append entries into SSL key log file (#31371)

This corrects an issue where a developer is unable to decrypt live TLS captures
in Wireshark. Instead the user must take multiple steps to be able to view
decrypted TLS application data, including saving a capture on disk and
reloading the capture.

By appending rather than overwriting the TLS key log file, it is possible
to configure Wireshark TLS (Pre)-Master-Secret log filename before the
capture is started (pointing to and empty or existing file). Then, when a
packet capture is started, decryted data is available immediately. Further,
if the capture is restarted, no keys are lost and no Wireshark reconfiguration
is required.

Appending rather than overwiting TLS key files follows the technique used by
`openssl` binary, Chrome and others. All executables are able to append to the
same keylog file simultaneously, and Wireshark is able to dycrypt all apps
simultaneously.
pull/32250/head
Fred Klassen 2 years ago committed by GitHub
parent c6cdda03e7
commit 125141c9d2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 2
      src/core/tsi/ssl/key_logging/ssl_key_logging.cc

@ -50,7 +50,7 @@ TlsSessionKeyLoggerCache::TlsSessionKeyLogger::TlsSessionKeyLogger(
cache_(std::move(cache)) {
GPR_ASSERT(!tls_session_key_log_file_path_.empty());
GPR_ASSERT(cache_ != nullptr);
fd_ = fopen(tls_session_key_log_file_path_.c_str(), "w+");
fd_ = fopen(tls_session_key_log_file_path_.c_str(), "a");
if (fd_ == nullptr) {
grpc_error_handle error = GRPC_OS_ERROR(errno, "fopen");
gpr_log(GPR_ERROR,

Loading…
Cancel
Save