Skip to content

Commit c8e5111

Browse files
SparkiDevSparkiDev
authored
Merge pull request #7372 from julek-wolfssl/zd/17435
Add secret logging callback to TLS <= 1.2
2 parents 5ee0e34 + c62faa0 commit c8e5111

6 files changed

Lines changed: 91 additions & 40 deletions

File tree

‎src/internal.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7583,6 +7583,9 @@ int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
75837583
defined(WOLFSSL_SSLKEYLOGFILE) && defined(WOLFSSL_TLS13)
75847584
(void)wolfSSL_set_tls13_secret_cb(ssl, tls13ShowSecrets, NULL);
75857585
#endif
7586+
#if defined(HAVE_SECRET_CALLBACK) && defined(SHOW_SECRETS)
7587+
(void)wolfSSL_set_secret_cb(ssl, tlsShowSecrets, NULL);
7588+
#endif
75867589
#ifdef WOLFSSL_DUAL_ALG_CERTS
75877590
ssl->sigSpec = ctx->sigSpec;
75887591
ssl->sigSpecSz = ctx->sigSpecSz;

‎src/ssl.c‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8236,6 +8236,75 @@ int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb cb, void* ctx)
82368236
return WOLFSSL_SUCCESS;
82378237
}
82388238

8239+
int wolfSSL_set_secret_cb(WOLFSSL* ssl, TlsSecretCb cb, void* ctx)
8240+
{
8241+
WOLFSSL_ENTER("wolfSSL_set_secret_cb");
8242+
if (ssl == NULL)
8243+
return WOLFSSL_FATAL_ERROR;
8244+
8245+
ssl->tlsSecretCb = cb;
8246+
ssl->tlsSecretCtx = ctx;
8247+
8248+
return WOLFSSL_SUCCESS;
8249+
}
8250+
8251+
#ifdef SHOW_SECRETS
8252+
int tlsShowSecrets(WOLFSSL* ssl, void* secret, int secretSz,
8253+
void* ctx)
8254+
{
8255+
/* Wireshark Pre-Master-Secret Format:
8256+
* CLIENT_RANDOM <clientrandom> <mastersecret>
8257+
*/
8258+
const char* CLIENT_RANDOM_LABEL = "CLIENT_RANDOM";
8259+
int i, pmsPos = 0;
8260+
char pmsBuf[13 + 1 + 64 + 1 + 96 + 1 + 1];
8261+
byte clientRandom[RAN_LEN];
8262+
int clientRandomSz;
8263+
8264+
(void)ctx;
8265+
8266+
clientRandomSz = (int)wolfSSL_get_client_random(ssl, clientRandom,
8267+
sizeof(clientRandom));
8268+
8269+
if (clientRandomSz <= 0) {
8270+
printf("Error getting server random %d\n", clientRandomSz);
8271+
return BAD_FUNC_ARG;
8272+
}
8273+
8274+
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, "%s ",
8275+
CLIENT_RANDOM_LABEL);
8276+
pmsPos += XSTRLEN(CLIENT_RANDOM_LABEL) + 1;
8277+
for (i = 0; i < clientRandomSz; i++) {
8278+
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, "%02x",
8279+
clientRandom[i]);
8280+
pmsPos += 2;
8281+
}
8282+
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, " ");
8283+
pmsPos += 1;
8284+
for (i = 0; i < secretSz; i++) {
8285+
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, "%02x",
8286+
((byte*)secret)[i]);
8287+
pmsPos += 2;
8288+
}
8289+
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, "\n");
8290+
pmsPos += 1;
8291+
8292+
/* print master secret */
8293+
puts(pmsBuf);
8294+
8295+
#if !defined(NO_FILESYSTEM) && defined(WOLFSSL_SSLKEYLOGFILE)
8296+
{
8297+
FILE* f = XFOPEN(WOLFSSL_SSLKEYLOGFILE_OUTPUT, "a");
8298+
if (f != XBADFILE) {
8299+
XFWRITE(pmsBuf, 1, pmsPos, f);
8300+
XFCLOSE(f);
8301+
}
8302+
}
8303+
#endif
8304+
return 0;
8305+
}
8306+
#endif /* SHOW_SECRETS */
8307+
82398308
#endif
82408309

82418310

‎src/tls.c‎

Lines changed: 6 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -586,47 +586,13 @@ int MakeTlsMasterSecret(WOLFSSL* ssl)
586586
ssl->specs.mac_algorithm, ssl->heap, ssl->devId);
587587
}
588588
}
589+
#ifdef HAVE_SECRET_CALLBACK
590+
if (ret == 0 && ssl->tlsSecretCb != NULL) {
591+
ret = ssl->tlsSecretCb(ssl, ssl->arrays->masterSecret,
592+
SECRET_LEN, ssl->tlsSecretCtx);
593+
}
594+
#endif /* HAVE_SECRET_CALLBACK */
589595
if (ret == 0) {
590-
#ifdef SHOW_SECRETS
591-
/* Wireshark Pre-Master-Secret Format:
592-
* CLIENT_RANDOM <clientrandom> <mastersecret>
593-
*/
594-
const char* CLIENT_RANDOM_LABEL = "CLIENT_RANDOM";
595-
int i, pmsPos = 0;
596-
char pmsBuf[13 + 1 + 64 + 1 + 96 + 1 + 1];
597-
598-
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, "%s ",
599-
CLIENT_RANDOM_LABEL);
600-
pmsPos += XSTRLEN(CLIENT_RANDOM_LABEL) + 1;
601-
for (i = 0; i < RAN_LEN; i++) {
602-
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, "%02x",
603-
ssl->arrays->clientRandom[i]);
604-
pmsPos += 2;
605-
}
606-
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, " ");
607-
pmsPos += 1;
608-
for (i = 0; i < SECRET_LEN; i++) {
609-
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, "%02x",
610-
ssl->arrays->masterSecret[i]);
611-
pmsPos += 2;
612-
}
613-
XSNPRINTF(&pmsBuf[pmsPos], sizeof(pmsBuf) - pmsPos, "\n");
614-
pmsPos += 1;
615-
616-
/* print master secret */
617-
puts(pmsBuf);
618-
619-
#if !defined(NO_FILESYSTEM) && defined(WOLFSSL_SSLKEYLOGFILE)
620-
{
621-
FILE* f = XFOPEN(WOLFSSL_SSLKEYLOGFILE_OUTPUT, "a");
622-
if (f != XBADFILE) {
623-
XFWRITE(pmsBuf, 1, pmsPos, f);
624-
XFCLOSE(f);
625-
}
626-
}
627-
#endif
628-
#endif /* SHOW_SECRETS */
629-
630596
ret = DeriveTlsKeys(ssl);
631597
}
632598

‎src/tls13.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14776,6 +14776,7 @@ int tls13ShowSecrets(WOLFSSL* ssl, int id, const unsigned char* secret,
1477614776

1477714777
if (clientRandomSz <= 0) {
1477814778
printf("Error getting server random %d\n", clientRandomSz);
14779+
return BAD_FUNC_ARG;
1477914780
}
1478014781

1478114782
#if 0

‎wolfssl/internal.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5869,6 +5869,8 @@ struct WOLFSSL {
58695869
#ifdef HAVE_SECRET_CALLBACK
58705870
SessionSecretCb sessionSecretCb;
58715871
void* sessionSecretCtx;
5872+
TlsSecretCb tlsSecretCb;
5873+
void* tlsSecretCtx;
58725874
#ifdef WOLFSSL_TLS13
58735875
Tls13SecretCb tls13SecretCb;
58745876
void* tls13SecretCtx;
@@ -6749,6 +6751,11 @@ WOLFSSL_LOCAL int tls13ShowSecrets(WOLFSSL* ssl, int id, const unsigned char* se
67496751
int secretSz, void* ctx);
67506752
#endif
67516753

6754+
#if defined(SHOW_SECRETS)
6755+
WOLFSSL_LOCAL int tlsShowSecrets(WOLFSSL* ssl, void* secret,
6756+
int secretSz, void* ctx);
6757+
#endif
6758+
67526759
/* Optional Pre-Master-Secret logging for Wireshark */
67536760
#if !defined(NO_FILESYSTEM) && defined(WOLFSSL_SSLKEYLOGFILE)
67546761
#ifndef WOLFSSL_SSLKEYLOGFILE_OUTPUT

‎wolfssl/ssl.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1365,8 +1365,13 @@ WOLFSSL_ABI WOLFSSL_API long wolfSSL_CTX_set_session_cache_mode(WOLFSSL_CTX* ctx
13651365
#ifdef HAVE_SECRET_CALLBACK
13661366
typedef int (*SessionSecretCb)(WOLFSSL* ssl, void* secret, int* secretSz,
13671367
void* ctx);
1368+
/* This callback is used to set the master secret during resumption */
13681369
WOLFSSL_API int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb,
13691370
void*);
1371+
typedef int (*TlsSecretCb)(WOLFSSL* ssl, void* secret, int secretSz,
1372+
void* ctx);
1373+
/* This callback is used to log the secret for TLS <= 1.2 */
1374+
WOLFSSL_API int wolfSSL_set_secret_cb(WOLFSSL* ssl, TlsSecretCb cb, void* ctx);
13701375
#ifdef WOLFSSL_TLS13
13711376
typedef int (*Tls13SecretCb)(WOLFSSL* ssl, int id, const unsigned char* secret,
13721377
int secretSz, void* ctx);

0 commit comments

Comments
 (0)