speed sm2/3/4

`gmssl speed sm2 sm3 sms4`
2026-08-09 07:23:56 +08:00 · 2017-11-25 13:22:04 +08:00
parent 4d60905e04
commit 2458fcb879
24 changed files with 618 additions and 340 deletions
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -285,7 +285,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
     128,
     128,
     },
+#endif /* OPENSSL_NO_GMTLS */

+#ifndef OPENSSL_NO_SM2
    /* ECDHE-SM2-[SM1|SMS4|SSF33]-[SM3|SHA256] */
    {
     1,
@@ -377,8 +379,8 @@ static SSL_CIPHER ssl3_ciphers[] = {
     128,
     128,
     },
+#endif /* OPENSSL_NO_SM2 */

-#endif /* OPENSSL_NO_GMTLS */
 #ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
    {
     1,
@@ -3934,11 +3936,11 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
        /* with PSK there must be server callback set */
        if ((alg_k & SSL_PSK) && s->psk_server_callback == NULL)
            continue;
-#endif                          /* OPENSSL_NO_PSK */
+#endif /* OPENSSL_NO_PSK */

        ok = (alg_k & mask_k) && (alg_a & mask_a);
 #ifdef CIPHER_DEBUG
-        fprintf(stderr, "%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n", ok, alg_k,
+        fprintf(stderr, "%d:[alg_k=%08lX:alg_a=%08lX:mask_k=%08lX:mask_a=%08lX]%p:%s\n", ok, alg_k,
                alg_a, mask_k, mask_a, (void *)c, c->name);
 #endif

--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -64,7 +64,7 @@ typedef struct {
    ASN1_OCTET_STRING *srp_username;
 #endif
    long flags;
-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    X509 *peer_extra;
 #endif
 } SSL_SESSION_ASN1;
@@ -93,7 +93,7 @@ ASN1_SEQUENCE(SSL_SESSION_ASN1) = {
    ASN1_EXP_OPT(SSL_SESSION_ASN1, srp_username, ASN1_OCTET_STRING, 12),
 #endif
    ASN1_EXP_OPT(SSL_SESSION_ASN1, flags, ZLONG, 13),
-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    ASN1_EXP_OPT(SSL_SESSION_ASN1, peer_extra, X509, 14)
 #endif
 } static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
@@ -207,7 +207,7 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)

    as.flags = in->flags;

-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    as.peer_extra = in->peer_extra;
 #endif

@@ -365,7 +365,7 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
    /* Flags defaults to zero which is fine */
    ret->flags = as->flags;

-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    X509_free(ret->peer_extra);
    ret->peer_extra = as->peer_extra;
    as->peer_extra = NULL;
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -504,7 +504,8 @@ STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)
 STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s)
 {
    if (!s->server) {           /* we are in the client */
-        if (((s->version >> 8) == SSL3_VERSION_MAJOR) && (s->s3 != NULL))
+        if (((s->version >> 8) == SSL3_VERSION_MAJOR || SSL_IS_GMTLS(s))
+            && (s->s3 != NULL))
            return (s->s3->tmp.ca_names);
        else
            return (NULL);
@@ -765,45 +766,6 @@ int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
    return 1;
 }

-/* 输出双证书及CA证书链 */
-/*
-static int ssl_add_sm2_certs(SSL *s, unsigned long *l)
-{
-    BUF_MEM *buf = s->init_buf;
-    CERT_PKEY *sign_cpk = &s->cert->pkeys[SSL_PKEY_SM2_SIGN];
-    CERT_PKEY *enc_cpk = &s->cert->pkeys[SSL_PKEY_SM2_ENC];
-    STACK_OF(X509) *extra_certs;
-    int i;
-
-    if (!BUF_MEM_grow_clean(buf, 10)) {
-        fprintf(stderr, "-----<error> %s() %s %d\n", __func__, __FILE__, __LINE__);
-        return 0;
-    }
-    if (sign_cpk->chain)
-        extra_certs = sign_cpk->chain;
-    else
-        extra_certs = s->ctx->extra_certs;
-
-    if (!ssl_add_cert_to_buf(buf, l, sign_cpk->x509)) {
-        fprintf(stderr, "-----<error> %s() %s %d\n", __func__, __FILE__, __LINE__);
-        return 0;
-    }
-    if (!ssl_add_cert_to_buf(buf, l, enc_cpk->x509)) {
-        fprintf(stderr, "-----<error> %s() %s %d\n", __func__, __FILE__, __LINE__);
-        return 0;
-    }
-
-    for (i = 0; i < sk_X509_num(extra_certs); i++) {
-        if (!ssl_add_cert_to_buf(buf, 1, sk_X509_value(extra_certs, i))) {
-            fprintf(stderr, "-----<error> %s() %s %d\n", __func__, __FILE__, __LINE__);
-            return 0;
-        }
-    }
-
-    return 1;
-}
-*/
-
 /* Add certificate chain to internal SSL BUF_MEM structure */
 int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
 {
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -219,10 +219,8 @@ static int ssl_mac_pkey_id[SSL_MD_NUM_IDX] = {
    EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef,
    /* GOST2012_512 */
    EVP_PKEY_HMAC,
-#ifndef OPENSSL_NO_GMTLS_METHOD
    /* MD5_SHA1, SHA224, SHA512, SM3 */
    NID_undef, NID_undef, NID_undef, EVP_PKEY_HMAC
-#endif
 };

 static int ssl_mac_secret_size[SSL_MD_NUM_IDX];
@@ -466,9 +464,10 @@ void ssl_load_ciphers(void)
 #ifdef OPENSSL_NO_EC
    disabled_mkey_mask |= SSL_kECDHEPSK;
    disabled_auth_mask |= SSL_aECDSA;
-# ifdef OPENSSL_NO_GMTLS_METHOD
-   /* do something */                            
-# endif
+#endif
+#ifdef OPENSSL_NO_SM2
+    disabled_mkey_mask |= SSL_kSM2DHEPSK;
+    disabled_auth_mask |= SSL_aSM2;
 #endif
 #ifdef OPENSSL_NO_PSK
    disabled_mkey_mask |= SSL_PSK;
@@ -667,9 +666,8 @@ const EVP_MD *ssl_handshake_md(SSL *s)

 const EVP_MD *ssl_prf_md(SSL *s)
 {
-#ifndef OPENSSL_NO_GMTLS_METHOD
-    /* In GM/T 0024, PRF always use SM3 */
-    if (s->version == GMTLS_VERSION)
+#ifndef OPENSSL_NO_GMTLS
+    if (SSL_IS_GMTLS(s))
        return EVP_sm3();
 #endif
    return ssl_md(ssl_get_algorithm2(s) >> TLS1_PRF_DGST_SHIFT);
@@ -1580,11 +1578,7 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
    const char *ver;
    const char *kx, *au, *enc, *mac;
    uint32_t alg_mkey, alg_auth, alg_enc, alg_mac;
-#ifndef OPENSSL_NO_GMTLS
    static const char *format = "%-30s %-10s Kx=%-8s Au=%-6s Enc=%-23s Mac=%-4s\n";
-#else
-    static const char *format = "%-23s %s Kx=%-4s Au=%-4s Enc=%-8s Mac=%-4s\n";
-#endif

    if (buf == NULL) {
        len = 128;
@@ -1629,7 +1623,6 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
    case SSL_kGOST:
        kx = "GOST";
        break;
-#ifndef OPENSSL_NO_GMTLS_METHOD
    case SSL_kSM2:
        kx = "SM2";
        break;
@@ -1645,7 +1638,6 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
    case SSL_kSM9DHE:
        kx = "SM9DHE";
        break;
-#endif
    default:
        kx = "unknown";
    }
@@ -1676,14 +1668,12 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
    case (SSL_aGOST12 | SSL_aGOST01):
        au = "GOST12";
        break;
-#ifndef OPENSSL_NO_GMTLS_METHOD
    case SSL_aSM2:
        au = "SM2";
        break;
    case SSL_aSM9:
        au = "SM9";
        break;
-#endif
    default:
        au = "unknown";
        break;
@@ -1748,7 +1738,6 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
    case SSL_CHACHA20POLY1305:
        enc = "CHACHA20/POLY1305(256)";
        break;
-#ifndef OPENSSL_NO_GMTLS_METHOD
    case SSL_SMS4:
        enc = "SMS4(128)";
        break;
@@ -1770,7 +1759,6 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
    case SSL_SSF33:
        enc = "SSF33(128)";
        break;
-#endif
    default:
        enc = "unknown";
        break;
@@ -1803,11 +1791,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
    case SSL_GOST12_512:
        mac = "GOST2012";
        break;
-#ifndef OPENSSL_NO_GMTLS_METHOD
    case SSL_SM3:
        mac = "SM3";
        break;
-#endif
    default:
        mac = "unknown";
        break;
@@ -2012,12 +1998,10 @@ int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
        return SSL_PKEY_GOST_EC;
    else if (alg_a & SSL_aGOST01)
        return SSL_PKEY_GOST01;
-#ifndef OPENSSL_NO_GMTLS_METHOD
    else if (alg_a & SSL_aSM2)
        return SSL_PKEY_SM2_SIGN;
    else if (alg_a & SSL_aSM9)
-        return -1;
-#endif
+        return SSL_PKEY_SM9_SIGN;
    return -1;
 }

--- a/ssl/ssl_conf.c
+++ b/ssl/ssl_conf.c
@@ -282,11 +282,9 @@ static int protocol_from_string(const char *value)
        {"TLSv1", TLS1_VERSION},
        {"TLSv1.1", TLS1_1_VERSION},
        {"TLSv1.2", TLS1_2_VERSION},
-#ifndef OPENSSL_NO_GMTLS_VERSION
-        {"GMTLS", GMTLS_VERSION},
-#endif
        {"DTLSv1", DTLS1_VERSION},
-        {"DTLSv1.2", DTLS1_2_VERSION}
+        {"DTLSv1.2", DTLS1_2_VERSION},
+        {"GMTLS", GMTLS_VERSION}
    };
    size_t i;
    size_t n = OSSL_NELEM(versions);
@@ -529,9 +527,7 @@ static const ssl_conf_cmd_tbl ssl_conf_cmds[] = {
    SSL_CONF_CMD_SWITCH("no_tls1", 0),
    SSL_CONF_CMD_SWITCH("no_tls1_1", 0),
    SSL_CONF_CMD_SWITCH("no_tls1_2", 0),
-#ifndef OPENSSL_NO_GMTLS
    SSL_CONF_CMD_SWITCH("no_gmtls", 0),
-#endif
    SSL_CONF_CMD_SWITCH("bugs", 0),
    SSL_CONF_CMD_SWITCH("no_comp", 0),
    SSL_CONF_CMD_SWITCH("comp", 0),
@@ -589,9 +585,7 @@ static const ssl_switch_tbl ssl_cmd_switches[] = {
    {SSL_OP_NO_TLSv1, 0},       /* no_tls1 */
    {SSL_OP_NO_TLSv1_1, 0},     /* no_tls1_1 */
    {SSL_OP_NO_TLSv1_2, 0},     /* no_tls1_2 */
-#ifndef OPENSSL_NO_GMTLS_METHOD
    {SSL_OP_NO_GMTLS, 0},       /* no_gmtls */
-#endif
    {SSL_OP_ALL, 0},            /* bugs */
    {SSL_OP_NO_COMPRESSION, 0}, /* no_comp */
    {SSL_OP_NO_COMPRESSION, SSL_TFLAG_INV}, /* comp */
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -678,6 +678,11 @@ int SSL_is_dtls(const SSL *s)
    return SSL_IS_DTLS(s) ? 1 : 0;
 }

+int SSL_is_gmtls(const SSL *s)
+{
+    return SSL_IS_GMTLS(s) ? 1 : 0;
+}
+
 int SSL_up_ref(SSL *s)
 {
    int i;
@@ -2655,7 +2660,7 @@ void ssl_set_masks(SSL *s)
    have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID;
 #endif
 #ifndef OPENSSL_NO_SM2
-    have_sm2_cert = pvalid[SSL_PKEY_SM2_SIGN] & CERT_PKEY_VALID;
+    have_sm2_cert = pvalid[SSL_PKEY_SM2_ENC] & CERT_PKEY_VALID;
 #endif
    mask_k = 0;
    mask_a = 0;
@@ -2712,13 +2717,18 @@ void ssl_set_masks(SSL *s)
        ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE;
        if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN))
            ecdsa_ok = 0;
-        if (ecdsa_ok)
+        if (ecdsa_ok) {
+fprintf(stderr, "%s %d\n", __FILE__, __LINE__);
            mask_a |= SSL_aECDSA;
+            mask_a |= SSL_aSM2;//先将就一下
+        }
    }
 #endif
 #ifndef OPENSSL_NO_SM2
+    //这个现在不好用啊！
    if (have_sm2_cert) {
        uint32_t ex_kusage;
+fprintf(stderr, "%s %d\n", __FILE__, __LINE__);
        cpk = &c->pkeys[SSL_PKEY_SM2_SIGN];
        x = cpk->x509;
 	OPENSSL_assert(x);
@@ -2874,7 +2884,7 @@ EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,
    } else if ((alg_a & SSL_aECDSA) &&
               (c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
        idx = SSL_PKEY_ECC;
-#ifndef OPENSSL_NO_GMTLS_SM2
+#ifndef OPENSSL_NO_SM2
    else if ((alg_a & SSL_aSM2) &&
              (c->pkeys[SSL_PKEY_SM2_SIGN].privatekey != NULL))
        idx = SSL_PKEY_SM2_SIGN;
@@ -3156,10 +3166,8 @@ const char *ssl_protocol_to_string(int version)
        return "DTLSv1";
    else if (version == DTLS1_2_VERSION)
        return "DTLSv1.2";
-#ifndef OPENSSL_NO_GMTLS_METHOD
    else if (version == GMTLS_VERSION)
        return "GMTLSv1.1";
-#endif
    else
        return ("unknown");
 }
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -231,13 +231,11 @@
 # define SSL_kECDHEPSK           0x00000080U
 # define SSL_kDHEPSK             0x00000100U

-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define SSL_kSM2               0x00000200U
-#  define SSL_kSM2DHE            0x00000400U
-#  define SSL_kSM2PSK            0x00000800U
-#  define SSL_kSM9               0x00001000U
-#  define SSL_kSM9DHE            0x00002000U
-# endif
+# define SSL_kSM2               0x00000200U
+# define SSL_kSM2DHE            0x00000400U
+# define SSL_kSM2PSK            0x00000800U
+# define SSL_kSM9               0x00001000U
+# define SSL_kSM9DHE            0x00002000U

 /* all PSK */

@@ -260,11 +258,9 @@
 # define SSL_aSRP                0x00000040U
 /* GOST R 34.10-2012 signature auth */
 # define SSL_aGOST12             0x00000080U
-# ifndef OPENSSL_NO_GMTLS_METHOD
-/* SM2 */
+/* GMTLS */
 #  define SSL_aSM2               0x00000100U
 #  define SSL_aSM9               0x00000200U
-# endif

 /* Bits for algorithm_enc (symmetric encryption) */
 # define SSL_DES                 0x00000001U
@@ -287,24 +283,20 @@
 # define SSL_AES256CCM8          0x00020000U
 # define SSL_eGOST2814789CNT12   0x00040000U
 # define SSL_CHACHA20POLY1305    0x00080000U
-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define SSL_SMS4               0x00100000U
-#  define SSL_SMS4GCM            0x00200000U
-#  define SSL_SMS4CCM            0x00400000U
-#  define SSL_SMS4CCM8           0x00800000U
-#  define SSL_ZUC                0x01000000U
-#  define SSL_SM1                0x02000000U
-#  define SSL_SSF33              0x04000000U
-# endif
+# define SSL_SMS4                0x00100000U
+# define SSL_SMS4GCM             0x00200000U
+# define SSL_SMS4CCM             0x00400000U
+# define SSL_SMS4CCM8            0x00800000U
+# define SSL_ZUC                 0x01000000U
+# define SSL_SM1                 0x02000000U
+# define SSL_SSF33               0x04000000U

 # define SSL_AESGCM              (SSL_AES128GCM | SSL_AES256GCM)
 # define SSL_AESCCM              (SSL_AES128CCM | SSL_AES256CCM | SSL_AES128CCM8 | SSL_AES256CCM8)
 # define SSL_AES                 (SSL_AES128|SSL_AES256|SSL_AESGCM|SSL_AESCCM)
 # define SSL_CAMELLIA            (SSL_CAMELLIA128|SSL_CAMELLIA256)
 # define SSL_CHACHA20            (SSL_CHACHA20POLY1305)
-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define SSL_SMS4ALL            (SSL_SMS4 | SSL_SMS4GCM | SSL_SMS4CCM | SSL_SMS4CCM8)
-# endif
+# define SSL_SMS4ALL             (SSL_SMS4 | SSL_SMS4GCM | SSL_SMS4CCM | SSL_SMS4CCM8)

 /* Bits for algorithm_mac (symmetric authentication) */

@@ -319,9 +311,7 @@
 # define SSL_GOST12_256          0x00000080U
 # define SSL_GOST89MAC12         0x00000100U
 # define SSL_GOST12_512          0x00000200U
-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define SSL_SM3                0x00000400U
-# endif
+# define SSL_SM3                 0x00000400U

 /*
 * When adding new digest in the ssl_ciph.c and increment SSL_MD_NUM_IDX make
@@ -340,12 +330,8 @@
 # define SSL_MD_MD5_SHA1_IDX 9
 # define SSL_MD_SHA224_IDX 10
 # define SSL_MD_SHA512_IDX 11
-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define SSL_MD_SM3_IDX 12
-#  define SSL_MAX_DIGEST 13
-# else
-#  define SSL_MAX_DIGEST 12
-# endif
+# define SSL_MD_SM3_IDX 12
+# define SSL_MAX_DIGEST 13

 /* Bits for algorithm2 (handshake digests and other extra flags) */

@@ -358,9 +344,7 @@
 # define SSL_HANDSHAKE_MAC_GOST12_256 SSL_MD_GOST12_256_IDX
 # define SSL_HANDSHAKE_MAC_GOST12_512 SSL_MD_GOST12_512_IDX
 # define SSL_HANDSHAKE_MAC_DEFAULT  SSL_HANDSHAKE_MAC_MD5_SHA1
-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define SSL_HANDSHAKE_MAC_SM3     SSL_MD_SM3_IDX
-# endif
+# define SSL_HANDSHAKE_MAC_SM3      SSL_MD_SM3_IDX

 /* Bits 8-15 bits are PRF */
 # define TLS1_PRF_DGST_SHIFT 8
@@ -370,10 +354,8 @@
 # define TLS1_PRF_GOST94 (SSL_MD_GOST94_IDX << TLS1_PRF_DGST_SHIFT)
 # define TLS1_PRF_GOST12_256 (SSL_MD_GOST12_256_IDX << TLS1_PRF_DGST_SHIFT)
 # define TLS1_PRF_GOST12_512 (SSL_MD_GOST12_512_IDX << TLS1_PRF_DGST_SHIFT)
-# define TLS1_PRF            (SSL_MD_MD5_SHA1_IDX << TLS1_PRF_DGST_SHIFT)
-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define TLS1_PRF_SM3 (SSL_MD_SM3_IDX << TLS1_PRF_DGST_SHIFT)
-# endif
+# define TLS1_PRF        (SSL_MD_MD5_SHA1_IDX << TLS1_PRF_DGST_SHIFT)
+# define TLS1_PRF_SM3    (SSL_MD_SM3_IDX << TLS1_PRF_DGST_SHIFT)

 /*
 * Stream MAC for GOST ciphersuites from cryptopro draft (currently this also
@@ -443,14 +425,10 @@
 # define SSL_PKEY_GOST01         4
 # define SSL_PKEY_GOST12_256     5
 # define SSL_PKEY_GOST12_512     6
-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define SSL_PKEY_SM2_ENC       7
-#  define SSL_PKEY_SM2_SIGN      8
-#  define SSL_PKEY_SM9           9
-#  define SSL_PKEY_NUM          10
-# else
-#  define SSL_PKEY_NUM           7
-# endif
+# define SSL_PKEY_SM2_ENC        7
+# define SSL_PKEY_SM2_SIGN       8
+# define SSL_PKEY_SM9_SIGN       9
+# define SSL_PKEY_NUM           10

 /*
 * Pseudo-constant. GOST cipher suites can use different certs for 1
@@ -591,7 +569,7 @@ struct ssl_session_st {
    int not_resumable;
    /* This is the cert and type for the other end. */
    X509 *peer;
-# ifndef OPENSSL_NO_GMTLS_METHOD
+# ifndef OPENSSL_NO_GMTLS
    X509 *peer_extra;
    char *peer_identity;
    CERT_SM9 ibe;
@@ -1726,12 +1704,9 @@ __owur const SSL_METHOD *dtls_bad_ver_client_method(void);
 __owur const SSL_METHOD *dtlsv1_2_method(void);
 __owur const SSL_METHOD *dtlsv1_2_server_method(void);
 __owur const SSL_METHOD *dtlsv1_2_client_method(void);
-#ifndef OPENSSL_NO_GMTLS_METHOD
 __owur const SSL_METHOD *gmtls_method(void);
 __owur const SSL_METHOD *gmtls_server_method(void);
 __owur const SSL_METHOD *gmtls_client_method(void);
-#endif
-

 extern const SSL3_ENC_METHOD TLSv1_enc_data;
 extern const SSL3_ENC_METHOD TLSv1_1_enc_data;
@@ -1739,9 +1714,7 @@ extern const SSL3_ENC_METHOD TLSv1_2_enc_data;
 extern const SSL3_ENC_METHOD SSLv3_enc_data;
 extern const SSL3_ENC_METHOD DTLSv1_enc_data;
 extern const SSL3_ENC_METHOD DTLSv1_2_enc_data;
-# ifndef OPENSSL_NO_GMTLS_METHOD
 extern const SSL3_ENC_METHOD GMTLS_enc_data;
-# endif

 /*
 * Flags for SSL methods
@@ -1750,9 +1723,8 @@ extern const SSL3_ENC_METHOD GMTLS_enc_data;
 # define SSL_METHOD_NO_SUITEB    (1U<<1)


-# ifndef OPENSSL_NO_GMTLS_METHOD
-#  define IMPLEMENT_gmtls_meth_func(flags, mask, func_name, s_accept, \
-                                    s_connect, enc_data) \
+# define IMPLEMENT_gmtls_meth_func(flags, mask, func_name, s_accept, \
+                                   s_connect, enc_data) \
 const SSL_METHOD *func_name(void)  \
        { \
        static const SSL_METHOD func_name##_data= { \
@@ -1788,7 +1760,6 @@ const SSL_METHOD *func_name(void)  \
        }; \
        return &func_name##_data; \
        }
-# endif /* OPENSSL_NO_GMTLS_METHOD */

 # define IMPLEMENT_tls_meth_func(version, flags, mask, func_name, s_accept, \
                                 s_connect, enc_data) \
@@ -1828,15 +1799,6 @@ const SSL_METHOD *func_name(void)  \
        return &func_name##_data; \
        }

-
-
-
-
-
-
-
-
-
 # define IMPLEMENT_ssl3_meth_func(func_name, s_accept, s_connect) \
 const SSL_METHOD *func_name(void)  \
        { \
@@ -2114,9 +2076,7 @@ __owur int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
                                       int use_context);
 __owur int tls1_alert_code(int code);
 __owur int ssl3_alert_code(int code);
-#  ifndef OPENSSL_NO_GMTLS_METHOD
 __owur int gmtls_alert_code(int code);
-#  endif
 __owur int ssl_ok(SSL *s);

 #  ifndef OPENSSL_NO_EC
--- a/ssl/ssl_rsa.c
+++ b/ssl/ssl_rsa.c
@@ -129,6 +129,7 @@ static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
        return (0);
    }

+#ifndef OPENSSL_NO_SM2
    /* set private key even without keyUsage in cert */
    if (i == SSL_PKEY_SM2_SIGN) {
        if (c->pkeys[SSL_PKEY_SM2_ENC].privatekey)
@@ -140,6 +141,7 @@ static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
        else
            i = SSL_PKEY_SM2_SIGN;
    }
+#endif

    if (c->pkeys[i].x509 != NULL) {
        EVP_PKEY *pktmp;
@@ -159,8 +161,6 @@ static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
        /*
         * Don't check the public/private key, this is mostly for smart
         * cards.
-	 * SM2和EC也可能是智能卡！
-	 *					
         */
        if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA
            && RSA_flags(EVP_PKEY_get0_RSA(pkey)) & RSA_METHOD_FLAG_NO_CHECK) ;
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -153,7 +153,7 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
    if (src->peer != NULL)
        X509_up_ref(src->peer);

-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    if (src->peer_extra != NULL)
        X509_up_ref(src->peer_extra);
 #endif
@@ -764,7 +764,7 @@ void SSL_SESSION_free(SSL_SESSION *ss)
    OPENSSL_cleanse(ss->master_key, sizeof ss->master_key);
    OPENSSL_cleanse(ss->session_id, sizeof ss->session_id);
    X509_free(ss->peer);
-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    X509_free(ss->peer_extra);
 #endif
    sk_X509_pop_free(ss->peer_chain, X509_free);
@@ -899,7 +899,7 @@ X509 *SSL_SESSION_get0_peer(SSL_SESSION *s)
    return s->peer;
 }

-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
 X509 *SSL_SESSION_get0_peer_extra(SSL_SESSION *s)
 {
    return s->peer_extra;
--- a/ssl/ssl_stat.c
+++ b/ssl/ssl_stat.c
@@ -286,7 +286,7 @@ const char *SSL_alert_desc_string(int value)
        return "BH";
    case TLS1_AD_UNKNOWN_PSK_IDENTITY:
        return "UP";
-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    case GMTLS_AD_UNSUPPORTED_SITE2SITE:
        return "U2";
    case GMTLS_AD_NO_AREA:
@@ -370,7 +370,7 @@ const char *SSL_alert_desc_string_long(int value)
        return "unknown PSK identity";
    case TLS1_AD_NO_APPLICATION_PROTOCOL:
        return "no application protocol";
-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    case GMTLS_AD_UNSUPPORTED_SITE2SITE:
        return "unsupported site2site";
    case GMTLS_AD_NO_AREA:
--- a/ssl/statem/statem_clnt.c
+++ b/ssl/statem/statem_clnt.c
@@ -1,3 +1,51 @@
+/* ====================================================================
+ * Copyright (c) 2014 - 2017 The GmSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the GmSSL Project.
+ *    (http://gmssl.org/)"
+ *
+ * 4. The name "GmSSL Project" must not be used to endorse or promote
+ *    products derived from this software without prior written
+ *    permission. For written permission, please contact
+ *    guanzhi1980@gmail.com.
+ *
+ * 5. Products derived from this software may not be called "GmSSL"
+ *    nor may "GmSSL" appear in their names without prior written
+ *    permission of the GmSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the GmSSL Project
+ *    (http://gmssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE GmSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
 /*
 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
 *
@@ -60,13 +108,13 @@
 #ifndef OPENSSL_NO_DH
 # include <openssl/dh.h>
 #endif
+#ifndef OPENSSL_NO_SM2
+# include <openssl/sm2.h>
+#endif
 #include <openssl/bn.h>
 #ifndef OPENSSL_NO_ENGINE
 # include <openssl/engine.h>
 #endif
-#ifndef OPENSSL_NO_SM2
-# include <openssl/sm2.h>
-#endif

 static ossl_inline int cert_req_allowed(SSL *s);
 static int key_exchange_expected(SSL *s);
@@ -89,7 +137,6 @@ static ossl_inline int cert_req_allowed(SSL *s)
        || (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aSRP | SSL_aPSK)))
        return 0;

-    /* gmtls ciphers always allow req */
    return 1;
 }

@@ -104,11 +151,10 @@ static int key_exchange_expected(SSL *s)
 {
    long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

-#ifndef OPENSSL_NO_GMTLS_METHOD
-    if (s->version == GMTLS_VERSION)
+#ifndef OPENSSL_NO_GMTLS
+    if (SSL_IS_GMTLS(s))
        return 1;
 #endif
-
    /*
     * Can't skip server key exchange if this is an ephemeral
     * ciphersuite or for SRP
@@ -649,9 +695,8 @@ MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt)
 #ifndef OPENSSL_NO_GMTLS
        if (SSL_IS_GMTLS(s))
            return tls_process_server_certificate(s, pkt);
-        else
 #endif
-            return tls_process_server_certificate(s, pkt);
+        return tls_process_server_certificate(s, pkt);

    case TLS_ST_CR_CERT_STATUS:
        return tls_process_cert_status(s, pkt);
@@ -660,9 +705,8 @@ MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt)
 #ifndef OPENSSL_NO_GMTLS
        if (SSL_IS_GMTLS(s))
            return gmtls_process_server_key_exchange(s, pkt);
-        else
 #endif
-            return tls_process_server_key_exchange(s, pkt);
+        return tls_process_server_key_exchange(s, pkt);

    case TLS_ST_CR_CERT_REQ:
        return tls_process_certificate_request(s, pkt);
@@ -1544,11 +1588,6 @@ static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey, int *al)
 #endif
 }

-//这个函数实际上就是从packet里面读取曲线参数，对方临时公钥
-//把这个临时公钥设置到s->s3->peer_tmp （在哪儿处理的？）
-//然后再根据认证算法(s->s3->tmp.new_cipher->algorithm_auth 确定对方的签名算法（应该是证书中拿到的）
-//最后从s->session->peer中取出对方的签名公钥，从pkey参数返回
-//这个函数并不去处理签名值，而是留给后续处理，因此sm2的话不提取任何数据，这个函数是无效的
 static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey, int *al)
 {
 #ifndef OPENSSL_NO_EC
@@ -1633,10 +1672,9 @@ static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey, int *al)
     * ECParameters in the server key exchange message. We do support RSA
     * and ECDSA.
     */
-    // 这里的s->session->peer 应该是在处理证书消息的时候设定的，要看看具体在哪儿
    if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA)
        *pkey = X509_get0_pubkey(s->session->peer);
-#ifndef OPENSSL_NO_GMTLS
+#ifndef OPENSSL_NO_SM2
    else if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aSM2)
        *pkey = X509_get0_pubkey(s->session->peer);
 #endif
@@ -2292,13 +2330,9 @@ static int tls_construct_cke_rsa(SSL *s, unsigned char **p, int *len, int *al)
    }

    q = *p;
-    /* Fix buf for TLS and beyond */
-    if (s->version > SSL3_VERSION)
+    /* Fix buf for TLS, GMTLS and beyond */
+    if (s->version > SSL3_VERSION || SSL_IS_GMTLS(s))
        *p += 2;
-#ifndef OPENSSL_NO_GMTLS_METHOD
-    if (s->version == GMTLS_VERSION)
-        *p += 2;
-#endif
    pctx = EVP_PKEY_CTX_new(pkey, NULL);
    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0
        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {
@@ -2317,21 +2351,13 @@ static int tls_construct_cke_rsa(SSL *s, unsigned char **p, int *len, int *al)
        (*p)[1]++;
    if (s->options & SSL_OP_PKCS1_CHECK_2)
        tmp_buf[0] = 0x70;
-				
-	// tmp_buf 没有定义，可能出现了编辑错误！
 # endif

    /* Fix buf for TLS and beyond */
-    if (s->version > SSL3_VERSION) {
+    if (s->version > SSL3_VERSION || SSL_IS_GMTLS(s)) {
        s2n(*len, q);
        *len += 2;
    }
-#ifndef OPENSSL_NO_GMTLS_METHOD
-    if (s->version == GMTLS_VERSION) {
-        s2n(*len, q);
-        *len += 2;
-    }
-#endif

    s->s3->tmp.pms = pms;
    s->s3->tmp.pmslen = pmslen;
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -1,3 +1,51 @@
+/* ====================================================================
+ * Copyright (c) 2014 - 2017 The GmSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the GmSSL Project.
+ *    (http://gmssl.org/)"
+ *
+ * 4. The name "GmSSL Project" must not be used to endorse or promote
+ *    products derived from this software without prior written
+ *    permission. For written permission, please contact
+ *    guanzhi1980@gmail.com.
+ *
+ * 5. Products derived from this software may not be called "GmSSL"
+ *    nor may "GmSSL" appear in their names without prior written
+ *    permission of the GmSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the GmSSL Project
+ *    (http://gmssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE GmSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
 /*
 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
 *
@@ -230,8 +278,8 @@ static int send_server_key_exchange(SSL *s)
 {
    unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

-#ifndef OPENSSL_NO_GMTLS_METHOD
-    if (s->method->version == GMTLS_VERSION)
+#ifndef OPENSSL_NO_GMTLS
+    if (SSL_IS_GMTLS(s))
        return 1;
 #endif

@@ -643,17 +691,15 @@ int ossl_statem_server_construct_message(SSL *s)
 #ifndef OPENSSL_NO_GMTLS
        if (SSL_IS_GMTLS(s))
            return tls_construct_server_certificate(s)
-        else
 #endif
-            return tls_construct_server_certificate(s);
+        return tls_construct_server_certificate(s);

    case TLS_ST_SW_KEY_EXCH:
 #ifndef OPENSSL_NO_GMTLS
        if (SSL_IS_GMTLS(s))
            return gmtls_construct_server_key_exchange(s)
-        else
 #endif
-            return tls_construct_server_key_exchange(s);
+        return tls_construct_server_key_exchange(s);

    case TLS_ST_SW_CERT_REQ:
        return tls_construct_certificate_request(s);
@@ -760,20 +806,18 @@ MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt)
        return tls_process_client_hello(s, pkt);

    case TLS_ST_SR_CERT:
-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
        if (SSL_IS_GMTLS(s))
            return tls_process_client_certificate(s, pkt);
-        else
 #endif
-	    return tls_process_client_certificate(s, pkt);
+        return tls_process_client_certificate(s, pkt);

    case TLS_ST_SR_KEY_EXCH:
 #ifndef OPENSSL_NO_GMTLS
        if (SSL_IS_GMTLS(s))
            return gmtls_process_client_key_exchange(s, pkt);
-        else
 #endif
-	    return tls_process_client_key_exchange(s, pkt);
+        return tls_process_client_key_exchange(s, pkt);

    case TLS_ST_SR_CERT_VRFY:
        return tls_process_cert_verify(s, pkt);
@@ -984,7 +1028,7 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
        } else if ((version & 0xff00) == (SSL3_VERSION_MAJOR << 8)) {
            /* SSLv3/TLS */
            s->client_version = version;
-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
        } else if (version == GMTLS_VERSION) {
            s->client_version = version;
 #endif
@@ -1273,7 +1317,7 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
        }
    }

-#ifndef OPENSSL_NO_GMTLS_METHOD
+#ifndef OPENSSL_NO_GMTLS
    if (!s->hit && (s->version == GMTLS_VERSION || s->version >= TLS1_VERSION)
 	&& s->tls_session_secret_cb) {
 #else
@@ -1668,7 +1712,7 @@ int tls_construct_server_key_exchange(SSL *s)
    BUF_MEM *buf;
    EVP_MD_CTX *md_ctx = NULL;

-    if (!(md_ctx == EVP_MD_CTX_new())) {
+    if (!(md_ctx = EVP_MD_CTX_new())) {
        SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
        al = SSL_AD_INTERNAL_ERROR;
        goto f_err;
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -84,7 +84,6 @@ SSL3_ENC_METHOD const TLSv1_2_enc_data = {
    ssl3_handshake_write
 };

-#ifndef OPENSSL_NO_GMTLS_METHOD
 SSL3_ENC_METHOD const GMTLS_enc_data = {
    tls1_enc,
    tls1_mac,
@@ -102,7 +101,6 @@ SSL3_ENC_METHOD const GMTLS_enc_data = {
    ssl3_set_handshake_header,
    ssl3_handshake_write
 };
-#endif

 long tls1_default_timeout(void)
 {
@@ -179,9 +177,7 @@ static const tls_curve_info nid_list[] = {
    {NID_brainpoolP384r1, 192, TLS_CURVE_PRIME}, /* brainpoolP384r1 (27) */
    {NID_brainpoolP512r1, 256, TLS_CURVE_PRIME}, /* brainpool512r1 (28) */
    {NID_X25519, 128, TLS_CURVE_CUSTOM}, /* X25519 (29) */
-#ifndef OPENSSL_NO_GMTLS
    {NID_sm2p256v1, 128, TLS_CURVE_PRIME}, /* sm2p256v1 (30) */
-#endif
 };

 static const unsigned char ecformats_default[] = {
@@ -192,9 +188,7 @@ static const unsigned char ecformats_default[] = {

 /* The default curves */
 static const unsigned char eccurves_default[] = {
-#ifndef OPENSSL_NO_GMTLS
-    0, 30,                      /* sm2p256v1 (30) */
-#endif
+    0, 30,                      /* sm2p256v1 (30) */			
    0, 29,                      /* X25519 (29) */
    0, 23,                      /* secp256r1 (23) */
    0, 25,                      /* secp521r1 (25) */
@@ -345,8 +339,8 @@ int tls1_shared_curve(SSL *s, int nmatch)
    size_t num_pref, num_supp, i, j;
    int k;

-#ifndef OPENSSL_NO_GMTLS_METHOD
-    if (s->method->version == GMTLS_VERSION)
+#ifndef OPENSSL_NO_GMTLS
+    if (SSL_IS_GMTLS(s))
        return NID_sm2p256v1;
 #endif

@@ -3005,13 +2999,8 @@ int tls_check_serverhello_tlsext_early(SSL *s, const PACKET *ext,
     * If tickets disabled behave as if no ticket present to permit stateful
     * resumption.
     */
-#ifndef OPENSSL_NO_GMTLS_METHOD
    if ((s->version <= SSL3_VERSION) && (s->version != GMTLS_VERSION))
        return 0;
-#else
-    if ((s->version <= SSL3_VERSION))
-        return 0;
-#endif

    if (!PACKET_get_net_2(&local_ext, &i)) {
        retv = 0;
--- a/ssl/t1_trce.c
+++ b/ssl/t1_trce.c
@@ -61,12 +61,10 @@ static ssl_trace_tbl ssl_version_tbl[] = {
    {TLS1_VERSION, "TLS 1.0"},
    {TLS1_1_VERSION, "TLS 1.1"},
    {TLS1_2_VERSION, "TLS 1.2"},
-#ifndef OPENSSL_NO_GMTLS_VERSION
-    {GMTLS_VERSION, "GMTLS 1.1"},
-#endif
    {DTLS1_VERSION, "DTLS 1.0"},
    {DTLS1_2_VERSION, "DTLS 1.2"},
-    {DTLS1_BAD_VER, "DTLS 1.0 (bad)"}
+    {DTLS1_BAD_VER, "DTLS 1.0 (bad)"},
+    {GMTLS_VERSION, "GMTLS 1.1"}
 };

 static ssl_trace_tbl ssl_content_tbl[] = {
@@ -425,8 +423,7 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = {
    {0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305"},
    {0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305"},
    {0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305"},
-#ifndef OPENSSL_NO_GMTLS_METHOD
-# if 1 /* GM/T 0024 official names */
+# if 0 /* GM/T 0024 official names */
    {0xE001, "GMT_ECDHE_SM1_SM3"},
    {0xE003, "GMT_ECC_SM1_SM3"},
    {0xE005, "GMT_IBSDH_SM1_SM3"},
@@ -468,7 +465,6 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = {
    {0xE10A, "GMTLS_ECDHE_SM2_WITH_SMS4_GCM_SHA256"},
    {0xE10B, "GMTLS_ECDHE_SM2_WITH_SMS4_CCM_SHA256"},
    {0xE10C, "GMTLS_ECDHE_SM2_WITH_SMS4_CCM_8_SHA256"},
-#endif
    {0xFEFE, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
    {0xFEFF, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"},

@@ -539,9 +535,7 @@ static ssl_trace_tbl ssl_curve_tbl[] = {
    {27, "brainpoolP384r1"},
    {28, "brainpoolP512r1"},
    {29, "ecdh_x25519"},
-#ifndef OPENSSL_NO_GMTLS_METHOD
-    {30, "sm2p256v1"},
-#endif
+    {30, "sm2p256v1"},			
    {0xFF01, "arbitrary_explicit_prime_curves"},
    {0xFF02, "arbitrary_explicit_char2_curves"}
 };
@@ -560,9 +554,7 @@ static ssl_trace_tbl ssl_md_tbl[] = {
    {TLSEXT_hash_sha256, "sha256"},
    {TLSEXT_hash_sha384, "sha384"},
    {TLSEXT_hash_sha512, "sha512"},
-#ifndef OPENSSL_NO_GMTLS_METHOD
    {TLSEXT_hash_sm3, "sm3"},
-#endif
    {TLSEXT_hash_gostr3411, "md_gost94"},
    {TLSEXT_hash_gostr34112012_256, "md_gost2012_256"},
    {TLSEXT_hash_gostr34112012_512, "md_gost2012_512"}
@@ -573,9 +565,7 @@ static ssl_trace_tbl ssl_sig_tbl[] = {
    {TLSEXT_signature_rsa, "rsa"},
    {TLSEXT_signature_dsa, "dsa"},
    {TLSEXT_signature_ecdsa, "ecdsa"},
-#ifndef OPENSSL_NO_GMTLS_METHOD
    {TLSEXT_signature_sm2sign, "sm2sign"},
-#endif
    {TLSEXT_signature_gostr34102001, "gost2001"},
    {TLSEXT_signature_gostr34102012_256, "gost2012_256"},
    {TLSEXT_signature_gostr34102012_512, "gost2012_512"}
@@ -599,9 +589,7 @@ static ssl_trace_tbl ssl_ctype_tbl[] = {
    {5, "rsa_ephemeral_dh"},
    {6, "dss_ephemeral_dh"},
    {20, "fortezza_dms"},
-#ifndef OPENSSL_NO_GMTLS_METHOD
    {7,  "sm2_sign"},
-#endif
    {64, "ecdsa_sign"},
    {65, "rsa_fixed_ecdh"},
    {66, "ecdsa_fixed_ecdh"}
@@ -958,7 +946,6 @@ static int ssl_get_keyex(const char **pname, SSL *ssl)
        *pname = "GOST";
        return SSL_kGOST;
    }
-#ifndef OPENSSL_NO_GMTLS
    if (alg_k & SSL_kSM2) {
        *pname = "SM2";
        return SSL_kSM2;
@@ -979,7 +966,6 @@ static int ssl_get_keyex(const char **pname, SSL *ssl)
        *pname = "SM9DHE";
        return SSL_kSM9DHE;
    }
-#endif
    *pname = "UNKNOWN";
    return 0;
 }
@@ -1023,7 +1009,6 @@ static int ssl_print_client_keyex(BIO *bio, int indent, SSL *ssl,
            return 0;
        break;

-#ifndef OPENSSL_NO_GMTLS
    case SSL_kSM2:
    case SSL_kSM9:
        if (!ssl_print_hexbuf(bio, indent + 2,
@@ -1041,7 +1026,6 @@ static int ssl_print_client_keyex(BIO *bio, int indent, SSL *ssl,
        if (!ssl_print_hexbuf(bio, indent + 2, "sm9_Yc", 1, &msg, &msglen))
            return 0;
        break;
-#endif
    }

    return !msglen;
@@ -1083,10 +1067,8 @@ static int ssl_print_server_keyex(BIO *bio, int indent, SSL *ssl,
 # ifndef OPENSSL_NO_EC
    case SSL_kECDHE:
    case SSL_kECDHEPSK:
-#  ifndef OPENSSL_NO_GMTLS
    case SSL_kSM2DHE:
    case SSL_kSM2PSK:
-#  endif
        if (msglen < 1)
            return 0;
        BIO_indent(bio, indent + 2, 80);