Add tls_domain_name and origin options to QdrantConfig - #309

All Submissions:

• Contributions should target the dev branch. Did you create your branch from dev?
• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change? The open feat: add custom TLS config support #271 adds a general tls_config; this PR only adds the two options below and doesn't depend on it.

New Feature Submissions:

1. Does your submission pass tests? (cargo test --lib: 40 passed. Integration tests that need a live Qdrant were not run.)
2. Have you formatted your code locally using cargo +nightly fmt --all command prior to submission? (cargo fmt --check is clean on the stable toolchain; the nightly-only import options aren't applied.)
3. Have you checked your code using cargo clippy --all --all-features command? (cargo clippy --all-targets --all-features -- -D warnings is clean.)

Changes to Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?
• Have you successfully ran tests with your changes locally?

What

Adds two optional fields to QdrantConfig, both None by default, with builder methods:

let client = Qdrant::from_url("https://127.0.0.1:50123")
    .tls_domain_name("qdrant.internal")          // certificate verification + SNI
    .origin("https://qdrant.internal:6334")      // HTTP/2 :authority
    .build()?;

• tls_domain_name is passed to ClientTlsConfig::domain_name for https URIs.
• origin is passed to Endpoint::origin.

ChannelPool::make_channel now builds its endpoint in a small private build_endpoint helper, so the TLS and origin settings can be unit-tested without connecting.

Why

When the client dials a tunnel or proxy whose address differs from the server name (for example an SSH forward at https://127.0.0.1:50123 in front of qdrant.internal:6334), the certificate is checked against 127.0.0.1, and requests carry 127.0.0.1:50123 as the :authority. There was no way to change either, since the channel is built internally. Fixes #306.

How was it tested

• cargo test --lib: 40 passed, including new tests for the config defaults, the builder methods, and the endpoint construction with and without the two options (including an invalid origin returning an error).
• Smoke test against a local TLS server (self-signed certificate) on 127.0.0.1: with tls_domain_name set, the handshake uses that name, and verification is still enforced (an untrusted certificate fails with UnknownIssuer).
• Not run: integration tests that need a live Qdrant.

Verification isn't weakened. Only the name it is checked against changes, and nothing changes when the options are unset.

Fixes #306

Authored by Mihir Inamdar.