Per-SNI HTTP/3 over ACME via purecrypto::quic::peek_initial_sni (0.6.25)

- rt/quic.rs: CertSource { Static | Acme }. For ACME, each new QUIC connection
  peeks the SNI from the Initial (peek_initial_sni) and selects the cert with
  AcmeManager::choose_cached — a NON-blocking lookup (in-memory cache → disk)
  so the single QUIC event loop never stalls on issuance (the TCP path issues;
  browsers reach TCP first and upgrade via Alt-Svc).
- AcmeManager::choose_cached: cached/on-disk cert only, no ACME round-trip.
- run_h3 builds CertSource from .acme() (per-SNI) or .tls() (static); the
  http3_host hack stays gone.
- CLI: HTTP/3 on by default for ACME too (http3_enabled includes accept_tos).

Note: per-SNI h3 over ACME is gated on a purecrypto peek_initial_sni fix —
it currently returns Ok(None) for a real curl/ngtcp2 1200-byte padded Initial
(the full QuicConnection parses the same datagram fine), so the cert can't be
selected yet. Static-cert HTTP/3 is unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MagicalTux

Cargo.lock

@@ -147,6 +147,40 @@ impl AcmeManager {
         }
     }
 
+    /// Like [`choose`](Self::choose) but **never blocks on ACME issuance** —
+    /// it serves only a cert already cached or on disk. Used by the QUIC/HTTP-3
+    /// runtime, whose single event loop must not stall on a multi-second
+    /// issuance; the TCP path issues, and HTTP/3 picks the cert up once it
+    /// exists (browsers reach TCP first and upgrade via `Alt-Svc`).
+    pub fn choose_cached(&self, sni: Option<&str>, peer_is_loopback: bool) -> CertChoice {
+        if peer_is_loopback {
+            return CertChoice::Serve(self.self_signed());
+        }
+        let Some(host) = sni.map(normalize).filter(|h| !h.is_empty()) else {
+            return CertChoice::Serve(self.self_signed());
+        };
+        if let Some(wl) = &self.inner.cfg.host_whitelist
+            && !wl.contains(&host)
+        {
+            return CertChoice::Reject;
+        }
+        if let Some(c) = self.inner.cache.lock().unwrap().get(&host).cloned() {
+            return CertChoice::Serve(c.acceptor.clone());
+        }
+        match self.inner.store.load_cert(&host) {
+            Ok(Some(stored)) => match TlsAcceptor::from_pem(&stored.chain_pem, &stored.key_pem) {
+                Ok(acceptor) => {
+                    let not_after = cert_not_after(&stored.chain_pem);
+                    self.cache_put(&host, acceptor.clone(), not_after);
+                    CertChoice::Serve(acceptor)
+                }
+                Err(_) => CertChoice::Reject,
+            },
+            // Not issued yet: don't block the QUIC loop — let the TCP path issue.
+            _ => CertChoice::Reject,
+        }
+    }
+
     /// Return a ready acceptor for `host`, issuing or renewing as needed.
     fn get_or_issue(&self, host: &str) -> Result<TlsAcceptor> {
         let now = now_secs();

src/acme/manager.rs

@@ -59,11 +59,6 @@ fn run() -> httpsd::Result<()> {
             }
         });
         eprintln!("httpsd: also serving HTTP/3 on udp/{addr}");
-    } else if !opts.no_http3 && opts.acme_accept_tos && !opts.is_tls() {
-        eprintln!(
-            "httpsd: HTTP/3 not started — per-SNI HTTP/3 under ACME awaits QUIC SNI support; \
-             use --tls-cert for HTTP/3"
-        );
     }
 
     let server = opts.build_server()?;
@@ -261,11 +256,11 @@ impl Options {
         Ok(server)
     }
 
-    /// Whether HTTP/3 should run: on by default with a static TLS cert, off via
-    /// `--no-http3`. (Per-SNI HTTP/3 under ACME isn't available yet.)
+    /// Whether HTTP/3 should run: on by default whenever HTTPS is served (a
+    /// static cert or ACME), off via `--no-http3`.
     #[cfg(feature = "h3")]
     fn http3_enabled(&self) -> bool {
-        !self.no_http3 && self.is_tls()
+        !self.no_http3 && (self.is_tls() || self.acme_accept_tos)
     }
 
     /// The port from the listen address (defaults to 443 if unparseable).

src/bin/httpsd.rs

@@ -278,28 +278,30 @@ impl Server {
     /// Run an HTTP/3 server on a QUIC/UDP event loop, listening on the same
     /// address(es) as the TCP server (but over UDP). HTTP/3 is always encrypted.
     ///
-    /// Uses the static [`tls`](Server::tls) acceptor's certificate. Per-SNI
-    /// certificate selection over QUIC (the HTTP/3 equivalent of the TCP path's
-    /// ClientHello peek) needs the QUIC engine to expose the SNI from the
-    /// encrypted Initial packet before the handshake; until then, on-demand
-    /// ACME certificates aren't available over HTTP/3. Blocks the calling thread.
+    /// Under ACME, certificates are selected per-connection by peeking the SNI
+    /// from the QUIC Initial (`purecrypto::quic::peek_initial_sni`); the QUIC
+    /// loop serves already-issued certs (the TCP path does the issuing). With a
+    /// static [`tls`](Server::tls) acceptor, that one certificate is used.
+    /// Blocks the calling thread.
     #[cfg(feature = "h3")]
     pub fn run_h3(self) -> Result<()> {
-        let acceptor = self.h3_acceptor()?;
+        let certs = self.h3_cert_source()?;
         let cfg = self.session_config();
-        quic::run(self.addrs.clone(), cfg, acceptor)
+        quic::run(self.addrs.clone(), cfg, certs)
     }
 
     #[cfg(feature = "h3")]
-    fn h3_acceptor(&self) -> Result<TlsAcceptor> {
+    fn h3_cert_source(&self) -> Result<quic::CertSource> {
+        #[cfg(feature = "acme")]
+        if let Some(mgr) = &self.acme {
+            return Ok(quic::CertSource::Acme(mgr.clone()));
+        }
         #[cfg(feature = "tls")]
         if let Some(acc) = &self.tls {
-            return Ok(acc.clone());
+            return Ok(quic::CertSource::Static(acc.clone()));
         }
         Err(Error::Config(
-            "HTTP/3 needs a static TLS certificate (Server::tls); per-SNI HTTP/3 under ACME \
-             awaits QUIC ClientHello/SNI peek support in purecrypto"
-                .into(),
+            "HTTP/3 requires TLS: a static cert via .tls(), or ACME via .acme()".into(),
         ))
     }
 }

src/rt/mod.rs

@@ -20,6 +20,44 @@ use crate::h3::H3Conn;
 use crate::session::SessionConfig;
 use crate::tls::TlsAcceptor;
 
+#[cfg(feature = "acme")]
+use crate::acme::{AcmeManager, CertChoice};
+
+/// Where the QUIC listener gets a certificate for each new connection.
+pub(crate) enum CertSource {
+    /// One static certificate for every connection.
+    Static(TlsAcceptor),
+    /// Per-SNI certificates from ACME, selected by peeking the QUIC Initial.
+    #[cfg(feature = "acme")]
+    Acme(AcmeManager),
+}
+
+impl CertSource {
+    /// Choose the acceptor for a new connection given its first datagram.
+    /// Returns `None` to drop the datagram (SNI not yet available, host not
+    /// permitted, or no cert issued yet — the client retries / falls back).
+    #[cfg_attr(not(feature = "acme"), allow(unused_variables))]
+    fn acceptor_for(&self, peer: SocketAddr, first_datagram: &[u8]) -> Option<TlsAcceptor> {
+        match self {
+            CertSource::Static(acceptor) => Some(acceptor.clone()),
+            #[cfg(feature = "acme")]
+            CertSource::Acme(mgr) => {
+                // The QUIC ClientHello rides in the encrypted Initial; peek its
+                // SNI without committing to a connection.
+                let info = match purecrypto::quic::peek_initial_sni(first_datagram) {
+                    Ok(Some(info)) => info,
+                    // Need the full Initial, or not a ClientHello — wait for retry.
+                    Ok(None) | Err(_) => return None,
+                };
+                match mgr.choose_cached(info.server_name.as_deref(), peer.ip().is_loopback()) {
+                    CertChoice::Serve(acceptor) => Some(acceptor),
+                    CertChoice::Reject => None,
+                }
+            }
+        }
+    }
+}
+
 /// QUIC datagrams must fit a conservative MTU; 1350 is the usual safe ceiling,
 /// we read into a slightly larger buffer.
 const RECV_BUF: usize = 2048;
@@ -34,7 +72,7 @@ struct Conn {
 }
 
 /// Bind a UDP socket and serve HTTP/3 until a fatal socket error.
-pub(crate) fn run(addrs: Vec<SocketAddr>, cfg: SessionConfig, acceptor: TlsAcceptor) -> Result<()> {
+pub(crate) fn run(addrs: Vec<SocketAddr>, cfg: SessionConfig, certs: CertSource) -> Result<()> {
     let socket = bind_first(&addrs)?;
     let start = Instant::now();
     let mut conns: HashMap<SocketAddr, Conn> = HashMap::new();
@@ -55,7 +93,7 @@ pub(crate) fn run(addrs: Vec<SocketAddr>, cfg: SessionConfig, acceptor: TlsAccep
         match socket.recv_from(&mut buf) {
             Ok((n, peer)) => {
                 let data = buf[..n].to_vec();
-                if let Err(e) = on_datagram(&socket, &mut conns, peer, &data, &cfg, &acceptor) {
+                if let Err(e) = on_datagram(&socket, &mut conns, peer, &data, &cfg, &certs) {
                     if cfg!(debug_assertions) {
                         eprintln!("httpsd: h3 connection error from {peer}: {e}");
                     }
@@ -90,9 +128,13 @@ fn on_datagram(
     peer: SocketAddr,
     data: &[u8],
     cfg: &SessionConfig,
-    acceptor: &TlsAcceptor,
+    certs: &CertSource,
 ) -> Result<()> {
     if let std::collections::hash_map::Entry::Vacant(slot) = conns.entry(peer) {
+        // New connection: pick the certificate from the Initial's SNI.
+        let Some(acceptor) = certs.acceptor_for(peer, data) else {
+            return Ok(()); // SNI unavailable / host not served — drop, client retries
+        };
         let qcfg = acceptor.quic_config()?;
         let quic = QuicConnection::server(qcfg).map_err(qerr)?;
         slot.insert(Conn {