Add new handshake handler and keylog writer

[stv0g]

This change adds support for a new environment variable 'WG_KEYLOGFILE'
in resemblance to the 'SSLKEYLOGFILE' environment variable used by
curl, Chrome & Firefox to log ephemeral TLS encryption keys

When set, wireguard-go will log ephemeral keys generated during
each handshake to a file specified by the environment variable in the
WireGuard key log format.

The format used is the same as then one generated by the
extract-handshakes.sh script.

See also:

• https://git.zx2c4.com/wireguard-tools/tree/contrib/extract-handshakes
• https://wiki.wireshark.org/WireGuard#key-log-format
• https://everything.curl.dev/usingcurl/tls/sslkeylogfile

Signed-off-by: Steffen Vogel post@steffenvogel.de

[stv0g]

Any chance to get this reviewed? I've also posted it on the mailing list.
But there seems nobody to care?

[zx2c4]

I'm slightly worried about baking this in directly... For the kernel, it's just extracted from memory using a kprobe. Wonder if a similar kludge would work here?

Wondering what you want this for, by the way.

[stv0g]

Hi @zx2c4,

I am using for debugging purposes of my WireGuard-based P2P VPN agent cunīcu.
cunicu uses ICE, STUN and TURN servers to build a mesh of WireGuard peer-to-peer links.

To debug all of this, I wrote Gont a network testing toolkit written in Go.
Gont uses Linux network namespaces to build virtual network topologies including firewalls, NATs, network impairments and more.

Gont also includes a feature to automatically record PCAP files of all network links between the namespaces.
Wireshark can load these PCAP dumps and decrypt WireGuard as well as SSL trafic as long as we dump the ephemeral keys as well.

This is why I need this feature: I would like to dump wireguard-go's ephemeral keys to a PCAP file for subsequent analysis in WireShark for debugging purposes.

[stv0g]

@zx2c4 How would you feel, if I remove the setup of the key log writer from main.go? That way this feature would not ship with the wireguard-go binaries but would need to be enabled explicity by a user of the wireguard-go module?