expose ACLK SSL KeyLog interface for developers (#14109)
* add possibility to decypt trafic for developers for debugging purposes * requires netdata to be explicitly built with this feature enabled
Timotej S committed
Dec 14, 2022 at 10:31 UTC
5847aeadcce2ea03dba23fc7baabcd4d04dfecb9
3 files changed
+52
Makefile.am
+4
@@ -740,6 +740,10 @@ libmqttwebsockets_a_SOURCES = \
740
741
libmqttwebsockets_a_CFLAGS = $(CFLAGS) -DMQTT_WSS_CUSTOM_ALLOC -DRBUF_CUSTOM_MALLOC -I$(srcdir)/aclk/helpers -I$(srcdir)/mqtt_websockets/c_rhash/include
742
743
+if MQTT_WSS_DEBUG
744
+libmqttwebsockets_a_CFLAGS += -DMQTT_WSS_DEBUG
745
+endif
746
+
747
mqtt_websockets/src/mqtt_wss_client.$(OBJEXT) : CFLAGS += -Wno-unused-result
748
749
ACLK_PROTO_DEFINITIONS = \
aclk/aclk.c
+37
@@ -61,6 +61,26 @@ struct aclk_shared_state aclk_shared_state = {
61
.mqtt_shutdown_msg_rcvd = 0
62
};
63
64
+#ifdef MQTT_WSS_DEBUG
65
+#include <openssl/ssl.h>
66
+#define DEFAULT_SSKEYLOGFILE_NAME "SSLKEYLOGFILE"
67
+const char *ssl_log_filename = NULL;
68
+FILE *ssl_log_file = NULL;
69
+static void aclk_ssl_keylog_cb(const SSL *ssl, const char *line)
70
+{
71
+ (void)ssl;
72
+ if (!ssl_log_file)
73
+ ssl_log_file = fopen(ssl_log_filename, "a");
74
+ if (!ssl_log_file) {
75
+ error("Couldn't open ssl_log file (%s) for append.", ssl_log_filename);
76
+ return;
77
+ }
78
+ fputs(line, ssl_log_file);
79
+ putc('\n', ssl_log_file);
80
+ fflush(ssl_log_file);
81
+}
82
+#endif
83
+
84
#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
85
OSSL_DECODER_CTX *aclk_dctx = NULL;
86
EVP_PKEY *aclk_private_key = NULL;
@@ -681,6 +701,18 @@ void *aclk_main(void *ptr)
701
goto exit;
702
}
703
704
+#ifdef MQTT_WSS_DEBUG
705
+ size_t default_ssl_log_filename_size = strlen(netdata_configured_log_dir) + strlen(DEFAULT_SSKEYLOGFILE_NAME) + 2;
706
+ char *default_ssl_log_filename = mallocz(default_ssl_log_filename_size);
707
+ snprintfz(default_ssl_log_filename, default_ssl_log_filename_size, "%s/%s", netdata_configured_log_dir, DEFAULT_SSKEYLOGFILE_NAME);
708
+ ssl_log_filename = config_get(CONFIG_SECTION_CLOUD, "aclk ssl keylog file", default_ssl_log_filename);
709
+ freez(default_ssl_log_filename);
710
+ if (ssl_log_filename) {
711
+ error_report("SSLKEYLOGFILE active (path:\"%s\")!", ssl_log_filename);
712
+ mqtt_wss_set_SSL_CTX_keylog_cb(mqttwss_client, aclk_ssl_keylog_cb);
713
+ }
714
+#endif
715
+
716
// Enable MQTT buffer growth if necessary
717
// e.g. old cloud architecture clients with huge nodes
718
// that send JSON payloads of 10 MB as single messages
@@ -717,6 +749,11 @@ void *aclk_main(void *ptr)
749
750
aclk_graceful_disconnect(mqttwss_client);
751
752
+#ifdef MQTT_WSS_DEBUG
753
+ if (ssl_log_file)
754
+ fclose(ssl_log_file);
755
+#endif
756
+
757
exit_full:
758
// Tear Down
759
QUERY_THREAD_WAKEUP_ALL;
configure.ac
+11
@@ -213,6 +213,12 @@ AC_ARG_ENABLE(
213
[enable_ml_tests="yes"],
214
[enable_ml_tests="no"]
215
)
216
+AC_ARG_ENABLE(
217
+ [aclk_ssl_debug],
218
+ [AS_HELP_STRING([--enable-aclk-ssl-debug], [Enables possibility for SSL key logging @<:@default no@:>@])],
219
+ [aclk_ssl_debug="yes"],
220
+ [aclk_ssl_debug="no"]
221
+)
222
223
# -----------------------------------------------------------------------------
224
# Enforce building with C99, bail early if we can't.
@@ -713,6 +719,11 @@ if test "${with_bundled_protobuf}" != "no"; then
719
fi
720
fi
721
722
+AM_CONDITIONAL([MQTT_WSS_DEBUG], [test "${aclk_ssl_debug}" = "yes"])
723
+if test "${aclk_ssl_debug}" = "yes"; then
724
+ AC_DEFINE([MQTT_WSS_DEBUG], [1], [ACLK SSL allow debugging])
725
+fi
726
+
727
if test "${with_bundled_protobuf}" != "yes"; then
728
PKG_CHECK_MODULES(
729
[PROTOBUF],