drivenet / sslkeylog-processor

A companion tool for https://github.com/drivenet/sslkeylog to convert logs into MongoDB-stored data.

sslkeylog-processor

This is a tool to process logs produced by the sslkeylog utility and send them to a MongoDB instance.

Building

cargo build --release && upx --best target/release/sslkeylog-processor

UPX is used to reduce binary size, if you prefer not using it, just skip it.

Usage

Run the built binary to determine the command-line options. On Windows, file names support wildcard expansion, on other OSes shell expansion is expected to take care of that. The tool optionally supports MaxMind geolocation database to store GeoNames identifier.

Schema

All keys are placed in the collections named <sni>@<server_ip>:<server_port>_<year><month><day> with the following schemas:

// TLS pre-1.3
{
  "_id": <server_random>:BinData,
  "t": <timestamp>:DateTime,
  "r": <client_random>:BinData,
  "i": <client_ip>:int/BinData,
  "p": <client_port>:int,
  "c": <cipher_id>:int,
  "k": <premaster>:BinData,
  ["g": <geoname_id>:int],
}

// TLS 1.3:
{
  "_id": <server_random>:BinData,
  "t": <timestamp>:DateTime,
  "r": <client_random>:BinData,
  "i": <client_ip>:int/BinData,
  "p": <client_port>:int,
  "c": <cipher_id>:int,
  "h": <server_handshake>:BinData,
  "f": <client_handshake>:BinData,
  "z": <server_0>:BinData,
  "s": <client_0>:BinData,
  ["g": <geoname_id>:int],
}

Each collection has the following indexes:

1. random on the r field (ascending)
2. timestamp on the t field (ascending)