keylog: Add test 2090 for SSLKEYLOGFILE structure

[yedayak]

Only the TLS 1.2 structure for now since it's simpler, and only has a single label type.
This has the bonus of also testing libressl that only supports logging keys in TLS 1.2

Fix fallout in GnuTLS.

[testclutch]

Analysis of PR #19816 at fa623505:

Test 2090 failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 48 different CI jobs (the link just goes to one of them).

Generated by Testclutch

[yedayak]

I managed to reproduce the wolfssl failure, it seems that it needs to be built with CFLAGS=-DHAVE_EX_DATA=1 or else wolfSSL_get_app_data and wolfSSL_set_app_data don't work. Not sure why this doesn't fail other tests though
Edit: wolfssl has a configure option to enable it, added it to the GHA task for building opensslextra, but I guess the cache will need to be deleted?

[bagder]

@vszakats any idea on the wolfSSL thing @yedayak mentions above?

[vszakats]

Hm, it's curl: ../../lib/vtls/wolfssl.c:486: wssl_vtls_new_session_cb: Assertion cf != ((void *)0)' failed.
It's curious how this is triggered by setting SSLKEYLOGFILE. Session cache depends on this wolfSSL feature, in some cases? I'll take a look tomorrow.

This patch builds wolfssl-opensslextra for this PR, without using the cache:

--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -481,18 +481,8 @@ jobs:
             --disable-benchmark --disable-crypttests --disable-examples --prefix=/home/runner/wolfssl-all
           make install
 
-      - name: 'cache wolfssl (opensslextra)'  # does support `OPENSSL_COEXIST`
-        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra') }}
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        id: cache-wolfssl-opensslextra
-        env:
-          cache-name: cache-wolfssl-opensslextra
-        with:
-          path: ~/wolfssl-opensslextra
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
-
       - name: 'build wolfssl (opensslextra)'
-        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra') && steps.cache-wolfssl-opensslextra.outputs.cache-hit != 'true' }}
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra') }}
         run: |
           curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
             --location "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" | tar -xz

[vszakats]

This wolfSSL option is automatically enabled for wolfSSL QUIC builds,
which makes it easier to go unnoticed.

The public macro telling the feature is built-in is HAVE_EX_DATA.
curl should probably gracefully exclude features that depend on this
feature.

Did not yet dig why it's triggering, but opened #19852 trying to avoid
a leak for !HAVE_EX_DATA wolfSSLs.

[vszakats]

Confirmed that patch #19852 fixed the wolfssl-opensslextra crash.

[bagder]

Thanks!