Ability to add SNI header in TLS ClientHello message

[wilsonfv]

Description

When join a network / connect to another node, as an INITIATOR during first plain handshake message, I want to add SNI header in TLS ClientHello message so that Target Server can return correct certificate by reading TLS SNI header.

Modern Server may host multiple virtual hostnames. In order to return correct TLS certificate to client, client may add SNI header during TLS clientHello. This is common industry solution to resolve one server hosting multiple virtual hostnames problem.

Existing P2P RLPx agent does not add SNI header when constructing TLS ClientHello.

besu/ethereum/p2p/src/main/java/org/hyperledger/besu/ethereum/p2p/rlpx/RlpxAgent.java

Lines 333 to 349 in 7c926d2

	private CompletableFuture<PeerConnection> initiateOutboundConnection(final Peer peer) {
	LOG.trace("Initiating connection to peer: {}", peer.getEnodeURL());
	if (peer instanceof DiscoveryPeer) {
	((DiscoveryPeer) peer).setLastAttemptedConnection(System.currentTimeMillis());
	}
	return connectionInitializer
	.connect(peer)
	.whenComplete(
	(conn, err) -> {
	if (err != null) {
	LOG.debug("Failed to connect to peer {}: {}", peer.getId(), err);
	} else {
	LOG.debug("Outbound connection established to peer: {}", peer.getId());
	}
	});
	}

besu/ethereum/p2p/src/main/java/org/hyperledger/besu/ethereum/p2p/rlpx/connections/netty/NettyTLSConnectionInitializer.java

Lines 93 to 102 in 1b45cac

	private void addHandlersToChannelPipeline(final Channel ch, final SslContext sslContext) {
	ch.pipeline().addLast(sslContext.newHandler(ch.alloc()));
	ch.pipeline().addLast(new SnappyFrameDecoder());
	ch.pipeline().addLast(new SnappyFrameEncoder());
	ch.pipeline()
	.addLast(
	new LengthFieldBasedFrameDecoder(
	LENGTH_MAX_MESSAGE_FRAME, 0, LENGTH_FRAME_SIZE, 0, LENGTH_FRAME_SIZE));
	ch.pipeline().addLast(new LengthFieldPrepender(LENGTH_FRAME_SIZE));
	}

In order to add SNI header in TLS ClientHello, NettyTLSConnectionInitializer should call another implementation of sslContext.newHandler

    public final SslHandler newHandler(ByteBufAllocator alloc, String peerHost, int peerPort) {
        return newHandler(alloc, peerHost, peerPort, startTls);
    }

We could add a new command line option in Besu to enable this feature. Such as proposed command line option p2p-tls-clienthello-sni, once this is enabled, SNI header will be added in TLS ClientHello. Default behavior is disabled.

Acceptance Criteria

If besu command line option p2p-tls-clienthello-sni is enabled, RLPx agent will add SNI header in TLS ClientHello message.

[non-fungible-nelson]

Hi there - thank you for requesting this! This is a great issue for a new contributor to pick up. It is likely the Maintainers cannot pick this up at this time.

[atoulme]

I'm sorry, I'm unsure why I'm tagged on this issue. I have no insight into this work.