File 8787.patch of Package powerdns-dnsdist

Overview Repositories Revisions Requests Users Attributes Meta

File 8787.patch of Package powerdns-dnsdist (Revision b66c5f935839563d14e329e46de09a3c)

Currently displaying revision b66c5f935839563d14e329e46de09a3c , Show latest

From 0a530e9d549bb88ee43ee2770b17c74c68c8db91 Mon Sep 17 00:00:00 2001
From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Thu, 6 Feb 2020 10:06:39 +0100
Subject: [PATCH 1/2] dnsdist: Fix key logging for DNS over TLS

---
 pdns/dnsdistdist/tcpiohandler.cc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index 59017d8f81..71ca39f516 100644
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -42,6 +42,7 @@ class OpenSSLFrontendContext
   OpenSSLTLSTicketKeysRing d_ticketKeys;
   std::map<int, std::string> d_ocspResponses;
   std::unique_ptr<SSL_CTX, void(*)(SSL_CTX*)> d_tlsCtx{nullptr, SSL_CTX_free};
+  std::unique_ptr<FILE, int(*)(FILE*)> d_keyLogFile{nullptr, fclose};
 };
 
 class OpenSSLTLSConnection: public TLSConnection
@@ -303,6 +304,10 @@ class OpenSSLTLSIOCtx: public TLSCtx
 
     libssl_set_error_counters_callback(d_feContext->d_tlsCtx, &fe.d_tlsCounters);
 
+    if (!fe.d_tlsConfig.d_keyLogFile.empty()) {
+      d_feContext->d_keyLogFile = libssl_set_key_log_file(d_feContext->d_tlsCtx, fe.d_tlsConfig.d_keyLogFile);
+    }
+
     try {
       if (fe.d_tlsConfig.d_ticketKeyFile.empty()) {
         handleTicketsKeyRotation(time(nullptr));

From 9b56c83d6fddda67836f02762303e86565708394 Mon Sep 17 00:00:00 2001
From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Thu, 6 Feb 2020 10:07:18 +0100
Subject: [PATCH 2/2] dnsdist: Flush the TLS key material to the file right
 away

This feature is used to debug TLS flows, we don't really care about
the performance in that case and we want to have access to the keys
as soon as possible, without waiting for a buffer to be flushed.
---
 pdns/dnsdistdist/libssl.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pdns/dnsdistdist/libssl.cc b/pdns/dnsdistdist/libssl.cc
index 5da395c37c..6aa91bf038 100644
--- a/pdns/dnsdistdist/libssl.cc
+++ b/pdns/dnsdistdist/libssl.cc
@@ -744,6 +744,7 @@ static void libssl_key_log_file_callback(const SSL* ssl, const char* line)
   }
 
   fprintf(fp, "%s\n", line);
+  fflush(fp);
 }
 #endif /* HAVE_SSL_CTX_SET_KEYLOG_CALLBACK */

Places

File 8787.patch of Package powerdns-dnsdist (Revision b66c5f935839563d14e329e46de09a3c)

Places