Apply the same approach as the rules system on the TLS configuration choice

Co-authored-by: Julien Salleyron <julien.salleyron@gmail.com>

pkg/server/router/tcp/router.go

@@ -177,8 +177,8 @@ func (m *Manager) buildEntryPointHandler(ctx context.Context, configs map[string
 
 		// Domain Fronting
 		if !strings.EqualFold(host, serverName) {
-			tlsOptionSNI := findTLSOptionName(tlsOptionsForHost, serverName)
+			tlsOptionHeader := findTLSOptionName(tlsOptionsForHost, host, true)
-			tlsOptionHeader := findTLSOptionName(tlsOptionsForHost, host)
+			tlsOptionSNI := findTLSOptionName(tlsOptionsForHost, serverName, false)
 
 			if tlsOptionHeader != tlsOptionSNI {
 				log.WithoutContext().
@@ -322,16 +322,43 @@ func (m *Manager) buildTCPHandler(ctx context.Context, router *runtime.TCPRouter
 	return tcp.NewChain().Extend(*mHandler).Then(sHandler)
 }
 
-func findTLSOptionName(tlsOptionsForHost map[string]string, host string) string {
+func findTLSOptionName(tlsOptionsForHost map[string]string, host string, fqdn bool) string {
+	name := findTLSOptName(tlsOptionsForHost, host, fqdn)
+	if name != "" {
+		return name
+	}
+
+	name = findTLSOptName(tlsOptionsForHost, strings.ToLower(host), fqdn)
+	if name != "" {
+		return name
+	}
+
+	return traefiktls.DefaultTLSConfigName
+}
+
+func findTLSOptName(tlsOptionsForHost map[string]string, host string, fqdn bool) string {
 	tlsOptions, ok := tlsOptionsForHost[host]
 	if ok {
 		return tlsOptions
 	}
 
-	tlsOptions, ok = tlsOptionsForHost[strings.ToLower(host)]
+	if !fqdn {
+		return ""
+	}
+
+	if last := len(host) - 1; last >= 0 && host[last] == '.' {
+		tlsOptions, ok = tlsOptionsForHost[host[:last]]
 		if ok {
 			return tlsOptions
 		}
 
-	return traefiktls.DefaultTLSConfigName
+		return ""
+	}
+
+	tlsOptions, ok = tlsOptionsForHost[host+"."]
+	if ok {
+		return tlsOptions
+	}
+
+	return ""
 }

pkg/server/router/tcp/router_test.go

@@ -59,7 +59,6 @@ func TestRuntimeConfiguration(t *testing.T) {
 				},
 				"bar": {
 					TCPRouter: &dynamic.TCPRouter{
-
 						EntryPoints: []string{"web"},
 						Service:     "foo-service",
 						Rule:        "HostSNI(`foo.bar`)",
@@ -136,7 +135,6 @@ func TestRuntimeConfiguration(t *testing.T) {
 				},
 				"bar": {
 					Router: &dynamic.Router{
-
 						EntryPoints: []string{"web"},
 						Service:     "foo-service",
 						Rule:        "Host(`bar.foo`) && PathPrefix(`/path`)",
@@ -240,7 +238,6 @@ func TestRuntimeConfiguration(t *testing.T) {
 				},
 				"bar": {
 					TCPRouter: &dynamic.TCPRouter{
-
 						EntryPoints: []string{"web"},
 						Service:     "foo-service",
 						Rule:        "HostSNI(`foo.bar`)",
@@ -340,177 +337,7 @@ func TestRuntimeConfiguration(t *testing.T) {
 }
 
 func TestDomainFronting(t *testing.T) {
-	tests := []struct {
+	tlsOptionsBase := map[string]traefiktls.Options{
-		desc           string
-		routers        map[string]*runtime.RouterInfo
-		expectedStatus int
-	}{
-		{
-			desc: "Request is misdirected when TLS options are different",
-			routers: map[string]*runtime.RouterInfo{
-				"router-1@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host1.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-				"router-2@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host2.local`)",
-						TLS:         &dynamic.RouterTLSConfig{},
-					},
-				},
-			},
-			expectedStatus: http.StatusMisdirectedRequest,
-		},
-		{
-			desc: "Request is OK when TLS options are the same",
-			routers: map[string]*runtime.RouterInfo{
-				"router-1@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host1.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-				"router-2@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host2.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-			},
-			expectedStatus: http.StatusOK,
-		},
-		{
-			desc: "Default TLS options is used when options are ambiguous for the same host",
-			routers: map[string]*runtime.RouterInfo{
-				"router-1@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host1.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-				"router-2@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host1.local`) && PathPrefix(`/foo`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "default",
-						},
-					},
-				},
-				"router-3@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host2.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-			},
-			expectedStatus: http.StatusMisdirectedRequest,
-		},
-		{
-			desc: "Default TLS options should not be used when options are the same for the same host",
-			routers: map[string]*runtime.RouterInfo{
-				"router-1@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host1.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-				"router-2@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host1.local`) && PathPrefix(`/bar`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-				"router-3@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host2.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-			},
-			expectedStatus: http.StatusOK,
-		},
-		{
-			desc: "Request is misdirected when TLS options have the same name but from different providers",
-			routers: map[string]*runtime.RouterInfo{
-				"router-1@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host1.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-				"router-2@crd": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host2.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1",
-						},
-					},
-				},
-			},
-			expectedStatus: http.StatusMisdirectedRequest,
-		},
-		{
-			desc: "Request is OK when TLS options reference from a different provider is the same",
-			routers: map[string]*runtime.RouterInfo{
-				"router-1@file": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host1.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1@crd",
-						},
-					},
-				},
-				"router-2@crd": {
-					Router: &dynamic.Router{
-						EntryPoints: []string{"web"},
-						Rule:        "Host(`host2.local`)",
-						TLS: &dynamic.RouterTLSConfig{
-							Options: "host1@crd",
-						},
-					},
-				},
-			},
-			expectedStatus: http.StatusOK,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.desc, func(t *testing.T) {
-			entryPoints := []string{"web"}
-			tlsOptions := map[string]traefiktls.Options{
 		"default": {
 			MinVersion: "VersionTLS10",
 		},
@@ -522,6 +349,246 @@ func TestDomainFronting(t *testing.T) {
 		},
 	}
 
+	entryPoints := []string{"web"}
+
+	tests := []struct {
+		desc           string
+		routers        map[string]*runtime.RouterInfo
+		tlsOptions     map[string]traefiktls.Options
+		host           string
+		ServerName     string
+		expectedStatus int
+	}{
+		{
+			desc: "Request is misdirected when TLS options are different",
+			routers: map[string]*runtime.RouterInfo{
+				"router-1@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+				"router-2@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host2.local`)",
+						TLS:         &dynamic.RouterTLSConfig{},
+					},
+				},
+			},
+			tlsOptions:     tlsOptionsBase,
+			host:           "host1.local",
+			ServerName:     "host2.local",
+			expectedStatus: http.StatusMisdirectedRequest,
+		},
+		{
+			desc: "Request is OK when TLS options are the same",
+			routers: map[string]*runtime.RouterInfo{
+				"router-1@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+				"router-2@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host2.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+			},
+			tlsOptions:     tlsOptionsBase,
+			host:           "host1.local",
+			ServerName:     "host2.local",
+			expectedStatus: http.StatusOK,
+		},
+		{
+			desc: "Default TLS options is used when options are ambiguous for the same host",
+			routers: map[string]*runtime.RouterInfo{
+				"router-1@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+				"router-2@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`) && PathPrefix(`/foo`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "default",
+						},
+					},
+				},
+				"router-3@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host2.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+			},
+			tlsOptions:     tlsOptionsBase,
+			host:           "host1.local",
+			ServerName:     "host2.local",
+			expectedStatus: http.StatusMisdirectedRequest,
+		},
+		{
+			desc: "Default TLS options should not be used when options are the same for the same host",
+			routers: map[string]*runtime.RouterInfo{
+				"router-1@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+				"router-2@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`) && PathPrefix(`/bar`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+				"router-3@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host2.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+			},
+			tlsOptions:     tlsOptionsBase,
+			host:           "host1.local",
+			ServerName:     "host2.local",
+			expectedStatus: http.StatusOK,
+		},
+		{
+			desc: "Request is misdirected when TLS options have the same name but from different providers",
+			routers: map[string]*runtime.RouterInfo{
+				"router-1@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+				"router-2@crd": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host2.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1",
+						},
+					},
+				},
+			},
+			tlsOptions:     tlsOptionsBase,
+			host:           "host1.local",
+			ServerName:     "host2.local",
+			expectedStatus: http.StatusMisdirectedRequest,
+		},
+		{
+			desc: "Request is OK when TLS options reference from a different provider is the same",
+			routers: map[string]*runtime.RouterInfo{
+				"router-1@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1@crd",
+						},
+					},
+				},
+				"router-2@crd": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host2.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1@crd",
+						},
+					},
+				},
+			},
+			tlsOptions:     tlsOptionsBase,
+			host:           "host1.local",
+			ServerName:     "host2.local",
+			expectedStatus: http.StatusOK,
+		},
+		{
+			desc: "Request is misdirected when server name is empty and the host name is an FQDN, but router's rule is not",
+			routers: map[string]*runtime.RouterInfo{
+				"router-1@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1@file",
+						},
+					},
+				},
+			},
+			tlsOptions: map[string]traefiktls.Options{
+				"default": {
+					MinVersion: "VersionTLS13",
+				},
+				"host1@file": {
+					MinVersion: "VersionTLS12",
+				},
+			},
+			host:           "host1.local.",
+			expectedStatus: http.StatusMisdirectedRequest,
+		},
+		{
+			desc: "Request is misdirected when server name is empty and the host name is not FQDN, but router's rule is",
+			routers: map[string]*runtime.RouterInfo{
+				"router-1@file": {
+					Router: &dynamic.Router{
+						EntryPoints: entryPoints,
+						Rule:        "Host(`host1.local.`)",
+						TLS: &dynamic.RouterTLSConfig{
+							Options: "host1@file",
+						},
+					},
+				},
+			},
+			tlsOptions: map[string]traefiktls.Options{
+				"default": {
+					MinVersion: "VersionTLS13",
+				},
+				"host1@file": {
+					MinVersion: "VersionTLS12",
+				},
+			},
+			host:           "host1.local",
+			expectedStatus: http.StatusMisdirectedRequest,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
 			conf := &runtime.Configuration{
 				Routers: test.routers,
 			}
@@ -529,7 +596,7 @@ func TestDomainFronting(t *testing.T) {
 			serviceManager := tcp.NewManager(conf)
 
 			tlsManager := traefiktls.NewManager()
-			tlsManager.UpdateConfigs(context.Background(), map[string]traefiktls.Store{}, tlsOptions, []*traefiktls.CertAndStores{})
+			tlsManager.UpdateConfigs(context.Background(), map[string]traefiktls.Store{}, test.tlsOptions, []*traefiktls.CertAndStores{})
 
 			httpsHandler := map[string]http.Handler{
 				"web": http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {}),
@@ -545,9 +612,9 @@ func TestDomainFronting(t *testing.T) {
 			require.True(t, ok)
 
 			req := httptest.NewRequest(http.MethodGet, "/", nil)
-			req.Host = "host1.local"
+			req.Host = test.host
 			req.TLS = &tls.ConnectionState{
-				ServerName: "host2.local",
+				ServerName: test.ServerName,
 			}
 
 			rw := httptest.NewRecorder()