feat: optional SSLKEYLOGFILE support

Add a `use_key_log` option to server and client TLS configs that -- when
set -- will enable rustls's `SSLKEYLOGFILE` handling.

This is helpful when you want to intercept TLS traffic for debugging and
is generally supported by many libraries and browsers. Also see:
https://wiki.wireshark.org/TLS#using-the-pre-master-secret

Author: crepererum

tonic/src/transport/channel/tls.rs

@@ -12,6 +12,7 @@ pub struct ClientTlsConfig {
     domain: Option<String>,
     cert: Option<Certificate>,
     identity: Option<Identity>,
+    use_key_log: bool,
 }
 
 impl fmt::Debug for ClientTlsConfig {
@@ -31,6 +32,7 @@ impl ClientTlsConfig {
             domain: None,
             cert: None,
             identity: None,
+            use_key_log: false,
         }
     }
 
@@ -58,11 +60,24 @@ impl ClientTlsConfig {
         }
     }
 
+    /// Use key log as specified by the `SSLKEYLOGFILE` environment variable.
+    pub fn use_key_log(self) -> Self {
+        ClientTlsConfig {
+            use_key_log: true,
+            ..self
+        }
+    }
+
     pub(crate) fn tls_connector(&self, uri: Uri) -> Result<TlsConnector, crate::Error> {
         let domain = match &self.domain {
             None => uri.host().ok_or_else(Error::new_invalid_uri)?.to_string(),
             Some(domain) => domain.clone(),
         };
-        TlsConnector::new(self.cert.clone(), self.identity.clone(), domain)
+        TlsConnector::new(
+            self.cert.clone(),
+            self.identity.clone(),
+            domain,
+            self.use_key_log,
+        )
     }
 }

tonic/src/transport/server/tls.rs

@@ -10,6 +10,7 @@ pub struct ServerTlsConfig {
     identity: Option<Identity>,
     client_ca_root: Option<Certificate>,
     client_auth_optional: bool,
+    use_key_log: bool,
 }
 
 impl fmt::Debug for ServerTlsConfig {
@@ -25,6 +26,7 @@ impl ServerTlsConfig {
             identity: None,
             client_ca_root: None,
             client_auth_optional: false,
+            use_key_log: false,
         }
     }
 
@@ -57,11 +59,20 @@ impl ServerTlsConfig {
         }
     }
 
+    /// Use key log as specified by the `SSLKEYLOGFILE` environment variable.
+    pub fn use_key_log(self) -> Self {
+        ServerTlsConfig {
+            use_key_log: true,
+            ..self
+        }
+    }
+
     pub(crate) fn tls_acceptor(&self) -> Result<TlsAcceptor, crate::Error> {
         TlsAcceptor::new(
             self.identity.clone().unwrap(),
             self.client_ca_root.clone(),
             self.client_auth_optional,
+            self.use_key_log,
         )
     }
 }

tonic/src/transport/service/connector.rs

@@ -51,7 +51,7 @@ impl<C> Connector<C> {
 
         host.try_into()
             .ok()
-            .and_then(|dns| TlsConnector::new(None, None, dns).ok())
+            .and_then(|dns| TlsConnector::new(None, None, dns, false).ok())
     }
 }
 

tonic/src/transport/service/tls.rs

@@ -31,6 +31,7 @@ impl TlsConnector {
         ca_cert: Option<Certificate>,
         identity: Option<Identity>,
         domain: String,
+        use_key_log: bool,
     ) -> Result<Self, crate::Error> {
         let builder = ClientConfig::builder().with_safe_defaults();
         let mut roots = RootCertStore::empty();
@@ -61,6 +62,11 @@ impl TlsConnector {
         };
 
         config.alpn_protocols.push(ALPN_H2.as_bytes().to_vec());
+
+        if use_key_log {
+            config.key_log = Arc::new(rustls::KeyLogFile::new());
+        }
+
         Ok(Self {
             config: Arc::new(config),
             domain: Arc::new(domain.as_str().try_into()?),
@@ -106,6 +112,7 @@ impl TlsAcceptor {
         identity: Identity,
         client_ca_root: Option<Certificate>,
         client_auth_optional: bool,
+        use_key_log: bool,
     ) -> Result<Self, crate::Error> {
         let builder = ServerConfig::builder().with_safe_defaults();
 
@@ -131,6 +138,11 @@ impl TlsAcceptor {
         let mut config = builder.with_single_cert(cert, key)?;
 
         config.alpn_protocols.push(ALPN_H2.as_bytes().to_vec());
+
+        if use_key_log {
+            config.key_log = Arc::new(rustls::KeyLogFile::new());
+        }
+
         Ok(Self {
             inner: Arc::new(config),
         })