-
Notifications
You must be signed in to change notification settings - Fork 986
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* 'admin-ssl_keylog_file' variable has been introduced to allow users to specify the path for the SSLKEYLOG file. The file path can be an absolute path or relative to the ProxySQL data directory. * Assigning an empty path to the 'admin-ssl_keylog_file' variable signifies that the SSLKEYLOG file feature is disabled. * In case an invalid path is provided for the SSLKEYLOG file, ProxySQL will automatically revert to the last valid path value. * 'PROXYSQL FLUSH LOGS' command can be used to rotate SSLKEYLOG file. # Conflicts: # lib/mysql_connection.cpp
- Loading branch information
1 parent
3efa344
commit 8f899e3
Showing
11 changed files
with
185 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| #ifndef __PROXYSQL_SSLKEYLOG_H | ||
| #define __PROXYSQL_SSLKEYLOG_H | ||
| #include "proxysql.h" | ||
|
|
||
| void proxysql_keylog_init(); | ||
| bool proxysql_keylog_open(const char* keylog_file); | ||
| void proxysql_keylog_close(bool lock = true); | ||
| void proxysql_keylog_write_line_callback(const SSL *ssl, const char* line); | ||
|
|
||
| #endif // __PROXYSQL_SSLKEYLOG_H |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| #include "proxysql_sslkeylog.h" | ||
|
|
||
| // https://firefox-source-docs.mozilla.org/security/nss/legacy/key_log_format/index.html | ||
|
|
||
| #define KEYLOG_LABEL_MAXLEN (sizeof("CLIENT_HANDSHAKE_TRAFFIC_SECRET") - 1) | ||
|
|
||
| #define CLIENT_RANDOM_SIZE 32 | ||
|
|
||
| /* | ||
| * The master secret in TLS 1.2 and before is always 48 bytes. In TLS 1.3, the | ||
| * secret size depends on the cipher suite's hash function which is 32 bytes | ||
| * for SHA-256 and 48 bytes for SHA-384. | ||
| */ | ||
| #define SECRET_MAXLEN 48 | ||
|
|
||
| static pthread_rwlock_t keylog_file_rwlock; | ||
|
|
||
| /* The fp for the open SSLKEYLOGFILE, or NULL if not open */ | ||
| static FILE *keylog_file_fp = NULL; | ||
|
|
||
| FILE* proxysql_open_file(const char* file) { | ||
| FILE *file_tmp = fopen(file, "a+"); | ||
| if (file_tmp) { | ||
| if (setvbuf(file_tmp, NULL, _IOLBF, 4096)) { | ||
| fclose(file_tmp); | ||
| file_tmp = NULL; | ||
| goto __exit; | ||
| } | ||
| } | ||
| __exit: | ||
| return file_tmp; | ||
| } | ||
|
|
||
| void proxysql_keylog_init() { | ||
| pthread_rwlock_init(&keylog_file_rwlock, nullptr); | ||
| keylog_file_fp = NULL; | ||
| } | ||
|
|
||
| bool proxysql_keylog_open(const char* keylog_file) | ||
| { | ||
| assert(keylog_file); | ||
| FILE* keylog_file_tmp = proxysql_open_file(keylog_file); | ||
| if (!keylog_file_tmp) return false; | ||
| pthread_rwlock_wrlock(&keylog_file_rwlock); | ||
| proxysql_keylog_close(false); | ||
| keylog_file_fp = keylog_file_tmp; | ||
| pthread_rwlock_unlock(&keylog_file_rwlock); | ||
| return true; | ||
| } | ||
|
|
||
| void proxysql_keylog_close(bool lock) | ||
| { | ||
| if (lock) | ||
| pthread_rwlock_wrlock(&keylog_file_rwlock); | ||
| if(keylog_file_fp) { | ||
| fclose(keylog_file_fp); | ||
| keylog_file_fp = NULL; | ||
| } | ||
| if (lock) | ||
| pthread_rwlock_unlock(&keylog_file_rwlock); | ||
| } | ||
|
|
||
| void proxysql_keylog_write_line_callback(const SSL *ssl, const char *line) | ||
| { | ||
| (void)ssl; // to fix warning | ||
|
|
||
| // checking keylog_file_fp without acquiring a lock is safe, as it is checked again after acquring lock | ||
| if (!keylog_file_fp) return; | ||
|
|
||
| /* The current maximum valid keylog line length LF and NUL is 195. */ | ||
| size_t linelen; | ||
| char buf[256]; | ||
|
|
||
| pthread_rwlock_rdlock(&keylog_file_rwlock); | ||
| if(!keylog_file_fp || !line) { | ||
| goto __exit; | ||
| } | ||
|
|
||
| linelen = strlen(line); | ||
| if(linelen == 0 || linelen > sizeof(buf) - 2) { | ||
| /* Empty line or too big to fit in a LF and NUL. */ | ||
| goto __exit; | ||
| } | ||
|
|
||
| memcpy(buf, line, linelen); | ||
| if(line[linelen - 1] != '\n') { | ||
| buf[linelen++] = '\n'; | ||
| } | ||
| buf[linelen] = '\0'; | ||
|
|
||
| /* as we are using rwlock, using fputs as it's thread-safe*/ | ||
| fputs(buf, keylog_file_fp); | ||
|
|
||
| __exit: | ||
| pthread_rwlock_unlock(&keylog_file_rwlock); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters