openresty / openresty/lua-resty-core

get_client_hello_ext() | lua-resty-core/lib/ngx/ssl | Issue with custom TLS Extension Type 17516

Open
#459 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Lua
Stars
853
Forks
286
Avg merge
35m
Merged PRs (30d)
1

Description

I am trying to extract a TLS Extension with a custom Extension type 17516. I am using openresty/lua-resty-core get_client_hello_ext() method, but i am not getting any data.

This is my nginx.conf:
error_log /usr/local/openresty/nginx/logs/error.log info;

events {
worker_connections 2048;
}

http {
server {
listen 443 ssl;
server_name localhost;
ssl_certificate /usr/local/openresty/nginx/conf/certificate.crt;
ssl_certificate_key /usr/local/openresty/nginx/conf/private.key;

    ssl_client_hello_by_lua_block {
        local ssl_clt = require "ngx.ssl.clienthello"
        local ext = ssl_clt.get_client_hello_ext(0x446c)
        local encoded_ext = ngx.encode_base64(ext)
        ngx.log(ngx.INFO, "Extension: ", encoded_ext)
    }

    location / {
        # Proxy_pass configuration if needed
        proxy_pass http://backendserver:8080/;
    }
}

}

This is how i am sending the TLS Extension:
Extension: Unknown type 17516 (len=28)
Type: Unknown (17516)
Length: 28
Data: 546869732069732074686520456e63727970746564204d534953444e

I tried also by calling the get_client_hello_ext(17516) with the Extension type in decimal, but i am still not getting the values.

It seems that the get_client_hello_ext method is not working for no standard Ext_Type like 17516.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the report with the nginx.conf example and the custom extension type 17516, checking the get_client_hello_ext() entry point in ngx.ssl.clienthello. Compare decimal and hexadecimal type handling and the returned value against the captured extension data; done means the method returns the custom extension payload or clearly reports why it cannot.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.