Update for nginx PR 562.

Author: bavshin-f5

.github/workflows/ci.yaml

@@ -37,7 +37,7 @@ jobs:
         rust-version:
           - stable
         nginx-ref:
-          - master
+          - "pull/562/merge:client_hello_cb"
           - stable-1.28
         build:
           - debug

build.rs

@@ -54,13 +54,18 @@ fn detect_nginx_features() {
     // Generate cfg values for version checks
 
     println!("cargo::rustc-check-cfg=cfg(ngx_ssl_cache)");
+    println!("cargo::rustc-check-cfg=cfg(ngx_ssl_client_hello_cb)");
     println!("cargo::rerun-if-env-changed=DEP_NGINX_VERSION_NUMBER");
     if let Ok(version) = env::var("DEP_NGINX_VERSION_NUMBER") {
         let version: u64 = version.parse().unwrap();
 
         if version >= 1_027_002 {
             println!("cargo::rustc-cfg=ngx_ssl_cache");
         }
+
+        if version >= 1_029_002 {
+            println!("cargo::rustc-cfg=ngx_ssl_client_hello_cb");
+        }
     }
 }
 

src/acme/solvers/tls_alpn.rs

@@ -37,8 +37,16 @@ use crate::conf::AcmeMainConfig;
 use super::{ChallengeSolver, SolverError};
 
 /// `openssl-sys` does not publish these constants.
-#[allow(non_upper_case_globals)]
-const TLSEXT_TYPE_application_layer_protocol_negotiation: c_uint = 16;
+#[allow(non_upper_case_globals, dead_code)]
+mod tlsext {
+    use core::ffi::c_uint;
+
+    pub const TLSEXT_MAXLEN_host_name: usize = 255;
+    pub const TLSEXT_NAMETYPE_host_name: u8 = 0;
+    pub const TLSEXT_TYPE_server_name: c_uint = 0;
+    pub const TLSEXT_TYPE_application_layer_protocol_negotiation: c_uint = 16;
+}
+use tlsext::*;
 
 /// Registers tls-alpn-01 in the server merge configuration handler.
 pub fn merge_srv_conf(cf: &mut ngx_conf_t) -> Result<(), Status> {
@@ -166,7 +174,7 @@ impl<'a> Iterator for TlsAlpnIter<'a> {
     }
 }
 
-#[cfg(openssl = "openssl")]
+#[cfg(any(openssl = "openssl", openssl = "awslc"))]
 fn acme_register_client_hello_cb(ssl_ctx: &mut SSL_CTX) {
     use openssl_sys::{SSL_CLIENT_HELLO_ERROR, SSL_CLIENT_HELLO_SUCCESS};
 
@@ -186,7 +194,7 @@ fn acme_register_client_hello_cb(ssl_ctx: &mut SSL_CTX) {
 
     extern "C" fn ssl_client_hello_cb(
         ssl: *mut SSL,
-        _alert: *mut c_int,
+        #[allow(unused)] alert: *mut c_int,
         _data: *mut c_void,
     ) -> c_int {
         let ssl = unsafe { ssl.as_mut() }.expect("valid SSL ptr passed to callback");
@@ -213,6 +221,30 @@ fn acme_register_client_hello_cb(ssl_ctx: &mut SSL_CTX) {
             return SSL_CLIENT_HELLO_ERROR;
         }
 
+        #[cfg(ngx_ssl_client_hello_cb)]
+        match ssl_client_hello_get_ext(ssl, TLSEXT_TYPE_server_name)
+            .as_ref()
+            .map(ssl_parse_server_name_ext)
+        {
+            Some(Ok(x)) => {
+                if unsafe {
+                    nginx_sys::ngx_http_ssl_servername(
+                        ptr::from_mut(ssl).cast(),
+                        alert,
+                        x.as_ptr().cast_mut().cast(),
+                    )
+                } == openssl_sys::SSL_TLSEXT_ERR_ALERT_FATAL
+                {
+                    return SSL_CLIENT_HELLO_ERROR;
+                }
+            }
+            Some(Err(ad)) => {
+                unsafe { *alert = ad };
+                return SSL_CLIENT_HELLO_ERROR;
+            }
+            _ => (),
+        };
+
         SSL_CLIENT_HELLO_SUCCESS
     }
 
@@ -225,7 +257,7 @@ fn acme_register_client_hello_cb(ssl_ctx: &mut SSL_CTX) {
     };
 }
 
-#[cfg(any(openssl = "awslc", openssl = "boringssl"))]
+#[cfg(openssl = "boringssl")]
 fn acme_register_client_hello_cb(ssl_ctx: &mut SSL_CTX) {
     use openssl_sys::SSL_CLIENT_HELLO;
 
@@ -287,6 +319,32 @@ fn acme_register_client_hello_cb(ssl_ctx: &mut SSL_CTX) {
     };
 }
 
+#[cfg(all(ngx_ssl_client_hello_cb, not(openssl = "boringssl")))]
+fn ssl_parse_server_name_ext(p: &ngx_str_t) -> Result<&[u8], c_int> {
+    use openssl_sys::{SSL_AD_DECODE_ERROR, SSL_AD_UNRECOGNIZED_NAME};
+
+    let ext = p.as_bytes();
+    let (len, ext) = ext.split_first_chunk().ok_or(SSL_AD_DECODE_ERROR)?;
+
+    let len: usize = u16::from_be_bytes(*len).into();
+    if len < 3 || len != ext.len() || ext[0] != TLSEXT_NAMETYPE_host_name {
+        return Err(SSL_AD_DECODE_ERROR);
+    }
+
+    let (len, ext) = ext[1..].split_first_chunk().ok_or(SSL_AD_DECODE_ERROR)?;
+
+    let len: usize = u16::from_be_bytes(*len).into();
+    if len == 0 || len != ext.len() {
+        return Err(SSL_AD_DECODE_ERROR);
+    }
+
+    if len > TLSEXT_MAXLEN_host_name || ext.contains(&0) {
+        return Err(SSL_AD_UNRECOGNIZED_NAME);
+    }
+
+    Ok(ext)
+}
+
 /// Get module configuration from a connection.
 ///
 /// # Safety