middleware

Documentation

Overview

Package middleware provides net.Listener-level TLS ClientHello extraction.

FingerprintListener wraps an existing net.Listener, peeks at the raw ClientHello bytes before handing the connection to crypto/tls for the real handshake. This allows the application to inspect TLS fingerprints (JA3, JA4, etc.) without interfering with normal TLS operation.

Index

• func GetClientHello(ctx context.Context) *parse.ClientHello
• func WithClientHello(ctx context.Context, ch *parse.ClientHello) context.Context
• type ClientHelloInfo
• type FingerprintListener
  • func (l *FingerprintListener) Accept() (net.Conn, error)
  • func (l *FingerprintListener) Handler(inner http.Handler) http.Handler
  • func (l *FingerprintListener) Lookup(remoteAddr string) *parse.ClientHello

Functions

func GetClientHello

func GetClientHello(ctx context.Context) *parse.ClientHello

GetClientHello retrieves the ClientHello from the context, if present. Returns nil if no ClientHello was stored.

func WithClientHello

func WithClientHello(ctx context.Context, ch *parse.ClientHello) context.Context

WithClientHello returns a new context with the ClientHello attached.

Types

type ClientHelloInfo

type ClientHelloInfo struct {
	ClientHello *parse.ClientHello
	RemoteAddr  net.Addr
}

ClientHelloInfo contains the extracted ClientHello and connection metadata.

type FingerprintListener

type FingerprintListener struct {
	net.Listener
	TLSConfig     *tls.Config
	OnClientHello func(info *ClientHelloInfo)
	// contains filtered or unexported fields
}

FingerprintListener wraps a net.Listener to extract TLS ClientHello before the handshake.

Usage:

ln, _ := net.Listen("tcp", ":443")
fl := &middleware.FingerprintListener{
    Listener:  ln,
    TLSConfig: tlsCfg,
}
handler := fl.Handler(mux) // wraps mux to inject ClientHello into context
http.Serve(fl, handler)

func (*FingerprintListener) Accept

func (l *FingerprintListener) Accept() (net.Conn, error)

Accept waits for and returns the next connection. It peeks at the raw TLS ClientHello bytes before initiating the TLS handshake. If ClientHello parsing fails (e.g., non-TLS traffic), the connection is still returned — only the callback is skipped.

func (*FingerprintListener) Handler

func (l *FingerprintListener) Handler(inner http.Handler) http.Handler

Handler returns an http.Handler that injects the ClientHello into each request's context before passing it to the inner handler.

func (*FingerprintListener) Lookup

func (l *FingerprintListener) Lookup(remoteAddr string) *parse.ClientHello

Lookup retrieves and removes the ClientHello for the given remote address.