Skip to content

bugfix: lua_ssl_key_log did not take effect with BoringSSL. #417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
h2zi wants to merge 1 commit into
base: master
Choose a base branch
from
Open

bugfix: lua_ssl_key_log did not take effect with BoringSSL. #417

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion src/ngx_stream_lua_module.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,12 @@
#include "ngx_stream_lua_prereadby.h"


#if !defined(OPENSSL_VERSION_NUMBER) || OPENSSL_VERSION_NUMBER > 0x101010afL
/*
* BoringSSL always reports OPENSSL_VERSION_NUMBER as 1.1.1, but does provide
* SSL_CTX_set_keylog_callback()
*/
#if !defined(OPENSSL_VERSION_NUMBER) || OPENSSL_VERSION_NUMBER > 0x101010afL \
|| defined(OPENSSL_IS_BORINGSSL)
#define HAVE_SSL_KEY_LOG 1
#endif

Expand Down
21 changes: 17 additions & 4 deletions t/129-ssl-socket.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3115,8 +3115,21 @@ handshake rejected while SSL handshaking
end

local key_log = f:read("*a")
ngx.say(key_log)
f:close()

-- the log is appended to on each request, so keep the secrets
-- of the last handshake only, identified by its client random;
-- SSL libraries log them in different orders
local random = key_log:match("(%x+) %x+\n$")
local lines = {}
for line in key_log:gmatch("[^\n]+") do
if line:find(" " .. random .. " ", 1, true) then
lines[#lines + 1] = line
end
end

table.sort(lines)
ngx.say(table.concat(lines, "\n"))
end -- do
collectgarbage()
}
Expand All @@ -3127,11 +3140,11 @@ ssl handshake: userdata
sent stream request: 53 bytes.
received: HTTP/1.1 200 OK
close: 1 nil
SERVER_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+
EXPORTER_SECRET [0-9a-z\s]+
SERVER_TRAFFIC_SECRET_0 [0-9a-z\s]+
CLIENT_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+
CLIENT_TRAFFIC_SECRET_0 [0-9a-z\s]+
EXPORTER_SECRET [0-9a-z\s]+
SERVER_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+
SERVER_TRAFFIC_SECRET_0 [0-9a-z\s]+

--- log_level: debug
--- grep_error_log eval: qr/lua ssl (?:set|save|free) session: [0-9A-F]+/
Expand Down
Loading