I am currently trying to implement a tls handshake into a http proxy that I am writing. I know that I could use OpenSSL to do the work for me but I am interested in writing it myself.
I am currently working through the TLS RFC and am confused about how to parse the ClientHello message, particularly the fact that it may or may not have a session ID and that there seems to be a no count on the number of ciphersuites or compression methods.
Does anyone know the best way of doing this?
The session_id is preceded by the length. Same with the cipher suites and compression algorithms.
What's you're missing is section 4.3 of the RFC:
Variable length vectors are defined by specifying a subrange of legal lengths, inclusively, using the notation . When encoded, the actual length precedes the vector's contents in the byte stream. The length will be in the form of a number consuming as many bytes as required to hold the vector's specified maximum (ceiling) length. A variable length vector with an actual length field of zero is referred to as an empty vector.