kolontsov / node-sslkeylog Goto Github PK

Starting with Node 11.10 (I think), Node.JS supports making TLS1.3 connections:
nodejs/node@7393e37af1 (commit on v11.x)
nodejs/node@42dbaed460 (commit on v12.x)

Info on TLS 1.3 secrets and how Wireshark decrypts them:
https://security.stackexchange.com/a/42350/5067 (would be nice adding to README)

All this means:

• The API changes, we should use session event if Node >= 11.10 is detected, instead of secureConnection or secureConnect.
• We should log secrets in a different format.

I'll try to work on this.

I've seen this repository and I was actually close to forking it and trying to integrate it with the TLSSocket API as I'm trying to debug the network traffic of a TLS client in my case.

But I coincidentially found the keylog event that's being fired by the TLSSocket. The original issue in the nodejs repository didn't mention this, so I thought I let you know as it would ease up everything much much more.

(taken from the official nodejs api docs, added in v12.3.0,v10.20.0 respectively)

• https://nodejs.org/api/tls.html#tls_event_keylog_1
• https://nodejs.org/api/tls.html#tls_event_keylog

const logFile = fs.createWriteStream('/tmp/ssl-keys.log', { flags: 'a' });
// ...
tlsSocket.on('keylog', (line) => logFile.write(line));