(arrow-rs) branch main updated: feat: `SSLKEYLOGFILE` support for flight CLI (#8239)

[al...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

alamb pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git


The following commit(s) were added to refs/heads/main by this push:
     new 1c4d9252f9 feat: `SSLKEYLOGFILE` support for flight CLI (#8239)
1c4d9252f9 is described below

commit 1c4d9252f90693abe07892e4c1941e7e7f1e7fc4
Author: Marco Neumann <ma...@crepererum.net>
AuthorDate: Sat Sep 6 12:12:49 2025 +0200

    feat: `SSLKEYLOGFILE` support for flight CLI (#8239)
    
    # Which issue does this PR close?
    \-
    
    # Rationale for this change
    This is #4875 now that the upstream changes are available.
    
    Allows analysis of TLS traffic with an external tool like Wireshark.
    
    See https://wiki.wireshark.org/TLS#using-the-pre-master-secret
    
    # What changes are included in this PR?
    New flag that opts into into the standard `SSLKEYLOGFILE` handling that
    other libraries and browsers support.
    
    # Are these changes tested?
    Not automatic test, but I did validate that setting the flag AND the env
    variable emits a log file that is successfully used by Wireshark to
    decrypt the traffic.
    
    # Are there any user-facing changes?
    Mostly none for normal users, but might be helpful for developers.
---
 arrow-flight/src/bin/flight_sql_client.rs | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/arrow-flight/src/bin/flight_sql_client.rs b/arrow-flight/src/bin/flight_sql_client.rs
index 9d11aca0b4..154b59f5d3 100644
--- a/arrow-flight/src/bin/flight_sql_client.rs
+++ b/arrow-flight/src/bin/flight_sql_client.rs
@@ -104,6 +104,14 @@ struct ClientArgs {
     #[clap(long)]
     tls: bool,
 
+    /// Dump TLS key log.
+    ///
+    /// The target file is specified by the `SSLKEYLOGFILE` environment variable.
+    ///
+    /// Requires `--tls`.
+    #[clap(long, requires = "tls")]
+    key_log: bool,
+
     /// Server host.
     ///
     /// Required.
@@ -404,7 +412,11 @@ async fn setup_client(args: ClientArgs) -> Result<FlightSqlServiceClient<Channel
         .keep_alive_while_idle(true);
 
     if args.tls {
-        let tls_config = ClientTlsConfig::new().with_enabled_roots();
+        let mut tls_config = ClientTlsConfig::new().with_enabled_roots();
+        if args.key_log {
+            tls_config = tls_config.use_key_log();
+        }
+
         endpoint = endpoint
             .tls_config(tls_config)
             .context("create TLS endpoint")?;