keylogfile: simplify the callback mechanism

This partially reverts commit 97117556 with a simpler interface.  The
original intention of having the callback mechanism was to reuse it
for monitoring QUIC encryption changes.  However, it turned out to be
insufficient because such changes must be emitted after a new epoch is
ready.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

diff --git a/NEWS b/NEWS
index 3e6e7fa83e3ba306ef0b866a08a14187839ba7da..21e95d5a337ea21956c89d62474ae910788ed51d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,12 +9,14 @@ See the end for copying conditions.
 
 ** libgnutls: Added new APIs to access KDF algorithms (#813).
 
+** libgnutls: Added new callback gnutls_keylog_func that enables a custom
+   logging functionality.
+
 ** API and ABI modifications:
 gnutls_hkdf_extract: Added
 gnutls_hkdf_expand: Added
 gnutls_pbkdf2: Added
-gnutls_handshake_secret_type_t: New enumeration
-gnutls_handshake_set_secret_function: Added
+gnutls_session_set_keylog_function: Added
 
 * Version 3.6.12 (released 2020-02-01)
 

diff --git a/devel/libgnutls-latest-x86_64.abi b/devel/libgnutls-latest-x86_64.abi
index 3a9497697e8dc3f256a9725eba49cd83916aed15..6fa8640926fe76cd9956ae6ba64487297aaf3144 100644 (file)
--- a/devel/libgnutls-latest-x86_64.abi
+++ b/devel/libgnutls-latest-x86_64.abi
@@ -300,7 +300,6 @@
     <elf-symbol name='gnutls_handshake_set_post_client_hello_function' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_handshake_set_private_extensions' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_handshake_set_random' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
-    <elf-symbol name='gnutls_handshake_set_secret_function' version='GNUTLS_3_6_13' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_handshake_set_timeout' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_hash' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_hash_copy' version='GNUTLS_3_6_9' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
@@ -797,6 +796,7 @@
     <elf-symbol name='gnutls_session_resumption_requested' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_session_set_data' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_session_set_id' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
+    <elf-symbol name='gnutls_session_set_keylog_function' version='GNUTLS_3_6_13' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_session_set_premaster' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_session_set_ptr' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>
     <elf-symbol name='gnutls_session_set_verify_cert2' version='GNUTLS_3_4' is-default-version='yes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes'/>

diff --git a/devel/symbols.last b/devel/symbols.last
index 037741c562fac7834c206dd483a0917bfb310bb1..4654e4f708faea715c987658602aa74c51b41cd1 100644 (file)
--- a/devel/symbols.last
+++ b/devel/symbols.last
@@ -267,7 +267,6 @@ gnutls_handshake_set_max_packet_length@GNUTLS_3_4
 gnutls_handshake_set_post_client_hello_function@GNUTLS_3_4
 gnutls_handshake_set_private_extensions@GNUTLS_3_4
 gnutls_handshake_set_random@GNUTLS_3_4
-gnutls_handshake_set_secret_function@GNUTLS_3_6_13
 gnutls_handshake_set_timeout@GNUTLS_3_4
 gnutls_hash@GNUTLS_3_4
 gnutls_hash_copy@GNUTLS_3_6_9
@@ -765,6 +764,7 @@ gnutls_session_key_update@GNUTLS_3_6_3
 gnutls_session_resumption_requested@GNUTLS_3_4
 gnutls_session_set_data@GNUTLS_3_4
 gnutls_session_set_id@GNUTLS_3_4
+gnutls_session_set_keylog_function@GNUTLS_3_6_13
 gnutls_session_set_premaster@GNUTLS_3_4
 gnutls_session_set_ptr@GNUTLS_3_4
 gnutls_session_set_verify_cert2@GNUTLS_3_4

diff --git a/doc/Makefile.am b/doc/Makefile.am
index ef3c40f76c93392cc03790d6ee218fe4731069c7..0d24b337200f255fade128446229adb656067710 100644 (file)
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -556,7 +556,6 @@ ENUMS += enums/gnutls_fips_mode_t
 ENUMS += enums/gnutls_gost_paramset_t
 ENUMS += enums/gnutls_group_t
 ENUMS += enums/gnutls_handshake_description_t
-ENUMS += enums/gnutls_handshake_secret_type_t
 ENUMS += enums/gnutls_init_flags_t
 ENUMS += enums/gnutls_keygen_types_t
 ENUMS += enums/gnutls_keyid_flags_t
@@ -1084,8 +1083,6 @@ FUNCS += functions/gnutls_handshake_set_private_extensions
 FUNCS += functions/gnutls_handshake_set_private_extensions.short
 FUNCS += functions/gnutls_handshake_set_random
 FUNCS += functions/gnutls_handshake_set_random.short
-FUNCS += functions/gnutls_handshake_set_secret_function
-FUNCS += functions/gnutls_handshake_set_secret_function.short
 FUNCS += functions/gnutls_handshake_set_timeout
 FUNCS += functions/gnutls_handshake_set_timeout.short
 FUNCS += functions/gnutls_hash
@@ -1950,6 +1947,8 @@ FUNCS += functions/gnutls_session_set_data
 FUNCS += functions/gnutls_session_set_data.short
 FUNCS += functions/gnutls_session_set_id
 FUNCS += functions/gnutls_session_set_id.short
+FUNCS += functions/gnutls_session_set_keylog_function
+FUNCS += functions/gnutls_session_set_keylog_function.short
 FUNCS += functions/gnutls_session_set_premaster
 FUNCS += functions/gnutls_session_set_premaster.short
 FUNCS += functions/gnutls_session_set_ptr

diff --git a/doc/manpages/Makefile.am b/doc/manpages/Makefile.am
index 14e591e62f16a72c2d85233819709f03604dabd6..ca0e279e1c87532f860f0cd20749d49eaded47f7 100644 (file)
--- a/doc/manpages/Makefile.am
+++ b/doc/manpages/Makefile.am
@@ -343,7 +343,6 @@ APIMANS += gnutls_handshake_set_max_packet_length.3
 APIMANS += gnutls_handshake_set_post_client_hello_function.3
 APIMANS += gnutls_handshake_set_private_extensions.3
 APIMANS += gnutls_handshake_set_random.3
-APIMANS += gnutls_handshake_set_secret_function.3
 APIMANS += gnutls_handshake_set_timeout.3
 APIMANS += gnutls_hash.3
 APIMANS += gnutls_hash_copy.3
@@ -776,6 +775,7 @@ APIMANS += gnutls_session_key_update.3
 APIMANS += gnutls_session_resumption_requested.3
 APIMANS += gnutls_session_set_data.3
 APIMANS += gnutls_session_set_id.3
+APIMANS += gnutls_session_set_keylog_function.3
 APIMANS += gnutls_session_set_premaster.3
 APIMANS += gnutls_session_set_ptr.3
 APIMANS += gnutls_session_set_verify_cert.3

diff --git a/lib/constate.c b/lib/constate.c
index a11577d7ba5f811f9de596018c1204aaedf0a48a..eb05fdd04cad81ca5b9614c39372f8fb03ee1fda 100644 (file)
--- a/lib/constate.c
+++ b/lib/constate.c
@@ -197,7 +197,6 @@ _tls13_update_keys(gnutls_session_t session, hs_stage_t stage,
        char buf[65];
        record_state_st *upd_state;
        record_parameters_st *prev = NULL;
-       gnutls_handshake_secret_type_t secret_type;
        int ret;
 
        /* generate new keys for direction needed and copy old from previous epoch */
@@ -275,7 +274,6 @@ _tls13_update_keys(gnutls_session_t session, hs_stage_t stage,
                ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.tls13.ap_ckey, iv_size, iv_block);
                if (ret < 0)
                        return gnutls_assert_val(ret);
-               secret_type = GNUTLS_SECRET_CLIENT_TRAFFIC_SECRET;
        } else {
                ret = _tls13_expand_secret(session, APPLICATION_TRAFFIC_UPDATE,
                                           sizeof(APPLICATION_TRAFFIC_UPDATE)-1,
@@ -293,14 +291,8 @@ _tls13_update_keys(gnutls_session_t session, hs_stage_t stage,
                ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.tls13.ap_skey, iv_size, iv_block);
                if (ret < 0)
                        return gnutls_assert_val(ret);
-               secret_type = GNUTLS_SECRET_SERVER_TRAFFIC_SECRET;
        }
 
-       ret = _gnutls_call_secret_func(session, secret_type,
-                                      key_block, key_size);
-       if (ret < 0)
-               return gnutls_assert_val(ret);
-
        upd_state->mac_key_size = 0;
 
        assert(key_size <= sizeof(upd_state->key));
@@ -396,7 +388,7 @@ _tls13_set_keys(gnutls_session_t session, hs_stage_t stage,
        record_state_st *client_write, *server_write;
        const char *label;
        unsigned label_size, hsk_len;
-       gnutls_handshake_secret_type_t secret_type;
+       const char *keylog_label;
        void *ckey, *skey;
        int ret;
 
@@ -412,13 +404,13 @@ _tls13_set_keys(gnutls_session_t session, hs_stage_t stage,
                label = HANDSHAKE_CLIENT_TRAFFIC_LABEL;
                label_size = sizeof(HANDSHAKE_CLIENT_TRAFFIC_LABEL)-1;
                hsk_len = session->internals.handshake_hash_buffer.length;
-               secret_type = GNUTLS_SECRET_CLIENT_HANDSHAKE_TRAFFIC_SECRET;
+               keylog_label = "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
                ckey = session->key.proto.tls13.hs_ckey;
        } else {
                label = APPLICATION_CLIENT_TRAFFIC_LABEL;
                label_size = sizeof(APPLICATION_CLIENT_TRAFFIC_LABEL)-1;
                hsk_len = session->internals.handshake_hash_buffer_server_finished_len;
-               secret_type = GNUTLS_SECRET_CLIENT_TRAFFIC_SECRET;
+               keylog_label = "CLIENT_TRAFFIC_SECRET_0";
                ckey = session->key.proto.tls13.ap_ckey;
        }
 
@@ -430,7 +422,7 @@ _tls13_set_keys(gnutls_session_t session, hs_stage_t stage,
        if (ret < 0)
                return gnutls_assert_val(ret);
 
-       ret = _gnutls_call_secret_func(session, secret_type,
+       ret = _gnutls_call_keylog_func(session, keylog_label,
                                       ckey,
                                       session->security_parameters.prf->output_size);
        if (ret < 0)
@@ -449,12 +441,12 @@ _tls13_set_keys(gnutls_session_t session, hs_stage_t stage,
        if (stage == STAGE_HS) {
                label = HANDSHAKE_SERVER_TRAFFIC_LABEL;
                label_size = sizeof(HANDSHAKE_SERVER_TRAFFIC_LABEL)-1;
-               secret_type = GNUTLS_SECRET_SERVER_HANDSHAKE_TRAFFIC_SECRET;
+               keylog_label = "SERVER_HANDSHAKE_TRAFFIC_SECRET";
                skey = session->key.proto.tls13.hs_skey;
        } else {
                label = APPLICATION_SERVER_TRAFFIC_LABEL;
                label_size = sizeof(APPLICATION_SERVER_TRAFFIC_LABEL)-1;
-               secret_type = GNUTLS_SECRET_SERVER_TRAFFIC_SECRET;
+               keylog_label = "SERVER_TRAFFIC_SECRET_0";
                skey = session->key.proto.tls13.ap_skey;
        }
 
@@ -467,7 +459,7 @@ _tls13_set_keys(gnutls_session_t session, hs_stage_t stage,
        if (ret < 0)
                return gnutls_assert_val(ret);
 
-       ret = _gnutls_call_secret_func(session, secret_type,
+       ret = _gnutls_call_keylog_func(session, keylog_label,
                                       skey,
                                       session->security_parameters.prf->output_size);
        if (ret < 0)

diff --git a/lib/ext/pre_shared_key.c b/lib/ext/pre_shared_key.c
index eef84814d626ba1c224074e89256f248508d0c30..8a39cda153e92a1b10f18e6dc7c11944d4e0ae18 100644 (file)
--- a/lib/ext/pre_shared_key.c
+++ b/lib/ext/pre_shared_key.c
@@ -203,7 +203,7 @@ generate_early_secrets(gnutls_session_t session,
        if (ret < 0)
                return gnutls_assert_val(ret);
 
-       ret = _gnutls_call_secret_func(session, GNUTLS_SECRET_CLIENT_EARLY_TRAFFIC_SECRET,
+       ret = _gnutls_call_keylog_func(session, "CLIENT_EARLY_TRAFFIC_SECRET",
                                       session->key.proto.tls13.e_ckey,
                                       prf->output_size);
        if (ret < 0)
@@ -217,7 +217,7 @@ generate_early_secrets(gnutls_session_t session,
        if (ret < 0)
                return gnutls_assert_val(ret);
 
-       ret = _gnutls_call_secret_func(session, GNUTLS_SECRET_EARLY_EXPORTER_SECRET,
+       ret = _gnutls_call_keylog_func(session, "EARLY_EXPORTER_SECRET",
                                       session->key.proto.tls13.ap_expkey,
                                       prf->output_size);
        if (ret < 0)

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index cd2adc103df992a277119626262c74d07b077dd5..d9d851be627cda3789061a1d55e685816a1cef86 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -1243,7 +1243,7 @@ typedef struct {
        unsigned int h_type;    /* the hooked type */
        int16_t h_post;         /* whether post-generation/receive */
 
-       gnutls_handshake_secret_func secret_func;
+       gnutls_keylog_func keylog_func;
 
        /* holds the selected certificate and key.
         * use _gnutls_selected_certs_deinit() and _gnutls_selected_certs_set()

diff --git a/lib/handshake-tls13.c b/lib/handshake-tls13.c
index 39d002bd04f40fc5eaaedd024f0439bc2a9d4dde..24f5af65c696d09a30bbf49af5d8cb904ee9001f 100644 (file)
--- a/lib/handshake-tls13.c
+++ b/lib/handshake-tls13.c
@@ -292,7 +292,7 @@ static int generate_ap_traffic_keys(gnutls_session_t session)
        if (ret < 0)
                return gnutls_assert_val(ret);
 
-       ret = _gnutls_call_secret_func(session, GNUTLS_SECRET_EXPORTER_SECRET,
+       ret = _gnutls_call_keylog_func(session, "EXPORTER_SECRET",
                                       session->key.proto.tls13.ap_expkey,
                                       session->security_parameters.prf->output_size);
        if (ret < 0)

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index 13b6c3565915c96d0061ea1987c4fad1eb5c9c8e..cfc1f35e922e438a18edf0b6cd98050be0c75c5d 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -2292,58 +2292,23 @@ void gnutls_global_set_log_function(gnutls_log_func log_func);
 void gnutls_global_set_audit_log_function(gnutls_audit_log_func log_func);
 void gnutls_global_set_log_level(int level);
 
-/**
- * gnutls_handshake_secret_type_t:
- * @GNUTLS_SECRET_CLIENT_RANDOM: 48 bytes for the master secret (for SSL 3.0,
- *    TLS 1.0, 1.1 and 1.2)
- * @GNUTLS_SECRET_CLIENT_EARLY_TRAFFIC_SECRET: the early traffic secret for the
- *    client side (for TLS 1.3)
- * @GNUTLS_SECRET_CLIENT_HANDSHAKE_TRAFFIC_SECRET: the handshake traffic secret
- *    for the client side (for TLS 1.3)
- * @GNUTLS_SECRET_SERVER_HANDSHAKE_TRAFFIC_SECRET: the handshake traffic secret
- *    for the server side (for TLS 1.3)
- * @GNUTLS_SECRET_CLIENT_TRAFFIC_SECRET: the application traffic secret for the
- *    client side (for TLS 1.3)
- * @GNUTLS_SECRET_SERVER_TRAFFIC_SECRET: the application traffic secret for the
- *    server side (for TLS 1.3)
- * @GNUTLS_SECRET_EARLY_EXPORTER_SECRET: the early exporter secret (for TLS 1.3,
- *    used for 0-RTT keys).
- * @GNUTLS_SECRET_EXPORTER_SECRET: the exporter secret (for TLS 1.3, used for
- *    1-RTT keys)
- *
- * Enumeration of different types of secrets derived during handshake.
- * This is used by gnutls_handshake_set_secret_function().
- *
- * Since: 3.6.13
- */
-typedef enum {
-       GNUTLS_SECRET_CLIENT_RANDOM,
-       GNUTLS_SECRET_CLIENT_EARLY_TRAFFIC_SECRET,
-       GNUTLS_SECRET_CLIENT_HANDSHAKE_TRAFFIC_SECRET,
-       GNUTLS_SECRET_SERVER_HANDSHAKE_TRAFFIC_SECRET,
-       GNUTLS_SECRET_CLIENT_TRAFFIC_SECRET,
-       GNUTLS_SECRET_SERVER_TRAFFIC_SECRET,
-       GNUTLS_SECRET_EARLY_EXPORTER_SECRET,
-       GNUTLS_SECRET_EXPORTER_SECRET
-} gnutls_handshake_secret_type_t;
-
   /**
-   * gnutls_handshake_secret_function:
+   * gnutls_keylog_func:
    * @session: the current session
-   * @type: #gnutls_handshake_secret_type_t
+   * @label: the keylog label
    * @secret: the (const) data of the derived secret.
    *
-   * Function prototype for secret derivation hooks. It is set using
-   * gnutls_handshake_set_secret_function().
+   * Function prototype for keylog hooks. It is set using
+   * gnutls_session_set_keylog_function().
    *
    * Returns: Non zero on error.
    * Since: 3.6.13
    */
-typedef int (*gnutls_handshake_secret_func) (gnutls_session_t session,
-                                            gnutls_handshake_secret_type_t type,
-                                            const gnutls_datum_t *secret);
-void gnutls_handshake_set_secret_function(gnutls_session_t session,
-                                         gnutls_handshake_secret_func func);
+typedef int (*gnutls_keylog_func) (gnutls_session_t session,
+                                  const char *label,
+                                  const gnutls_datum_t *secret);
+void gnutls_session_set_keylog_function(gnutls_session_t session,
+                                       gnutls_keylog_func func);
 
 /* Diffie-Hellman parameter handling.
  */

diff --git a/lib/kx.c b/lib/kx.c
index 43056d412a605f521ba63f4fa85883adad211432..d5abf69ea700d438ace280743ac3782763788b28 100644 (file)
--- a/lib/kx.c
+++ b/lib/kx.c
@@ -71,7 +71,7 @@ int _gnutls_generate_master(gnutls_session_t session, int keep_premaster)
 }
 
 /**
- * gnutls_handshake_set_secret_function:
+ * gnutls_session_set_keylog_function:
  * @session: is #gnutls_session_t type
  * @func: is the function to be called
  *
@@ -81,68 +81,36 @@ int _gnutls_generate_master(gnutls_session_t session, int keep_premaster)
  * Since: 3.6.13
  */
 void
-gnutls_handshake_set_secret_function(gnutls_session_t session,
-                                    gnutls_handshake_secret_func func)
+gnutls_session_set_keylog_function(gnutls_session_t session,
+                                  gnutls_keylog_func func)
 {
-       session->internals.secret_func = func;
+       session->internals.keylog_func = func;
 }
 
 int
-_gnutls_call_secret_func(gnutls_session_t session,
-                        gnutls_handshake_secret_type_t type,
+_gnutls_call_keylog_func(gnutls_session_t session,
+                        const char *label,
                         const uint8_t *data,
                         unsigned size)
 {
-       if (session->internals.secret_func) {
+       if (session->internals.keylog_func) {
                gnutls_datum_t secret = {(void*)data, size};
-               return session->internals.secret_func(session, type, &secret);
+               return session->internals.keylog_func(session, label, &secret);
        }
        return 0;
 }
 
-static const char *
-secret_type_to_nss_keylog_label(gnutls_handshake_secret_type_t type)
-{
-       switch (type) {
-       case GNUTLS_SECRET_CLIENT_RANDOM:
-               return "CLIENT_RANDOM";
-       case GNUTLS_SECRET_CLIENT_EARLY_TRAFFIC_SECRET:
-               return "CLIENT_EARLY_TRAFFIC_SECRET";
-       case GNUTLS_SECRET_CLIENT_HANDSHAKE_TRAFFIC_SECRET:
-               return "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
-       case GNUTLS_SECRET_SERVER_HANDSHAKE_TRAFFIC_SECRET:
-               return "SERVER_HANDSHAKE_TRAFFIC_SECRET";
-       case GNUTLS_SECRET_CLIENT_TRAFFIC_SECRET:
-               return "CLIENT_TRAFFIC_SECRET_0";
-       case GNUTLS_SECRET_SERVER_TRAFFIC_SECRET:
-               return "SERVER_TRAFFIC_SECRET_0";
-       case GNUTLS_SECRET_EARLY_EXPORTER_SECRET:
-               return "EARLY_EXPORTER_SECRET";
-       case GNUTLS_SECRET_EXPORTER_SECRET:
-               return "EXPORTER_SECRET";
-       default:
-               gnutls_assert();
-               return NULL;
-       }
-}
-
 int
-_gnutls_nss_keylog_secret_func(gnutls_session_t session,
-                              gnutls_handshake_secret_type_t type,
-                              const gnutls_datum_t *secret)
+_gnutls_nss_keylog_func(gnutls_session_t session,
+                       const char *label,
+                       const gnutls_datum_t *secret)
 {
-       const char *label;
-
        /* ignore subsequent traffic secrets that are calculated from
         * the previous traffic secret
         */
        if (!session->internals.handshake_in_progress)
                return 0;
 
-       label = secret_type_to_nss_keylog_label(type);
-       if (unlikely(label == NULL))
-               return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
-
        _gnutls_nss_keylog_write(session, label, secret->data, secret->size);
        return 0;
 }
@@ -265,7 +233,7 @@ generate_normal_master(gnutls_session_t session,
        if (ret < 0)
                return ret;
 
-       ret = _gnutls_call_secret_func(session, GNUTLS_SECRET_CLIENT_RANDOM,
+       ret = _gnutls_call_keylog_func(session, "CLIENT_RANDOM",
                                       session->security_parameters.master_secret,
                                       GNUTLS_MASTER_SIZE);
        if (ret < 0)

diff --git a/lib/kx.h b/lib/kx.h
index 8d8d4225ef4d625f4939fc5637364efa7753077e..6b4a7fcae54e0dedd01b1b45b268e89940c5046f 100644 (file)
--- a/lib/kx.h
+++ b/lib/kx.h
@@ -38,15 +38,15 @@ int _gnutls_recv_server_crt_request(gnutls_session_t session);
 int _gnutls_send_server_crt_request(gnutls_session_t session, int again);
 int _gnutls_recv_client_certificate_verify_message(gnutls_session_t
                                                   session);
-int _gnutls_call_secret_func(gnutls_session_t session,
-                            gnutls_handshake_secret_type_t type,
+int _gnutls_call_keylog_func(gnutls_session_t session,
+                            const char *label,
                             const uint8_t *data,
                             unsigned size);
 void _gnutls_nss_keylog_write(gnutls_session_t session,
                              const char *label,
                              const uint8_t *secret, size_t secret_size);
-int _gnutls_nss_keylog_secret_func(gnutls_session_t session,
-                                  gnutls_handshake_secret_type_t type,
-                                  const gnutls_datum_t *secret);
+int _gnutls_nss_keylog_func(gnutls_session_t session,
+                           const char *label,
+                           const gnutls_datum_t *secret);
 
 #endif /* GNUTLS_LIB_KX_H */

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index c1aace905ef3806d773208f6876430f93d1d2d40..234d43e755802a7fe0c63c7e45adb01f3c3c73e2 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -1315,7 +1315,7 @@ GNUTLS_3_6_13
        gnutls_hkdf_extract;
        gnutls_hkdf_expand;
        gnutls_pbkdf2;
-       gnutls_handshake_set_secret_function;
+       gnutls_session_set_keylog_function;
 } GNUTLS_3_6_12;
 
 GNUTLS_FIPS140_3_4 {

diff --git a/lib/state.c b/lib/state.c
index f33cd5a8bc01372d0fef156cc7a3aefc0bb9824d..35ebb2a23000832eb5ababc2961c4990e09d1ddb 100644 (file)
--- a/lib/state.c
+++ b/lib/state.c
@@ -588,9 +588,8 @@ int gnutls_init(gnutls_session_t * session, unsigned int flags)
        if (_gnutls_disable_tls13 != 0)
                (*session)->internals.flags |= INT_FLAG_NO_TLS13;
 
-       /* Install the default secret function */
-       gnutls_handshake_set_secret_function(*session,
-                                            _gnutls_nss_keylog_secret_func);
+       /* Install the default keylog function */
+       gnutls_session_set_keylog_function(*session, _gnutls_nss_keylog_func);
 
        return 0;
 }

diff --git a/tests/Makefile.am b/tests/Makefile.am
index 5b9fdb716821ab66e3265320e9fb5d41010b42c1..5c89f77c1174f033dd49575ef0a15ec9e47246df 100644 (file)
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -217,7 +217,7 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
         tls-record-size-limit-asym dh-compute ecdh-compute sign-verify-data-newapi \
         sign-verify-newapi sign-verify-deterministic iov aead-cipher-vec \
         tls13-without-timeout-func buffer status-request-revoked \
-        set_x509_ocsp_multi_cli kdf-api secret-hook
+        set_x509_ocsp_multi_cli kdf-api keylog-func
 
 if HAVE_SECCOMP_TESTS
 ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp

diff --git a/tests/secret-hook.c b/tests/keylog-func.c
similarity index 78%
rename from tests/secret-hook.c
rename to tests/keylog-func.c
index f4523a6a46329ead684477d5b0c8b0954b7fdbd2..8c4d32114284e837f0a1c07e63df2bd08c94f061 100644 (file)
--- a/tests/secret-hook.c
+++ b/tests/keylog-func.c
@@ -49,8 +49,7 @@ int main(int argc, char **argv)
 #include "cert-common.h"
 #include "utils.h"
 
-/* This program tests whether a secret hook function is called upon a
- * new traffic secret is installed.
+/* This program tests whether a keylog function is called.
  */
 
 static void terminate(void);
@@ -72,57 +71,30 @@ static pid_t child;
 #define MAX_BUF 1024
 #define MSG "Hello TLS"
 
-static const char *
-secret_type_to_str(gnutls_handshake_secret_type_t type)
-{
-       switch (type) {
-       case GNUTLS_SECRET_CLIENT_RANDOM:
-               return "CLIENT_RANDOM";
-       case GNUTLS_SECRET_CLIENT_EARLY_TRAFFIC_SECRET:
-               return "CLIENT_EARLY_TRAFFIC_SECRET";
-       case GNUTLS_SECRET_CLIENT_HANDSHAKE_TRAFFIC_SECRET:
-               return "CLIENT_HANDSHAKE_TRAFFIC_SECRET";
-       case GNUTLS_SECRET_SERVER_HANDSHAKE_TRAFFIC_SECRET:
-               return "SERVER_HANDSHAKE_TRAFFIC_SECRET";
-       case GNUTLS_SECRET_CLIENT_TRAFFIC_SECRET:
-               return "CLIENT_TRAFFIC_SECRET";
-       case GNUTLS_SECRET_SERVER_TRAFFIC_SECRET:
-               return "SERVER_TRAFFIC_SECRET";
-       case GNUTLS_SECRET_EARLY_EXPORTER_SECRET:
-               return "EARLY_EXPORTER_SECRET";
-       case GNUTLS_SECRET_EXPORTER_SECRET:
-               return "EXPORTER_SECRET";
-       default:
-               return NULL;
-       }
-}
-
 static int
-secret_hook_func(gnutls_session_t session,
-                gnutls_handshake_secret_type_t type,
-                const gnutls_datum_t *secret)
+keylog_func(gnutls_session_t session,
+           const char *label,
+           const gnutls_datum_t *secret)
 {
        unsigned int *call_count = gnutls_session_get_ptr(session);
-       static const gnutls_handshake_secret_type_t exp_types[] = {
-               GNUTLS_SECRET_CLIENT_HANDSHAKE_TRAFFIC_SECRET,
-               GNUTLS_SECRET_SERVER_HANDSHAKE_TRAFFIC_SECRET,
-               GNUTLS_SECRET_EXPORTER_SECRET,
-               GNUTLS_SECRET_CLIENT_TRAFFIC_SECRET,
-               GNUTLS_SECRET_SERVER_TRAFFIC_SECRET,
-               GNUTLS_SECRET_CLIENT_TRAFFIC_SECRET,
-               GNUTLS_SECRET_SERVER_TRAFFIC_SECRET
+       static const char *exp_labels[] = {
+               "CLIENT_HANDSHAKE_TRAFFIC_SECRET",
+               "SERVER_HANDSHAKE_TRAFFIC_SECRET",
+               "EXPORTER_SECRET",
+               "CLIENT_TRAFFIC_SECRET_0",
+               "SERVER_TRAFFIC_SECRET_0"
        };
 
-       if (*call_count >= sizeof(exp_types)/sizeof(exp_types[0]))
+       if (*call_count >= sizeof(exp_labels)/sizeof(exp_labels[0]))
                fail("unexpected secret at call count %u\n",
                     *call_count);
 
-       if (type != exp_types[*call_count])
+       if (strcmp(label, exp_labels[*call_count]) != 0)
                fail("unexpected %s at call count %u\n",
-                    secret_type_to_str(type), *call_count);
+                    label, *call_count);
        else if (debug)
                success("received %s at call count %u\n",
-                       secret_type_to_str(type), *call_count);
+                       label, *call_count);
 
        (*call_count)++;
        return 0;
@@ -168,7 +140,7 @@ static void client(int fd, const char *prio, unsigned int exp_call_count)
 
        gnutls_transport_set_int(session, fd);
 
-       gnutls_handshake_set_secret_function(session, secret_hook_func);
+       gnutls_session_set_keylog_function(session, keylog_func);
 
        /* Perform the TLS handshake
         */
@@ -189,18 +161,6 @@ static void client(int fd, const char *prio, unsigned int exp_call_count)
                        gnutls_protocol_get_name
                        (gnutls_protocol_get_version(session)));
 
-       /* Send key update */
-       do {
-               ret = gnutls_session_key_update(session, GNUTLS_KU_PEER);
-       } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
-
-       if (ret < 0)
-               fail("error in key update: %s\n", gnutls_strerror(ret));
-       else {
-               if (debug)
-                       success("client: Sent key update\n");
-       }
-
        gnutls_record_send(session, MSG, strlen(MSG));
 
        do {
@@ -279,7 +239,7 @@ static void server(int fd, const char *prio, unsigned int exp_call_count)
 
        gnutls_transport_set_int(session, fd);
 
-       gnutls_handshake_set_secret_function(session, secret_hook_func);
+       gnutls_session_set_keylog_function(session, keylog_func);
 
        do {
                ret = gnutls_handshake(session);
@@ -383,7 +343,7 @@ run(const char *prio, unsigned int exp_call_count)
 
 void doit(void)
 {
-       run("NORMAL:-VERS-ALL:+VERS-TLS1.3", 7);
+       run("NORMAL:-VERS-ALL:+VERS-TLS1.3", 5);
 }
 
 #endif                         /* _WIN32 */