Skip to content

Support SSLKEYLOGFILE in Release builds - #100665

Merged
rzikm merged 8 commits into
dotnet:mainfrom
rzikm:37915-sslkeylogfile
Apr 10, 2024
Merged

Support SSLKEYLOGFILE in Release builds#100665
rzikm merged 8 commits into
dotnet:mainfrom
rzikm:37915-sslkeylogfile

Conversation

@rzikm

@rzikmrzikm commented Apr 5, 2024

Copy link
Copy Markdown
Member

Closes#37915.

This PR unifies existing SSLKEYLOGFILE exporting between SslStream and QuicConnection to use same shared code, and enables the feature in Release builds of libraries. This makes the feature available to consumers without needing to compile Debug builds of .NET Runtime.

Note that the SSLKEYLOGFILE feature is currently supported for:

OSSslStreamQuicConnection
WindowsNot possibleYes
LinuxYesYes
OSXNot possible?Yes*

*MsQuic is not yet officially supported on OSX, but once it is, no changes should be necessary from .NET side.

For security concerns, in addition to setting SSLKEYLOGFILE environment variable, setting System.Net.EnableSslKeyLogging AppContext switch to true is required. This can be done either via code

AppContext.SetSwitch("System.Net.EnableSslKeyLogging",true);

or via {project}.runtimeconfig.json

{
"runtimeOptions": {
"configProperties": {
"System.Net.EnableSslKeyLogging": true
}
}
}

Debug runtime libraires (= local development builds of .NET Runtime) don't require the AppContext switch for the feature.

@ghostghost added the area-System.Net label Apr 5, 2024
@rzikm
rzikm requested a review from a teamApril 5, 2024 10:43

@ManickaPManickaP left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo few small comments. Thank you!

Comment threadsrc/libraries/System.Net.Quic/src/System.Net.Quic.csproj Outdated
Comment threadsrc/libraries/Common/src/System/Net/Security/SslKeyLogger.cs
Co-authored-by: Marie Píchová <11718369+ManickaP@users.noreply.github.com>
Comment threadsrc/libraries/Common/src/System/Net/Security/SslKeyLogger.cs Outdated

@wfurtwfurt left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM in general.

Comment threadsrc/libraries/Common/src/System/Net/Security/SslKeyLogger.cs
@rzikm

Copy link
Copy Markdown
MemberAuthor

CI Failures are unrelated

@rzikm
rzikm merged commit 39b4878 into dotnet:mainApr 10, 2024
matouskozak pushed a commit to matouskozak/runtime that referenced this pull request Apr 30, 2024
* Allow SSLKEYLOGFILE functionality in Release builds
* Unify SSLKEYLOGFILE logging, gate behind AppContextSwitch
* Add more points where QUIC secrets are logged
* Enable in Debug builds without appctx switch
* Update src/libraries/System.Net.Quic/src/System.Net.Quic.csproj
Co-authored-by: Marie Píchová <11718369+ManickaP@users.noreply.github.com>
* Code review feedback
* More code review changes
* i����Adjust appctx switch name
---------
Co-authored-by: Marie Píchová <11718369+ManickaP@users.noreply.github.com>
@github-actionsgithub-actionsBot locked and limited conversation to collaborators May 12, 2024
@karelzkarelz added this to the 9.0.0 milestone May 14, 2024
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support SSLKEYLOGFILE in SslStream

4 participants

@rzikm@ManickaP@wfurt@karelz