client/server: support for KeyLog trait, SSLKEYLOGFILE
For debugging purposes it's quite helpful to be able to log session secrets to a file specified by the SSLKEYLOGFILE env var, for example to use with Wireshark to decrypt session traffic.
This commit adds two methods to rustls-ffi for both client and server configurations to facilitate this:
-
rustls_server_config_builder_set_key_log_file()andrustls_client_config_builder_set_key_log_file()enable using the RustlsKeyLogFileimplementation of theKeyLogtrait. This option simply honours theSSLKEYLOGFILEenv var and spits out a NSS formatted key log file appropriate for use with Wireshark and other tools that support this format. -
rustls_server_config_builder_set_key_log()andrustls_client_config_builder_set_key_log()enable providing C callbacks that will be invoked to decide which secrets are logged, and to do the logging. This allows for fine-grained control over how secrets are logged and may be more appropriate for applications that already handle this task for other TLS backends (e.g. curl).
The client and server examples are updated to optionally use these new features. If the SSLKEYLOG env. var is set, both will use the _set_key_log_file() fns to set up the standard file based key logging. If the STDERRKEYLOG env var is set then both will use the _set_key_log() fns to set up custom callbacks that will print the hex-encoded secret data to stderr as a simple demonstration.
See the upstream rustls::KeyLog trait and rustls::KeyLogFile implementation for more detail.