Add exporting SSL/TLS master key log feature

Enable this feature by setting the system property
   -Dio.netty.ssl.masterKeyHandler=true
or
   System.setProperty(SslMasterKeyHandler.SYSTEM_PROP_KEY, "true");
The keys will be written to the log named "io.netty.wireshark" in
the warnning level. To export the keys to a file, you can configure
log factory like: (with log4j.xml for example)
<appender name="key-file" class="org.apache.log4j.RollingFileAppender">
	<param name="file" value="d:/keyfile.txt"/>
	<layout class="org.apache.log4j.PatternLayout">
		<param name="ConversionPattern" value="%m%n"/>
	</layout>
</appender>
<category name="io.netty.wireshark">
	<priority value="DEBUG" />
	<appender-ref ref="key-file" />
</category>

Wireshark can analyze the messages gRPC over TLS with this
key log file.

close #7199

Author: huangqiangxiong

netty/src/main/java/io/grpc/netty/ProtocolNegotiators.java

@@ -64,6 +64,7 @@
 import io.netty.handler.ssl.SslContextBuilder;
 import io.netty.handler.ssl.SslHandler;
 import io.netty.handler.ssl.SslHandshakeCompletionEvent;
+import io.netty.handler.ssl.SslMasterKeyHandler;
 import io.netty.handler.ssl.SslProvider;
 import io.netty.util.AsciiString;
 import io.netty.util.Attribute;
@@ -396,6 +397,14 @@ public void handlerAdded(ChannelHandlerContext ctx) throws Exception {
       ctx.pipeline().addBefore(ctx.name(), /* name= */ null, this.executor != null
           ? new SslHandler(sslEngine, false, this.executor)
           : new SslHandler(sslEngine, false));
+
+      // Support exporting the key and session identifier to the log named
+      // "io.netty.wireshark" when the system property named "io.netty.ssl.masterKeyHandler"
+      // is "true". This feature is used to analyze gRPC traffic with Wireshark.
+      if (Boolean.getBoolean(SslMasterKeyHandler.SYSTEM_PROP_KEY)) {
+        ctx.pipeline().addBefore(ctx.name(), null,
+            SslMasterKeyHandler.newWireSharkSslMasterKeyHandler());
+      }
     }
 
     @Override
@@ -572,6 +581,14 @@ protected void handlerAdded0(ChannelHandlerContext ctx) {
       ctx.pipeline().addBefore(ctx.name(), /* name= */ null, this.executor != null
           ? new SslHandler(sslEngine, false, this.executor)
           : new SslHandler(sslEngine, false));
+
+      // Support exporting the key and session identifier to the log named
+      // "io.netty.wireshark" when the system property named "io.netty.ssl.masterKeyHandler"
+      // is "true". This feature is used to analyze gRPC traffic with Wireshark.
+      if (Boolean.getBoolean(SslMasterKeyHandler.SYSTEM_PROP_KEY)) {
+        ctx.pipeline().addBefore(ctx.name(), null,
+            SslMasterKeyHandler.newWireSharkSslMasterKeyHandler());
+      }
     }
 
     @Override

netty/src/test/java/io/grpc/netty/ProtocolNegotiatorsTest.java

@@ -26,8 +26,11 @@
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.argThat;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 
 import io.grpc.Attributes;
 import io.grpc.CallCredentials;
@@ -94,8 +97,11 @@
 import io.netty.handler.ssl.SslContextBuilder;
 import io.netty.handler.ssl.SslHandler;
 import io.netty.handler.ssl.SslHandshakeCompletionEvent;
+import io.netty.handler.ssl.SslMasterKeyHandler;
 import io.netty.handler.ssl.SupportedCipherSuiteFilter;
 import io.netty.handler.ssl.util.SelfSignedCertificate;
+import io.netty.util.internal.logging.InternalLogger;
+import io.netty.util.internal.logging.InternalLoggerFactory;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.net.SocketAddress;
@@ -124,6 +130,7 @@
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
 import org.mockito.ArgumentCaptor;
+import org.mockito.ArgumentMatcher;
 import org.mockito.ArgumentMatchers;
 import org.mockito.Mockito;
 
@@ -160,6 +167,10 @@ public static void loadCerts() throws Exception {
   private SSLEngine engine;
   private ChannelHandlerContext channelHandlerCtx;
 
+  private InternalLogger mockLogger4KeyLog;
+  private InternalLogger mockLogger4Others;
+  private InternalLoggerFactory oldLoggerFactory;
+
   @Before
   public void setUp() throws Exception {
     File serverCert = TestUtils.loadCert("server1.pem");
@@ -168,6 +179,11 @@ public void setUp() throws Exception {
         .ciphers(TestUtils.preferredTestCiphers(), SupportedCipherSuiteFilter.INSTANCE).build();
     engine = SSLContext.getDefault().createSSLEngine();
     engine.setUseClientMode(true);
+
+    oldLoggerFactory = InternalLoggerFactory.getDefaultFactory();
+    mockLogger4KeyLog = mock(InternalLogger.class);
+    mockLogger4Others = mock(InternalLogger.class);
+    InternalLoggerFactory.setDefaultFactory(new FakeLoggerFactory());
   }
 
   @After
@@ -179,6 +195,10 @@ public void tearDown() {
       chan.close();
     }
     group.shutdownGracefully();
+
+    Mockito.reset(mockLogger4KeyLog);
+    Mockito.reset(mockLogger4Others);
+    InternalLoggerFactory.setDefaultFactory(oldLoggerFactory);
   }
 
   @Test
@@ -1190,4 +1210,81 @@ public void handlerAdded(ChannelHandlerContext ctx) throws Exception {
       ctx.pipeline().fireUserEventTriggered(ProtocolNegotiationEvent.DEFAULT);
     }
   }
+
+  @Test
+  public void clientTlsHandler_serverTlsHandler_sslMasterKeyLog() throws Exception {
+    // The master key log feature should be disabled
+    // when the "io.netty.ssl.masterKeyHandler" property is missing.
+    System.clearProperty(SslMasterKeyHandler.SYSTEM_PROP_KEY);
+    clientTlsHandler_firesNegotiation();
+    verify(mockLogger4KeyLog, never()).warn(argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        return arg.contains(" Master-Key:");
+      }
+    }), argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        return true;
+      }
+    }), argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        return true;
+      }
+    }));
+
+    // The master key log feature should be disabled
+    // when the value of "io.netty.ssl.masterKeyHandler" property is not "true".
+    System.setProperty(SslMasterKeyHandler.SYSTEM_PROP_KEY, "false");
+    clientTlsHandler_firesNegotiation();
+    verify(mockLogger4KeyLog, never()).warn(argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        return arg.contains(" Master-Key:");
+      }
+    }), argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        return true;
+      }
+    }), argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        return true;
+      }
+    }));
+
+    // The master key log feature should be enabled
+    // when the value of "io.netty.ssl.masterKeyHandler" property is "true".
+    System.setProperty(SslMasterKeyHandler.SYSTEM_PROP_KEY, "true");
+    clientTlsHandler_firesNegotiation();
+    // writing key twice because both client and server will enable key log feature
+    verify(mockLogger4KeyLog, times(2)).warn(argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        // writing key in one line each time, like:
+        // "RSA Session-ID:9da5b... Master-Key:5d74b...\n"
+        return arg.contains(" Master-Key:");
+      }
+    }), argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        return true;
+      }
+    }), argThat(new ArgumentMatcher<String>() {
+      @Override
+      public boolean matches(String arg) {
+        return true;
+      }
+    }));
+    System.clearProperty(SslMasterKeyHandler.SYSTEM_PROP_KEY);
+  }
+
+  private class FakeLoggerFactory extends InternalLoggerFactory {
+    @Override
+    protected InternalLogger newInstance(String name) {
+      return name.equals("io.netty.wireshark") ? mockLogger4KeyLog : mockLogger4Others;
+    }
+  }
 }