TSClientHello

Synopsis

#include <ts/apidefs.h>

type TSClientHello

type TSClientHello::TSExtensionTypeList: A type alias for an iterable container of extension type IDs.

Description

TSClientHello is an opaque handle to a TLS ClientHello message sent by a client during the TLS handshake. It provides access to the client’s TLS version, cipher suites, and extensions.

The implementation abstracts differences between OpenSSL and BoringSSL to provide a consistent interface.

Accessor Methods

The following methods are available to access ClientHello data:

bool is_available() const: Returns whether the object contains valid values. As long as TSVConnClientHelloGet() is called from the TS_EVENT_SSL_CLIENT_HELLO hook, the return value should be true.

uint16_t get_version() const: Returns the TLS version from the ClientHello message.

const uint8_t *get_cipher_suites() const: Returns a pointer to the cipher suites buffer. The length is available via get_cipher_suites_len().

size_t get_cipher_suites_len() const: Returns the length of the cipher suites buffer in bytes.

TSClientHello::TSExtensionTypeList get_extension_types() const: Returns an iterable container of every extension type ID in the ClientHello, in the order the client sent them. The list includes GREASE values and extension types the SSL library does not recognize, on both BoringSSL and OpenSSL. On OpenSSL, the list is read from the raw ClientHello message because OpenSSL’s own ClientHello API omits extensions it does not recognize. If the raw message cannot be parsed, the list falls back to the extensions OpenSSL recognizes, and proxy.process.ssl.client_hello_raw_parse_failure is incremented.

Note

On OpenSSL, TSClientHelloExtensionGet() can still only return the contents of extensions that OpenSSL recognizes. An extension type such as ALPS (0x4469) can appear in this list while TSClientHelloExtensionGet() returns TS_ERROR for it.

void *_get_internal() const: Returns a pointer to internal implementation data. This is an internal accessor for advanced use cases. This accessor is not part of the stable public API, and plugins must not cast or rely on the returned pointer type.