Problem
Hello headers for the classic dialer are fixed at dial time (DialerConfig.Headers / the per-call headers passed to CreateWithHeaders). Some dialers need to set hello headers that depend on the verified identity of the peer they reached, which is only known after the TLS handshake completes and before the hello is sent.
This comes up when a dialer connects to an address that can resolve to one of several backends (e.g. a load-balanced or anycast-fronted pool): the dialer doesn't know which backend it reached until it inspects the presented certificate, but it still wants to put backend-specific values (identity/grouping/instance headers) into the hello.
The classic dialer already establishes the transport/TLS connection (DialWithLocalBinding) before composing and sending the hello (sendHello), so the peer certificates are available at exactly the right point. There's just no way to contribute headers there today.
Proposal
Add an optional HelloHeaderProvider func([]*x509.Certificate) (map[int32][]byte, error) to DialerConfig. When set, the classic dialer invokes it after the transport connection is established and before the hello is sent, and merges the returned headers into the hello. Returning an error aborts the dial. A nil provider preserves existing behavior.
Problem
Hello headers for the classic dialer are fixed at dial time (
DialerConfig.Headers/ the per-call headers passed toCreateWithHeaders). Some dialers need to set hello headers that depend on the verified identity of the peer they reached, which is only known after the TLS handshake completes and before the hello is sent.This comes up when a dialer connects to an address that can resolve to one of several backends (e.g. a load-balanced or anycast-fronted pool): the dialer doesn't know which backend it reached until it inspects the presented certificate, but it still wants to put backend-specific values (identity/grouping/instance headers) into the hello.
The classic dialer already establishes the transport/TLS connection (
DialWithLocalBinding) before composing and sending the hello (sendHello), so the peer certificates are available at exactly the right point. There's just no way to contribute headers there today.Proposal
Add an optional
HelloHeaderProvider func([]*x509.Certificate) (map[int32][]byte, error)toDialerConfig. When set, the classic dialer invokes it after the transport connection is established and before the hello is sent, and merges the returned headers into the hello. Returning an error aborts the dial. A nil provider preserves existing behavior.