deno_tls 0.244.0

TLS for Deno
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

// Copyright 2018-2026 the Deno authors. MIT license.

//! TLS key logging support for debugging encrypted traffic.
//!
//! When the `SSLKEYLOGFILE` environment variable is set, TLS session keys
//! are written to the specified file in NSS Key Log format, which can be
//! used by tools like Wireshark to decrypt TLS traffic.

use std::env;
use std::fs::OpenOptions;
use std::sync::Arc;
use std::sync::OnceLock;

use rustls::KeyLog;
use rustls::KeyLogFile;

static SSL_KEY_LOG: OnceLock<Arc<dyn KeyLog + Send + Sync>> = OnceLock::new();

/// Eagerly initializes the global TLS key logger.
///
/// `KeyLogFile::new()` reads `SSLKEYLOGFILE` from the process environment.
/// Callers can use this to snapshot that value early, instead of on first TLS
/// config construction.
pub(super) fn init_ssl_key_log() {
  let _ = get_ssl_key_log();
}

pub fn get_ssl_key_log() -> Arc<dyn KeyLog> {
  SSL_KEY_LOG
    .get_or_init(|| {
      if let Some(path) = env::var_os("SSLKEYLOGFILE")
        && let Err(e) = {
          #[allow(
            clippy::disallowed_methods,
            reason = "keylog file uses direct fs access"
          )]
          let result = OpenOptions::new().append(true).create(true).open(&path);
          result
        }
      {
        log::warn!(
          "SSLKEYLOGFILE is set but '{}' could not be opened: {e}",
          path.to_string_lossy()
        );
      }
      Arc::new(KeyLogFile::new())
    })
    .clone()
}