qdevice-net: Log debug SSL connection info

Display basic information about the SSL connection after it is
established (using SSL_HandshakeCallback) to ease debugging of PQC.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>

qdevices/nss-sock.c

@@ -401,8 +401,10 @@ nss_sock_non_blocking_client_succeeded(const PRPollDesc *pfd)
  */
 PRFileDesc *
 nss_sock_start_ssl_as_client(PRFileDesc *input_sock, const char *ssl_url,
-    SSLBadCertHandler bad_cert_hook, SSLGetClientAuthData client_auth_hook,
-    void *client_auth_hook_arg, int force_handshake, int *reset_would_block)
+    SSLBadCertHandler bad_cert_hook,
+    SSLGetClientAuthData client_auth_hook, void *client_auth_hook_arg,
+    SSLHandshakeCallback handshake_callback, void *handshake_callback_arg,
+    int force_handshake, int *reset_would_block)
 {
 	PRFileDesc *ssl_sock;
 
@@ -434,6 +436,12 @@ nss_sock_start_ssl_as_client(PRFileDesc *input_sock, const char *ssl_url,
 		return (NULL);
 	}
 
+	if (handshake_callback != NULL &&
+	    (SSL_HandshakeCallback(ssl_sock, handshake_callback,
+	    handshake_callback_arg) != SECSuccess)) {
+		return (NULL);
+	}
+
 	if (SSL_ResetHandshake(ssl_sock, PR_FALSE) != SECSuccess) {
 		return (NULL);
 	}

qdevices/nss-sock.h

@@ -67,8 +67,10 @@ extern PRFileDesc 	*nss_sock_create_client_socket(const char *hostname, uint16_t
     PRIntn af, PRIntervalTime timeout);
 
 extern PRFileDesc	*nss_sock_start_ssl_as_client(PRFileDesc *input_sock, const char *ssl_url,
-    SSLBadCertHandler bad_cert_hook, SSLGetClientAuthData client_auth_hook,
-    void *client_auth_hook_arg, int force_handshake, int *reset_would_block);
+    SSLBadCertHandler bad_cert_hook,
+    SSLGetClientAuthData client_auth_hook, void *client_auth_hook_arg,
+    SSLHandshakeCallback handshake_callback, void *handshake_callback_arg,
+    int force_handshake, int *reset_would_block);
 
 extern PRFileDesc	*nss_sock_start_ssl_as_server(PRFileDesc *input_sock,
     CERTCertificate *server_cert, SECKEYPrivateKey *server_key, int require_client_cert,

qdevices/qdevice-net-nss.c

@@ -72,3 +72,71 @@ qdevice_net_nss_get_client_auth_data(void *arg, PRFileDesc *sock, struct CERTDis
 	return (NSS_GetClientAuthData((void *)instance->advanced_settings->net_nss_client_cert_nickname,
 	    sock, caNames, pRetCert, pRetKey));
 }
+
+static void
+qdevice_net_nss_dump_cert_info(const char *prefix, CERTCertificate *cert)
+{
+	char *nss_subject, *nss_issuer;
+	const char *subject, *issuer;
+	SECOidData *signature_oid_data, *public_key_oid_data;
+	const char *signature_algorithm_desc, *public_key_algorithm_desc;
+
+	nss_subject = CERT_NameToAscii(&cert->subject);
+	subject = (nss_subject != NULL ? nss_subject : "Unknown");
+
+	nss_issuer = CERT_NameToAscii(&cert->issuer);
+	issuer = (nss_issuer != NULL ? nss_issuer : "Unknown");
+
+	signature_oid_data = SECOID_FindOID(&cert->signature.algorithm);
+	signature_algorithm_desc = ((signature_oid_data != NULL && signature_oid_data->desc != NULL) ?
+	    signature_oid_data->desc : "Unknown");
+
+	public_key_oid_data = SECOID_FindOID(&cert->subjectPublicKeyInfo.algorithm.algorithm);
+	public_key_algorithm_desc = ((public_key_oid_data != NULL && public_key_oid_data->desc != NULL) ?
+	    public_key_oid_data->desc : "Unknown");
+
+	log(LOG_DEBUG, "  %s certificate Subject: %s, Issuer: %s, Signature Algorithm: %s, Public Key Algorithm: %s",
+	    prefix, subject, issuer, signature_algorithm_desc, public_key_algorithm_desc);
+
+	if (nss_subject != NULL) {
+		PORT_Free(nss_subject);
+	}
+
+	if (nss_issuer != NULL) {
+		PORT_Free(nss_issuer);
+	}
+}
+
+void
+qdevice_net_nss_handshake_callback(PRFileDesc *fd, void *client_data)
+{
+	SSLChannelInfo ci = { 0 };
+	CERTCertificate *cert;
+
+	if (SSL_GetChannelInfo(fd, &ci, sizeof(ci)) == SECSuccess) {
+		/*
+		 * No easy way to decode this numbers so they are written unencoded.
+		 * Values are in the /usr/include/nss3/sslt.h
+		 * - SSLKEAType - ssl_kea_ecdh = 4, ssl_kea_ecdh_hybrid = 8 (PQC)
+		 * - SSLNamedGroup - ssl_grp_ec_secp256r1 = 23,ssl_grp_kem_mlkem768x25519 = 4588 (PQC)
+		 */
+		log(LOG_DEBUG, "Using TLS channel protocol version: %04x, keaType: %u, keaGroup: %u",
+		    ci.protocolVersion, ci.keaType, ci.keaGroup);
+	} else {
+		log_nss(LOG_WARNING, "qdevice_net_nss_handshake_callback SSL_GetChannelInfo error");
+	}
+
+	cert = SSL_PeerCertificate(fd);
+	if (cert != NULL) {
+		qdevice_net_nss_dump_cert_info("Peer", cert);
+
+		CERT_DestroyCertificate(cert);
+	}
+
+	cert = SSL_LocalCertificate(fd);
+	if (cert != NULL) {
+		qdevice_net_nss_dump_cert_info("Local", cert);
+
+		CERT_DestroyCertificate(cert);
+	}
+}

qdevices/qdevice-net-nss.h

@@ -49,6 +49,8 @@ extern SECStatus		qdevice_net_nss_get_client_auth_data(void *arg,
     PRFileDesc *sock, struct CERTDistNamesStr *caNames,
     struct CERTCertificateStr **pRetCert, struct SECKEYPrivateKeyStr **pRetKey);
 
+extern void			qdevice_net_nss_handshake_callback(PRFileDesc *fd,
+    void *client_data);
 
 #ifdef __cplusplus
 }

qdevices/qdevice-net-socket.c

@@ -286,8 +286,9 @@ qdevice_net_socket_write_finished(struct qdevice_net_instance *instance)
 		if ((new_pr_fd = nss_sock_start_ssl_as_client(instance->socket,
 		    instance->advanced_settings->net_nss_qnetd_cn,
 		    qdevice_net_nss_bad_cert_hook,
-		    qdevice_net_nss_get_client_auth_data,
-		    instance, 0, NULL)) == NULL) {
+		    qdevice_net_nss_get_client_auth_data, instance,
+		    qdevice_net_nss_handshake_callback, NULL,
+		    0, NULL)) == NULL) {
 			log_nss(LOG_ERR, "Can't start TLS");
 			instance->disconnect_reason = QDEVICE_NET_DISCONNECT_REASON_CANT_START_TLS;
 			return (-1);