sslkeylog.c: support TLS 1.3 and OpenSSL 1.1.1

OpenSSL 1.1.1 adds TLS 1.3 support which uses a new secrets format.
Previously it resulted in garbage keylog files, this has been fixed now.

OpenSSL 1.1.1 also introduces a new API for secrets extraction.
Consumers can use it like this (curl uses this code for example):

    static void keylog_callback(const SSL *ssl, const char *line) {
        /* write line and terminating '\n' */
    }

    {
        SSL_CTX *ctx;
        ...
        SSL_CTX_set_keylog_callback(ctx, keylog_callback);
        SSL *ssl = SSL_new(ctx);
    }

In case you cannot change the source code for an application, you can
use sslkeylog.c again. This will basically perform the above step, set
the key log callback before calling SSL_new.

Since the new OpenSSL 1.1.1 API requires no further interception of
SSL_read and other functions, a new NO_OPENSSL_110_SUPPORT macro was to
avoid intercepting these. Additionally, a NO_OPENSSL_102_SUPPORT macro
avoids the need for OpenSSL development headers.
Caveat: when building with OpenSSL <= 1.0.2, libsslkeylog.so will not be
compatible with runtime OpenSSL 1.1.0. OpenSSL 1.1.1 still works though.

Use of SSL_new and interception via SSL_CTX_set_keylog_callback was
initially proposed by Derick Rethans, thanks for the suggestion!

0 files changed, 0 insertions, 0 deletions