[nginx] SSL: $ssl_encrypted_hello variable.

[Maxim Dounin]

details:   http://freenginx.org/hg/nginx/rev/84f82b372bc0
branches:  
changeset: 9423:84f82b372bc0
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Sep 20 02:16:13 2025 +0300
description:
SSL: $ssl_encrypted_hello variable.

diffstat:

 src/event/ngx_event_openssl.c          |  45 ++++++++++++++++++++++++++++++++++
 src/event/ngx_event_openssl.h          |   2 +
 src/http/modules/ngx_http_ssl_module.c |   3 ++
 3 files changed, 50 insertions(+), 0 deletions(-)

diffs (80 lines):

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -5835,6 +5835,51 @@ ngx_ssl_get_early_data(ngx_connection_t 
 
 
 ngx_int_t
+ngx_ssl_get_encrypted_hello(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
+{
+    s->len = 0;
+
+#ifdef OSSL_ECH_FOR_RETRY
+    {
+    int    status;
+    char  *outer, *inner;
+
+    /* OpenSSL */
+
+    outer = NULL;
+    inner = NULL;
+
+    status = SSL_ech_get1_status(c->ssl->connection, &outer, &inner);
+
+    if (status == SSL_ECH_STATUS_SUCCESS
+        || status == SSL_ECH_STATUS_BAD_NAME)
+    {
+        ngx_str_set(s, "1");
+    }
+
+    if (outer) {
+        OPENSSL_free(outer);
+    }
+
+    if (inner) {
+        OPENSSL_free(inner);
+    }
+    }
+#elif defined SSL_R_UNSUPPORTED_ECH_SERVER_CONFIG
+
+    /* BoringSSL */
+
+    if (SSL_ech_accepted(c->ssl->connection)) {
+        ngx_str_set(s, "1");
+    }
+
+#endif
+
+    return NGX_OK;
+}
+
+
+ngx_int_t
 ngx_ssl_get_server_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 {
 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
--- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h
@@ -289,6 +289,8 @@ ngx_int_t ngx_ssl_get_session_reused(ngx
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_early_data(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
+ngx_int_t ngx_ssl_get_encrypted_hello(ngx_connection_t *c, ngx_pool_t *pool,
+    ngx_str_t *s);
 ngx_int_t ngx_ssl_get_server_name(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_alpn_protocol(ngx_connection_t *c, ngx_pool_t *pool,
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -359,6 +359,9 @@ static ngx_http_variable_t  ngx_http_ssl
       (uintptr_t) ngx_ssl_get_early_data,
       NGX_HTTP_VAR_CHANGEABLE|NGX_HTTP_VAR_NOCACHEABLE, 0 },
 
+    { ngx_string("ssl_encrypted_hello"), NULL, ngx_http_ssl_variable,
+      (uintptr_t) ngx_ssl_get_encrypted_hello, NGX_HTTP_VAR_CHANGEABLE, 0 },
+
     { ngx_string("ssl_server_name"), NULL, ngx_http_ssl_variable,
       (uintptr_t) ngx_ssl_get_server_name, NGX_HTTP_VAR_CHANGEABLE, 0 },