Skip to content

Commit 3033371

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #6717 from bigbrett/sniffer-keylogfile
sniffer keylog file support
2 parents fd9c78d + 66c53b0 commit 3033371

17 files changed

Lines changed: 784 additions & 104 deletions

‎configure.ac‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1324,6 +1324,17 @@ then
13241324
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS_MTU"
13251325
fi
13261326

1327+
# KeyLog file export
1328+
AC_ARG_ENABLE([keylog-export],
1329+
[AS_HELP_STRING([--enable-keylog-export],[Enable (DANGEROUS INSECURE) exporting TLS secrets to an NSS keylog file (default: disabled)])],
1330+
[ ENABLED_KEYLOG_EXPORT=$enableval ],
1331+
[ ENABLED_KEYLOG_EXPORT=no ]
1332+
)
1333+
if test "$ENABLED_KEYLOG_EXPORT" = "yes"
1334+
then
1335+
AM_CFLAGS="$AM_CFLAGS -DSHOW_SECRETS -DHAVE_SECRET_CALLBACK -DWOLFSSL_SSLKEYLOGFILE"
1336+
fi
1337+
13271338
# TLS v1.3 Draft 18 (Note: only final TLS v1.3 supported, here for backwards build compatibility)
13281339
AC_ARG_ENABLE([tls13-draft18],
13291340
[AS_HELP_STRING([--enable-tls13-draft18],[Enable wolfSSL TLS v1.3 Draft 18 (default: disabled)])],
@@ -9449,6 +9460,7 @@ echo " * PSA: $ENABLED_PSA"
94499460
echo " * System CA certs: $ENABLED_SYS_CA_CERTS"
94509461
echo " * ERR Queues per Thread: $ENABLED_ERRORQUEUEPERTHREAD"
94519462
echo " * rwlock: $ENABLED_RWLOCK"
9463+
echo " * keylog export: $ENABLED_KEYLOG_EXPORT"
94529464
echo ""
94539465
echo "---"
94549466

‎scripts/sniffer-gen.sh‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ run_sequence() {
4646
run_test "TLS13-AES128-GCM-SHA256" "-v 4" "-v 4"
4747
run_test "TLS13-AES256-GCM-SHA384" "-v 4" "-v 4"
4848
run_test "TLS13-CHACHA20-POLY1305-SHA256" "-v 4" "-v 4"
49-
elif [ "$1" == "tls12" ]; then # TLS v1.2
49+
elif [ "$1" == "tls12" ] || [ "$1" == "tls12-keylog" ]; then # TLS v1.2
5050
run_test "ECDHE-ECDSA-AES128-GCM-SHA256" "-v 3 -A ./certs/ca-ecc-cert.pem -k ./certs/ecc-key.pem -c ./certs/intermediate/server-chain-ecc.pem -V" "-v 3 -A ./certs/ca-ecc-cert.pem -k ./certs/ecc-client-key.pem -c ./certs/intermediate/client-chain-ecc.pem -C"
5151
run_test "ECDHE-ECDSA-AES256-GCM-SHA384" "-v 3 -A ./certs/ca-ecc-cert.pem -k ./certs/ecc-key.pem -c ./certs/intermediate/server-chain-ecc.pem -V" "-v 3 -A ./certs/ca-ecc-cert.pem -k ./certs/ecc-client-key.pem -c ./certs/intermediate/client-chain-ecc.pem -C"
5252
elif [ "$1" == "tls13-dh-resume" ] || [ "$1" == "tls13-ecc-resume" ]; then # TLS v1.3 Resumption
@@ -69,19 +69,37 @@ run_sequence() {
6969
fi
7070
}
7171

72-
run_capture(){
72+
73+
run_capture() {
74+
local config_flags=()
7375
echo -e "\nconfiguring and building wolfssl ($1)..."
74-
./configure --enable-sniffer $2 1>/dev/null || exit $?
76+
77+
# Add default flags
78+
config_flags+=(--enable-sniffer)
79+
80+
# If additional arguments are provided, add them to the array
81+
if [ -n "$2" ]; then
82+
# Convert string into an array, respecting quoted strings as a single element
83+
eval "config_flags+=($2)"
84+
fi
85+
86+
./configure "${config_flags[@]}" 1>/dev/null || exit $?
7587
make 1>/dev/null || exit $?
88+
7689
echo "starting capture"
7790
tcpdump -i lo -n port 11111 -w ./scripts/sniffer-${1}.pcap -U &
7891
tcpdump_pid=$!
7992
run_sequence $1
8093
sleep 1
8194
kill -15 $tcpdump_pid; tcpdump_pid=0
95+
96+
if [ "$1" == "tls12-keylog" ]; then
97+
cp ./sslkeylog.log ./scripts/sniffer-${1}.sslkeylog
98+
fi
8299
}
83100

84101
run_capture "tls12" ""
102+
run_capture "tls12-keylog" "--enable-enc-then-mac=no --enable-keylog-export CFLAGS='-Wno-cpp -DWOLFSSL_SNIFFER_KEYLOGFILE'"
85103
run_capture "tls13-ecc" ""
86104
run_capture "tls13-ecc-resume" "--enable-session-ticket"
87105
run_capture "tls13-dh" "--disable-ecc"

‎scripts/sniffer-testsuite.test‎

Lines changed: 51 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -59,15 +59,21 @@ has_static_rsa=no
5959
if [ $? -eq 0 ]; then
6060
has_static_rsa=yes
6161
fi
62+
# ./configure --enable-sniffer CFLAGS="-DWOLFSSL_SNIFFER_KEYLOGFILE"
63+
has_keylog=no
64+
./sslSniffer/sslSnifferTest/snifftest -? 2>&1 | grep -- 'ssl_keylog_file'
65+
if [ $? -eq 0 ]; then
66+
has_keylog=yes
67+
fi
6268

6369

6470
RESULT=0
6571

6672
# TLS v1.2 Static RSA Test
6773
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_static_rsa == yes
6874
then
69-
echo -e "\nStaring snifftest on testsuite.pcap...\n"
70-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-static-rsa.pcap ./certs/server-key.pem 127.0.0.1 11111
75+
echo -e "\nStaring snifftest on sniffer-static-rsa.pcap...\n"
76+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-static-rsa.pcap -key ./certs/server-key.pem -server 127.0.0.1 -port 11111
7177

7278
RESULT=$?
7379
[ $RESULT -ne 0 ] && echo -e "\nsnifftest static RSA failed\n" && exit 1
@@ -77,16 +83,45 @@ fi
7783
if test $RESULT -eq 0 && test $has_rsa == yes && test $has_tlsv12 == yes && test $has_static_rsa == yes
7884
then
7985
echo -e "\nStaring snifftest on sniffer-ipv6.pcap...\n"
80-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-ipv6.pcap ./certs/server-key.pem ::1 11111
86+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-ipv6.pcap -key ./certs/server-key.pem -server ::1 -port 11111
8187

8288
RESULT=$?
8389
[ $RESULT -ne 0 ] && echo -e "\nsnifftest (ipv6) failed\n" && exit 1
8490
fi
8591

92+
# TLS v1.2 sniffer keylog file test: runs sniffer on pcap and associated keylog file and compares decrypted traffic with known good output.
93+
# To regenerate the known good output, run `scripts/sniffer-gen.sh` to regenerate the pcap and keylog file, then run the sniffer on it
94+
# with the same arguments as in the test below, but redirect output to `./scripts/sniffer-tls12-keylog.out`.
95+
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_keylog == yes
96+
then
97+
echo -e "\nStaring snifftest on sniffer-tls12-keylog.pcap...\n"
98+
99+
TMPFILE=$(mktemp)
100+
RESULT=$?
101+
[ $RESULT -ne 0 ] && echo -e "\nsnifftest keylog test failed: unable to create tmpfile\n" && rm $TMPFILE && exit 1
102+
103+
./sslSniffer/sslSnifferTest/snifftest \
104+
-pcap scripts/sniffer-tls12-keylog.pcap \
105+
-keylogfile scripts/sniffer-tls12-keylog.sslkeylog \
106+
-server 127.0.0.1 -port 11111 > $TMPFILE
107+
108+
RESULT=$?
109+
[ $RESULT -ne 0 ] && echo -e "\nsnifftest keylog test failed: snifftest returned $RESULT\n" && rm $TMPFILE && exit 1
110+
111+
# sed '1d' strips out first line, which contains wolfSSL version
112+
sed '1d' $TMPFILE | diff - <(sed '1d' scripts/sniffer-tls12-keylog.out)
113+
114+
RESULT=$?
115+
[ $RESULT -ne 0 ] && echo -e "\nsnifftest keylog test failed: snifftest diff returned $RESULT\n" && rm $TMPFILE && exit 1
116+
117+
rm $TMPFILE
118+
fi
119+
86120
# TLS v1.3 sniffer test ECC
87121
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes
88122
then
89-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-ecc.pcap ./certs/statickeys/ecc-secp256r1.pem 127.0.0.1 11111
123+
echo -e "\nStaring snifftest on sniffer-tls13-ecc.pcap...\n"
124+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-ecc.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
90125

91126
RESULT=$?
92127
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 ECC failed\n" && exit 1
@@ -95,7 +130,8 @@ fi
95130
# TLS v1.3 sniffer test DH
96131
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_dh == yes
97132
then
98-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-dh.pcap ./certs/statickeys/dh-ffdhe2048.pem 127.0.0.1 11111
133+
echo -e "\nStaring snifftest on sniffer-tls13-dh.pcap...\n"
134+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-dh.pcap -key ./certs/statickeys/dh-ffdhe2048.pem -server 127.0.0.1 -port 11111
99135

100136
RESULT=$?
101137
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 DH failed\n" && exit 1
@@ -104,7 +140,8 @@ fi
104140
# TLS v1.3 sniffer test X25519
105141
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_x25519 == yes
106142
then
107-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-x25519.pcap ./certs/statickeys/x25519.pem 127.0.0.1 11111
143+
echo -e "\nStaring snifftest on sniffer-tls13-x25519.pcap...\n"
144+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-x25519.pcap -key ./certs/statickeys/x25519.pem -server 127.0.0.1 -port 11111
108145

109146
RESULT=$?
110147
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 X25519 failed\n" && exit 1
@@ -113,7 +150,8 @@ fi
113150
# TLS v1.3 sniffer test ECC resumption
114151
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes && test $session_ticket == yes
115152
then
116-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-ecc-resume.pcap ./certs/statickeys/ecc-secp256r1.pem 127.0.0.1 11111
153+
echo -e "\nStaring snifftest on sniffer-tls13-ecc-resume.pcap...\n"
154+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-ecc-resume.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
117155

118156
RESULT=$?
119157
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 ECC failed\n" && exit 1
@@ -122,7 +160,8 @@ fi
122160
# TLS v1.3 sniffer test DH
123161
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_dh == yes && test $session_ticket == yes
124162
then
125-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-dh-resume.pcap ./certs/statickeys/dh-ffdhe2048.pem 127.0.0.1 11111
163+
echo -e "\nStaring snifftest on sniffer-tls13-dh-resume.pcap...\n"
164+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-dh-resume.pcap -key ./certs/statickeys/dh-ffdhe2048.pem -server 127.0.0.1 -port 11111
126165

127166
RESULT=$?
128167
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 DH failed\n" && exit 1
@@ -131,7 +170,8 @@ fi
131170
# TLS v1.3 sniffer test X25519
132171
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_x25519 == yes && test $session_ticket == yes
133172
then
134-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-x25519-resume.pcap ./certs/statickeys/x25519.pem 127.0.0.1 11111
173+
echo -e "\nStaring snifftest on sniffer-tls13-x25519-resume.pcap...\n"
174+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-x25519-resume.pcap -key ./certs/statickeys/x25519.pem -server 127.0.0.1 -port 11111
135175

136176
RESULT=$?
137177
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 X25519 failed\n" && exit 1
@@ -140,12 +180,12 @@ fi
140180
# TLS v1.3 sniffer test hello_retry_request (HRR) with ECDHE
141181
if test $RESULT -eq 0 && test $has_tlsv13 == yes && test $has_ecc == yes
142182
then
143-
./sslSniffer/sslSnifferTest/snifftest ./scripts/sniffer-tls13-hrr.pcap ./certs/statickeys/ecc-secp256r1.pem 127.0.0.1 11111
183+
echo -e "\nStaring snifftest on sniffer-tls13-hrr.pcap...\n"
184+
./sslSniffer/sslSnifferTest/snifftest -pcap ./scripts/sniffer-tls13-hrr.pcap -key ./certs/statickeys/ecc-secp256r1.pem -server 127.0.0.1 -port 11111
144185

145186
RESULT=$?
146187
[ $RESULT -ne 0 ] && echo -e "\nsnifftest TLS v1.3 HRR failed\n" && exit 1
147188
fi
148189

149190
echo -e "\nSuccess!\n"
150-
151191
exit 0

‎scripts/sniffer-tls12-keylog.out‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
snifftest 5.6.3
2+
sniffer features: key_callback tls_v13 tls_v12 static_ephemeral sni extended_master rsa dh ecc rsa_static dh_static ssl_keylog_file
3+
4+
SSL App Data(26:14):hello wolfssl!
5+
SSL App Data(27:22):I hear you fa shizzle!
6+
SSL App Data(57:14):hello wolfssl!
7+
SSL App Data(58:22):I hear you fa shizzle!

‎scripts/sniffer-tls12-keylog.pcap‎

15 KB
Binary file not shown.

‎scripts/sniffer-tls12-keylog.sslkeylog‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
CLIENT_RANDOM 3827fef5d4172f3753d81661dbc228b41adcb2357e04e493f8d9d4d4a85777d3 5240740265eaa6a8622805728bf53fd88b546b1523e4b9c3d4b6573471bc081ce9f074520df99873c0c447d3a37ebdc6
2+
CLIENT_RANDOM 3827fef5d4172f3753d81661dbc228b41adcb2357e04e493f8d9d4d4a85777d3 5240740265eaa6a8622805728bf53fd88b546b1523e4b9c3d4b6573471bc081ce9f074520df99873c0c447d3a37ebdc6
3+
CLIENT_RANDOM 8d793a1160661700dc686746be0e77a01dcf94472971bfbb517c6d7d179b7bcd ac612c7b9292ad6bc5304176b9dcde81ee488b6adb63bb6917cbf38a0775e9e334766839e091506972450e77ba6ce977
4+
CLIENT_RANDOM 8d793a1160661700dc686746be0e77a01dcf94472971bfbb517c6d7d179b7bcd ac612c7b9292ad6bc5304176b9dcde81ee488b6adb63bb6917cbf38a0775e9e334766839e091506972450e77ba6ce977
5+
CLIENT_RANDOM 4a1d3695145e5136a2914756962f848f033b62d3a9b714f7e659ae3f133d2527 118442e0edd05696d1566eb73693a9a1316d24ac62e024f92e685c540eaec31a463e19091d45b63cfc8539d3bd11915b
6+
CLIENT_RANDOM 4a1d3695145e5136a2914756962f848f033b62d3a9b714f7e659ae3f133d2527 118442e0edd05696d1566eb73693a9a1316d24ac62e024f92e685c540eaec31a463e19091d45b63cfc8539d3bd11915b
7+
CLIENT_RANDOM 307abe19ea84d9b45621df5b89fee8d2f9ac66eb4303cf9303cf6e957ad1d75d dfb9bb0d29579a0b2f35be65982954f33268c30ea8709985a45c95633c1c6e94cbfdebe625bda975572921b4462d5153
8+
CLIENT_RANDOM 307abe19ea84d9b45621df5b89fee8d2f9ac66eb4303cf9303cf6e957ad1d75d dfb9bb0d29579a0b2f35be65982954f33268c30ea8709985a45c95633c1c6e94cbfdebe625bda975572921b4462d5153
9+
CLIENT_RANDOM 41ad4bceb3b900ffbc77f9b0c67d69a62f2b1d490f91b2af496cf6e78371900d 9752ea66a193ac04e4a20aca3c7160faa2637efb927d00c2a2d90b77e2e7875a760ee76f9ce509e549f8303625a2fd59
10+
CLIENT_RANDOM 41ad4bceb3b900ffbc77f9b0c67d69a62f2b1d490f91b2af496cf6e78371900d 9752ea66a193ac04e4a20aca3c7160faa2637efb927d00c2a2d90b77e2e7875a760ee76f9ce509e549f8303625a2fd59
11+
CLIENT_RANDOM 596ffcdec477ac0b24e0958ecd7c1fc7cc5b37337bac90803b864e3edbad8780 2f86705d0c4fb7e92c7cb1ef2f104955724d5a0b5abd18478d39c1dd96222b4462e4382982bec26e9a231ec970c2d509
12+
CLIENT_RANDOM 596ffcdec477ac0b24e0958ecd7c1fc7cc5b37337bac90803b864e3edbad8780 2f86705d0c4fb7e92c7cb1ef2f104955724d5a0b5abd18478d39c1dd96222b4462e4382982bec26e9a231ec970c2d509

‎src/internal.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7502,7 +7502,7 @@ int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
75027502
#endif
75037503

75047504
#if defined(HAVE_SECRET_CALLBACK) && defined(SHOW_SECRETS) && \
7505-
defined(WOLFSSL_SSLKEYLOGFILE)
7505+
defined(WOLFSSL_SSLKEYLOGFILE) && defined(WOLFSSL_TLS13)
75067506
(void)wolfSSL_set_tls13_secret_cb(ssl, tls13ShowSecrets, NULL);
75077507
#endif
75087508

@@ -17651,7 +17651,7 @@ int ChachaAEADEncrypt(WOLFSSL* ssl, byte* out, const byte* input,
1765117651
*
1765217652
* Return 0 on success negative values in error case
1765317653
*/
17654-
static int ChachaAEADDecrypt(WOLFSSL* ssl, byte* plain, const byte* input,
17654+
int ChachaAEADDecrypt(WOLFSSL* ssl, byte* plain, const byte* input,
1765517655
word16 sz)
1765617656
{
1765717657
byte add[AEAD_AUTH_DATA_SZ];

0 commit comments

Comments
 (0)