updated to resolve conflict on upstream wildcard sni feature

Author: wwwehr

gateway/src/proxy/tls_passthough.rs

@@ -69,21 +69,41 @@ async fn resolve_app_address(prefix: &str, sni: &str, compat: bool, state: &Prox
             let Some(txt_record) = lookup.iter().next() else {
                 continue;
             };
-            let Some(data) = txt_record.txt_data().first() else {
-                continue;
-            };
-            return AppAddress::parse(data).context("failed to parse app address");
+            let locked = state.lock();
+            if let Ok(addr) = select_app_address(txt_record.txt_data(), &locked.state.apps) {
+                return Ok(addr);
+            }
+        }
+    } else if let Ok(lookup) = resolver.txt_lookup(txt_domain).await {
+        if let Some(txt_record) = lookup.iter().next() {
+            let locked = state.lock();
+            if let Ok(addr) = select_app_address(txt_record.txt_data(), &locked.state.apps) {
+                return Ok(addr);
+            }
         }
-        anyhow::bail!("failed to resolve legacy app address");
-    } else {
+    }
+
+    // wildcard fallback: try {prefix}-wildcard.{parent_domain}
+    if let Some((_, parent)) = sni.split_once('.') {
+        let wildcard_domain = format!("{prefix}-wildcard.{parent}");
         let lookup = resolver
-            .txt_lookup(txt_domain)
+            .txt_lookup(&wildcard_domain)
             .await
-            .context("failed to lookup app address")?;
-        let txt_record = lookup.iter().next().context("no txt record found")?;
+            .with_context(|| {
+                format!("failed to lookup wildcard app address for {sni} via {wildcard_domain}")
+            })?;
+        let txt_record = lookup
+            .iter()
+            .next()
+            .with_context(|| format!("no txt record found for {sni} via {wildcard_domain}"))?;
         let locked = state.lock();
-        select_app_address(txt_record.txt_data(), &locked.state.apps)
+        return select_app_address(txt_record.txt_data(), &locked.state.apps)
+            .with_context(|| {
+                format!("failed to parse app address for {sni} via {wildcard_domain}")
+            });
     }
+
+    anyhow::bail!("failed to resolve app address for {sni}");
 }
 
 pub(crate) async fn proxy_with_sni(
@@ -97,8 +117,8 @@ pub(crate) async fn proxy_with_sni(
     let dns_timeout = state.config.proxy.timeouts.dns_resolve;
     let addr = timeout(dns_timeout, resolve_app_address(ns_prefix, sni, compat, &state))
         .await
-        .context("DNS TXT resolve timeout")?
-        .context("failed to resolve app address")?;
+        .with_context(|| format!("DNS TXT resolve timeout for {sni}"))?
+        .with_context(|| format!("failed to resolve app address for {sni}"))?;
     debug!("target address is {}:{}", addr.app_id, addr.port);
     proxy_to_app(state, inbound, buffer, &addr.app_id, addr.port).await
 }