Documentation
¶
Overview ¶
Package tlsinspect parses and verifies TLS ClientHello records on named TCP tunnels without terminating TLS. It extracts the SNI server_name extension and detects Encrypted Client Hello (ECH).
Index ¶
Constants ¶
const ( // RecordTypeHandshake is the TLS record content type for Handshake (22). RecordTypeHandshake = 0x16 // HandshakeTypeClientHello is the TLS handshake message type for ClientHello (1). HandshakeTypeClientHello = 0x01 // ExtServerName is the TLS extension type for SNI server_name (0). ExtServerName = 0x0000 // ExtEncryptedClientHello is the TLS extension type for Encrypted Client Hello (0xfe0d). ExtEncryptedClientHello = 0xfe0d // MaxRecordBytes is the maximum RFC 8446 TLS record payload length (16 KiB). MaxRecordBytes = 16384 )
Variables ¶
This section is empty.
Functions ¶
func ParseClientHelloHandshake ¶
ParseClientHelloHandshake parses the payload of a TLS Handshake record containing a single ClientHello message and extracts the SNI host_name and ECH presence.
func VerifyClientHello ¶
func VerifyClientHello(r io.Reader, expectedHost string) (rawRecord []byte, normalizedSNI string, err error)
VerifyClientHello reads a single TLS record from r, verifies that it is an unencrypted TLS ClientHello whose SNI matches expectedHost and that Encrypted Client Hello (ECH, 0xfe0d) is not present, and returns the exact raw record bytes so the caller can replay them to the upstream server before splicing.
Types ¶
type ClientHello ¶
type ClientHello struct {
// RawRecord is the complete TLS record (5-byte header + payload) suitable
// for replaying to the upstream server after inspection.
RawRecord []byte
// ServerName is the raw host_name extracted from the SNI extension, if present.
ServerName string
// HasECH reports whether the ClientHello includes the Encrypted Client Hello extension.
HasECH bool
}
ClientHello holds the parsed metadata and raw wire bytes of a single TLS ClientHello record read from a stream.
func ReadClientHello ¶
func ReadClientHello(r io.Reader) (*ClientHello, error)
ReadClientHello reads a single TLS Handshake record from r and parses it as a ClientHello message. Even when handshake parsing fails after the record bytes have been read, RawRecord is populated on the returned struct if non-nil.
Source Files