Module sni 

SNI-based routing for TCP TLS passthrough.

extract_sni peeks the server name out of a TLS ClientHello without terminating TLS, so the SniRouter can pick a backend pool by hostname and the raw bytes are relayed on to it. The parser operates on a possibly partial, fully untrusted buffer: it is bounds-checked at every step and never panics — a short buffer yields SniResult::Incomplete (read more), and anything malformed or non-ClientHello yields SniResult::NotPresent (fall back to the default pool).

Structs

SniRouter

Routes a TCP connection to a backend pool by its ClientHello SNI hostname, falling back to a default pool.

Enums

Skip 🔒

SniPattern 🔒

An SNI match pattern: exact hostname or a single-label wildcard. Shared by the L4 stream router and the TLS multi-cert resolver.

SniResult

Outcome of parsing a (possibly partial) TLS record for the SNI hostname.

Constants

MAX_RECORD_LEN 🔒

Max TLS record length per RFC (2^14 + 256 headroom); a larger declared length is treated as malformed.

Functions

advance 🔒

Advances p by n, or None if that would exceed ceiling.

be16 🔒

Big-endian u16 at buf[p..p+2], or None if out of bounds.

be24 🔒

Big-endian u24 at buf[p..p+3], or None if out of bounds.

extract_sni

Extracts the SNI hostname from the start of a TLS stream. Bounds-safe and panic-free; see the module docs for the SniResult contract.

parse_server_name 🔒

Parses the server_name extension body (buf[start..end]).

skip_vec 🔒

Skips a length-prefixed vector: reads a len_bytes-wide (1 or 2) big-endian length at p, then skips that many bytes, all bounded by ceiling.