Repository: grpc/grpc-go
File: internal/xds/balancer/clusterimpl/tests/balancer_test.go (Go)

Code before:

	// Set the endpoint hostname for authority rewriting.
	resources.Endpoints[0].Endpoints[0].LbEndpoints[0].GetEndpoint().Hostname = endpointHostname

	// Modify the route to enable AutoHostRewrite.
	resources.Routes[0].VirtualHosts[0].Routes[0].GetRoute().HostRewriteSpecifier = &v3routepb.RouteAction_AutoHostRewrite{
		AutoHostRewrite: &wrapperspb.BoolValue{Value: true},
	}

	if err := mgmtServer.Update(ctx, resources); err != nil {
		t.Fatal(err)
	}
}

// TestAuthorityOverriding verifies that the :authority header is correctly
// rewritten to the endpoint's hostname. Also verifies that CallAuthority
// call option takes precedence.
func (s) TestAuthorityOverriding(t *testing.T) {
	testutils.SetEnvConfig(t, &envconfig.XDSAuthorityRewrite, true)
	mgmtServer, resolverBuilder, nodeID := setupManagementServerAndResolver(t)

	// Start a server backend exposing the test service.
	authorityCh := make(chan string, 1)
	f := &stubserver.StubServer{
		EmptyCallF: func(ctx context.Context, _ *testpb.Empty) (*testpb.Empty, error) {
			if md, ok := metadata.FromIncomingContext(ctx); ok {
				if authVals := md.Get(":authority"); len(authVals) > 0 {
					authorityCh <- authVals[0]
				}
			}
			return &testpb.Empty{}, nil
		},
	}
	server := stubserver.StartTestService(t, f)
	defer server.Stop()

	const xdsAuthorityOverride = "rewritten.example.com"

	ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
	defer cancel()
	configureXDSResources(ctx, t, mgmtServer, nodeID, server.Address, xdsAuthorityOverride)

	// Create a ClientConn and make a successful RPC.
	cc, err := grpc.NewClient("xds:///my-test-xds-service", grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithResolvers(resolverBuilder))
	if err != nil {
		t.Fatalf("Failed to create client: %v", err)
	}
	defer cc.Close()

	client := testgrpc.NewTestServiceClient(cc)
	if _, err := client.EmptyCall(ctx, &testpb.Empty{}); err != nil {

Review comment (bug):
I think what you might need is the following:
- A server TLS credentials, where the certificate is presented for a domain name like `x.test.exmaple.com`
- A client TLS credentials, where the roots are set to `x509/server_ca_cert.pem`, and the `serverNameOverride` is set to something like `*.test.example.com`
- Send an xDS resource where the authority overwrite is set to `x.test.exmaple.com` and verify the connection works
- Send an xDS resource where the authority overwrite is set to `y.test.exmaple.com` and verify the connection fails. This failure should be because the TLS handshake fails.
- Send an xDS resource where the authority overwrite is set to `xyz.exmaple.com` and verify the connection fails. This failure should be because the TLS creds rejects the authority override.



Code after:
		t.Fatalf("client.EmptyCall() failed: %v", err)
	}

	if gotAuthority != xdsAuthorityOverride {
		t.Errorf("invalid authority got: %q, want: %q", gotAuthority, xdsAuthorityOverride)
	}

	// The authority specified via the `CallAuthority` CallOption takes the
	// highest precedence when determining the `:authority` header.
	const userAuthorityOverride = "user-override.com"
	if _, err := client.EmptyCall(ctx, &testpb.Empty{}, grpc.CallAuthority(userAuthorityOverride)); err != nil {
		t.Fatalf("client.EmptyCall() failed: %v", err)
	}

	if gotAuthority != userAuthorityOverride {
		t.Errorf("Server received authority %q, want %q (user override)", gotAuthority, userAuthorityOverride)
	}
}

// TestAuthorityOverridingWithTLS verifies the interaction between xDS Authority
// Rewriting and TLS Secure Naming. It ensures that when the :authority header
// is rewritten by the clusterimpl picker, the new authority is correctly
// validated against the server's TLS certificate before the RPC proceeds.
// Also check that RPC fails when the rewritten authority does not match the
// server's certificate due to secure naming validation.
func (s) TestAuthorityOverridingWithTLS(t *testing.T) {
	tests := []struct {
		name                 string
		xdsAuthorityOverride string
		wantSuccess          bool
	}{
		{
			name:                 "Valid_Authority_Rewrite",
			xdsAuthorityOverride: "x.test.example.com",
			wantSuccess:          true,
		},
		{
			name:                 "Authority_Rewrite_Mismatch",
			xdsAuthorityOverride: "xyz.exmaple.com",
			wantSuccess:          false,
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			testutils.SetEnvConfig(t, &envconfig.XDSAuthorityRewrite, true)
			mgmtServer, resolverBuilder, nodeID := setupManagementServerAndResolver(t)

			serverCreds := testutils.CreateServerTLSCredentials(t, tls.RequireAndVerifyClientCert)

			// Start a server backend exposing the test service.
			var gotAuthority string