Skip to content

Commit 38b662c

Browse files
bneradtbneradt
authored
Fix test_QUIC unit test builds. (#8678) (#8691)
The test_QUIC unit tests were failing to build because they didn't link against a file with the TLSKeyLogger definition. This fixes the undefined references by breaking out TLSKeyLogger into a separate object that the unit tests can link with. (cherry picked from commit 2d70a00)
1 parent 1a37ae9 commit 38b662c

File tree

10 files changed

+235
-175
lines changed

10 files changed

+235
-175
lines changed

‎iocore/net/Makefile.am‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ libinknet_a_SOURCES = \
157157
P_SSLUtils.h \
158158
P_SSLClientCoordinator.h \
159159
P_SSLClientUtils.h \
160+
P_TLSKeyLogger.h \
160161
P_OCSPStapling.h \
161162
P_UDPConnection.h \
162163
P_UDPIOEvent.h \
@@ -191,6 +192,7 @@ libinknet_a_SOURCES = \
191192
SSLUtils.cc \
192193
OCSPStapling.cc \
193194
TLSBasicSupport.cc \
195+
TLSKeyLogger.cc \
194196
TLSSessionResumptionSupport.cc \
195197
TLSSNISupport.cc \
196198
UDPIOEvent.cc \

‎iocore/net/P_SSLUtils.h‎

Lines changed: 0 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,7 @@
3535
#include "P_SSLCertLookup.h"
3636

3737
#include <map>
38-
#include <mutex>
3938
#include <set>
40-
#include <shared_mutex>
4139

4240
struct SSLConfigParams;
4341
class SSLNetVConnection;
@@ -64,105 +62,6 @@ struct SSLLoadingContext {
6462
explicit SSLLoadingContext(SSL_CTX *c, SSLCertContextType ctx_type) : ctx(c), ctx_type(ctx_type) {}
6563
};
6664

67-
/** A class for handling TLS secrets logging. */
68-
class TLSKeyLogger
69-
{
70-
public:
71-
TLSKeyLogger(const TLSKeyLogger &) = delete;
72-
TLSKeyLogger &operator=(const TLSKeyLogger &) = delete;
73-
74-
~TLSKeyLogger()
75-
{
76-
std::unique_lock lock{_mutex};
77-
close_keylog_file();
78-
}
79-
80-
/** A callback for TLS secret key logging.
81-
*
82-
* This is the callback registered with OpenSSL's SSL_CTX_set_keylog_callback
83-
* to log TLS secrets if the user enabled that feature. For more information
84-
* about this callback, see OpenSSL's documentation of
85-
* SSL_CTX_set_keylog_callback.
86-
*
87-
* @param[in] ssl The SSL object associated with the connection.
88-
* @param[in] line The line to place in the keylog file.
89-
*/
90-
static void
91-
ssl_keylog_cb(const SSL *ssl, const char *line)
92-
{
93-
instance().log(line);
94-
}
95-
96-
/** Return whether TLS key logging is enabled.
97-
*
98-
* @return True if TLS session key logging is enabled, false otherwise.
99-
*/
100-
static bool
101-
is_enabled()
102-
{
103-
return instance()._fd >= 0;
104-
}
105-
106-
/** Enable keylogging.
107-
*
108-
* @param[in] keylog_file The path to the file to log TLS secrets to.
109-
*/
110-
static void
111-
enable_keylogging(const char *keylog_file)
112-
{
113-
instance().enable_keylogging_internal(keylog_file);
114-
}
115-
116-
/** Disable TLS secrets logging. */
117-
static void
118-
disable_keylogging()
119-
{
120-
instance().disable_keylogging_internal();
121-
}
122-
123-
private:
124-
TLSKeyLogger() = default;
125-
126-
/** Return the TLSKeyLogger singleton.
127-
*
128-
* We use a getter rather than a class static singleton member so that the
129-
* construction of the singleton delayed until after TLS configuration is
130-
* processed.
131-
*/
132-
static TLSKeyLogger &
133-
instance()
134-
{
135-
static TLSKeyLogger instance;
136-
return instance;
137-
}
138-
139-
/** Close the file descriptor for the key log file.
140-
*
141-
* @note This assumes that a unique lock has been acquired for _mutex.
142-
*/
143-
void close_keylog_file();
144-
145-
/** A TLS secret line to log to the keylog file.
146-
*
147-
* @param[in] line A line to log to the keylog file.
148-
*/
149-
void log(const char *line);
150-
151-
/** Enable TLS keylogging in the instance singleton. */
152-
void enable_keylogging_internal(const char *keylog_file);
153-
154-
/** Disable TLS keylogging in the instance singleton. */
155-
void disable_keylogging_internal();
156-
157-
private:
158-
/** A file descriptor for the log file receiving the TLS secrets. */
159-
int _fd = -1;
160-
161-
/** A mutex to coordinate dynamically changing TLS logging config changes and
162-
* logging to the TLS log file. */
163-
std::shared_mutex _mutex;
164-
};
165-
16665
/**
16766
@brief Load SSL certificates from ssl_multicert.config and setup SSLCertLookup for SSLCertificateConfig
16867
*/

‎iocore/net/P_TLSKeyLogger.h‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
/**
2+
3+
@section license License
4+
5+
Licensed to the Apache Software Foundation (ASF) under one
6+
or more contributor license agreements. See the NOTICE file
7+
distributed with this work for additional information
8+
regarding copyright ownership. The ASF licenses this file
9+
to you under the Apache License, Version 2.0 (the
10+
"License"); you may not use this file except in compliance
11+
with the License. You may obtain a copy of the License at
12+
13+
http://www.apache.org/licenses/LICENSE-2.0
14+
15+
Unless required by applicable law or agreed to in writing, software
16+
distributed under the License is distributed on an "AS IS" BASIS,
17+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18+
See the License for the specific language governing permissions and
19+
limitations under the License.
20+
*/
21+
22+
#pragma once
23+
24+
#ifndef OPENSSL_IS_BORINGSSL
25+
#include <openssl/opensslconf.h>
26+
#endif
27+
#include <openssl/ssl.h>
28+
29+
#include <memory>
30+
#include <shared_mutex>
31+
32+
/** A class for handling TLS secrets logging. */
33+
class TLSKeyLogger
34+
{
35+
public:
36+
TLSKeyLogger(const TLSKeyLogger &) = delete;
37+
TLSKeyLogger &operator=(const TLSKeyLogger &) = delete;
38+
39+
~TLSKeyLogger()
40+
{
41+
std::unique_lock lock{_mutex};
42+
close_keylog_file();
43+
}
44+
45+
/** A callback for TLS secret key logging.
46+
*
47+
* This is the callback registered with OpenSSL's SSL_CTX_set_keylog_callback
48+
* to log TLS secrets if the user enabled that feature. For more information
49+
* about this callback, see OpenSSL's documentation of
50+
* SSL_CTX_set_keylog_callback.
51+
*
52+
* @param[in] ssl The SSL object associated with the connection.
53+
* @param[in] line The line to place in the keylog file.
54+
*/
55+
static void
56+
ssl_keylog_cb(const SSL *ssl, const char *line)
57+
{
58+
instance().log(line);
59+
}
60+
61+
/** Return whether TLS key logging is enabled.
62+
*
63+
* @return True if TLS session key logging is enabled, false otherwise.
64+
*/
65+
static bool
66+
is_enabled()
67+
{
68+
return instance()._fd >= 0;
69+
}
70+
71+
/** Enable keylogging.
72+
*
73+
* @param[in] keylog_file The path to the file to log TLS secrets to.
74+
*/
75+
static void
76+
enable_keylogging(const char *keylog_file)
77+
{
78+
instance().enable_keylogging_internal(keylog_file);
79+
}
80+
81+
/** Disable TLS secrets logging. */
82+
static void
83+
disable_keylogging()
84+
{
85+
instance().disable_keylogging_internal();
86+
}
87+
88+
private:
89+
TLSKeyLogger() = default;
90+
91+
/** Return the TLSKeyLogger singleton.
92+
*
93+
* We use a getter rather than a class static singleton member so that the
94+
* construction of the singleton delayed until after TLS configuration is
95+
* processed.
96+
*/
97+
static TLSKeyLogger &
98+
instance()
99+
{
100+
static TLSKeyLogger instance;
101+
return instance;
102+
}
103+
104+
/** Close the file descriptor for the key log file.
105+
*
106+
* @note This assumes that a unique lock has been acquired for _mutex.
107+
*/
108+
void close_keylog_file();
109+
110+
/** A TLS secret line to log to the keylog file.
111+
*
112+
* @param[in] line A line to log to the keylog file.
113+
*/
114+
void log(const char *line);
115+
116+
/** Enable TLS keylogging in the instance singleton. */
117+
void enable_keylogging_internal(const char *keylog_file);
118+
119+
/** Disable TLS keylogging in the instance singleton. */
120+
void disable_keylogging_internal();
121+
122+
private:
123+
/** A file descriptor for the log file receiving the TLS secrets. */
124+
int _fd = -1;
125+
126+
/** A mutex to coordinate dynamically changing TLS logging config changes and
127+
* logging to the TLS log file. */
128+
std::shared_mutex _mutex;
129+
};

‎iocore/net/SSLClientUtils.cc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
#include "P_SSLClientUtils.h"
3030
#include "P_SSLConfig.h"
3131
#include "P_SSLNetVConnection.h"
32+
#include "P_TLSKeyLogger.h"
3233
#include "YamlSNIConfig.h"
3334
#include "SSLDiags.h"
3435
#include "SSLSessionCache.h"

‎iocore/net/SSLConfig.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@
5050
#include "P_SSLSNI.h"
5151
#include "P_SSLCertLookup.h"
5252
#include "P_SSLSNI.h"
53-
#include "P_SSLUtils.h"
53+
#include "P_TLSKeyLogger.h"
5454
#include "SSLDiags.h"
5555
#include "SSLSessionCache.h"
5656
#include "SSLSessionTicket.h"

‎iocore/net/SSLUtils.cc‎

Lines changed: 1 addition & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
#include "P_OCSPStapling.h"
3939
#include "P_SSLSNI.h"
4040
#include "P_SSLConfig.h"
41+
#include "P_TLSKeyLogger.h"
4142
#include "BoringSSLUtils.h"
4243
#include "ProxyProtocol.h"
4344
#include "SSLSessionCache.h"
@@ -46,11 +47,7 @@
4647
#include "SSLDiags.h"
4748
#include "SSLStats.h"
4849

49-
#include <fcntl.h>
5050
#include <string>
51-
#include <sys/stat.h>
52-
#include <sys/types.h>
53-
#include <sys/uio.h>
5451
#include <unistd.h>
5552
#include <termios.h>
5653
#include <vector>
@@ -104,74 +101,6 @@ static int ssl_vc_index = -1;
104101
static ink_mutex *mutex_buf = nullptr;
105102
static bool open_ssl_initialized = false;
106103

107-
// The caller of this function is responsible to acquire a unique_lock for
108-
// _mutex.
109-
void
110-
TLSKeyLogger::close_keylog_file()
111-
{
112-
if (_fd == -1) {
113-
return;
114-
}
115-
if (close(_fd) == -1) {
116-
Error("Could not close keylog file: %s", strerror(errno));
117-
}
118-
_fd = -1;
119-
}
120-
121-
void
122-
TLSKeyLogger::enable_keylogging_internal(const char *keylog_file)
123-
{
124-
#if TS_HAS_TLS_KEYLOGGING
125-
Debug("ssl_keylog", "Enabling TLS key logging to: %s.", keylog_file);
126-
std::unique_lock lock{_mutex};
127-
if (keylog_file == nullptr) {
128-
close_keylog_file();
129-
Debug("ssl_keylog", "Received a nullptr for keylog_file: disabling keylogging.");
130-
return;
131-
}
132-
133-
_fd = open(keylog_file, O_WRONLY | O_APPEND | O_CREAT, S_IWUSR | S_IRUSR);
134-
if (_fd == -1) {
135-
Error("Could not open keylog file %s: %s", keylog_file, strerror(errno));
136-
return;
137-
}
138-
Note("Opened %s for TLS key logging.", keylog_file);
139-
#else
140-
Error("TLS keylogging is configured, but Traffic Server is not compiled with a version of OpenSSL that supports it.");
141-
return;
142-
#endif /* TS_HAS_TLS_KEYLOGGING */
143-
}
144-
145-
void
146-
TLSKeyLogger::disable_keylogging_internal()
147-
{
148-
std::unique_lock lock{_mutex};
149-
if (is_enabled()) {
150-
Note("Disabling TLS key logging.");
151-
}
152-
close_keylog_file();
153-
Debug("ssl_keylog", "TLS keylogging is disabled.");
154-
}
155-
156-
void
157-
TLSKeyLogger::log(const char *line)
158-
{
159-
std::shared_lock lock{_mutex};
160-
if (!is_enabled()) {
161-
return;
162-
}
163-
164-
// writev() is guaranteed to be thread safe.
165-
struct iovec vector[2];
166-
vector[0].iov_base = const_cast<void *>(reinterpret_cast<const void *>(line));
167-
vector[0].iov_len = strlen(line);
168-
vector[1].iov_base = const_cast<void *>(reinterpret_cast<const void *>("\n"));
169-
vector[1].iov_len = 1;
170-
if (writev(_fd, vector, 2) <= 0) {
171-
Error("Could not write TLS session key to key log file: %s", strerror(errno));
172-
}
173-
}
174-
175104
/* Using pthread thread ID and mutex functions directly, instead of
176105
* ATS this_ethread / ProxyMutex, so that other linked libraries
177106
* may use pthreads and openssl without confusing us here. (TS-2271).

0 commit comments

Comments
 (0)