tlshowdy

README

tlshowdy

A library that provides simple TLS SNI demultiplexing without actually consuming the SSL handshake.

Read the docs at https://godoc.org/github.com/spacemonkeygo/tlshowdy

LICENSE

Copyright (c) 2012 The Go Authors. All rights reserved.

Some modifications by Space Monkey, 2015.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

• Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
• Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
• Neither the name of Google Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Documentation

Overview

package tlshowdy contains a number of utilities all designed to implement one primary method, Peek, which allows for simple implementations of virtual host demultiplexing using SNI.

Index

• Constants
• func PrefixIsTLS(prefix []byte) bool
• func ReadHandshake(r io.Reader) (data []byte, is_ssl bool, err error)
• func ReadRecord(r io.Reader) (record []byte, is_ssl bool, err error)
• type ClientHelloMsg
  • func Peek(conn net.Conn) (*ClientHelloMsg, net.Conn, error)
  • func Read(r io.Reader) (msg *ClientHelloMsg, err error)
  • func (m *ClientHelloMsg) Marshal() []byte
  • func (m *ClientHelloMsg) Unmarshal(data []byte) bool
• type PrefixConn
  • func NewPrefixConn(prefix []byte, conn net.Conn) *PrefixConn
  • func (c *PrefixConn) Read(p []byte) (n int, err error)
  • func (c *PrefixConn) UnderlyingConn() net.Conn
• type RecordingReader
  • func NewRecordingReader(r io.Reader) *RecordingReader
  • func (r *RecordingReader) Read(p []byte) (n int, err error)

Constants

const PrefixLength = 1

PrefixLength is the number of bytes required to determine if the connection is a TLS connection.

Functions

func PrefixIsTLS

func PrefixIsTLS(prefix []byte) bool

PrefixIsTLS will return if an incoming connection is, in fact, likely to be a TLS connection.

func ReadHandshake

func ReadHandshake(r io.Reader) (data []byte, is_ssl bool,
	err error)

ReadHandshake reads an incoming TLS handshake message

func ReadRecord

func ReadRecord(r io.Reader) (record []byte, is_ssl bool,
	err error)

ReadRecord reads a single TLS record.

Types

type ClientHelloMsg

type ClientHelloMsg struct {
	Vers               uint16
	Random             []byte
	SessionId          []byte
	CipherSuites       []uint16
	CompressionMethods []uint8
	NextProtoNeg       bool
	ServerName         string
	SupportedPoints    []uint8
	TicketSupported    bool
	SessionTicket      []uint8
	ALPNProtocols      []string
}

ClientHelloMsg is a Go struct version of the TLS client hello message.

func Peek

func Peek(conn net.Conn) (*ClientHelloMsg, net.Conn, error)

Peek takes a net.Conn and reads a TLS client hello message if possible. The returned conn is a net.Conn that has whatever Peek read during processing placed back at the front of the read stream. If no client hello was detected but no other read error occurred, a nil ClientHelloMsg will be returned.

func Read

func Read(r io.Reader) (msg *ClientHelloMsg, err error)

Read reads a full TLS client hello

func (*ClientHelloMsg) Marshal

func (m *ClientHelloMsg) Marshal() []byte

func (*ClientHelloMsg) Unmarshal

func (m *ClientHelloMsg) Unmarshal(data []byte) bool

type PrefixConn

type PrefixConn struct {
	net.Conn
	// contains filtered or unexported fields
}

PrefixConn wraps a net.Conn but attaches a prefixed amount of data to the incoming side. This is used by Peek to replace consumed data.

func NewPrefixConn

func NewPrefixConn(prefix []byte, conn net.Conn) *PrefixConn

func (*PrefixConn) Read

func (c *PrefixConn) Read(p []byte) (n int, err error)

func (*PrefixConn) UnderlyingConn

func (c *PrefixConn) UnderlyingConn() net.Conn

type RecordingReader

type RecordingReader struct {
	Received []byte
	// contains filtered or unexported fields
}

RecordingReader wraps another io.Reader but keeps track of what it has read so far.

func NewRecordingReader

func NewRecordingReader(r io.Reader) *RecordingReader

func (*RecordingReader) Read

func (r *RecordingReader) Read(p []byte) (n int, err error)