Wireshark decryption

[GuillaumeCornette]

Hi, for one of my university project I have to analyse the performance of MSquic but i can't get the SSL secret.
Here is what I did in the clientRun of the sample.c, right after the ConnectionOpen() :

CXPLAT_TLS_SECRETS TlsSecrets;
if (QUIC_FAILED(Status = MsQuic->SetParam(Connection, QUIC_PARAM_LEVEL_CONNECTION, QUIC_PARAM_CONN_TLS_SECRETS, sizeof(TlsSecrets), (uint8_t*)&TlsSecrets)))
{
printf("TLS SECRETS SetParam failed, 0x%x!\n", Status);
}
else{
const char* SslKeyLogFile = "sslkeylogfile.log";
WriteSslKeylogFile(SslKeyLogFile, TlsSecrets);

But when i launch /script/build.ps1 i get this error of WriteSslKeyLogFile from msquichelper :

implicit declaration of function ‘WriteSslKeylogFile’ [-Werror=implicit-function-declaration] WriteSslKeylogFile(SslKeyLogFile, TlsSecrets);

What should I do to correct it ?
Thank you

[nibanks]

Are you waiting for the handshake to complete before writing the secrets to file? The way things work is that you must set the secrets pointer before starting the connection, then during the handshake, QUIC writes the information to the struct, and then once the handshake is complete, the app can be sure all the data is available.

[GuillaumeCornette]

I get a "TLS SECRET SetParam failed, 0x16!" printf I run the client.
And here is how my secret looks like :

# TLS 1.3 secrets log file, generated by quicinterop
CLIENT_HANDSHAKE_TRAFFIC_SECRET 0000350000000000000000000000000000000000000000000000000000007c000000770000006e0000005b000000e0342195b97f000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000050010000000000000000000000000000400100000000000015000000b97f000070e9 2295b97f000000000000000000005001000000000000007cea94b97f0000ffffffff0000000015000000425e5844c84dcd94b97f0000f0ab2295b97f0000050000000000000015000000350000000000000000000000000000000000000000000000000000007c000000770000006e0000005b000000e0342195b97f000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000050010000000000000000000000000000400100000000000015000000b97f000070e9
SERVER_TRAFFIC_SECRET_0 9f839355000068e5d6f1fe7f0000006a838593550000d0e4d6f1fe7f0000c9862395b97f00000300000000000000c0b82295b97f000005000000000000000000000000000000010000000000000080a12295b97f00005001000000000000c0b82295b97f000080a12295b97f00006fc7d59401000000f0a42295b97f000000000000000000005001 00000000000015000000b97f000070e9d6f1fe7f00006e4b2495b97f000005000000000000001500000035000000000000000000000000000000000000000000000000000000420c9f839355000068e5d6f1fe7f0000006a838593550000d0e4d6f1fe7f0000c9862395b97f00000300000000000000c0b82295b97f000005000000000000000000000000000000010000000000000080a12295b97f00005001000000000000c0b82295b97f000080a12295b97f00006fc7d59401000000f0a42295b97f000000000000000000005001
CLIENT_EARLY_TRAFFIC_SECRET 000001000000f084a1cca37f0000000000000000000040010000000000001500000008090a0bffffffff000000005f5a0143425e5844c82d4ccca37f0000f08ba1cca37f00000000000000000000000000000000000000000000000000007c00 000000000000c098a1cca37f00000500000000000000000000000000000001000000000000008081a1cca37f00001300000000000000c098a1cca37f00008081a1cca37f00000000000001000000f084a1cca37f0000000000000000000040010000000000001500000008090a0bffffffff000000005f5a0143425e5844c82d4ccca37f0000f08ba1cca37f00000000000000000000000000000000000000000000000000007c00
CLIENT_HANDSHAKE_TRAFFIC_SECRET a1cca37f00000000000000000000000000000000000000000000000000007c000000770000006e0000005b00000000000000000000000000000000000000e014a0cca37f00000000000000000000040000000000000000000000000000000000 a1cca37f00000000000001000000f084a1cca37f0000000000000000000040010000000000001500000008090a0bffffffff000000005f5a0143425e5844c82d4ccca37f0000f08ba1cca37f00000000000000000000000000000000000000000000000000007c000000770000006e0000005b00000000000000000000000000000000000000e014a0cca37f00000000000000000000040000000000000000000000000000000000
CLIENT_TRAFFIC_SECRET_0 00000000000040e67fc3a37f0000c82d4ccca37f000005000000000000001500000035000000000000000000000000000000000000000000000000000000421c635059550000f084a1cca37f0000007a305259550000a897019dfc7f00000097 000000000000e014a0cca37f00000000000000000000040000000000000000000000000000000000000000000000500100000000000057afa2cca37f00004001000000000000150000000000000040e67fc3a37f0000c82d4ccca37f000005000000000000001500000035000000000000000000000000000000000000000000000000000000421c635059550000f084a1cca37f0000007a305259550000a897019dfc7f00000097
CLIENT_TRAFFIC_SECRET_0  
CLIENT_EARLY_TRAFFIC_SECRET 000001000000f0c4b598f07f0000000000000000000040010000000000001500000008090a0bffffffff000000005f5a0143425e5844c86d6098f07f0000f0cbb598f07f00000000000000000000000000000000000000000000000000007c000000770000006e0000005b00000000000000000000000000000000000000e054b498f07f00000000000000000000040000000000000000000000000000000000 000000000000c0d8b598f07f000005000000000000000000000000000000010000000000000080c1b598f07f00001300000000000000c0d8b598f07f000080c1b598f07f00000000000001000000f0c4b598f07f0000000000000000000040010000000000001500000008090a0bffffffff000000005f5a0143425e5844c86d6098f07f0000f0cbb598f07f00000000000000000000000000000000000000000000000000007c000000770000006e0000005b00000000000000000000000000000000000000e054b498f07f00000000000000000000040000000000000000000000000000000000
SERVER_TRAFFIC_SECRET_0 ce4070550000f0c4b598f07f000000fa9a4170550000e8a3e7b4fc7f000040a3e7b4fc7f000050a3e7b4fc7f0000c9a6b698f07f00000300000000000000c0d8b598f07f000005000000000000000000000000000000010000000000000080c1b598f07f00001300000000000000c0d8b598f07f000080c1b598f07f00000000000001000000f0c4b598f07f0000000000000000000040010000000000001500 000000000000150000000000000040e67f8ff07f0000c86d6098f07f00000500000000000000150000003500000000000000000000000000000000000000000000000000000042acce4070550000f0c4b598f07f000000fa9a4170550000e8a3e7b4fc7f000040a3e7b4fc7f000050a3e7b4fc7f0000c9a6b698f07f00000300000000000000c0d8b598f07f000005000000000000000000000000000000010000000000000080c1b598f07f00001300000000000000c0d8b598f07f000080c1b598f07f00000000000001000000f0c4b598f07f0000000000000000000040010000000000001500

I notice that i had to run several times the client to have all of the content shown above, at first i only had a few fields. Don't know why i have 2 SERVER_TRAFFIC_SECRET and CLIENT_TRAFFIC_SECRET.

[nibanks]

Well, you have to wait for the CONNECTED event before you print the secrets. You're currently just calling ConnectionStart (which is an async function that simply queues up the request) and then printing.

As far as the error, I still cannot see any reason why that might be happening. I believe 0x16 would be QUIC_STATUS_INVALID_PARAMETER, and that would only happen if (BufferLength != sizeof(CXPLAT_TLS_SECRETS) || Buffer == NULL).

[GuillaumeCornette]

Changing _In_ CXPLAT_TLS_SECRETS &TlsSecrets into _In_ CXPLAT_TLS_SECRETS TlsSecrets may not be the reason ? I find it weird but it's the only way I found to be able to compile.

[nibanks]

You're talking about for WriteSslKeyLogFile2? You should change it to _In_ CXPLAT_TLS_SECRETS* TlsSecrets to pass a pointer to the struct. C doesn't support passing a reference (&).

[GuillaumeCornette]

That's what I thought but when i did that and upgraded the rest of the code in order to compile I got a segmentation fault (core dumped).
Valgrind is showing me that the fault occurs at the third if condition in WriteSslKeylogFile : if (TlsSecrets->IsSet.ClientRandom) in which i change the . into -> to be able to compile the code after adding the pointer to _In_ CXPLAT_TLS_SECRETS* TlsSecrets.