feat(tls): add SNI to SslDigest

This adds the SNI (Server Name Indication) to the SslDigest struct,
making it accessible in the HTTP filter context via session.digest().

The SNI is extracted during TLS handshake for the boringssl/openssl
backend. The rustls and s2n backends pass None for now and can be
extended in future work.

Users can now access the SNI in their request_filter callback:

    if let Some(digest) = session.digest() {
        if let Some(ssl_digest) = &digest.ssl_digest {
            if let Some(sni) = &ssl_digest.sni {
                // Use SNI for routing/validation logic
            }
        }
    }

Fixes #547

Author: singhvishalkr

pingora-core/src/protocols/tls/boringssl_openssl/stream.rs

@@ -209,7 +209,11 @@ impl SslDigest {
             None => (Vec::new(), None, None),
         };
 
-        SslDigest::new(cipher, ssl.version_str(), org, sn, cert_digest)
+        let sni = ssl
+            .servername(ssl::NameType::HOST_NAME)
+            .map(ToOwned::to_owned);
+
+        SslDigest::new(cipher, ssl.version_str(), org, sn, cert_digest, sni)
     }
 }
 

pingora-core/src/protocols/tls/digest.rs

@@ -31,6 +31,8 @@ pub struct SslDigest {
     pub serial_number: Option<String>,
     /// The digest of the peer's certificate
     pub cert_digest: Vec<u8>,
+    /// The SNI used during the TLS handshake
+    pub sni: Option<String>,
     /// The user-defined TLS data
     pub extension: SslDigestExtension,
 }
@@ -43,6 +45,7 @@ impl SslDigest {
         organization: Option<String>,
         serial_number: Option<String>,
         cert_digest: Vec<u8>,
+        sni: Option<String>,
     ) -> Self
     where
         S: Into<Cow<'static, str>>,
@@ -53,6 +56,7 @@ impl SslDigest {
             organization,
             serial_number,
             cert_digest,
+            sni,
             extension: SslDigestExtension::default(),
         }
     }

pingora-core/src/protocols/tls/rustls/stream.rs

@@ -390,7 +390,10 @@ impl SslDigest {
             .map(|(organization, serial)| (organization, Some(serial)))
             .unwrap_or_default();
 
-        SslDigest::new(cipher, version, organization, serial_number, cert_digest)
+        // SNI extraction not yet implemented for rustls
+        let sni = None;
+
+        SslDigest::new(cipher, version, organization, serial_number, cert_digest, sni)
     }
 }
 

pingora-core/src/protocols/tls/s2n/stream.rs

@@ -307,12 +307,16 @@ impl SslDigest {
             }
         }
 
+        // SNI extraction not yet implemented for s2n
+        let sni = None;
+
         SslDigest::new(
             cipher,
             version,
             organization,
             serial_number,
             cert_digest.unwrap_or_default(),
+            sni,
         )
     }
 }