From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Sun, 30 Dec 2018 22:51:18 +0000 (+0000)
Subject: OpenSSL: Debug output TLS 1.3 keying
X-Git-Tag: exim-4.93-RC0~306
X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=8a40db1c6153e108913c6308a95eb71725bddde3;p=exim.git

OpenSSL: Debug output TLS 1.3 keying

(cherry picked from commit 3c1f3b85aa4139ba062268ca958bab0dd0d64140)
---

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 01c3a129e..9e91192cf 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -8,7 +8,8 @@ options, and new features, see the NewStuff file next to this ChangeLog.
 Exim version 4.93
 -----------------
 
-     (none yet)
+JH/01 OpenSSL: With debug enabled output keying information sufficient, server
+      side, to decode a TLS 1.3 packet capture.
 
 
 Exim version 4.92
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index f04cbf813..045e30a85 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -91,6 +91,12 @@ change this guard and punt the issue for a while longer. */
 # endif
 #endif
 
+#ifndef LIBRESSL_VERSION_NUMBER
+# if OPENSSL_VERSION_NUMBER >= 0x010101000L
+#  define OPENSSL_HAVE_KEYLOG_CB
+# endif
+#endif
+
 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
 # define DISABLE_OCSP
@@ -774,6 +780,12 @@ DEBUG(D_tls)
   }
 }
 
+static void
+keylog_callback(const SSL *ssl, const char *line)
+{
+DEBUG(D_tls) debug_printf("%.200s\n", line);
+}
+
 
 
 /*************************************************
@@ -1768,6 +1780,9 @@ if (!RAND_status())
 level. */
 
 DEBUG(D_tls) SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
+#ifdef OPENSSL_HAVE_KEYLOG_CB
+DEBUG(D_tls) SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
+#endif
 
 /* Automatically re-try reads/writes after renegotiation. */
 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);