获取客户端添加的 OpenSSL 自定义扩展

Question

我一直在尝试在 client hello 上获取自定义客户端扩展，但我不知道如何发出 get_custom_ext 或类似的方法。

首先我们在客户端添加扩展SSL_CTX_set_custom_cli_ext

int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
                                          custom_ext_add_cb add_cb,
                                          custom_ext_free_cb free_cb, void *add_arg,
                                          custom_ext_parse_cb parse_cb,
                                          void *parse_arg)

现在客户端在每个client hello上都添加了一个extension，但是服务端如何正确获取自定义添加的extension呢？

Answer 1

看来你可以在服务器上注册相同的自定义扩展，通过是否调用add_cb回调来检测客户端是否提出了扩展。

For the ServerHello and EncryptedExtension messages every registered add_cb is called once if and only if the requirements of the specified context are met and the corresponding extension was received in the ClientHello. That is, if no corresponding extension was received in the ClientHello then add_cb will not be called. (https://www.openssl.org/docs/manmaster/man3/SSL_CTX_add_server_custom_ext.html#EXTENSION-CALLBACKS)

即做相应的

int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
                                  custom_ext_add_cb add_cb,
                                  custom_ext_free_cb free_cb, void *add_arg,
                                  custom_ext_parse_cb parse_cb,
                                  void *parse_arg);

并让您的 add_cb 回调标记上下文（或其他数据结构）以指示此连接使用了自定义扩展。

获取客户端添加的 OpenSSL 自定义扩展

Get OpenSSL custom extension added by client

c

https

openssl

handshake