Tcp mode keylog for TLS 1.3

Help!
1

Hello,

I am using haproxy (version 2.6.12) as a TLS proxy to serve a local TCP server.

I would like to log the TLS secret key as I was doing for TLS1.2 (with a lua on a tcp-request content and txn.sf:ssl_fc_session_key).

But for TLS1.3 I am getting nowhere, the variables are always empty.

Here is the extract of my configuration:

global
	log stdout format raw daemon
	user root
	group root
	tune.ssl.keylog on
	lua-load sslkeylogger.lua
    ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384
    ssl-default-server-ciphersuites TLS_AES_256_GCM_SHA38

frontend remote_client_to_local_server
 	# try to log an element
	tcp-request session set-var(sess.early_secret) ssl_fc_client_early_traffic_secret
	log-format "ssl_fc_client_early_traffic_secret: %[var(sess.early_secret)]"
 	# tcp-request content lua.sslkeylog /tmp/key.log if { ssl_fc }
     
	bind 10.85.221.14:14443 ssl crt crt.pem ssl-min-ver TLSv1.3 
	default_backend backend_remote_client_to_local_server

backend backend_remote_client_to_local_server
	mode tcp
	tcp-request content lua.sslkeylog /tmp/key.log if { ssl_fc }
	server local_server 127.0.0.1:14443

The lua script is the one provided here: haproxy/dev/sslkeylogger/sslkeylogger.lua at e1c8bfd0ed960d3b3dec39e78ad75bec117912d0 · haproxy/haproxy · GitHub

I added the tcp to the action register : core.register_action('sslkeylog', { "tcp-req", "http-req" }, sslkeylog, 1)

None of the variable define in the documentation (such as ssl_fc_client_early_traffic_secret) contains an element, they are always empty.

Also, the session variable (sess.early_secret) is empty too.

I don’t know what I might be doing wrong or if it is even possible for TLS1.3…

Thanks for your replies !