为SSL/TLS的http头添加更多参数

As far as I understand, https is http plus SSL/TLS.

What do I need to do if I want to add 3 more parameters for the header? I found a file inside Mozilla's NSS - ssl3ext.c, but I don't understand it and don't know how to start. Need a clue from you guys..

Is this something about SSL/TLS extension? But it is far more complex right?

#0

SSL/TLS is a transport layer. It's negotiated first, and then HTTP talks "over" it. To add more HTTP header parameters you do exactly the same as you would normally.

(to be completely clear - HTTPS is HTTP "on top" of TLS/SSL. The TLS/SSL connection is made first and then HTTP uses it just like it would use an unencrypted transport).

#1

if a developer would like to add some more information/parameters for his SSL communication/handshaking, where does the parameter should be located?

RFC 3546 'Transport Layer Security (TLS) Extensions' is the only defined way to add additional parameters to the SSL/TLS handshake.

You can add your extension to the Client Hello message. If the server recognizes it, it can respond with a corresponding extension on the Server Hello message. The server cannot send it unless it was requested, however.

is it inside the code for http header or is it creating a new extension for TLS like the server name indication(SNI)?

It has nothing to do with HTTP. The SSL/TLS handshake is over before HTTP even begins.

I have looked into the code and RFC for SNI but seems does not get any clues?

Look at RFC 3546 for the extension format. The IANA manages the extension numbers. http://www.iana.org/assignments/tls-extensiontype-values/ Note that there is no 'experimental' range for you to use. IMHO what you do over your own ports is your own business, but be aware of the possibility of conflict in the future.

Does adding more parameters to the handshaking process will disturb the current implementation?

Some SSLv3 and older TLS 1.0 servers will hang up on you if you send an extension they don't like. Major web browsers implement fallback reconnect logic without extensions.

will it broke the standard?

If your extension follows the general format for extensions defined in RFC 3546, the only (modern) standard you are breaking is that you are not using an IANA-blessed extension ID number. If your extension is generally useful, you should strongly consider submitting it for formal standardization.

#2

You can add as many HTTP header parameters as you like, without concern for SSL. If you want to modify the SSL handshake, you should have the source to your SSL libraries on both sides of the connection.

I'm not sure what your trying to do here though. You could modify the ClientHandshake to include more/customer cipher suites. You could also define a custom content type. Currently the first byte in a TLS record determines the content type, which are as follows:

0x14    20  ChangeCipherSpec
0x15    21  Alert
0x16    22  Handshake
0x17    23  Application

Depending on what you are trying to do, you may be well served by adding a custom alert to the Alert Protocol. Alerts can be sent at any time, in either direction.

Customizing the protocol will break the standard, though you can do things like add cipher suites without changing the protocol. Between client certs and server certs, the protocol generally has everything most people need for authentication and encryption.

推荐文章

敲除.js用QUNIT对象误差进行测试

敲除.js用QUNIT对象误差进行测试

推荐文章

为特殊字符按下键,如2次点火,输出不带“¨”的字符

为特殊字符按下键,如2次点火,输出不带“¨”的字符

推荐文章

springsecurity+JSF角色驱动的页面组件呈现(链接等)最佳实践

springsecurity+JSF角色驱动的页面组件呈现(链接等)最佳实践

推荐文章

用字典分离后缀

用字典分离后缀

推荐文章

Apycom Jquery菜单无法正常工作

Apycom Jquery菜单无法正常工作

推荐文章

试图释放内存会导致错误

试图释放内存会导致错误

推荐文章

在Silverlight中使用自定义DLL

在Silverlight中使用自定义DLL

推荐文章

芹菜过期-上升异常

芹菜过期-上升异常

推荐文章

Django从sqlite3切换到Postgresql问题

Django从sqlite3切换到Postgresql问题

推荐文章

已知尺寸的JPEG图像的最大文件大小

已知尺寸的JPEG图像的最大文件大小

推荐文章

无法为使用PHP的用户获取正确的IP

无法为使用PHP的用户获取正确的IP

推荐文章

使用临时文件将迭代器获取到STL容器时的细微错误:如何避免?

使用临时文件将迭代器获取到STL容器时的细微错误:如何避免?

推荐文章

我需要四个变量的FOREACH循环或for循环的代码

我需要四个变量的FOREACH循环或for循环的代码

推荐文章

如何在sql中从两个表中获取数据

如何在sql中从两个表中获取数据

推荐文章

MAKEINTRESOURCE返回资源ID的错误指针

MAKEINTRESOURCE返回资源ID的错误指针

推荐文章

Solr/Lucene:将“字数”转换为数字的过滤器

Solr/Lucene:将“字数”转换为数字的过滤器