Routing based on ALPN

Vladimir Homutov vl at nginx.com
Tue Mar 6 14:43:47 UTC 2018


On Sun, Feb 25, 2018 at 08:16:18PM +0100, Wiktor Kwapisiewicz via nginx wrote:
> >> Is there a way to access and save ALPN value to a variable?
> >
> > It should possible to parse the incoming buffer with https://nginx.org/r/js_filter and create a variable to make a routing decision on.
> >
>
> Excellent idea for quickly solving this problem, thanks!
>
> Would a long term solution involve creating a new, additional variable
> in the ssl_preread module (e.g. ssl_preread_alpn)?
>

below is the initial version of patch that creates the
"$ssl_preread_alpn_protocols" variable; the content is a comma-separated
list of protocols, sent by client in ALPN extension, if present.

Any feedback is appretiated.

-------------- next part --------------
# HG changeset patch
# User Roman Arutyunyan <arut at nginx.com>
# Date 1520346970 -10800
#      Tue Mar 06 17:36:10 2018 +0300
# Node ID edea1fea2b3970889946d38a077c7f3ed98613f5
# Parent  265c29b0b8b8c54b1c623268481ed85324ce3c79
Stream ssl_preread: $ssl_preread_alpn_protocols variable.

The variable keeps a comma-separated list of ALPN protocol names sent by client.

diff --git a/src/stream/ngx_stream_ssl_preread_module.c b/src/stream/ngx_stream_ssl_preread_module.c
--- a/src/stream/ngx_stream_ssl_preread_module.c
+++ b/src/stream/ngx_stream_ssl_preread_module.c
@@ -17,10 +17,12 @@ typedef struct {
 typedef struct {
     size_t          left;
     size_t          size;
+    size_t          ext;
     u_char         *pos;
     u_char         *dst;
     u_char          buf[4];
     ngx_str_t       host;
+    ngx_str_t       alpn;
     ngx_log_t      *log;
     ngx_pool_t     *pool;
     ngx_uint_t      state;
@@ -32,6 +34,8 @@ static ngx_int_t ngx_stream_ssl_preread_
     ngx_stream_ssl_preread_ctx_t *ctx, u_char *pos, u_char *last);
 static ngx_int_t ngx_stream_ssl_preread_server_name_variable(
     ngx_stream_session_t *s, ngx_stream_variable_value_t *v, uintptr_t data);
+static ngx_int_t ngx_stream_ssl_preread_alpn_protocols_variable(
+    ngx_stream_session_t *s, ngx_stream_variable_value_t *v, uintptr_t data);
 static ngx_int_t ngx_stream_ssl_preread_add_variables(ngx_conf_t *cf);
 static void *ngx_stream_ssl_preread_create_srv_conf(ngx_conf_t *cf);
 static char *ngx_stream_ssl_preread_merge_srv_conf(ngx_conf_t *cf, void *parent,
@@ -85,6 +89,9 @@ static ngx_stream_variable_t  ngx_stream
     { ngx_string("ssl_preread_server_name"), NULL,
       ngx_stream_ssl_preread_server_name_variable, 0, 0, 0 },
 
+    { ngx_string("ssl_preread_alpn_protocols"), NULL,
+      ngx_stream_ssl_preread_alpn_protocols_variable, 0, 0, 0 },
+
       ngx_stream_null_variable
 };
 
@@ -175,7 +182,7 @@ static ngx_int_t
 ngx_stream_ssl_preread_parse_record(ngx_stream_ssl_preread_ctx_t *ctx,
     u_char *pos, u_char *last)
 {
-    size_t   left, n, size;
+    size_t   left, n, size, ext;
     u_char  *dst, *p;
 
     enum {
@@ -192,7 +199,10 @@ ngx_stream_ssl_preread_parse_record(ngx_
         sw_ext_header,      /* extension_type, extension_data length */
         sw_sni_len,         /* SNI length */
         sw_sni_host_head,   /* SNI name_type, host_name length */
-        sw_sni_host         /* SNI host_name */
+        sw_sni_host,        /* SNI host_name */
+        sw_alpn_len,        /* ALPN length */
+        sw_alpn_proto_len,  /* ALPN protocol_name length */
+        sw_alpn_proto_data  /* ALPN protocol_name */
     } state;
 
     ngx_log_debug2(NGX_LOG_DEBUG_STREAM, ctx->log, 0,
@@ -201,6 +211,7 @@ ngx_stream_ssl_preread_parse_record(ngx_
     state = ctx->state;
     size = ctx->size;
     left = ctx->left;
+    ext = ctx->ext;
     dst = ctx->dst;
     p = ctx->buf;
 
@@ -299,10 +310,18 @@ ngx_stream_ssl_preread_parse_record(ngx_
             break;
 
         case sw_ext_header:
-            if (p[0] == 0 && p[1] == 0) {
+            if (p[0] == 0 && p[1] == 0 && ctx->host.data == NULL) {
                 /* SNI extension */
                 state = sw_sni_len;
-                dst = NULL;
+                dst = p;
+                size = 2;
+                break;
+            }
+
+            if (p[0] == 0 && p[1] == 16 && ctx->alpn.data == NULL) {
+                /* ALPN extension */
+                state = sw_alpn_len;
+                dst = p;
                 size = 2;
                 break;
             }
@@ -313,6 +332,7 @@ ngx_stream_ssl_preread_parse_record(ngx_
             break;
 
         case sw_sni_len:
+            ext = (p[0] << 8) + p[1];
             state = sw_sni_host_head;
             dst = p;
             size = 3;
@@ -328,6 +348,13 @@ ngx_stream_ssl_preread_parse_record(ngx_
             state = sw_sni_host;
             size = (p[1] << 8) + p[2];
 
+            if (ext < 3 + size) {
+                ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0,
+                               "ssl preread: SNI format error");
+                return NGX_DECLINED;
+            }
+            ext -= 3 + size;
+
             ctx->host.data = ngx_pnalloc(ctx->pool, size);
             if (ctx->host.data == NULL) {
                 return NGX_ERROR;
@@ -341,7 +368,64 @@ ngx_stream_ssl_preread_parse_record(ngx_
 
             ngx_log_debug1(NGX_LOG_DEBUG_STREAM, ctx->log, 0,
                            "ssl preread: SNI hostname \"%V\"", &ctx->host);
-            return NGX_OK;
+
+            state = sw_ext;
+            dst = NULL;
+            size = ext;
+            break;
+
+        case sw_alpn_len:
+            ext = (p[0] << 8) + p[1];
+            dst = p;
+            size = 1;
+
+            ctx->alpn.data = ngx_pnalloc(ctx->pool, ext);
+            if (ctx->alpn.data == NULL) {
+                return NGX_ERROR;
+            }
+
+            state = sw_alpn_proto_len;
+            break;
+
+        case sw_alpn_proto_len:
+            dst = ctx->alpn.data + ctx->alpn.len;
+            size = p[0];
+
+            if (ext < 1 + size) {
+                ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0,
+                               "ssl preread: ALPN format error");
+                return NGX_DECLINED;
+            }
+            ext -= 1 + size;
+            state = sw_alpn_proto_data;
+            break;
+
+        case sw_alpn_proto_data:
+
+            if (p[0] == 0) {
+                ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0,
+                               "ssl preread: ALPN protocol zero length");
+                return NGX_DECLINED;
+            }
+
+            ctx->alpn.len += p[0];
+
+            ngx_log_debug1(NGX_LOG_DEBUG_STREAM, ctx->log, 0,
+                           "ssl preread: ALPN protocols \"%V\"", &ctx->alpn);
+
+            if (ext) {
+                ctx->alpn.data[ctx->alpn.len++] = ',';
+
+                state = sw_alpn_proto_len;
+                dst = p;
+                size = 1;
+                break;
+            }
+
+            state = sw_ext;
+            dst = NULL;
+            size = 0;
+            break;
         }
 
         if (left < size) {
@@ -354,6 +438,7 @@ ngx_stream_ssl_preread_parse_record(ngx_
     ctx->state = state;
     ctx->size = size;
     ctx->left = left;
+    ctx->ext = ext;
     ctx->dst = dst;
 
     return NGX_AGAIN;
@@ -384,6 +469,29 @@ ngx_stream_ssl_preread_server_name_varia
 
 
 static ngx_int_t
+ngx_stream_ssl_preread_alpn_protocols_variable(ngx_stream_session_t *s,
+    ngx_variable_value_t *v, uintptr_t data)
+{
+    ngx_stream_ssl_preread_ctx_t  *ctx;
+
+    ctx = ngx_stream_get_module_ctx(s, ngx_stream_ssl_preread_module);
+
+    if (ctx == NULL) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+    v->len = ctx->alpn.len;
+    v->data = ctx->alpn.data;
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
 ngx_stream_ssl_preread_add_variables(ngx_conf_t *cf)
 {
     ngx_stream_variable_t  *var, *v;


More information about the nginx mailing list