listener: deprecate sni_domains.

api/envoy/api/v2/listener/listener.proto

@@ -148,20 +148,8 @@ message FilterChainMatch {
   //   unless all connecting clients are known to use ALPN.
   repeated string application_protocols = 10;
 
-  // If non-empty, a list of server names (e.g. SNI for TLS protocol) to consider when determining
-  // a filter chain match. Those values will be compared against the server names of a new
-  // connection, when detected by one of the listener filters.
-  //
-  // The server name will be matched against all wildcard domains, i.e. ``www.example.com``
-  // will be first matched against ``www.example.com``, then ``*.example.com``, then ``*.com``.
-  //
-  // Note that partial wildcards are not supported, and values like ``*w.example.com`` are invalid.
-  //
-  // .. attention::
-  //
-  //   Deprecated. Use :ref:`server_names <envoy_api_field_listener.FilterChainMatch.server_names>`
-  //   instead.
-  repeated string sni_domains = 1 [deprecated = true];
+  reserved 1;
+  reserved "sni_domains";
 }
 
 // A filter chain wraps a set of match criteria, an option TLS context, a set of filters, and

docs/root/intro/version_history.rst

@@ -124,8 +124,7 @@ Version history
 * listeners: added the ability to match :ref:`FilterChain <envoy_api_msg_listener.FilterChain>` using
   :ref:`application_protocols <envoy_api_field_listener.FilterChainMatch.application_protocols>`
   (e.g. ALPN for TLS protocol).
-* listeners: :ref:`sni_domains <envoy_api_field_listener.FilterChainMatch.sni_domains>` has been deprecated/renamed to
-  :ref:`server_names <envoy_api_field_listener.FilterChainMatch.server_names>`.
+* listeners: `sni_domains` has been deprecated/renamed to :ref:`server_names <envoy_api_field_listener.FilterChainMatch.server_names>`.
 * listeners: removed restriction on all filter chains having identical filters.
 * load balancer: added :ref:`weighted round robin
   <arch_overview_load_balancing_types_round_robin>` support. The round robin

source/server/listener_manager_impl.cc

@@ -209,29 +209,15 @@ ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, const std::st
       destination_ips.push_back(cidr_range.asString());
     }
 
-    std::vector<std::string> server_names;
-    if (!filter_chain_match.server_names().empty()) {
-      if (!filter_chain_match.sni_domains().empty()) {
-        throw EnvoyException(
-            fmt::format("error adding listener '{}': both \"server_names\" and the deprecated "
-                        "\"sni_domains\" are used, please merge the list of expected server names "
-                        "into \"server_names\" and remove \"sni_domains\"",
-                        address_->asString()));
-      }
-
-      server_names.assign(filter_chain_match.server_names().begin(),
-                          filter_chain_match.server_names().end());
-    } else if (!filter_chain_match.sni_domains().empty()) {
-      server_names.assign(filter_chain_match.sni_domains().begin(),
-                          filter_chain_match.sni_domains().end());
-    }
+    std::vector<std::string> server_names(filter_chain_match.server_names().begin(),
+                                          filter_chain_match.server_names().end());
 
     // Reject partial wildcards, we don't match on them.
     for (const auto& server_name : server_names) {
       if (server_name.find('*') != std::string::npos && !isWildcardServerName(server_name)) {
         throw EnvoyException(
             fmt::format("error adding listener '{}': partial wildcards are not supported in "
-                        "\"server_names\" (or the deprecated \"sni_domains\")",
+                        "\"server_names\"",
                         address_->asString()));
       }
     }

test/server/listener_manager_impl_test.cc

@@ -1743,7 +1743,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, SingleFilterChainWithInvalidServe
   EXPECT_THROW_WITH_MESSAGE(manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), "", true),
                             EnvoyException,
                             "error adding listener '127.0.0.1:1234': partial wildcards are not "
-                            "supported in \"server_names\" (or the deprecated \"sni_domains\")");
+                            "supported in \"server_names\"");
 }
 
 TEST_F(ListenerManagerImplWithRealFiltersTest, MultipleFilterChainsWithSameMatch) {
@@ -1874,69 +1874,6 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, CustomTransportProtocolWithSniWit
   EXPECT_TRUE(filterChainFactory.createListenerFilterChain(manager));
 }
 
-// Copy of the SingleFilterChainWithServerNamesMatch to make sure it behaves the same.
-TEST_F(ListenerManagerImplWithRealFiltersTest, SingleFilterChainWithDeprecatedSniDomainsMatch) {
-  const std::string yaml = TestEnvironment::substitute(R"EOF(
-    address:
-      socket_address: { address: 127.0.0.1, port_value: 1234 }
-    listener_filters:
-    - name: "envoy.listener.tls_inspector"
-      config: {}
-    filter_chains:
-    - filter_chain_match:
-        sni_domains: "server1.example.com"
-      tls_context:
-        common_tls_context:
-          tls_certificates:
-            - certificate_chain: { filename: "{{ test_rundir }}/test/common/ssl/test_data/san_dns_cert.pem" }
-              private_key: { filename: "{{ test_rundir }}/test/common/ssl/test_data/san_dns_key.pem" }
-  )EOF",
-                                                       Network::Address::IpVersion::v4);
-
-  EXPECT_CALL(server_.random_, uuid());
-  EXPECT_CALL(listener_factory_, createListenSocket(_, _, true));
-  manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), "", true);
-  EXPECT_EQ(1U, manager_->listeners().size());
-
-  // TLS client without SNI - no match.
-  auto filter_chain = findFilterChain(1234, true, "127.0.0.1", true, "", false, "tls", false, {});
-  EXPECT_EQ(filter_chain, nullptr);
-
-  // TLS client without matching SNI - no match.
-  filter_chain =
-      findFilterChain(1234, true, "127.0.0.1", true, "www.example.com", false, "tls", false, {});
-  EXPECT_EQ(filter_chain, nullptr);
-
-  // TLS client with matching SNI - using 1st filter chain.
-  filter_chain =
-      findFilterChain(1234, true, "127.0.0.1", true, "server1.example.com", true, "tls", true, {});
-  ASSERT_NE(filter_chain, nullptr);
-  EXPECT_TRUE(filter_chain->transportSocketFactory().implementsSecureTransport());
-  auto transport_socket = filter_chain->transportSocketFactory().createTransportSocket();
-  auto ssl_socket = dynamic_cast<Ssl::SslSocket*>(transport_socket.get());
-  auto server_names = ssl_socket->dnsSansLocalCertificate();
-  EXPECT_EQ(server_names.size(), 1);
-  EXPECT_EQ(server_names.front(), "server1.example.com");
-}
-
-TEST_F(ListenerManagerImplWithRealFiltersTest, DeprecatedSniDomainsAndServerNamesUsedTogether) {
-  const std::string yaml = TestEnvironment::substitute(R"EOF(
-    address:
-      socket_address: { address: 127.0.0.1, port_value: 1234 }
-    filter_chains:
-    - filter_chain_match:
-        server_names: "example.com"
-        sni_domains: "www.example.com"
-  )EOF",
-                                                       Network::Address::IpVersion::v4);
-
-  EXPECT_THROW_WITH_MESSAGE(
-      manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), "", true), EnvoyException,
-      "error adding listener '127.0.0.1:1234': both \"server_names\" and the deprecated "
-      "\"sni_domains\" are used, please merge the list of expected server names into "
-      "\"server_names\" and remove \"sni_domains\"");
-}
-
 TEST_F(ListenerManagerImplWithRealFiltersTest, TlsCertificateInline) {
   const std::string yaml = R"EOF(
     address:

test/server/server_corpus/clusterfuzz-testcase-server_fuzz_test-6610050496856064

@@ -28,7 +28,7 @@ static_resources {
     }
     filter_chains {
       filter_chain_match {
-        sni_domains: "6e702f1f66d415068aabbc60377ad67a326b6b2b"
+        server_names: "6e702f1f66d415068aabbc60377ad67a326b6b2b"
       }
     }
     filter_chains {