1berry/openssl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updating comments in test recipie

Browse Source 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
This commit is contained in:
Neil Horman 2024-10-09 16:28:02 -04:00 committed by Matt Caswell
parent 5dffe6afb0
commit 5b29c71aa4
4 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
INSTALL.md
View File

@ -1085,8 +1085,9 @@ Build with support for the SSLKEYLOGFILE environment variable
When enabled, setting SSLKEYLOGFILE to a file path records the keys exchanged When enabled, setting SSLKEYLOGFILE to a file path records the keys exchanged
during a TLS handshake for use in analysis tools like wireshark. Note that the during a TLS handshake for use in analysis tools like wireshark. Note that the
use of this mechanism allows for decryption of application payloads found in use of this mechanism allows for decryption of application payloads found in
captured packets using keys from the key log file. See Section 3 of captured packets using keys from the key log file and therefore has significant
[the draft standard for SSLKEYLOGFILE](https://datatracker.ietf.org/doc/draft-thomson-tls-keylogfile/) security consequences. See Section 3 of
[the draft standard for SSLKEYLOGFILE](https://datatracker.ietf.org/doc/draft-ietf-tls-keylogfile/)
### no-ts ### no-ts

6
ssl/ssl_lib.c
View File

@ -3904,7 +3904,7 @@ static long check_keylog_bio_free(BIO *b, int oper, const char *argp,
/** /**
* @brief records ssl secrets to a file * @brief records ssl secrets to a file
*/ */
static void sslkeylogfile_cb(const SSL *ssl, const char *line) static void do_sslkeylogfile(const SSL *ssl, const char *line)
{ {
if (keylog_lock == NULL) if (keylog_lock == NULL)
return; return;
@ -4202,7 +4202,7 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq,
goto out; goto out;
} }
/* Grab out global lock */ /* Grab our global lock */
if (!CRYPTO_THREAD_write_lock(keylog_lock)) { if (!CRYPTO_THREAD_write_lock(keylog_lock)) {
OSSL_TRACE(TLS, "Unable to acquire keylog write lock\n"); OSSL_TRACE(TLS, "Unable to acquire keylog write lock\n");
goto out; goto out;
@ -6909,7 +6909,7 @@ static int nss_keylog_int(const char *prefix,
#ifndef OPENSSL_NO_SSLKEYLOG #ifndef OPENSSL_NO_SSLKEYLOG
if (sctx->do_sslkeylog == 1) if (sctx->do_sslkeylog == 1)
sslkeylogfile_cb(SSL_CONNECTION_GET_SSL(sc), (const char *)out); do_sslkeylogfile(SSL_CONNECTION_GET_SSL(sc), (const char *)out);
#endif #endif
if (sctx->keylog_callback != NULL) if (sctx->keylog_callback != NULL)
sctx->keylog_callback(SSL_CONNECTION_GET_SSL(sc), (const char *)out); sctx->keylog_callback(SSL_CONNECTION_GET_SSL(sc), (const char *)out);

5
ssl/ssl_local.h
View File

@ -1100,10 +1100,7 @@ struct ssl_ctx_st {
SSL_CTX_keylog_cb_func keylog_callback; SSL_CTX_keylog_cb_func keylog_callback;
/* /*
* Private callback for internal key logging based on SSLKEYLOG env * Private flag for internal key logging based on SSLKEYLOG env
* We don't want to create a chaining mechanism as we're never sure
* if the application wants to set an additional callback or override
* the one set via SSLKEYLOGFILE, so we just keep them separate
*/ */
# ifndef OPENSSL_NO_SSLKEYLOG # ifndef OPENSSL_NO_SSLKEYLOG
uint32_t do_sslkeylog; uint32_t do_sslkeylog;

5
test/recipes/70-test_sslkeylogfile.t
View File

@ -36,8 +36,9 @@ my @s_server_cmd = ("s_server", "-accept", "0", "-naccept", "1",
"-cert", $server_pem, "-key", $server_key); "-cert", $server_pem, "-key", $server_key);
my $s_server_pid = open3(my $s_server_i, my $s_server_o, my $s_server_e, $shlib_wrap, $apps_openssl, @s_server_cmd); my $s_server_pid = open3(my $s_server_i, my $s_server_o, my $s_server_e, $shlib_wrap, $apps_openssl, @s_server_cmd);
# ACCEPT 0.0.0.0:45921 # expected outputs from the server
# ACCEPT [::]:45921 # ACCEPT 0.0.0.0:<port>
# ACCEPT [::]:<port>
my $port = "0"; my $port = "0";
# Figure out what port its listening on # Figure out what port its listening on
while (<$s_server_o>) { while (<$s_server_o>) {