fix(xds): Allow and normalize trailing dot (FQDN) in matchHostName #12644
+45
−4
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
matchHostNameinRoutingUtilsandXdsNameResolvercurrently rejects hostnames and patternswith a trailing dot (
.) viacheckArgument. A trailing dot denotes aFully Qualified Domain Name (FQDN) as defined in
RFC 1034 Section 3.1, and is a valid,
well-defined representation of an absolute domain name. Rejecting it is inconsistent with the RFC.
This change removes the trailing-dot rejection and adds normalization to strip the trailing dot
before matching, making
example.com.andexample.commatch equivalently.Background
Per RFC 1034 Section 3.1:
A trailing dot simply indicates that the name is rooted at the DNS root and is semantically
equivalent to the same name without the trailing dot. Treating it as invalid prevents legitimate
FQDNs from being used as hostnames or virtual host domain patterns in xDS routing configuration.
Motivation
This was discovered when using gRPC Proxyless Service Mesh on a Kubernetes cluster with Istio.
The issue surfaced after upgrading Istio from 1.26.8 to 1.28.3. The Istio change
istio/istio#56008 began sending FQDN-style domain
names (with trailing dots) in xDS route configuration, which caused grpc-java to throw an
IllegalArgumentExceptioninmatchHostName:The root cause is that grpc-java's
matchHostNamewas not RFC-compliant in rejecting trailing dots — the Istio upgrade merely made it visible. The fix here is to bring grpc-java into compliance with RFC 1034, independent of any specific Istio version.Changes
xds/src/main/java/io/grpc/xds/RoutingUtils.java: Removed trailing-dot rejection and addedFQDN normalization in
matchHostName.xds/src/main/java/io/grpc/xds/XdsNameResolver.java: Same as above.xds/src/test/java/io/grpc/xds/XdsNameResolverTest.java: AddedmatchHostName_trailingDottest covering exact match, prefix wildcard, and suffix wildcard with trailing dot combinations.
References