metadata: validate metadata keys and values

[Patrick0308]

validate grpc metadata to ensure grpc to follow http standards

close #468

RELEASE NOTES:

• TBD

[linux-foundation-easycla]

The committers are authorized under a signed CLA.

• ✅ 白泽 (6399d6e)

[easwars]

Based on #468 (comment), I'm guessing we also need to change client and server side header sending routines to perform this validation.

@Patrick0308
Was your plan to also do those changes?

Also, it would be better if a regex is used instead of manually checking every character in the metadata key/value.

[dfawley]

Also, it would be better if a regex is used instead of manually checking every character in the metadata key/value.

I wouldn't be certain of this. Regexes are probably going to be slower. We'd want to do some performance testing if this is done per-RPC (which it probably should).

[Patrick0308]

@easwars Yeah, I'll do it. I think regexes are slower than checking every character. But I'm not sure too.

[Patrick0308]

@dfawley @easwars PTAL

[dfawley]

@dfawley @easwars PTAL

Looks like we also need this validation in stream.go:(*ClientConn).NewStream

@menghanl it seems to me this validation should just be private to the grpc package, instead of a method on the metadata itself. WDYT? And did you say you found a function we can use for this in a stdlib package?

[menghanl]

Moving this to a private package sounds good.

There's no function does exactly what we want.
We can use https://pkg.go.dev/unicode#IsDigit for the digits.
https://pkg.go.dev/unicode#IsLetter checks all unicode letters, not just ascii (we can check <=MaxASCII but that's an extra step).

[dfawley]

Friendly ping. This is very close to being ready to merge; please let me know if you have any questions or need help with anything.

[Patrick0308]

@dfawley I'm back. In the last few days, I've been spending Chinese New Year.

[dfawley]

LGTM except for the one small formatting nit. Thank you!

[Patrick0308]

@dfawley PTAL