bpo-34271: Add ssl debugging helpers (GH-10031)

[tiran]

The ssl module now can dump key material to a keylog file and trace TLS
protocol messages with a tracing callback. The default and stdlib
contexts also support SSLKEYLOGFILE env var.

• API review
• whatsnew entry
• More tests

https://bugs.python.org/issue34271

[jmfrank63]

I made a first test setting the env variable SSLKEYLOGFILE from python and creating the file from there as well. Currently the ~ resolution does not seem to work, but besides that using the simple client socket example from the ssl docs I was able to grab the keys and log them into the file the env variable was pointing to. I was on a Mac and installed [email protected] via homebrew.

[tiran]

The SSLKEYLOGFILE only works, if you

• have OpenSSL 1.1.1 installed. OpenSSL 1.1.0 or 1.0.2 don't have a keylog callback API. Linux distributions like Debian and Fedora just started to include 1.1.1 in their latest test versions.
• use ssl.create_default_context(). A custom ssl.SSLContext doesn't use SSLKEYLOGFILE.

I decided against expanding ~ to user's home directory, because neither curl nor NSS expand them.

[jmfrank63]

I wrote some basic examples showing this works very well. Thanks to https://github.com/jmfrank63/ssl-examples/commits?author=nikosgraser for providing the requests example.

[tiran]

@zooba Could you please do me a favor and try the patch on Windows? One of the test cases is failing on Windows and I don't understand why.

====================================================================== FAIL: test_keylog_env (test.test_ssl.TestSSLDebug) ---------------------------------------------------------------------- Traceback (most recent call last): File "C:\projects\cpython\lib\test\test_ssl.py", line 4488, in test_keylog_env self.assertEqual(ctx.keylog_filename, support.TESTFN) AssertionError: None != '@test_4872_tmp' ---------------------------------------------------------------------- 

[tiran]

@zooba One Windows test case was failing because ignore_environment flag was set. I'm now skipping the test case if the flag is set.