implement SSLSocket#export_keying_material for doing RFC 5705 operations

[madblobfish]

I need to generate shared ttls secrets from TLS sessions using this API.
Note this implementation is incomplete! as it does not allow using the context.
See the first commit how that could look. It did not work for me so I removed it.

Should I write a test for this?

Refs:
https://datatracker.ietf.org/doc/html/rfc5705
https://datatracker.ietf.org/doc/html/rfc8446#section-7.5
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#exporter-labels
https://man.openbsd.org/SSL_export_keying_material.3

[madblobfish]

A super hacky radius implementation as a "real live" example can be found here: https://gist.github.com/madblobfish/9f1e89a3b5847ab80dcef16c56a4c0f9

[rhenium]

See the first commit how that could look. It did not work for me so I removed it.

What is blocking it from working? Check for rb_scan_args() for how to implement optional parameters in C extensions.

It also needs a StringValue() to ensure that the argument is actually an instance of String.

Should I write a test for this?

Yes. :)

[madblobfish]

This should fix everything, also squashed everything together (also did it wrong the first time, sorry for that noise).
Thanks for the rb_scan_args hint, that really helped :)
I've added a simple test, not sure how to test it deeper, but it seems to work (I also verified it with my application).

I got no example application code for the optional context functionality though.

Edit: removed useless comments from the test by another fix and squash

[rhenium]

Sorry that it took long to respond. I added a few code comments.

[madblobfish]

Don't worry about taking your time. Thanks for the review

[madblobfish]

new push should fix all comments, lets see if the CI agrees :)

[madblobfish]

Fixed failed tests (should have checked locally first 🤦) lets hope there are no compiler warnings left now

[rhenium]

Thank you so much!

[Neustradamus]

@madblobfish, @rhenium: Thanks a lot!

It is not possible to add text about RFC 9266 support in code?

[madblobfish]

Hi @Neustradamus
The mechanism is defined in https://datatracker.ietf.org/doc/html/rfc8446#section-7.5 and formerly in https://datatracker.ietf.org/doc/html/rfc5705.
I do not think it makes sense to collect all implementing RFCs for that in this openssl library. The information would quickly be outdated and annoying to keep up to date.

An official and proper overview of them may be found in IANA's registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#exporter-labels. Maybe this could be linked.
But in the end you can already find this registry linked in the openssl documentation: https://www.openssl.org/docs/man3.0/man3/SSL_export_keying_material.html