feat: implement SNI capability

[rikatz]

Gateway API tests requires requests with SNI headers. Currently the tls-scanner cannot make requests enforcing the hostname, not being able to detect that it is a TLS listener behind an envoy proxy and passing it.

This change adds the capability to specify what is the hostname of the endpoint being called, allowing the test to be properly executed

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rikatz
Once this PR has been reviewed and has the lgtm label, please assign richardsonnick for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rikatz]

/hold
I will test it locally on a Gateway API environment just to be sure everything works as desired

[qodo-for-rh-openshift]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 10 rules

1. SNI hostname arg injection 🐞 Bug ⛨ Security

Description

scanner.targetLine interpolates ScanJob.SNIHostname into the testssl.sh --file input line
without validation, even though that file’s lines are parsed as additional testssl.sh arguments. A
--sni-hostname containing whitespace or a leading -- can inject unintended testssl.sh flags or
split the intended target, causing wrong targets, wrong output paths, or failed scans.

Code

internal/scanner/scanner.go[R703-715]

+// targetLine builds the string written to testssl.sh's --file batch input for
+// job. Each line of that file is passed through as additional testssl.sh
+// arguments (see run_mass_testing/create_mass_testing_cmdline upstream), so a
+// line may carry flags in addition to the host:port target. When
+// job.SNIHostname is set, the line connects to job.IP via --ip= while sending
+// SNIHostname as the TLS servername, instead of sending job.IP as SNI.
+func targetLine(job ScanJob) string {
+	key := targetKey(job.IP, strconv.Itoa(job.Port))
+	if job.SNIHostname == "" {
+		return key
+	}
+	return fmt.Sprintf("--ip=%s %s", normalizeTargetHost(job.IP), targetKey(job.SNIHostname, strconv.Itoa(job.Port)))
+}

Relevance

●●● Strong

Team often adds input validation for new flags/options (e.g., positive-int CLI validation in PR #74;
rule validation in PR #40).

PR-#74
PR-#40
PR-#66

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The scanner writes --ip=<connect-ip> <SNIHostname:port> directly into the testssl --file input,
and the code comments state those lines are parsed as additional testssl arguments; since
--sni-hostname comes directly from the CLI, a malformed value can be interpreted as extra argv
tokens/options by testssl.sh.

internal/scanner/scanner.go[703-715]
cmd/tls-scanner/main.go[54-80]
cmd/tls-scanner/main.go[180-195]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`--sni-hostname` is user-controlled and is written into the testssl.sh batch targets file via `targetLine()` without any validation/normalization. Because testssl.sh treats each line in the `--file` input as argv tokens, a crafted/accidental value (e.g. containing whitespace or starting with `--`) can change how testssl.sh parses arguments.

### Issue Context
- `targetLine()` explicitly documents that targets-file lines are treated as additional arguments.
- `cmd/tls-scanner` passes the CLI `--sni-hostname` straight into `ScanJob.SNIHostname`.

### Fix Focus Areas
- internal/scanner/scanner.go[703-715]
- cmd/tls-scanner/main.go[54-80]

### Implementation notes
- Trim surrounding whitespace from `--sni-hostname`.
- Reject values containing any whitespace/control characters.
- Reject values that begin with `-` (option-like) or contain `/`.
- Optionally validate against a hostname/IP allowlist (e.g., `net.IsDomainName(...)` or a conservative regex) and return a clear CLI error if invalid.
- Add a small unit test that ensures invalid `--sni-hostname` values are rejected (e.g. `"bad host"`, `"--jsonfile"`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

• Author self-review: I have reviewed the code review findings, and addressed the relevant ones.

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[openshift-ci]

@rikatz: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[rikatz]

/hold
I am trying a different approach for Gateway API

[rikatz]

closing this, as I was able to fix it directly on Gateway API provisioning