JarryShaw · Nov 2, 2026 · Nov 1, 2026
diff --git a/docs/source/contributing/pep.rst b/docs/source/contributing/pep.rst
@@ -238,8 +238,12 @@ DTLS's own divergence (the epoch/sequence-number pair in its record header,
 and the fragment header each handshake message carries) staying in
 :class:`~pcapkit.protocols.application.dtls.DTLS` alone. ``ClientHello`` and
 ``ServerHello`` decode down to their cipher suite(s), compression method(s)
-and extension list (TYPE+LENGTH framed, extension bodies undecoded); every
-other handshake message is message-TYPE-level framing only. Decryption is a
+and extension list, and ``EncryptedExtensions`` down to its extension list. An
+extension body decodes where
+:attr:`SSL.__extension__ <pcapkit.protocols.application.ssl.SSL.__extension__>`
+registers a decoder for its type, and stays raw octets where none is
+registered or the decoder rejects it (:issue:`2514`). Every other handshake
+message is message-TYPE-level framing only. Decryption is a
 separate question and is not needed to make the record structure legible, in
 the same way :class:`ESP <pcapkit.protocols.internet.esp.ESP>` parses
 without keys.
@@ -1167,8 +1171,9 @@ group-record list, each a shape of its own.
 
 **Done within wave 2 — TLS/SSL with DTLS.** The `DTLS`_ section above lists
 what is decoded: the shared :class:`~pcapkit.protocols.application.ssl.SSL`
-base, TLS, DTLS, handshake message framing, and handshake-fragment
-reassembly (:issue:`2440`).
+base, TLS, DTLS, handshake message framing, the hello and
+``EncryptedExtensions`` extension lists with their registered extension bodies
+(:issue:`2514`), and handshake-fragment reassembly (:issue:`2440`).
 
 **Done ahead of wave 2 — handlers for the** ``DLT_NULL``, ``DLT_RAW``,
 ``DLT_LINUX_SLL`` **and** ``DLT_LINUX_SLL2`` **link types.** Each is a

diff --git a/docs/source/ext.rst b/docs/source/ext.rst
@@ -412,7 +412,9 @@ writes them:
 +                   +------------------------------------------------------------+-----------------------------------------------------------------------------------------------+----------------------------------------------------------------------------+
 |                   | :class:`~pcapkit.protocols.transport.dccp.DCCP`            | :attr:`DCCP.__option__ <pcapkit.protocols.transport.dccp.DCCP.__option__>`                    | :func:`~pcapkit.foundation.registry.protocols.register_dccp_option`        |
 +-------------------+------------------------------------------------------------+-----------------------------------------------------------------------------------------------+----------------------------------------------------------------------------+
-| Application Layer | :class:`~pcapkit.protocols.application.httpv2.HTTPv2`      | :attr:`HTTPv2.__frame__ <pcapkit.protocols.application.httpv2.HTTPv2.__frame__>`              | :func:`~pcapkit.foundation.registry.protocols.register_http_frame`         |
+|                   | :class:`~pcapkit.protocols.application.httpv2.HTTPv2`      | :attr:`HTTPv2.__frame__ <pcapkit.protocols.application.httpv2.HTTPv2.__frame__>`              | :func:`~pcapkit.foundation.registry.protocols.register_http_frame`         |
++ Application Layer +------------------------------------------------------------+-----------------------------------------------------------------------------------------------+----------------------------------------------------------------------------+
+|                   | :class:`~pcapkit.protocols.application.ssl.SSL`            | :attr:`SSL.__extension__ <pcapkit.protocols.application.ssl.SSL.__extension__>`               | :func:`~pcapkit.foundation.registry.protocols.register_tls_extension`      |
 +-------------------+------------------------------------------------------------+-----------------------------------------------------------------------------------------------+----------------------------------------------------------------------------+
 |                   |                                                            | :attr:`PCAPNG.__block__ <pcapkit.protocols.misc.pcapng.PCAPNG.__block__>`                     | :func:`~pcapkit.foundation.registry.protocols.register_pcapng_block`       |
 +                   +                                                            +-----------------------------------------------------------------------------------------------+----------------------------------------------------------------------------+

diff --git a/docs/source/pcapkit/const/tls.rst b/docs/source/pcapkit/const/tls.rst
@@ -16,6 +16,8 @@ enumerations include:
      - TLS/DTLS Content Types [*]_
    * - :class:`TLS_HandshakeType <pcapkit.const.tls.handshake_type.HandshakeType>`
      - TLS/DTLS HandshakeType [*]_
+   * - :class:`TLS_ExtensionType <pcapkit.const.tls.extension_type.ExtensionType>`
+     - TLS/DTLS ExtensionType Values [*]_
 
 .. versionadded:: 1.6.0
 
@@ -47,7 +49,21 @@ DTLS-only messages :rfc:`9147#section-5.2` adds to the registry.
    :undoc-members:
    :show-inheritance:
 
+TLS/DTLS ExtensionType Values
+=============================
+
+.. module:: pcapkit.const.tls.extension_type
+
+This module contains the constant enumeration for **TLS/DTLS ExtensionType Values**,
+which is automatically generated from :class:`pcapkit.vendor.tls.extension_type.ExtensionType`.
+
+.. autoclass:: pcapkit.const.tls.extension_type.ExtensionType
+   :members:
+   :undoc-members:
+   :show-inheritance:
+
 .. rubric:: Footnotes
 
 .. [*] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-5
 .. [*] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-7
+.. [*] https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1
diff --git a/docs/source/pcapkit/foundation/registry.rst b/docs/source/pcapkit/foundation/registry.rst
@@ -146,6 +146,8 @@ Application Layer Registries
 
 .. autofunction:: pcapkit.foundation.registry.protocols.register_http_frame
 
+.. autofunction:: pcapkit.foundation.registry.protocols.register_tls_extension
+
 Miscellaneous Protocol Registries
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

diff --git a/docs/source/pcapkit/protocols/application/dtls.rst b/docs/source/pcapkit/protocols/application/dtls.rst
@@ -121,9 +121,9 @@ Data Models
    :members:
    :show-inheritance:
 
-See :doc:`ssl` for ``ClientHello``, ``ServerHello``, ``Extension``, ``Alert``
-and ``ChangeCipherSpec``, shared verbatim with
-:class:`~pcapkit.protocols.application.tls.TLS`.
+See :doc:`ssl` for ``ClientHello``, ``ServerHello``, ``EncryptedExtensions``,
+``Extension`` and its decoded bodies, ``Alert`` and ``ChangeCipherSpec``,
+shared verbatim with :class:`~pcapkit.protocols.application.tls.TLS`.
 
 .. rubric:: Footnotes
 

diff --git a/docs/source/pcapkit/protocols/application/ssl.rst b/docs/source/pcapkit/protocols/application/ssl.rst
@@ -26,9 +26,9 @@ version and the length, and DTLS adds a fragment header to each handshake
 message. Each record header is declared in its subclass's own schema, and
 :class:`~pcapkit.protocols.application.dtls.DTLS` reads the epoch and sequence
 number. This base class carries the logic the two share -- content-type
-dispatch, handshake-message decoding (including the DTLS fragment header), and
-the record-level validation that keeps dispatch from accepting bytes that
-cannot be a genuine record.
+dispatch, handshake-message decoding (including the DTLS fragment header), the
+extension registry, and the record-level validation that keeps dispatch from
+accepting bytes that cannot be a genuine record.
 
 .. versionadded:: 1.6.0
 
@@ -41,6 +41,23 @@ cannot be a genuine record.
    :show-inheritance:
 
    .. automethod:: id
+   .. automethod:: register_extension
+
+   .. automethod:: _read_ext_unknown
+   .. automethod:: _read_ext_server_name
+   .. automethod:: _read_ext_supported_groups
+   .. automethod:: _read_ext_signature_algorithms
+   .. automethod:: _read_ext_alpn
+   .. automethod:: _read_ext_supported_versions
+   .. automethod:: _read_ext_key_share
+
+   .. automethod:: _make_ext_unknown
+   .. automethod:: _make_ext_server_name
+   .. automethod:: _make_ext_supported_groups
+   .. automethod:: _make_ext_signature_algorithms
+   .. automethod:: _make_ext_alpn
+   .. automethod:: _make_ext_supported_versions
+   .. automethod:: _make_ext_key_share
 
    .. automethod:: _validate_tls_record
 
@@ -58,9 +75,15 @@ cannot be a genuine record.
    .. automethod:: _read_tls_server_hello
    .. automethod:: _make_tls_server_hello
 
+   .. automethod:: _read_tls_encrypted_extensions
+   .. automethod:: _make_tls_encrypted_extensions
+
    .. automethod:: _read_tls_extensions
    .. automethod:: _make_tls_extensions
 
+   .. autoattribute:: __extension__
+      :no-value:
+
 Data Models
 -----------
 
@@ -78,10 +101,62 @@ Data Models
    :members:
    :show-inheritance:
 
+.. autoclass:: pcapkit.protocols.data.application.tls.EncryptedExtensions
+   :members:
+   :show-inheritance:
+
 .. autoclass:: pcapkit.protocols.data.application.tls.Extension
    :members:
    :show-inheritance:
 
+.. autoclass:: pcapkit.protocols.data.application.tls.ExtensionData
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.ServerNameList
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.ServerName
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.NamedGroupList
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.SignatureSchemeList
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.ProtocolNameList
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.SupportedVersionsClientHello
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.SupportedVersionsServerHello
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.KeyShareClientHello
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.KeyShareHelloRetryRequest
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.KeyShareServerHello
+   :members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.data.application.tls.KeyShareEntry
+   :members:
+   :show-inheritance:
+
 .. autoclass:: pcapkit.protocols.data.application.tls.Alert
    :members:
    :show-inheritance:

diff --git a/docs/source/pcapkit/protocols/application/tls.rst b/docs/source/pcapkit/protocols/application/tls.rst
@@ -9,7 +9,7 @@ extractor for the TLS/SSLv3+ record-layer family [*]_ -- SSLv3 (:rfc:`6101`),
 TLS 1.0 (:rfc:`2246`), TLS 1.1 (:rfc:`4346`), TLS 1.2 (:rfc:`5246`) and TLS
 1.3 (:rfc:`9846`, which obsoletes :rfc:`5077`, :rfc:`5246`, :rfc:`6961`,
 :rfc:`7627`, :rfc:`8422` and :rfc:`8446`) -- at the record layer, plus
-handshake message TYPE-level framing.
+handshake message framing and the bodies `Decoded Fields`_ lists.
 
 Version Identification
 ----------------------
@@ -75,7 +75,10 @@ Decoded Fields
   decides which are):
 
   * ``ClientHello``/``ServerHello`` down to their cipher suites, compression
-    methods and extensions (type and length only).
+    methods and extensions, and ``EncryptedExtensions`` down to its
+    extensions; an extension's body decodes where
+    :attr:`SSL.__extension__ <pcapkit.protocols.application.ssl.SSL.__extension__>`
+    registers a decoder for its type.
   * Every other handshake message at type and length only.
   * ``Alert`` and ``ChangeCipherSpec`` in full.
 
@@ -150,8 +153,9 @@ Data Model
    :members:
    :show-inheritance:
 
-See :doc:`ssl` for ``ClientHello``, ``ServerHello``, ``Handshake``, ``Extension``,
-``Alert`` and ``ChangeCipherSpec``, shared verbatim with
+See :doc:`ssl` for ``ClientHello``, ``ServerHello``, ``EncryptedExtensions``,
+``Handshake``, ``Extension`` and its decoded bodies, ``Alert`` and
+``ChangeCipherSpec``, shared verbatim with
 :class:`~pcapkit.protocols.application.dtls.DTLS`.
 
 .. rubric:: Footnotes

diff --git a/docs/source/pcapkit/vendor/tls.rst b/docs/source/pcapkit/vendor/tls.rst
@@ -17,6 +17,8 @@ include:
      - TLS/DTLS Content Types [*]_
    * - :class:`TLS_HandshakeType <pcapkit.vendor.tls.handshake_type.HandshakeType>`
      - TLS/DTLS HandshakeType [*]_
+   * - :class:`TLS_ExtensionType <pcapkit.vendor.tls.extension_type.ExtensionType>`
+     - TLS/DTLS ExtensionType Values [*]_
 
 .. versionadded:: 1.6.0
 
@@ -44,7 +46,20 @@ which is automatically generating :class:`pcapkit.const.tls.handshake_type.Hands
    :members: FLAG, LINK
    :show-inheritance:
 
+TLS/DTLS ExtensionType Values
+=============================
+
+.. module:: pcapkit.vendor.tls.extension_type
+
+This module contains the vendor crawler for **TLS/DTLS ExtensionType Values**,
+which is automatically generating :class:`pcapkit.const.tls.extension_type.ExtensionType`.
+
+.. autoclass:: pcapkit.vendor.tls.extension_type.ExtensionType
+   :members: FLAG, LINK
+   :show-inheritance:
+
 .. rubric:: Footnotes
 
 .. [*] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-5
 .. [*] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-7
+.. [*] https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1
diff --git a/examples/generators/options.py b/examples/generators/options.py
@@ -1325,6 +1325,63 @@ def _httpv2_rebuild(frame: 'Any') -> 'Any':
                 frame=frame)
 
 
+###############################################################################
+# TLS -- handshake extensions
+###############################################################################
+#
+# Each case is one extension in a ``ClientHello``, built from keyword arguments
+# by the extension's ``_make_ext_*``. No capture is written: the ``tcp``
+# envelope is addressed to port 80, which dispatches to HTTP rather than TLS.
+
+
+def _tls_extension_registry() -> 'Any':
+    from pcapkit.protocols.application.tls import TLS
+    return TLS.__extension__
+
+
+def _tls_extension_overrides() -> 'dict[Any, dict[str, Any]]':
+    from pcapkit.const.tls.extension_type import ExtensionType as Enum_ExtensionType
+    from pcapkit.protocols.data.application.tls import KeyShareEntry, ServerName
+    return {
+        # Each of these defaults to an empty list.
+        Enum_ExtensionType.server_name: {
+            'server_name_list': (ServerName(name_type=0, name=b'example.com'),)},
+        Enum_ExtensionType.supported_groups: {'named_group_list': (0x001D, 0x0017)},
+        Enum_ExtensionType.signature_algorithms: {'supported_signature_algorithms': (0x0403, 0x0804)},
+        Enum_ExtensionType.application_layer_protocol_negotiation: {
+            'protocol_name_list': (b'h2', b'http/1.1')},
+        Enum_ExtensionType.supported_versions: {'versions': (0x0304, 0x0303)},
+        Enum_ExtensionType.key_share: {
+            'client_shares': (KeyShareEntry(group=0x001D, key_exchange=bytes(range(32))),)},
+    }
+
+
+def _tls_client_hello(extensions: 'Any') -> 'Any':
+    """A TLS record carrying one ``ClientHello`` with ``extensions``."""
+    from pcapkit.const.tls.content_type import ContentType as Enum_ContentType
+    from pcapkit.const.tls.handshake_type import HandshakeType as Enum_HandshakeType
+    from pcapkit.protocols.application.tls import TLS
+    from pcapkit.protocols.data.application.tls import ClientHello, Handshake
+
+    hello = ClientHello(version=0x0303, random=bytes(32), session_id=b'', cookie=None,
+                        cipher_suites=(0x1301,), compression_methods=(0,), extensions=extensions)
+    return TLS(content_type=Enum_ContentType.handshake, version=0x0303,
+               content=(Handshake(msg_type=Enum_HandshakeType.client_hello, length=0, body=hello),))
+
+
+def _tls_extension_build(code: 'Any', kwargs: 'dict[str, Any]') -> 'Any':
+    return _tls_client_hello(((code, dict(kwargs)),))
+
+
+def _tls_parse(octets: 'bytes') -> 'Any':
+    from pcapkit.protocols.application.tls import TLS
+    return TLS(octets, len(octets))
+
+
+def _tls_extension_extract(parsed: 'Any') -> 'Any':
+    return parsed.info.content[0].body.extensions
+
+
 ###############################################################################
 # PCAP-NG -- blocks, block options, name records and decryption secrets
 ###############################################################################
@@ -1765,6 +1822,10 @@ def _pcapng_secrets_build(code: 'Any', kwargs: 'dict[str, Any]') -> 'Any':
     Family('icmpv6-type', _icmpv6_registry, _icmpv6_overrides,
            _icmpv6_build, _icmpv6_parse, _icmp_extract, _icmpv6_rebuild,
            capture=None, envelope=None),
+    # No capture -- see the section comment above ``_tls_extension_registry``.
+    Family('tls-extension', _tls_extension_registry, _tls_extension_overrides,
+           _tls_extension_build, _tls_parse, _tls_extension_extract,
+           _tls_client_hello, capture=None, envelope=None),
     # The PCAP-NG families write no capture -- see the section comment
     # above ``PCAPNG_TIME`` for why the construction API's defaults do not
     # make a reproducible one, and what already covers that space instead.

diff --git a/pcapkit/all.py b/pcapkit/all.py
@@ -107,6 +107,7 @@
     'register_sctp_chunk', 'register_sctp_parameter', 'register_sctp_cause',
     'register_dccp_option',
     'register_http_frame',
+    'register_tls_extension',
     'register_pcapng_block', 'register_pcapng_option', 'register_pcapng_secrets',
     'register_pcapng_record',
     'register_extractor_engine',

diff --git a/pcapkit/const/__init__.py b/pcapkit/const/__init__.py
@@ -100,7 +100,7 @@
     # TCP
     'TCP_Checksum', 'TCP_Option', 'TCP_MPTCPOption', 'TCP_Flags',
     # TLS/DTLS
-    'TLS_ContentType', 'TLS_HandshakeType',
+    'TLS_ContentType', 'TLS_HandshakeType', 'TLS_ExtensionType',
     # VLAN
     'VLAN_PriorityLevel',
     # PCAPNG

diff --git a/pcapkit/const/tls/__init__.py b/pcapkit/const/tls/__init__.py
@@ -17,13 +17,17 @@
      - TLS/DTLS Content Types [*]_
    * - :class:`TLS_HandshakeType <pcapkit.const.tls.handshake_type.HandshakeType>`
      - TLS/DTLS HandshakeType [*]_
+   * - :class:`TLS_ExtensionType <pcapkit.const.tls.extension_type.ExtensionType>`
+     - TLS/DTLS ExtensionType Values [*]_
 
 .. [*] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-5
 .. [*] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-7
+.. [*] https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-1
 
 """
 
 from pcapkit.const.tls.content_type import ContentType as TLS_ContentType
+from pcapkit.const.tls.extension_type import ExtensionType as TLS_ExtensionType
 from pcapkit.const.tls.handshake_type import HandshakeType as TLS_HandshakeType
 
-__all__ = ['TLS_ContentType', 'TLS_HandshakeType']
+__all__ = ['TLS_ContentType', 'TLS_HandshakeType', 'TLS_ExtensionType']