Skip to content

feat(tls): add SNI to SslDigest for HTTP filter access#880

Open
singhvishalkr wants to merge 1 commit into
cloudflare:mainfrom
singhvishalkr:feat/ssl-digest-sni
Open

feat(tls): add SNI to SslDigest for HTTP filter access#880
singhvishalkr wants to merge 1 commit into
cloudflare:mainfrom
singhvishalkr:feat/ssl-digest-sni

Conversation

@singhvishalkr
Copy link
Copy Markdown

This PR adds the SNI (Server Name Indication) to the SslDigest struct, addressing the request in #547 to make SNI accessible in the HTTP filter context.

The implementation follows the approach suggested in the issue comments by @pszabop. When using boringssl or openssl, the SNI is extracted from the SSL connection during handshake and stored in SslDigest. This allows users to access it in their request_filter callback:

async fn request_filter(&self, session: &mut Session, ctx: &mut Self::CTX) -> Result<bool> {
    if let Some(digest) = session.digest() {
        if let Some(ssl_digest) = &digest.ssl_digest {
            if let Some(sni) = &ssl_digest.sni {
                // Compare with HTTP Host header, route based on SNI, etc.
            }
        }
    }
    Ok(false)
}

The rustls and s2n backends currently pass None for SNI. Extending those backends can be done in follow-up work.

Fixes #547

This adds the SNI (Server Name Indication) to the SslDigest struct,
making it accessible in the HTTP filter context via session.digest().

The SNI is extracted during TLS handshake for the boringssl/openssl
backend. The rustls and s2n backends pass None for now and can be
extended in future work.

Users can now access the SNI in their request_filter callback:

    if let Some(digest) = session.digest() {
        if let Some(ssl_digest) = &digest.ssl_digest {
            if let Some(sni) = &ssl_digest.sni {
                // Use SNI for routing/validation logic
            }
        }
    }

Fixes cloudflare#547

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Be able to get the SNI from the HTTP filter context

1 participant