abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-08-07 12:33:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update TLS 1.3

Browse Source 
KeyUpdate passed.
This commit is contained in:
Zhi Guan
2026-05-17 11:44:43 +08:00
parent a423251fe8
commit 290d699336
8 changed files with 437 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files

137
tools/tls13_client.c
View File

@@ -53,6 +53,7 @@ static const char *help =
" -sess_in Load server's session ticket file\n"
" -sess_out Save server's session ticket file\n"
" -early_data file Send early data, -psk_ke and/or -psk_dhe_ke should be set\n"
" -key_update_seq_num num Send KeyUpdate handshake after sending/receiving <num> records\n"
" -post_handshake_auth Support post_handshake_auth\n"
"\n"
"CipherSuites\n"
@@ -108,6 +109,9 @@ int tls13_client_main(int argc, char *argv[])
char buf[1024] = {0};
size_t len = sizeof(buf);
char send_buf[1024] = {0};
size_t sent_len = 0;
size_t sent_offset = 0;
char *sess_in = NULL;
char *sess_out = NULL;
@@ -153,8 +157,14 @@ int tls13_client_main(int argc, char *argv[])
int signature_algorithms_cert = 0;
int status_request = 0;
int signed_certificate_timestamp = 0;
int key_update_seq_num = 0;
int post_handshake_auth = 0;
int send_again = 0;
argc--;
argv++;
if (argc < 1) {
@@ -285,6 +295,14 @@ int tls13_client_main(int argc, char *argv[])
error_print();
return -1;
}
} else if (!strcmp(*argv, "-key_update_seq_num")) {
if (--argc < 1) goto bad;
key_update_seq_num = atoi(*(++argv));
if (key_update_seq_num < 0) {
error_print();
fprintf(stderr, "%s: invalid '-key_update_seq_num' value\n", prog);
return -1;
}
} else {
fprintf(stderr, "%s: invalid option '%s'\n", prog, *argv);
return 1;
@@ -381,8 +399,12 @@ bad:
if (key_update_seq_num > 0) {
if (tls_ctx_set_key_update_seq_num_limit(&ctx, key_update_seq_num) != 1) {
error_print();
return -1;
}
}
if (tls13_init(&conn, &ctx) != 1) {
@@ -558,75 +580,112 @@ bad:
for (;;) {
fd_set fds;
fd_set fds_send;
fd_set fds_recv;
size_t sentlen;
FD_ZERO(&fds);
FD_ZERO(&fds_send);
FD_ZERO(&fds_recv);
// listen socket
FD_SET(conn.sock, &fds);
FD_SET(conn.sock, &fds_recv);
// listen stdin
FD_SET(fileno(stdin), &fds);
FD_SET(fileno(stdin), &fds_recv);
if (sent_len > 0) {
FD_SET(conn.sock, &fds_send);
}
// 等待阻塞
if (select((int)(conn.sock + 1), // In WinSock2, select() ignore the this arg
&fds, NULL, NULL, NULL) < 0) {
&fds_recv, &fds_send, NULL, NULL) < 0) {
fprintf(stderr, "%s: select failed\n", prog);
goto end;
}
/*
if (!fgets(send_buf, sizeof(send_buf), stdin)) {
if (feof(stdin)) {
tls_shutdown(&conn);
goto end;
} else {
continue;
}
}
if (tls13_send(&conn, (uint8_t *)send_buf, strlen(send_buf), &sentlen) != 1) {
fprintf(stderr, "%s: send error\n", prog);
goto end;
}
*/
// 读socket
if (FD_ISSET(conn.sock, &fds_recv)) {
if (FD_ISSET(conn.sock, &fds)) {
for (;;) {
memset(buf, 0, sizeof(buf));
if (tls13_recv(&conn, (uint8_t *)buf, sizeof(buf), &len) != 1) {
memset(buf, 0, sizeof(buf));
if ((ret = tls13_recv(&conn, (uint8_t *)buf, sizeof(buf), &len)) != 1) {
if (ret == TLS_ERROR_SEND_AGAIN || ret == TLS_ERROR_RECV_AGAIN) {
continue;
} else {
error_print();
goto end;
}
fwrite(buf, 1, len, stdout);
fflush(stdout);
// FIXME: change tls13_recv API
if (conn.datalen == 0) {
break;
}
}
fwrite(buf, 1, len, stdout);
fflush(stdout);
format_bytes(stderr, 0, 0, "tls13_recv return", buf, len);
// FIXME: change tls13_recv API
/*
if (conn.datalen == 0) {
error_print();
break;
}
*/
}
if (FD_ISSET(fileno(stdin), &fds)) {
// 读用户输入
if (FD_ISSET(fileno(stdin), &fds_recv)) {
memset(send_buf, 0, sizeof(send_buf));
if (!fgets(send_buf, sizeof(send_buf), stdin)) {
if (feof(stdin)) {
error_print();
fprintf(stderr, "client shutdown\n");
tls_shutdown(&conn);
goto end;
} else {
continue;
}
}
if (tls13_send(&conn, (uint8_t *)send_buf, strlen(send_buf), &sentlen) != 1) {
fprintf(stderr, "%s: send error\n", prog);
goto end;
}
sent_len = strlen(send_buf) + 1;
sent_offset = 0;
fprintf(stderr, "###############################\n");
fprintf(stderr, "sentlen = %zu\n", sentlen);
format_bytes(stderr, 0, 0, "send hex", send_buf, sent_len);
fprintf(stderr, "sent_len = %zu\n", sent_len);
fprintf(stderr, "sent_offset = %zu\n", sent_offset);
}
if (sent_len > 0 && FD_ISSET(conn.sock, &fds_send)) {
// tls13_send 会返回一个 -1 , 但是没有打印错误信息！！！！
if ((ret = tls13_send(&conn, (uint8_t *)send_buf + sent_offset, sent_len, &sentlen)) != 1) {
if (ret == TLS_ERROR_SEND_AGAIN || ret == TLS_ERROR_RECV_AGAIN) {
continue;
} else {
fprintf(stderr, "ret = %d\n", ret);
fprintf(stderr, "%s: send error\n", prog);
goto end;
}
}
sent_offset += sentlen;
sent_len -= sentlen;
fprintf(stderr, "###############################\n");
fprintf(stderr, "sentlen = %zu\n", sentlen);
fprintf(stderr, "sent_len = %zu\n", sent_len);
fprintf(stderr, "sent_offset = %zu\n", sent_offset);
}
fprintf(stderr, "\n\n\n\n");
}
end:

127
tools/tls13_server.c
View File

@@ -24,8 +24,10 @@
// psk_cipher_suite 和 cipher_suite 是冗余的
// 现在我要尝试CertificateRequest
//
// 重新思考一下，各个层次如何将各自的输入输出打印出来，特别是在record层
// 每个报文包括密文和明文，应该将两者紧密连在一起，没有空格
// 在报文层，只显示明文的16进制，但是在上层，应该显示明文的ASCII和HEX，能够看清楚消息
static const char *options = "[-port num] -cert file -key file -pass str [-cacert file]";
@@ -51,6 +53,7 @@ static const char *help =
" -max_early_data_size num Set extension max_early_data_size\n"
" -cert_request Client certificate request\n"
" -cacert file CA certificate for client certificate verification\n"
" -key_update_seq_num num Send KeyUpdate handshake after sending/receiving <num> records\n"
"\n"
" -cipher_suite options\n"
" TLS_SM4_GCM_SM3 TLS 1.3\n"
@@ -315,10 +318,14 @@ int tls13_server_main(int argc , char **argv)
int sig_algs[4];
size_t sig_algs_cnt = 0;
int key_update_seq_num = 0;
size_t i;
int cert_request = 0;
char *cacertfile = NULL;
@@ -453,6 +460,14 @@ int tls13_server_main(int argc , char **argv)
return -1;
}
sig_algs[sig_algs_cnt++] = sig_alg;
} else if (!strcmp(*argv, "-key_update_seq_num")) {
if (--argc < 1) goto bad;
key_update_seq_num = atoi(*(++argv));
if (key_update_seq_num < 0) {
error_print();
fprintf(stderr, "%s: invalid '-key_update_seq_num' value\n", prog);
return -1;
}
} else {
fprintf(stderr, "%s: invalid option '%s'\n", prog, *argv);
return 1;
@@ -589,6 +604,12 @@ bad:
}
}
if (key_update_seq_num > 0) {
if (tls_ctx_set_key_update_seq_num_limit(&ctx, key_update_seq_num) != 1) {
error_print();
return -1;
}
}
if (tls_socket_create(&sock, AF_INET, SOCK_STREAM, 0) != 1) {
fprintf(stderr, "%s: socket create error\n", prog);
@@ -677,74 +698,98 @@ restart:
format_string(stderr, 0, 0, "EarlyData", conn.early_data_buf, conn.early_data_len);
}
size_t send_len = 0;
size_t send_offset = 0;
// 如果客户端发送的数据比较长，会被切分为多个record
// 服务器在接收到record之后，必须做同步，就是每收到一个record必须返回一个record
// 也就是server必须有一个同步机制
for (;;) {
fd_set fds_recv;
fd_set fds_send; // 只有在接收数据之后才需要设置
fd_set fds;
size_t sentlen;
FD_ZERO(&fds);
FD_ZERO(&fds_recv);
FD_ZERO(&fds_send);
// listen socket
FD_SET(conn.sock, &fds);
FD_SET(conn.sock, &fds_recv);
if (send_len > 0) {
FD_SET(conn.sock, &fds_send);
}
// 等待阻塞
if (select((int)(conn.sock + 1), // In WinSock2, select() ignore the this arg
&fds, NULL, NULL, NULL) < 0) {
&fds_recv, &fds_send, NULL, NULL) < 0) {
fprintf(stderr, "%s: select failed\n", prog);
goto end;
}
if (FD_ISSET(conn.sock, &fds)) {
for (;;) {
memset(buf, 0, sizeof(buf));
if (tls13_recv(&conn, (uint8_t *)buf, sizeof(buf), &len) != 1) {
goto end;
}
fwrite(buf, 1, len, stdout);
fflush(stdout);
// FIXME: change tls13_recv API
if (conn.datalen == 0) {
break;
}
}
if (send_len > 0 && FD_ISSET(conn.sock, &fds_send)) {
fprintf(stderr, ">>>>>>>> send back\n");
if (tls13_send(&conn, (uint8_t *)buf, len, &sentlen) != 1) {
format_bytes(stderr, 0, 0, "tls13_send", buf + send_offset, send_len);
if ((ret = tls13_send(&conn, (uint8_t *)buf + send_offset, send_len, &sentlen)) != 1) {
if (ret == TLS_ERROR_SEND_AGAIN || ret == TLS_ERROR_RECV_AGAIN) {
continue;
}
fprintf(stderr, "%s: send error\n", prog);
goto end;
}
send_offset += sentlen;
send_len -= sentlen;
fprintf(stderr, "---------------\n");
//memset(conn.record, 0, sizeof(conn.record));
//memset(conn.plain_record, 0, sizeof(conn.plain_record));
}
}
for (;;) {
if (FD_ISSET(conn.sock, &fds_recv)) {
int rv;
size_t sentlen;
memset(buf, 0, sizeof(buf));
do {
len = sizeof(buf);
if ((rv = tls13_recv(&conn, (uint8_t *)buf, sizeof(buf), &len)) != 1) {
if (rv < 0) fprintf(stderr, "%s: recv failure\n", prog);
else fprintf(stderr, "%s: Disconnected by remote\n", prog);
//close(conn.sock);
tls_cleanup(&conn);
goto restart;
if ((ret = tls13_recv(&conn, (uint8_t *)buf, sizeof(buf), &len)) != 1) {
if (ret == TLS_ERROR_SEND_AGAIN || ret == TLS_ERROR_RECV_AGAIN) {
continue;
}
error_print();
goto end;
}
} while (!len);
fwrite(buf, 1, len, stdout);
fflush(stdout);
if (tls13_send(&conn, (uint8_t *)buf, len, &sentlen) != 1) {
fprintf(stderr, "%s: send failure, close connection\n", prog);
tls_socket_close(conn.sock);
goto end;
send_len = len;
send_offset = 0;
/*
// FIXME: change tls13_recv API
if (conn.datalen == 0) {
break;
}
*/
}
fprintf(stderr, "\n\n\n\n");
}
end:
return ret;
}