From: Michał Kępień <michal@isc.org>
Date: Wed, 22 Dec 2021 17:17:26 +0000 (+0100)
Subject: Log TLS pre-master secrets when requested
X-Git-Tag: v9.17.22~27^2~5
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=060fed3097f3d99e5413623357ce0f646ac26125;p=thirdparty%2Fbind9.git

Log TLS pre-master secrets when requested

Generate log messages containing TLS pre-master secrets when the
SSLKEYLOGFILE environment variable is set.  This only ensures such
messages are prepared using the right logging category and passed to
libisc for further processing.

The TLS pre-master secret logging callback needs to be set on a
per-context basis, so ensure it happens for both client-side and
server-side TLS contexts.
---

diff --git a/lib/isc/tls.c b/lib/isc/tls.c
index b050ace2b5b..f3129d2ab2b 100644
--- a/lib/isc/tls.c
+++ b/lib/isc/tls.c
@@ -10,6 +10,7 @@
  */
 
 #include <inttypes.h>
+#include <stdlib.h>
 #include <string.h>
 #if HAVE_LIBNGHTTP2
 #include <nghttp2/nghttp2.h>
@@ -175,6 +176,30 @@ isc_tlsctx_free(isc_tlsctx_t **ctxp) {
 	SSL_CTX_free(ctx);
 }
 
+/*
+ * Callback invoked by the SSL library whenever a new TLS pre-master secret
+ * needs to be logged.
+ */
+static void
+sslkeylogfile_append(const SSL *ssl, const char *line) {
+	UNUSED(ssl);
+
+	isc_log_write(isc_lctx, ISC_LOGCATEGORY_SSLKEYLOG, ISC_LOGMODULE_NETMGR,
+		      ISC_LOG_INFO, "%s", line);
+}
+
+/*
+ * Enable TLS pre-master secret logging if the SSLKEYLOGFILE environment
+ * variable is set.  This needs to be done on a per-context basis as that is
+ * how SSL_CTX_set_keylog_callback() works.
+ */
+static void
+sslkeylogfile_init(isc_tlsctx_t *ctx) {
+	if (getenv("SSLKEYLOGFILE") != NULL) {
+		SSL_CTX_set_keylog_callback(ctx, sslkeylogfile_append);
+	}
+}
+
 isc_result_t
 isc_tlsctx_createclient(isc_tlsctx_t **ctxp) {
 	unsigned long err;
@@ -202,6 +227,8 @@ isc_tlsctx_createclient(isc_tlsctx_t **ctxp) {
 					 SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
 #endif
 
+	sslkeylogfile_init(ctx);
+
 	*ctxp = ctx;
 
 	return (ISC_R_SUCCESS);
@@ -408,6 +435,8 @@ isc_tlsctx_createserver(const char *keyfile, const char *certfile,
 		}
 	}
 
+	sslkeylogfile_init(ctx);
+
 	*ctxp = ctx;
 	return (ISC_R_SUCCESS);