SNI suffix matching support ("req_ssl_sni_end") for HaProxy 1.5 [patch enclosed]

[Noam Liran]

Hi,

We recently needed an ACL to match a request's SNI host against a suffix (i.e. create an ACL to match *.my.domain.com against the SNI hostname).
I was surprised to find out that req_ssl_sni had no search wrappers like _end and _reg.
I saw that adding them was really trivial (kudos!) and I think they might be useful for other users as well.

The patch to add req_ssl_sni_end is attached and was done against a vanilla 1.5dev19. I didn't make a patch for req_ssl_sni_reg but it looks pretty trivial.

I'd appreciate if one of the developers could give me a nod that it looks okay and maybe add it to 1.5dev22 :-)

Regards,
Noam Liran

[Cyril Bonté]

Hi Noam,

Post by Noam Liran
Hi,
We recently needed an ACL to match a request's SNI host against a suffix (i.e. create an ACL to match *.my.domain.com against the SNI hostname).
I was surprised to find out that req_ssl_sni had no search wrappers like _end and _reg.
I saw that adding them was really trivial (kudos!) and I think they might be useful for other users as well.
The patch to add req_ssl_sni_end is attached and was done against a vanilla 1.5dev19. I didn't make a patch for req_ssl_sni_reg but it looks pretty trivial.
I'd appreciate if one of the developers could give me a nod that it looks okay and maybe add it to 1.5dev22 :-)

I'm not sure this is something that should be added to the 1.5 branch :
many changes were done to allow different matching methods in acl
keywords. See here for more details :
http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#7.1

Without any patch, "req_ssl_sni_end" is the equivalent to "req.ssl_sni
-m end".

(note that several keywords have been deprecated, this is the case for
req_ssl_sni, in preference to req.ssl_sni).