Log negotiated TLS groups for HKEX adoption

[Pallab Paul (PallabPaul)]

Summary

• log the negotiated TLS group at INFO after each successful inbound TLS handshake
• include a machine-readable hybrid_key_exchange classification for adoption queries
• retain the connection ID for correlation with nearby transport logs

Validation

• syntax-compiled src/tls/openssl_server.h with Clang 18 and CCF warnings-as-errors flags
• git diff --check
• ASCII, copyright, and include-policy checks

Full test execution was not available because the WSL environment does not have Cargo installed.

[Copilot]

Copilot review overview

🟡 Changes recommended

Add test coverage verifying the emitted hybrid_key_exchange telemetry.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Add TLS tests for hybrid_key_exchange telemetry · New

What changed in this PR

Adds INFO-level inbound TLS handshake telemetry for negotiated groups, hybrid key exchange classification, and connection correlation.

Changes:

• Logs the negotiated TLS group and connection ID.
• Adds machine-readable hybrid_key_exchange status.
• Retains fallback handling for unknown groups.

File	Summary
src/​tls/​openssl_server.h	Logs negotiated TLS metadata after successful handshakes.

The new telemetry lacks test assertions for hybrid and classical classifications.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Amaury Chamayou (achamayou)]

The code needs formatting

[Amaury Chamayou (achamayou)]

A problem with doing this on handshake every time is that it's a log line even if the handshake fails, and so a client doing lots of failed handshakes for whatever reason will spam the log.

[Pallab Paul (PallabPaul)]

A problem with doing this on handshake every time is that it's a log line even if the handshake fails, and so a client doing lots of failed handshakes for whatever reason will spam the log.

The changes added only logs at INFO when SSL_accept() returns 1, so failed handshakes and retries won’t emit it. One issue still remains where a lot of successful connections can still generate log volume.