internal/transport: validate balancer and address metadata

[buger]

Fixes #9199

Validate metadata supplied by balancer PickResult.Metadata before merging it into the outgoing context, and validate resolver/address metadata before converting it to HTTP/2 header fields.

The tests cover invalid address metadata at the transport boundary and invalid balancer metadata through an end-to-end RPC path.

RELEASE NOTES:

• transport: Invalid metadata supplied by balancers or resolver addresses is rejected before request headers are created.

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 83.15%. Comparing base (d74861e) to head (b67d483).
⚠️ Report is 46 commits behind head on master.

Files with missing lines	Patch %	Lines
internal/transport/http2_client.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9203      +/-   ##
==========================================
- Coverage   83.21%   83.15%   -0.06%     
==========================================
  Files         420      422       +2     
  Lines       34008    34866     +858     
==========================================
+ Hits        28299    28994     +695     
- Misses       4275     4382     +107     
- Partials     1434     1490      +56     

Files with missing lines	Coverage Δ
stream.go	82.72% <100.00%> (+0.76%)	⬆️
internal/transport/http2_client.go	92.30% <0.00%> (-0.11%)	⬇️

... and 57 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[easwars]

Apologies for the delay in reviewing this. I will have this reviewed shortly.

[eshitachandwani]

Thank you for fixing this. It mostly looks good to me, I have added a few comments about test.

[buger]

Thanks @eshitachandwani, I updated this PR to address your review feedback.

Changes applied:

• moved address metadata validation coverage into test/balancer_test.go as an E2E test using r.InitialState
• covered both valid address metadata and invalid key/value address metadata
• tightened TestInvalidMetadataInPickResult to assert the validation error string in addition to codes.Internal

Local validation passed:

go test ./test -run '^Test/(InvalidMetadataInPickResult|AddressMetadataValidation)' -count=1\ngo test ./internal/transport -count=1\ngo test ./test -count=1\n```

[eshitachandwani]

LGTM modulo one minor nit.
Adding @easwars as a second reviewer.

[buger]

Thanks @eshitachandwani, I updated the picker helper naming to address the readability nit.

Change applied:

• replaced the p.p.Pick callsite with imp.picker.Pick

Local validation passed:

go test ./test -run '^Test/(InvalidMetadataInPickResult|AddressMetadataValidation)' -count=1
git diff --check

[buger]

I looked into the failed tests (latest) job: https://github.com/grpc/grpc-go/actions/runs/30353786653/job/90257151056

The failure appears unrelated to this PR. The failing package/test is google.golang.org/grpc/internal/xds/clients/xdsclient/test, specifically TestConnectedMetric_Reconnection:

metrics_test.go:774: XDSClientConnected check failed after 1st NewStream - got: timeout waiting for specific metric: context deadline exceeded, want 1
FAIL google.golang.org/grpc/internal/xds/clients/xdsclient/test

This PR only changes metadata validation paths in internal/transport/http2_client.go, stream.go, and adds coverage in test/balancer_test.go. The adjacent matrix jobs passed, including tests (-race, latest), tests (arm, latest), tests (i386, latest), and tests (latest-1).

I also ran the exact failing test locally against this PR branch multiple times and it passed:

go test ./internal/xds/clients/xdsclient/test -run '^Test/ConnectedMetric_Reconnection$' -count=10

So this looks like an xDS metrics timing flake rather than a regression from the metadata validation change.

[eshitachandwani]

I looked into the failed tests (latest) job: grpc/grpc-go/actions/runs/30353786653/job/90257151056

The failure appears unrelated to this PR. The failing package/test is google.golang.org/grpc/internal/xds/clients/xdsclient/test, specifically TestConnectedMetric_Reconnection:

metrics_test.go:774: XDSClientConnected check failed after 1st NewStream - got: timeout waiting for specific metric: context deadline exceeded, want 1
FAIL google.golang.org/grpc/internal/xds/clients/xdsclient/test

This PR only changes metadata validation paths in internal/transport/http2_client.go, stream.go, and adds coverage in test/balancer_test.go. The adjacent matrix jobs passed, including tests (-race, latest), tests (arm, latest), tests (i386, latest), and tests (latest-1).

I also ran the exact failing test locally against this PR branch multiple times and it passed:

go test ./internal/xds/clients/xdsclient/test -run '^Test/ConnectedMetric_Reconnection$' -count=10

So this looks like an xDS metrics timing flake rather than a regression from the metadata validation change.

We already have an open issue for this test, I have added the run there for the record and am re-running the test here.

[easwars]

@buger : Thanks for your contribution!