Case-insensitive TLS host matching

[AndiDog]

What this PR does / why we need it:

Right now, TLS host comparison is implemented as case-sensitive. For example, compressed QR codes of alphanumeric type only allow uppercase letters, and therefore a URL contained in a QR code might also be requested as-is (with uppercase domain name and query) depending on the client. DNS/X509-related RFCs state that comparison must be case-insensitive for the ASCII human-readable character range. That is already the case for VerifyHostname and correctly implemented for certificate SAN/CN matching, but the controller also first has to match the host against an ingress rule. This PR fixes the comparison.

Before the fix:

$ echo | openssl s_client -connect my-host:443 -servername my-host | grep subject=
[...]
subject=/...the expected certificate.../CN=my-host

$ echo | openssl s_client -connect my-host:443 -servername MY-HOST | grep subject=
[...]
subject=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate

There is no obvious workaround to accept uppercase host names:

The Ingress "my-ingress" is invalid: spec.tls[1].hosts: Invalid value: "SOME-UPPERCASE-HOST": a DNS-1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

How Has This Been Tested?

New unit test which was failing before the fix

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have added tests to cover my changes.
• All new and existing tests passed.

[k8s-ci-robot]

Hi @AndiDog. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[aledbf]

There is no obvious workaround to accept uppercase host names:

Just in case, even with this change, you will see the same error. The Ingress validation is done in Kubernetes itself, not ingress-nginx

[aledbf]

/ok-to-test

[aledbf]

/retest

[aledbf]

/assign

[aledbf]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, AndiDog

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [aledbf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aledbf]

/retest

[aledbf]

/retest

[aledbf]

/retest