Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SSLKEYLOGFILE support with QUIC #238

Open
Aposhian opened this issue Jul 31, 2024 · 2 comments
Open

Add SSLKEYLOGFILE support with QUIC #238

Aposhian opened this issue Jul 31, 2024 · 2 comments
Labels
enhancement New feature or request

Comments

@Aposhian
Copy link
Contributor

Aposhian commented Jul 31, 2024

Is your feature request related to a problem? Please describe.
I would like to debug QUIC packet captures using Wireshark when using a client based on NanoSDK, but I need a keylogfile to do that.

Describe the solution you'd like
When a build option is enabled (off by default), then when the environment variable SSLKEYLOGFILE is set to a valid path, write the msquic tls secrets to that file, using msquic interop as an example.

Describe alternatives you've considered
Provide a NanoSDK API for retrieving the secrets struct which can then be written to file (less ideal I think).

Additional context
I have already gotten a prototype version of this to work, and can PR something based on that. But it may not be the right way to do it. What I did discover is that the setup for TLS secrets logging has to go in the middle of the quic_connect_ipv4 function, since it has to happen after the connection is opened but before it is started.

@JaylinYu JaylinYu added the enhancement New feature or request label Aug 2, 2024
@bruno-silva-dtx
Copy link

bruno-silva-dtx commented Sep 25, 2024

Hello, @Aposhian
Sorry to bother you, but I'm trying to do just that, get the connection secret and open it in Wireshark. I'm using MQTT over QUIC, that is, I'm connecting to a bocker, all of this with docker containers, what I've been trying to do is the following:
export SSLKEYLOGFILE=/tmp/SSLKEYLOGFILE.log

but without results you capture nothing. Now I'm running out of ideas on how to capture.

@Aposhian
Copy link
Contributor Author

@bruno-silva-dtx are you using the version on my fork that I linked to? The upstream version of NanoSDK and/or msquic does not read the SSLKEYLOGFILE environment variable, but my fork does, but it does so a sort of hacky way and you will need to edit the tls config to point to your own certs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants