DONOTMERGE: sslkeylogfile

Author: haproxyFred

src/ssl_sock.c

@@ -105,6 +105,7 @@
 int nb_engines = 0;
 
 static struct eb_root cert_issuer_tree = EB_ROOT; /* issuers tree from "issuers-chain-path" */
+static FILE *sslkeylogfile = NULL;
 
 struct global_ssl global_ssl = {
 #ifdef LISTEN_DEFAULT_CIPHERS
@@ -4116,6 +4117,12 @@ void SSL_CTX_keylog(const SSL *ssl, const char *line)
 	char *lastarg = NULL;
 	char *dst = NULL;
 
+	if (sslkeylogfile) {
+		fwrite(line, strlen(line), 1, sslkeylogfile);
+		fwrite("\n", 1, 1, sslkeylogfile);
+		fflush(sslkeylogfile);
+	}
+
 #ifdef USE_QUIC_OPENSSL_COMPAT
 	quic_tls_compat_keylog_callback(ssl, line);
 #endif
@@ -7907,6 +7914,9 @@ static void __ssl_sock_init(void)
 	STACK_OF(SSL_COMP)* cm;
 	int n;
 #endif
+#ifdef HAVE_SSL_KEYLOG
+	char *sslkeylogfile_env;
+#endif
 
 	if (global_ssl.listen_default_ciphers)
 		global_ssl.listen_default_ciphers = strdup(global_ssl.listen_default_ciphers);
@@ -7950,6 +7960,9 @@ static void __ssl_sock_init(void)
 	ssl_qc_app_data_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
 #endif /* USE_QUIC */
 #ifdef HAVE_SSL_KEYLOG
+	sslkeylogfile_env = getenv("SSLKEYLOGFILE");
+	if (sslkeylogfile_env)
+		sslkeylogfile = fopen(sslkeylogfile_env, "a");
 	ssl_keylog_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, ssl_sock_keylog_free_func);
 #endif
 	ssl_client_crt_ref_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, ssl_sock_clt_crt_free_func);