Extract SNI value for logging in TCP mode

Help!
1

I have already confirmed that this ACL rule works to extract SNI from raw TCP packets.

    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }
    acl is_my_domain req.ssl_sni -i www.domain.com
    tcp-request content capture req.ssl_sni len 100

Note tcp-request content capture req.ssl_sni len 100, my intent is to log the SNI value in access logs, so somehow transmit this information so I can use it in log-format.

In log-format, I tried the following but it doesn’t work.

log-format "%[capture.req.ssl_sni]"

I get the following error:-

failed to parse log-format : failed to parse sample expression <capture.req.ssl_sni]

Any help on links to the documentation that my eyes can’t see are appreciated. Thanks!

2

Apparently, the answer to this already existed in another thread. Log SNI in TCP mode

The ordering matters, capture has to come before accept. This works for me.

    tcp-request inspect-delay 3s
    tcp-request content capture req.ssl_sni len 100

log-format "%[capture.req.hdr(0)]"