sslkeylog-processor

This is a tool to process logs produced by the sslkeylog utility and send them to a MongoDB instance.

Building

cargo build --release && upx --best target/release/sslkeylog-processor

UPX is used to reduce binary size, if you prefer not using it, just skip it.

If your build system's glibc is different from the target one, you may encounter the following error:

sslkeylog-processor: /lib/x86_64-linux-gnu/libc.so.6: version 'GLIBC_...' not found (required by sslkeylog-processor)

To fix this you might want to build a MUSL-based static binary. Prepare the environment with the following commands:

sudo apt install musl-tools
rustup target add x86_64-unknown-linux-musl

Then just use: cargo build --release --target x86_64-unknown-linux-musl && upx --best target/x86_64-unknown-linux-musl/release/sslkeylog-processor

Usage

Run the built binary to determine the command-line options. On Windows, file names support wildcard expansion, on other OSes shell expansion is expected to take care of that. The tool optionally supports MaxMind geolocation database to store GeoNames identifier.

Schema

All keys are placed in the collections named <sni>@<server_ip>:<server_port>_<year><month><day> with the following schemas:

// TLS pre-1.3
{
  "_id": <server_random>:BinData,
  "t": <timestamp>:DateTime,
  "r": <client_random>:BinData,
  "i": <client_ip>:int/BinData,
  "p": <client_port>:int,
  "c": <cipher_id>:int,
  "k": <premaster>:BinData,
  ["g": <geoname_id>:int],
}

// TLS 1.3:
{
  "_id": <server_random>:BinData,
  "t": <timestamp>:DateTime,
  "r": <client_random>:BinData,
  "i": <client_ip>:int/BinData,
  "p": <client_port>:int,
  "c": <cipher_id>:int,
  "h": <server_handshake>:BinData,
  "f": <client_handshake>:BinData,
  "z": <server_0>:BinData,
  "s": <client_0>:BinData,
  ["g": <geoname_id>:int],
}

Each collection has the following indexes:

1. random on the r field (ascending)
2. timestamp on the t field (ascending)