the cluster , so it cannot be set in handshake info.
- Add `AutoHostSni` filed to the handshake info.
- Adds a functions to set and get hostname from address attributes. As
of now, there was a function to get the Hostname from address
balancer.Attributes and set in endpoint atrributes.
- Adds E2E tests to verify the complete SNI setting and validation flow.
- Fix comments that mention CDS balancer creates handshake info.

Note: We will turn the environment variable to true only after inter-op
tests pass.

RELEASE NOTES:
- xds: add SNI support and SAN validation behind
GRPC_EXPERIMENTAL_XDS_SNI ([gRFC
A101](https://github.com/grpc/proposal/blob/master/A101-SNI-setting-and-SNI-SAN-validation.md))

Author: eshitachandwani

credentials/xds/xds.go

@@ -95,14 +95,14 @@ func (c *credsImpl) ClientHandshake(ctx context.Context, authority string, rawCo
 		return nil, nil, errors.New("ClientHandshake() is not supported for server credentials")
 	}
 
-	// The CDS balancer constructs a new HandshakeInfo using a call to
+	// The clusterimpl balancer constructs a new HandshakeInfo using a call to
 	// NewHandshakeInfo(), and then adds it to the attributes field of the
 	// resolver.Address when handling calls to NewSubConn(). The transport layer
 	// takes care of shipping these attributes in the context to this handshake
 	// function. We first read the credentials.ClientHandshakeInfo type from the
-	// context, which contains the attributes added by the CDS balancer. We then
-	// read the HandshakeInfo from the attributes to get to the actual data that
-	// we need here for the handshake.
+	// context, which contains the attributes added by the clusterimpl balancer.
+	// We then read the HandshakeInfo from the attributes to get to the actual
+	// data that we need here for the handshake.
 	chi := credentials.ClientHandshakeInfoFromContext(ctx)
 	// If there are no attributes in the received context or the attributes does
 	// not contain a HandshakeInfo, it could either mean that the user did not
@@ -133,7 +133,8 @@ func (c *credsImpl) ClientHandshake(ctx context.Context, authority string, rawCo
 	// 4. Key usage to match whether client/server usage.
 	// 5. A `VerifyPeerCertificate` function which performs normal peer
 	// 	  cert verification using configured roots, and the custom SAN checks.
-	cfg, err := hi.ClientSideTLSConfig(ctx)
+	hostname := xdsinternal.Hostname(chi.Attributes)
+	cfg, err := hi.ClientSideTLSConfig(ctx, hostname)
 	if err != nil {
 		return nil, nil, err
 	}

credentials/xds/xds_client_test.go

@@ -229,7 +229,7 @@ func newTestContextWithHandshakeInfo(parent context.Context, root, identity cert
 		sms = []matcher.StringMatcher{matcher.NewExactStringMatcher(sanExactMatch, false)}
 	}
 	var hiPtr atomic.Pointer[xdsinternal.HandshakeInfo]
-	info := xdsinternal.NewHandshakeInfo(root, identity, sms, false, sni, validateSANUsingSNI)
+	info := xdsinternal.NewHandshakeInfo(root, identity, sms, false, sni, validateSANUsingSNI, false)
 	hiPtr.Store(info)
 	addr := xdsinternal.SetHandshakeInfo(resolver.Address{}, &hiPtr)
 
@@ -618,7 +618,7 @@ func (s) TestClientCredsProviderSwitch(t *testing.T) {
 	// Create a root provider which will fail the handshake because it does not
 	// use the correct trust roots.
 	root1 := makeRootProvider(t, "x509/client_ca_cert.pem")
-	handshakeInfo := xdsinternal.NewHandshakeInfo(root1, nil, []matcher.StringMatcher{matcher.NewExactStringMatcher(defaultTestCertSAN, false)}, false, "", false)
+	handshakeInfo := xdsinternal.NewHandshakeInfo(root1, nil, []matcher.StringMatcher{matcher.NewExactStringMatcher(defaultTestCertSAN, false)}, false, "", false, false)
 	// We need to repeat most of what newTestContextWithHandshakeInfo() does
 	// here because we need access to the underlying HandshakeInfo so that we
 	// can update it before the next call to ClientHandshake().
@@ -645,7 +645,7 @@ func (s) TestClientCredsProviderSwitch(t *testing.T) {
 	// Create a new root provider which uses the correct trust roots. And update
 	// the HandshakeInfo with the new provider.
 	root2 := makeRootProvider(t, "x509/server_ca_cert.pem")
-	handshakeInfo = xdsinternal.NewHandshakeInfo(root2, nil, []matcher.StringMatcher{matcher.NewExactStringMatcher(defaultTestCertSAN, false)}, false, "", false)
+	handshakeInfo = xdsinternal.NewHandshakeInfo(root2, nil, []matcher.StringMatcher{matcher.NewExactStringMatcher(defaultTestCertSAN, false)}, false, "", false, false)
 	// Update the existing pointer, which address attribute will continue to
 	// point to.
 	hiPtr.Store(handshakeInfo)

credentials/xds/xds_server_test.go

@@ -123,7 +123,7 @@ func (s) TestServerCredsInvalidHandshakeInfo(t *testing.T) {
 		t.Fatalf("NewServerCredentials(%v) failed: %v", opts, err)
 	}
 
-	info := xdsinternal.NewHandshakeInfo(&fakeProvider{}, nil, nil, false, "", false)
+	info := xdsinternal.NewHandshakeInfo(&fakeProvider{}, nil, nil, false, "", false, false)
 	conn := newWrappedConn(nil, info, time.Time{})
 	if _, _, err := creds.ServerHandshake(conn); err == nil {
 		t.Fatal("ServerHandshake succeeded without identity certificate provider in HandshakeInfo")
@@ -159,7 +159,7 @@ func (s) TestServerCredsProviderFailure(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
-			info := xdsinternal.NewHandshakeInfo(test.rootProvider, test.identityProvider, nil, false, "", false)
+			info := xdsinternal.NewHandshakeInfo(test.rootProvider, test.identityProvider, nil, false, "", false, false)
 			conn := newWrappedConn(nil, info, time.Time{})
 			if _, _, err := creds.ServerHandshake(conn); err == nil || !strings.Contains(err.Error(), test.wantErr) {
 				t.Fatalf("ServerHandshake() returned error: %q, wantErr: %q", err, test.wantErr)
@@ -235,7 +235,7 @@ func (s) TestServerCredsHandshakeTimeout(t *testing.T) {
 	// Create a test server which uses the xDS server credentials created above
 	// to perform TLS handshake on incoming connections.
 	ts := newTestServerWithHandshakeFunc(ctx, func(rawConn net.Conn) handshakeResult {
-		hi := xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/client_ca_cert.pem"), makeIdentityProvider(t, "x509/server2_cert.pem", "x509/server2_key.pem"), nil, true, "", false)
+		hi := xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/client_ca_cert.pem"), makeIdentityProvider(t, "x509/server2_cert.pem", "x509/server2_key.pem"), nil, true, "", false, false)
 
 		// Create a wrapped conn which can return the HandshakeInfo created
 		// above with a very small deadline.
@@ -287,7 +287,7 @@ func (s) TestServerCredsHandshakeFailure(t *testing.T) {
 	ts := newTestServerWithHandshakeFunc(ctx, func(rawConn net.Conn) handshakeResult {
 		// Create a HandshakeInfo which has a root provider which does not match
 		// the certificate sent by the client.
-		hi := xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/client2_cert.pem", "x509/client2_key.pem"), nil, true, "", false)
+		hi := xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/client2_cert.pem", "x509/client2_key.pem"), nil, true, "", false, false)
 
 		// Create a wrapped conn which can return the HandshakeInfo and
 		// configured deadline to the xDS credentials' ServerHandshake()
@@ -368,7 +368,7 @@ func (s) TestServerCredsHandshakeSuccess(t *testing.T) {
 			// created above to perform TLS handshake on incoming connections.
 			ts := newTestServerWithHandshakeFunc(ctx, func(rawConn net.Conn) handshakeResult {
 				// Create a HandshakeInfo with information from the test table.
-				hi := xdsinternal.NewHandshakeInfo(test.rootProvider, test.identityProvider, nil, test.requireClientCert, "", false)
+				hi := xdsinternal.NewHandshakeInfo(test.rootProvider, test.identityProvider, nil, test.requireClientCert, "", false, false)
 
 				// Create a wrapped conn which can return the HandshakeInfo and
 				// configured deadline to the xDS credentials' ServerHandshake()
@@ -448,7 +448,7 @@ func (s) TestServerCredsProviderSwitch(t *testing.T) {
 		if cnt == 1 {
 			// Create a HandshakeInfo which has a root provider which does not match
 			// the certificate sent by the client.
-			hi = xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/client2_cert.pem", "x509/client2_key.pem"), nil, true, "", false)
+			hi = xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/server_ca_cert.pem"), makeIdentityProvider(t, "x509/client2_cert.pem", "x509/client2_key.pem"), nil, true, "", false, false)
 
 			// Create a wrapped conn which can return the HandshakeInfo and
 			// configured deadline to the xDS credentials' ServerHandshake()
@@ -462,7 +462,7 @@ func (s) TestServerCredsProviderSwitch(t *testing.T) {
 			return handshakeResult{}
 		}
 
-		hi = xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/client_ca_cert.pem"), makeIdentityProvider(t, "x509/server1_cert.pem", "x509/server1_key.pem"), nil, true, "", false)
+		hi = xdsinternal.NewHandshakeInfo(makeRootProvider(t, "x509/client_ca_cert.pem"), makeIdentityProvider(t, "x509/server1_cert.pem", "x509/server1_key.pem"), nil, true, "", false, false)
 
 		// Create a wrapped conn which can return the HandshakeInfo and
 		// configured deadline to the xDS credentials' ServerHandshake()

internal/credentials/xds/handshake_info.go

@@ -45,6 +45,27 @@ func init() {
 // the Attributes field of resolver.Address.
 type handshakeAttrKey struct{}
 
+// hostnameKey is the type used as the key to store the hostname in the
+// Attributes field of resolver.Address.
+type hostnameKey struct{}
+
+// SetAddressHostname returns a copy of addr in which the Attributes field is
+// updated with the provided hostname.
+func SetAddressHostname(addr resolver.Address, hostname string) resolver.Address {
+	addr.Attributes = addr.Attributes.WithValue(hostnameKey{}, hostname)
+	return addr
+}
+
+// Hostname returns the endpoint hostname stored in attr.
+func Hostname(attr *attributes.Attributes) string {
+	if attr == nil {
+		return ""
+	}
+	v := attr.Value(hostnameKey{})
+	hn, _ := v.(string)
+	return hn
+}
+
 // Equal reports whether the handshake info structs are identical.
 func (hi *HandshakeInfo) Equal(other *HandshakeInfo) bool {
 	if hi == nil && other == nil {
@@ -58,6 +79,7 @@ func (hi *HandshakeInfo) Equal(other *HandshakeInfo) bool {
 		hi.requireClientCert != other.requireClientCert ||
 		hi.sni != other.sni ||
 		hi.validateSANUsingSNI != other.validateSANUsingSNI ||
+		hi.useAutoHostSNI != other.useAutoHostSNI ||
 		len(hi.sanMatchers) != len(other.sanMatchers) {
 		return false
 	}
@@ -95,18 +117,20 @@ type HandshakeInfo struct {
 	requireClientCert   bool                    // Only on server side.
 	sni                 string                  // Only on client side, used for Server Name Indication in TLS handshake.
 	validateSANUsingSNI bool                    // Only on client side, indicates whether to perform validation of SANs based on SNI value.
+	useAutoHostSNI      bool                    // Only on client side, indicates whether to use endpoint hostname as SNI.
 }
 
 // NewHandshakeInfo returns a new handshake info configured with the provided
 // options.
-func NewHandshakeInfo(rootProvider certprovider.Provider, identityProvider certprovider.Provider, sanMatchers []matcher.StringMatcher, requireClientCert bool, sni string, validateSANUsingSNI bool) *HandshakeInfo {
+func NewHandshakeInfo(rootProvider certprovider.Provider, identityProvider certprovider.Provider, sanMatchers []matcher.StringMatcher, requireClientCert bool, sni string, validateSANUsingSNI bool, useAutoHostSNI bool) *HandshakeInfo {
 	return &HandshakeInfo{
 		rootProvider:        rootProvider,
 		identityProvider:    identityProvider,
 		sanMatchers:         sanMatchers,
 		requireClientCert:   requireClientCert,
 		sni:                 sni,
 		validateSANUsingSNI: validateSANUsingSNI,
+		useAutoHostSNI:      useAutoHostSNI,
 	}
 }
 
@@ -127,7 +151,13 @@ func (hi *HandshakeInfo) GetSANMatchersForTesting() []matcher.StringMatcher {
 
 // ClientSideTLSConfig constructs a tls.Config to be used in a client-side
 // handshake based on the contents of the HandshakeInfo.
-func (hi *HandshakeInfo) ClientSideTLSConfig(ctx context.Context) (*tls.Config, error) {
+//
+// hostname is passed as a parameter here instead of being part of the
+// HandshakeInfo because HandshakeInfo contains cluster-level security
+// configuration that applies to all endpoints in the cluster, while hostname is
+// specific to each endpoint. This allows sharing a single HandshakeInfo
+// instance across multiple endpoints in the same cluster.
+func (hi *HandshakeInfo) ClientSideTLSConfig(ctx context.Context, hostname string) (*tls.Config, error) {
 	// On the client side, rootProvider is mandatory. IdentityProvider is
 	// optional based on whether the client is doing TLS or mTLS.
 	if hi.rootProvider == nil {
@@ -152,7 +182,17 @@ func (hi *HandshakeInfo) ClientSideTLSConfig(ctx context.Context) (*tls.Config,
 		return nil, fmt.Errorf("xds: fetching trusted roots from CertificateProvider failed: %v", err)
 	}
 	cfg.RootCAs = km.Roots
-	cfg.VerifyPeerCertificate = hi.buildVerifyFunc(km, true)
+
+	// If AutoHostSNI is true, and the endpoint hostname is present, we use the
+	// endpoint hostname as the SNI value and also for SAN validation.
+	// Otherwise, we use the SNI value from HandshakeInfo (which is configured
+	// by the control plane) and validating SANs based on that.
+	sni := hi.sni
+	if hi.useAutoHostSNI && hostname != "" {
+		sni = hostname
+	}
+
+	cfg.VerifyPeerCertificate = hi.buildVerifyFunc(km, true, sni)
 
 	if idProv != nil {
 		km, err := idProv.KeyMaterial(ctx)
@@ -162,13 +202,13 @@ func (hi *HandshakeInfo) ClientSideTLSConfig(ctx context.Context) (*tls.Config,
 		cfg.Certificates = km.Certs
 	}
 
-	if envconfig.XDSSNIEnabled && hi.sni != "" {
-		cfg.ServerName = hi.sni
+	if envconfig.XDSSNIEnabled && sni != "" {
+		cfg.ServerName = sni
 	}
 	return cfg, nil
 }
 
-func (hi *HandshakeInfo) buildVerifyFunc(km *certprovider.KeyMaterial, isClient bool) func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
+func (hi *HandshakeInfo) buildVerifyFunc(km *certprovider.KeyMaterial, isClient bool, sni string) func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
 	return func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
 		// Parse all raw certificates presented by the peer.
 		var certs []*x509.Certificate
@@ -216,14 +256,14 @@ func (hi *HandshakeInfo) buildVerifyFunc(km *certprovider.KeyMaterial, isClient
 		// non-empty, validate only DNS SANs against the SNI. Otherwise, fallback to
 		// validating all received SANs against the control plane provided SAN
 		// matchers.
-		if envconfig.XDSSNIEnabled && hi.validateSANUsingSNI && hi.sni != "" {
+		if envconfig.XDSSNIEnabled && hi.validateSANUsingSNI && sni != "" {
 			// Verify SAN of leaf certificate with SNI using exact DNS matcher.
 			for _, san := range certs[0].DNSNames {
-				if dnsMatch(hi.sni, san) {
+				if dnsMatch(sni, san) {
 					return nil
 				}
 			}
-			return fmt.Errorf("xds: received DNS SANs: %v do not match the SNI: %v", certs[0].DNSNames, hi.sni)
+			return fmt.Errorf("xds: received DNS SANs: %v do not match the SNI: %s", certs[0].DNSNames, sni)
 		}
 		// The SANs sent by the xDS control plane are encoded as SPIFFE IDs. We need to
 		// only look at the SANs on the leaf cert.
@@ -272,7 +312,7 @@ func (hi *HandshakeInfo) ServerSideTLSConfig(ctx context.Context) (*tls.Config,
 			// dropped to tls.RequireAnyClientCert so that custom verification
 			// to use SPIFFE Bundles is done.
 			cfg.ClientAuth = tls.RequireAnyClientCert
-			cfg.VerifyPeerCertificate = hi.buildVerifyFunc(km, false)
+			cfg.VerifyPeerCertificate = hi.buildVerifyFunc(km, false, "")
 		} else {
 			cfg.ClientCAs = km.Roots
 		}