caddyhttp: create a placeholder for and log ech status (#7328)

Co-authored-by: Francis Lavoie <lavofr@gmail.com>

WeidiDeng committed Dec 8, 2025 at 00:01 UTC 6e0cbd0fa0d3022b41fc2c17b80f15402e685643

3 files changed +4

modules/caddyhttp/app.go

@@ -82,6 +82,7 @@ func init() {

82 // `{http.request.tls.proto}` | The negotiated next protocol

83 // `{http.request.tls.proto_mutual}` | The negotiated next protocol was advertised by the server

84 // `{http.request.tls.server_name}` | The server name requested by the client, if any

85 +// `{http.request.tls.ech}` | Whether ECH was offered by the client and accepted by the server

86 // `{http.request.tls.client.fingerprint}` | The SHA256 checksum of the client certificate

87 // `{http.request.tls.client.public_key}` | The public key of the client certificate.

88 // `{http.request.tls.client.public_key_sha256}` | The SHA256 checksum of the client's public key.

modules/caddyhttp/marshalers.go

@@ -110,6 +110,7 @@ func (t LoggableTLSConnState) MarshalLogObject(enc zapcore.ObjectEncoder) error

110 enc.AddUint16("cipher_suite", t.CipherSuite)

111 enc.AddString("proto", t.NegotiatedProtocol)

112 enc.AddString("server_name", t.ServerName)

113 + enc.AddBool("ech", t.ECHAccepted)

114 if len(t.PeerCertificates) > 0 {

115 enc.AddString("client_common_name", t.PeerCertificates[0].Subject.CommonName)

116 enc.AddString("client_serial", t.PeerCertificates[0].SerialNumber.String())

modules/caddyhttp/replacer.go

@@ -511,6 +511,8 @@ func getReqTLSReplacement(req *http.Request, key string) (any, bool) {

511 return true, true

512 case "server_name":

513 return req.TLS.ServerName, true

514 + case "ech":

515 + return req.TLS.ECHAccepted, true

516 }

517 return nil, false

518 }