WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

configure.ac and src/tls.c: fix --enable-keylog-export to warn at configure time, then build cleanly.

pull/6861/head
Daniel Pouzzner 2023-10-12 13:09:43 -05:00
parent 0e35e9cbbe
commit 0549dba3db
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
configure.ac
View File

@ -1338,13 +1338,14 @@ fi
# KeyLog file export # KeyLog file export
AC_ARG_ENABLE([keylog-export], AC_ARG_ENABLE([keylog-export],
[AS_HELP_STRING([--enable-keylog-export],[Enable (DANGEROUS INSECURE) exporting TLS secrets to an NSS keylog file (default: disabled)])], [AS_HELP_STRING([--enable-keylog-export],[Enable insecure export of TLS secrets to an NSS keylog file (default: disabled)])],
[ ENABLED_KEYLOG_EXPORT=$enableval ], [ ENABLED_KEYLOG_EXPORT=$enableval ],
[ ENABLED_KEYLOG_EXPORT=no ] [ ENABLED_KEYLOG_EXPORT=no ]
) )
if test "$ENABLED_KEYLOG_EXPORT" = "yes" if test "$ENABLED_KEYLOG_EXPORT" = "yes"
then then
AM_CFLAGS="$AM_CFLAGS -DSHOW_SECRETS -DHAVE_SECRET_CALLBACK -DWOLFSSL_SSLKEYLOGFILE" AC_MSG_WARN([Keylog export enabled -- Sensitive key data will be stored insecurely.])
AM_CFLAGS="$AM_CFLAGS -DSHOW_SECRETS -DHAVE_SECRET_CALLBACK -DWOLFSSL_SSLKEYLOGFILE -DWOLFSSL_KEYLOG_EXPORT_WARNED"
fi fi
# TLS v1.3 Draft 18 (Note: only final TLS v1.3 supported, here for backwards build compatibility) # TLS v1.3 Draft 18 (Note: only final TLS v1.3 supported, here for backwards build compatibility)

3
src/tls.c
View File

@ -106,7 +106,8 @@ static int TLSX_PopulateSupportedGroups(WOLFSSL* ssl, TLSX** extensions);
#endif #endif
/* Warn if secrets logging is enabled */ /* Warn if secrets logging is enabled */
#if defined(SHOW_SECRETS) || defined(WOLFSSL_SSLKEYLOGFILE) #if (defined(SHOW_SECRETS) || defined(WOLFSSL_SSLKEYLOGFILE)) && \
!defined(WOLFSSL_KEYLOG_EXPORT_WARNED)
#ifndef _MSC_VER #ifndef _MSC_VER
#warning The SHOW_SECRETS and WOLFSSL_SSLKEYLOGFILE options should only be used for debugging and never in a production environment #warning The SHOW_SECRETS and WOLFSSL_SSLKEYLOGFILE options should only be used for debugging and never in a production environment
#else #else