Enforce strict-sni instead of default certificate fallback

docs/release-notes/artifacts/pr0621.yaml

@@ -0,0 +1,16 @@
+version_schema: 2
+
+changes:
+  - title: Rejected TLS connections when SNI does not match a configured certificate
+    author: Copilot
+    type: breaking
+    description: >
+      Added `strict-sni` to the global `ssl-default-bind-options` so HAProxy
+      rejects TLS connections whose SNI does not match any configured
+      certificate instead of falling back to a default certificate.
+    urls:
+      pr:
+        - https://github.com/canonical/haproxy-operator/pull/621
+      related_issue: https://github.com/canonical/haproxy-operator/issues/610
+    visibility: public
+    highlight: false

haproxy-operator/templates/haproxy_ingress.cfg.j2

@@ -3,7 +3,7 @@
 frontend ingress
     mode http
     bind [::]:80 v4v6
-    bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1
+    bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 strict-sni
 
     filter compression
     compression algo gzip

haproxy-operator/templates/haproxy_ingress_per_unit.cfg.j2

@@ -3,7 +3,7 @@
 frontend ingress_per_unit
     mode http
     bind [::]:80 v4v6
-    bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1
+    bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 strict-sni
 
     filter compression
     compression algo gzip

haproxy-operator/templates/haproxy_route.cfg.j2

@@ -4,7 +4,7 @@
 frontend haproxy
     mode http
     bind [::]:80 v4v6
-    bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1
+    bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 strict-sni
 
 {{ ddos_protection_rules() }}
 

haproxy-operator/templates/haproxy_route_grpc.cfg.j2

@@ -1,7 +1,7 @@
 {% for backend in grpc_backends %}
 frontend {{ backend.backend_name }}
     mode http
-    bind [::]:{{ backend.application_data.external_grpc_port }} v4v6 ssl crt /var/lib/haproxy/certs alpn h2
+    bind [::]:{{ backend.application_data.external_grpc_port }} v4v6 ssl crt /var/lib/haproxy/certs alpn h2 strict-sni
     acl acl_host_{{ backend.backend_name }} req.hdr(host),field(1,:) -i {% for hostname in backend.hostname_acls %}{{hostname}} {% endfor +%}
     {% if backend.path_acl_required %}
     acl acl_path_{{ backend.backend_name }} path_beg -i {% for path in backend.application_data.paths %}{{ path }} {% endfor +%}

haproxy-operator/templates/haproxy_route_tcp.cfg.j2

@@ -20,7 +20,7 @@ send-proxy
 frontend haproxy_route_tcp_{{ frontend.bind_port }}
     mode tcp
     option tcplog
-    bind [::]:{{ frontend.bind_port }} v4v6 {% if frontend.tls_terminate %} ssl crt {{ haproxy_crt_dir }} {% endif +%}
+    bind [::]:{{ frontend.bind_port }} v4v6 {% if frontend.tls_terminate %} ssl crt {{ haproxy_crt_dir }} strict-sni {% endif +%}
 
 {# DDOS protection configuration. #}
 {% if ddos_protection_config.client_timeout %}