MINOR: ssl: add the ssl_bc_sni sample fetch function to retrieve backend SNI

Sometimes in order to debug certain difficult situations it can be useful
to know what SNI was configured on a connection going to a server, for
example to match it against what the server saw or to detect cases where
a server would route on SNI instead of Host. This sample fetch function
simply retrieves the SNI configured on the backend connection, if any.

(cherry picked from commit dae4cfe8c57dc7644a7afd847d964c8d7444deda)
[wt: backported in order to help tracking some issues]
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit ca6a7b4635ab9417e4f8a171b28269c145e1da33)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit a60a266393ad52b3f9e50e96348e7970ba9d17fd)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>

diff --git a/doc/configuration.txt b/doc/configuration.txt
index c0aeec8..abad35b 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -23317,6 +23317,7 @@ ssl_bc_server_traffic_secret_0                     string
 ssl_bc_server_random                               binary
 ssl_bc_session_id                                  binary
 ssl_bc_session_key                                 binary
+ssl_bc_sni                                         string
 ssl_bc_use_keysize                                 integer
 ssl_c_ca_err                                       integer
 ssl_c_ca_err_depth                                 integer
@@ -23650,6 +23651,13 @@ ssl_bc_session_key : binary
   traffic sent using ephemeral ciphers. This requires OpenSSL >= 1.1.0, or
   BoringSSL. It can be used in a tcp-check or an http-check ruleset.
 
+ssl_bc_sni : string
+  This retrieves the Server Name Indication TLS extension (SNI) field that was
+  used on the connection to the server. The result (when present) typically is
+  a string matching the HTTPS host name (253 chars or less). The main use case
+  is for logging and debugging purposes (e.g. figure what SNI was used when the
+  connection was established to match it against what the server has seen).
+
 ssl_bc_use_keysize : integer
   Returns the symmetric cipher key size used in bits when the outgoing
   connection was made over an SSL/TLS transport layer. It can be used in a

diff --git a/src/ssl_sample.c b/src/ssl_sample.c
index 0757c12..5d3fb88 100644 (file)
--- a/src/ssl_sample.c
+++ b/src/ssl_sample.c
@@ -1742,6 +1742,7 @@ smp_fetch_ssl_fc_session_key(const struct arg *args, struct sample *smp, const c
 }
 #endif
 
+/* ssl_fc_sni and ssl_bc_sni */
 static int
 smp_fetch_ssl_fc_sni(const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
@@ -1752,7 +1753,12 @@ smp_fetch_ssl_fc_sni(const struct arg *args, struct sample *smp, const char *kw,
        smp->flags = SMP_F_VOL_SESS | SMP_F_CONST;
        smp->data.type = SMP_T_STR;
 
-       conn = objt_conn(smp->sess->origin);
+       if (obj_type(smp->sess->origin) == OBJ_TYPE_CHECK)
+               conn = (kw[4] == 'b') ? sc_conn(__objt_check(smp->sess->origin)->sc) : NULL;
+       else
+               conn = (kw[4] != 'b') ? objt_conn(smp->sess->origin) :
+                       smp->strm ? sc_conn(smp->strm->scb) : NULL;
+
        ssl = ssl_sock_get_ssl_object(conn);
        if (!ssl)
                return 0;
@@ -2330,6 +2336,7 @@ static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
 #endif
        { "ssl_bc_err",             smp_fetch_ssl_fc_err,         0,                   NULL,    SMP_T_SINT, SMP_USE_L5SRV },
        { "ssl_bc_err_str",         smp_fetch_ssl_fc_err_str,     0,                   NULL,    SMP_T_STR,  SMP_USE_L5SRV },
+       { "ssl_bc_sni",             smp_fetch_ssl_fc_sni,         0,                   NULL,    SMP_T_STR,  SMP_USE_L5SRV },
        { "ssl_c_ca_err",           smp_fetch_ssl_c_ca_err,       0,                   NULL,    SMP_T_SINT, SMP_USE_L5CLI },
        { "ssl_c_ca_err_depth",     smp_fetch_ssl_c_ca_err_depth, 0,                   NULL,    SMP_T_SINT, SMP_USE_L5CLI },
        { "ssl_c_der",              smp_fetch_ssl_x_der,          0,                   NULL,    SMP_T_BIN,  SMP_USE_L5CLI },