pkg/transport: Add test for "deny incoming peer certs with wrong IP SAN"

[wenjiaswe]

Thanks to @MartinWeindel who actually wrote the test #10524. The PR #10524 is to add a flag so IP checking for incoming peer certs can be skipped if wanted, and @MartinWeindel found out that there was no test added at first place for the implementation of #7687. So all I did here is just to add the test to 3.2 when this feature was introduced.

[wenjiaswe]

When I run the test, it turned out that bad IP address was actually accepted, it seems like a bug.

$ PASSES=unit PKG=./pkg/transport TESTCASE="\bTestNewListenerTLSInfoClientVerify\b"   ./test -v
Starting 'unit' pass at Wed May 15 15:39:29 PDT 2019
Running unit tests...
=== RUN   TestNewListenerTLSInfoClientVerify
--- FAIL: TestNewListenerTLSInfoClientVerify (0.87s)
	listener_test.go:173: accepted for bad client address: goodClientHost=false
FAIL
coverage: 34.9% of statements
FAIL	github.com/coreos/etcd/pkg/transport	0.925s

[wenjiaswe]

It seems like in the test, peer cert in the test is not successfully created, len(st.PeerCertificates) is still zero in the test. The test works fine at HEAD, but not in v3.2.26, I need to spend some time and find out why.

etcd/pkg/transport/listener_tls.go

Line 120 in 182de1a

if len(st.PeerCertificates) > 0 {

[wenjiaswe]

Fixed. @jingyih would you please take another look? Thanks!
cc @hexfusion as well.

[jingyih]

Discussed with @wenjiaswe. We will not backport a test.