Module tls 

Available on crate feature tls only.

Passive TLS handshake observer.

Bridges tls-parser into flowscope’s SessionParser abstraction. Receives bytes from the per-flow TCP stream, emits parsed TlsClientHello / TlsServerHello / TlsAlert as TlsMessage variants.

Two SessionParser shapes ship side by side:

• TlsParser — per-message stream (ClientHello, ServerHello, Alert, optional JA3/JA4 fingerprints).
• TlsHandshakeParser — aggregator that emits one TlsHandshake event per observed handshake with SNI, ALPN, fingerprints, version, cipher, and HandshakeOutcome in a single struct.

Quick start

use flowscope::extract::FiveTuple;
use flowscope::tls::{TlsMessage, TlsParser};
use flowscope::{FlowSessionDriver, SessionEvent};

let _driver = FlowSessionDriver::new(
    FiveTuple::bidirectional(),
    TlsParser::default(),
);

Scope

• Passive observation only — no decryption, no MITM.
• ClientHello, ServerHello, Alert from the unencrypted handshake.
• SNI / ALPN / supported versions / cipher list / extension order.
• TLS 1.0 — TLS 1.3 (visibility limited after ChangeCipherSpec in 1.2 and after ServerHello in 1.3 since records are encrypted onward).
• Optional JA3 and JA4 client fingerprinting behind the tls-fingerprints feature (was ja3 + ja4 pre-0.12; collapsed in plan 131).

Convenience accessors

TlsClientHello

Method / field	Returns	Notes
sni	Option<&str>	Server Name Indication extension
cipher_suites	Vec<u16>	offered cipher suites in order
supported_versions	Vec<TlsVersion>	TLS 1.3 supported_versions extension
alpn	Vec<String>	ALPN protocols offered
extension_types	Vec<u16>	extension order — used by JA3 / JA4

TlsServerHello

Method / field	Returns	Notes
cipher_suite	u16	the chosen cipher
alpn	Option<String>	negotiated ALPN protocol
supported_version	Option<TlsVersion>	actual TLS 1.3 version

TlsHandshakeParser + TlsHandshake

The aggregator emits one TlsHandshake event per observed handshake with SNI / ALPN / JA3 / JA4 / version / cipher / resumption_attempted / HandshakeOutcome in a single struct.

Re-exports

pub use handshake::EchOutcome;

pub use handshake::HandshakeOutcome;

pub use handshake::TlsHandshake;

pub use handshake::TlsHandshakeParser;

pub use ja4::Ja4Parts;tls-fingerprints

pub use ja4::ja4 as ja4_fingerprint;tls-fingerprints

pub use ja4::ja4_parts;tls-fingerprints

Modules

handshake

TlsHandshakeParser — aggregates ClientHello + ServerHello + Alert into a single TlsHandshake message per flow.

ja4tls-fingerprints

JA4 client fingerprint (FoxIO v1, 2023).

Structs

TlsAlert

TLS Alert record (RFC 5246 §7.2).

TlsClientHello

Parsed TLS ClientHello — what the client offered to the server.

TlsConfig

Tunables for the TLS observer.

TlsParser

Per-flow TLS handshake parser. Holds independent state for the initiator (client) and responder (server) directions.

TlsServerHello

Parsed TLS ServerHello.

Enums

TlsAlertLevel

TlsMessage

Unified message type emitted by TlsParser.

TlsVersion

Constants

PARSER_KIND

Slug returned by TlsParser’s parser_kind(). See flowscope::parser_kinds::TLS.