Skip to content

Add sni to the SSL session digest#567

Open
pszabop wants to merge 3 commits intocloudflare:mainfrom
pszabop:add-sni
Open

Add sni to the SSL session digest#567
pszabop wants to merge 3 commits intocloudflare:mainfrom
pszabop:add-sni

Conversation

@pszabop
Copy link
Copy Markdown

@pszabop pszabop commented Mar 24, 2025

See issue #547

This PR adds the SNI to the session digest for SSL.

Rustls is stubbed because I couldn't figure out how to get it. Be happy to include that if someone can give me a hint.

I note to get the modified code to compile for Docker I had to modify the Dockerfile, as it looks like it hasn't kept up with the changes in optional modules. If you need an issue for that let me know. I doubt the patch is perfectly complete, the documentation on how to build all the options doesn't seem to be anywhere I can find it (and building with all options simultaneously breaks the build)

@pszabop
Copy link
Copy Markdown
Author

pszabop commented Mar 24, 2025

I removed the patch to Dockerfile, it's clearly out of date with the github build actions and thus should be handled as a separate issue. Now handling local builds with act -j pingora

@sdonal00
Copy link
Copy Markdown

I've been using this fix for months in production. I'm surprised it hasn't been added in 0.5 or 0.6. It would be really convenient if it was. @drcaramelsyrup

@pszabop
Copy link
Copy Markdown
Author

pszabop commented Nov 6, 2025

the entire SSL Digest creation method was changed and it causes merge conflicts and the function signature doesn't take the SNI. So will have to go through some effort to update the patch

@pszabop
Copy link
Copy Markdown
Author

pszabop commented Jan 23, 2026

Recent changes may have rendered this patch obsolete, as there's another way to solve getting the SNI:

Newer versions of Pingora provide:

  1. SslDigestExtension - A generic extension field on SslDigest that can store any Arc<dyn Any + Send + Sync>
  2. handshake_complete_callback - A TlsAccept trait method called after TLS handshake that can return data
    to be stored in the extension

And then you access it in a pingora callback like this:

if let Some(sni_ext) = ssl_digest.extension.get::<SniExtension>() {
    ctx.sni = Some(sni_ext.sni.clone());
}

I'll test this as soon as I get around to upgrading Pingora, and if it works I'll close this issue.

There could still be a problem with TLS session resumption not firing the handshake_complete_callback, I won't know until I try.

@Rhovian
Copy link
Copy Markdown

Rhovian commented Apr 9, 2026

This can be closed — the functionality is available via the existing SslDigestExtension + handshake_complete_callback mechanism.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants