55 lines
2.2 KiB
Rust
55 lines
2.2 KiB
Rust
/// This trait represents the ability to do something useful
|
|
/// with key material, such as logging it to a file for debugging.
|
|
///
|
|
/// Naturally, secrets passed over the interface are *extremely*
|
|
/// sensitive and can break the security of past, present and
|
|
/// future sessions.
|
|
///
|
|
/// You'll likely want some interior mutability in your
|
|
/// implementation to make this useful.
|
|
///
|
|
/// See [`KeyLogFile`](crate::KeyLogFile) that implements the standard
|
|
/// `SSLKEYLOGFILE` environment variable behaviour.
|
|
pub trait KeyLog: Send + Sync {
|
|
/// Log the given `secret`. `client_random` is provided for
|
|
/// session identification. `label` describes precisely what
|
|
/// `secret` means:
|
|
///
|
|
/// - `CLIENT_RANDOM`: `secret` is the master secret for a TLSv1.2 session.
|
|
/// - `CLIENT_EARLY_TRAFFIC_SECRET`: `secret` encrypts early data
|
|
/// transmitted by a client
|
|
/// - `SERVER_HANDSHAKE_TRAFFIC_SECRET`: `secret` encrypts
|
|
/// handshake messages from the server during a TLSv1.3 handshake.
|
|
/// - `CLIENT_HANDSHAKE_TRAFFIC_SECRET`: `secret` encrypts
|
|
/// handshake messages from the client during a TLSv1.3 handshake.
|
|
/// - `SERVER_TRAFFIC_SECRET_0`: `secret` encrypts post-handshake data
|
|
/// from the server in a TLSv1.3 session.
|
|
/// - `CLIENT_TRAFFIC_SECRET_0`: `secret` encrypts post-handshake data
|
|
/// from the client in a TLSv1.3 session.
|
|
/// - `EXPORTER_SECRET`: `secret` is the post-handshake exporter secret
|
|
/// in a TLSv1.3 session.
|
|
///
|
|
/// These strings are selected to match the NSS key log format:
|
|
/// <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format>
|
|
fn log(&self, label: &str, client_random: &[u8], secret: &[u8]);
|
|
|
|
/// Indicates whether the secret with label `label` will be logged.
|
|
///
|
|
/// If `will_log` returns true then `log` will be called with the secret.
|
|
/// Otherwise, `log` will not be called for the secret. This is a
|
|
/// performance optimization.
|
|
fn will_log(&self, _label: &str) -> bool {
|
|
true
|
|
}
|
|
}
|
|
|
|
/// KeyLog that does exactly nothing.
|
|
pub struct NoKeyLog;
|
|
|
|
impl KeyLog for NoKeyLog {
|
|
fn log(&self, _: &str, _: &[u8], _: &[u8]) {}
|
|
#[inline]
|
|
fn will_log(&self, _label: &str) -> bool {
|
|
false
|
|
}
|
|
}
|