Add a logging category for TLS pre-master secrets

TLS pre-master secrets will be dumped to disk using the logging
framework provided by libisc.  Add a new logging category for this type
of debugging data in order to enable exporting it to a dedicated
channel.  Derive the name of the new category from the name of the
relevant environment variable, SSLKEYLOGFILE.

diff --git a/doc/arm/logging-categories.rst b/doc/arm/logging-categories.rst
index d823eb2f637025a7185194440e57d4b137870ac9..781215ccd9d7a29f7da42378d40ca810c8ddc177 100644 (file)
--- a/doc/arm/logging-categories.rst
+++ b/doc/arm/logging-categories.rst
@@ -97,6 +97,9 @@
 ``spill``
     Queries that have been terminated, either by dropping or responding with SERVFAIL, as a result of a fetchlimit quota being exceeded.
 
+``sslkeylog``
+    TLS pre-master secrets (for debugging purposes).
+
 ``trust-anchor-telemetry``
     Trust-anchor-telemetry requests received by ``named``.
 

diff --git a/lib/isc/include/isc/log.h b/lib/isc/include/isc/log.h
index d1968e0f9115cb64f178b755159a82ac67bb7dff..f0348c7ca8b74ec88f33eb31eb66657fe9c619ae 100644 (file)
--- a/lib/isc/include/isc/log.h
+++ b/lib/isc/include/isc/log.h
@@ -167,8 +167,9 @@ extern isc_logmodule_t       isc_modules[];
  * Do not log directly to DEFAULT.  Use another category.  When in doubt,
  * use GENERAL.
  */
-#define ISC_LOGCATEGORY_DEFAULT (&isc_categories[0])
-#define ISC_LOGCATEGORY_GENERAL (&isc_categories[1])
+#define ISC_LOGCATEGORY_DEFAULT          (&isc_categories[0])
+#define ISC_LOGCATEGORY_GENERAL          (&isc_categories[1])
+#define ISC_LOGCATEGORY_SSLKEYLOG (&isc_categories[2])
 /*@}*/
 
 #define ISC_LOGMODULE_SOCKET   (&isc_modules[0])

diff --git a/lib/isc/log.c b/lib/isc/log.c
index 031393d4300b4a71da3128b39151badfc12395cd..8e83a50aacc49ba6c5fc9174466c496e6d4853ba 100644 (file)
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -181,6 +181,7 @@ isc_logcategory_t isc_categories[] = { { "default", 0 }, /* "default
                                                            must come
                                                            first. */
                                       { "general", 0 },
+                                      { "sslkeylog", 0 },
                                       { NULL, 0 } };
 
 /*!