Set HTTP hostname based on TLS server name #350
Conversation
fpetkovski
force-pushed
the
sni-support
branch
from
9c24fa6
to
038724f
Compare
|
Hello, Thank you for your contribution. I am not willing to have this repository depend on client_golang. We have an exception for an interface in version, and the tests in sigv4, but that's it. |
The net/http library uses the Host field from the Request object in order to determine the value of the Host header [1]. In order for the Prometheus client to support SNI, it needs to set this field to the value provided in the TLS server name. [1] golang/go#29865 Signed-off-by: fpetkovski <filip.petkovsky@gmail.com>
fpetkovski
force-pushed
the
sni-support
branch
from
038724f
to
c81c25d
Compare
|
Thanks for the feedback. Could you point me to where the dependency to client_golang is introduced in this PR? Do you mean because we are referencing the TLS config? |
There was a problem hiding this comment.
Hm, I don't see any client_golang dep @roidelapluie 🤔
Looks good to me, but let's wait for @roidelapluie voice, maybe I am missing something.
| CertFile: ClientCertificatePath, | ||
| KeyFile: ClientKeyNoPassPath, | ||
| ServerName: "test-domain.com", | ||
| InsecureSkipVerify: true}, |
There was a problem hiding this comment.
| InsecureSkipVerify: true}, | |
| InsecureSkipVerify: true, | |
| }, |
|
The initial commit introduced a dependency. Then it was force pushed. I can not merge this as is, I need to check that 1. SNI works even with our connection pooling and 2. This does not break blackbox exporter, which has similar logic. |
|
Ah yes, that seems to be correct: 038724f#diff-cdb28b391884a82ef481177749e35ba9c3c54bda95d93ffe3d5f3ba1c67c2c5eR35 |
|
after thinking twice, the TLS servername should come from the header, not the other way around. |
|
What do you mean by this? Isn't the TLS server name a user provided config? |
The net/http library uses the Host field from the Request object in
order to determine the value of the Host header [1]. In order for the
Prometheus client to support SNI, it needs to set this field to the
value provided in the TLS server name.
[1] golang/go#29865
Signed-off-by: fpetkovski filip.petkovsky@gmail.com
Fixes prometheus/prometheus#9403