fix(kuma-cp): use sni to verify upstream certificate san when specifi…

…ed along with address (backport #5347) (#5378) * fix(kuma-cp): use sni to verify upstream certificate san when specified instead of address (#5347) use sni to verify upstream certificate san when specified instead of address Signed-off-by: James D Bloom <[email protected]> Signed-off-by: James D Bloom <[email protected]> Co-authored-by: Charly Molter <[email protected]> * fix: accept both hostname and sni Signed-off-by: Mike Beaumont <[email protected]> * refactor: don't create unnecessary matchers Signed-off-by: Mike Beaumont <[email protected]> Signed-off-by: James D Bloom <[email protected]> Signed-off-by: Mike Beaumont <[email protected]> Co-authored-by: James D Bloom <[email protected]> Co-authored-by: Charly Molter <[email protected]> Co-authored-by: Mike Beaumont <[email protected]>
kumahq · Nov 29, 2022 · 7485065 · 7485065
1 parent 09d3783
commit 7485065
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 8 deletions.
diff --git a/pkg/xds/envoy/clusters/v3/client_side_tls_configurer_test.go b/pkg/xds/envoy/clusters/v3/client_side_tls_configurer_test.go
@@ -139,6 +139,7 @@ var _ = Describe("ClientSideTLSConfigurer", func() {
                     validationContext:
                       matchSubjectAltNames:
                       - exact: httpbin.org
+                      - exact: custom
                       trustedCa:
                         inlineBytes: Y2FjZXJ0
                   sni: custom

diff --git a/pkg/xds/envoy/tls/v3/tls.go b/pkg/xds/envoy/tls/v3/tls.go
@@ -107,16 +107,24 @@ func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool
 		if tlsContext.CommonTlsContext == nil {
 			tlsContext.CommonTlsContext = &envoy_tls.CommonTlsContext{}
 		}
+		matchers := []*envoy_type_matcher.StringMatcher{
+			{
+				MatchPattern: &envoy_type_matcher.StringMatcher_Exact{
+					Exact: hostname,
+				},
+			},
+		}
+		if len(sni) > 0 && sni != hostname {
+			matchers = append(matchers, &envoy_type_matcher.StringMatcher{
+				MatchPattern: &envoy_type_matcher.StringMatcher_Exact{
+					Exact: sni,
+				},
+			})
+		}
 		tlsContext.CommonTlsContext.ValidationContextType = &envoy_tls.CommonTlsContext_ValidationContext{
 			ValidationContext: &envoy_tls.CertificateValidationContext{
-				TrustedCa: dataSourceFromBytes(ca),
-				MatchSubjectAltNames: []*envoy_type_matcher.StringMatcher{
-					{
-						MatchPattern: &envoy_type_matcher.StringMatcher_Exact{
-							Exact: hostname,
-						},
-					},
-				},
+				TrustedCa:            dataSourceFromBytes(ca),
+				MatchSubjectAltNames: matchers,
 			},
 		}
 	}