StreamExtended

Actively maintained .NET library for peeking TLS ClientHello / ServerHello (SNI, ALPN, and other extensions) from a stream before SslStream.AuthenticateAsServer / AuthenticateAsClient.

Works on Windows, Linux, and macOS (.NET 10).

API docs · Wiki

• Peek TLS ClientHello and ServerHello without consuming the handshake
• Read SNI, ALPN, and other hello extensions before choosing a certificate
• CustomBufferedStream implements IPeekStream so peeked bytes stay available for SslStream

dotnet add package StreamExtended

Current line: 2.0 (requires .NET 10). For net45 / netstandard1.3, stay on the 1.0.x packages.

using StreamExtended;
using StreamExtended.BufferPool;
using StreamExtended.Network;

IBufferPool bufferPool = new DefaultBufferPool();
await using var stream = new CustomBufferedStream(networkStream, bufferPool, bufferSize: 4096, leaveOpen: true);

var clientHello = await SslTools.PeekClientHello(stream, bufferPool);
if (clientHello?.Extensions != null &&
    clientHello.Extensions.TryGetValue("server_name", out var sni))
{
    var hostName = sni.Data;
    // select certificate / continue with SslStream on the same stream
}

var serverHello = await SslTools.PeekServerHello(stream, bufferPool);

CustomBufferedStream implements IPeekStream, so peeked bytes remain available for the subsequent TLS handshake.

• Windows, Linux, macOS
• .NET 10 (net10.0)

Generated with DocFX on develop: justcoding121.github.io/stream-extended

How-to pages: GitHub Wiki.

dotnet test src/StreamExtended.sln -c Release
dotnet test tests/StreamExtended.Tests/StreamExtended.Tests.csproj -c Release
dotnet test tests/StreamExtended.Integration.Tests/StreamExtended.Integration.Tests.csproj -c Release --filter TestCategory=Integration
dotnet test tests/StreamExtended.Integration.Tests/StreamExtended.Integration.Tests.csproj -c Release --filter TestCategory=E2E
dotnet pack src/StreamExtended/StreamExtended.csproj -c Release

CI runs unit, integration, and e2e on Windows (build) plus Linux and macOS (test matrix). See Building and testing.

MIT — see LICENSE.