abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-08-07 12:33:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

add sm3/sms4 to speed

Browse Source
This commit is contained in:
Zhi Guan
2017-11-13 15:38:49 +08:00
parent e1c639160b
commit 4d60905e04
19 changed files with 2056 additions and 183 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ssl/build.info
View File

@@ -11,4 +11,7 @@ SOURCE[../libssl]=\
ssl_asn1.c ssl_txt.c ssl_init.c ssl_conf.c ssl_mcnf.c \
bio_ssl.c ssl_err.c t1_reneg.c tls_srp.c t1_trce.c ssl_utst.c \
record/ssl3_buffer.c record/ssl3_record.c record/dtls1_bitmap.c \
statem/statem.c statem/statem_gmtls.c
statem/statem.c
IF[{- !$disabled{gmtls} -}]
SOURCE[../libssl]=statem/statem_gmtls11.c
ENDIF

14
ssl/ssl_lib.c
View File

@@ -2636,7 +2636,7 @@ void ssl_set_masks(SSL *s)
int have_ecc_cert, ecdsa_ok;
X509 *x = NULL;
#endif
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
int have_sm2_cert, sm2sign_ok;
#endif
if (c == NULL)
@@ -2654,7 +2654,7 @@ void ssl_set_masks(SSL *s)
#ifndef OPENSSL_NO_EC
have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID;
#endif
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
have_sm2_cert = pvalid[SSL_PKEY_SM2_SIGN] & CERT_PKEY_VALID;
#endif
mask_k = 0;
@@ -2716,7 +2716,7 @@ void ssl_set_masks(SSL *s)
mask_a |= SSL_aECDSA;
}
#endif
#ifndef OPENSSL_NO_GMTLS_METHOD
#ifndef OPENSSL_NO_SM2
if (have_sm2_cert) {
uint32_t ex_kusage;
cpk = &c->pkeys[SSL_PKEY_SM2_SIGN];
@@ -2734,7 +2734,7 @@ void ssl_set_masks(SSL *s)
#ifndef OPENSSL_NO_EC
mask_k |= SSL_kECDHE;
#endif
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
mask_k |= SSL_kSM2;
mask_k |= SSL_kSM2DHE;
#endif
@@ -2748,7 +2748,7 @@ void ssl_set_masks(SSL *s)
mask_k |= SSL_kDHEPSK;
if (mask_k & SSL_kECDHE)
mask_k |= SSL_kECDHEPSK;
# ifndef OPENSSL_NO_GMTLS_METHOD
# ifndef OPENSSL_NO_SM2
if (mask_k & SSL_kSM2DHE)
mask_k |= SSL_kSM2PSK;
# endif
@@ -2828,7 +2828,7 @@ CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
return &c->pkeys[i];
}
#ifndef OPENSSL_NO_GMTLS_METHOD
#ifndef OPENSSL_NO_GMTLS
CERT_PKEY *ssl_get_server_send_pkey_ex(SSL *s)
{
CERT *c;
@@ -2874,7 +2874,7 @@ EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher,
} else if ((alg_a & SSL_aECDSA) &&
(c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
idx = SSL_PKEY_ECC;
#ifndef OPENSSL_NO_GMTLS_METHOD
#ifndef OPENSSL_NO_GMTLS_SM2
else if ((alg_a & SSL_aSM2) &&
(c->pkeys[SSL_PKEY_SM2_SIGN].privatekey != NULL))
idx = SSL_PKEY_SM2_SIGN;

10
ssl/statem/statem_clnt.c
View File

@@ -64,7 +64,7 @@
#ifndef OPENSSL_NO_ENGINE
# include <openssl/engine.h>
#endif
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
# include <openssl/sm2.h>
#endif
@@ -534,15 +534,19 @@ int ossl_statem_client_construct_message(SSL *s)
return tls_construct_client_hello(s);
case TLS_ST_CW_CERT:
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s))
return gmtls_construct_client_certificate(s);
else
#endif
return tls_construct_client_certificate(s);
case TLS_ST_CW_KEY_EXCH:
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s))
return gmtls_construct_client_key_exchange(s);
else
#endif
return tls_construct_client_key_exchange(s);
case TLS_ST_CW_CERT_VRFY:
@@ -642,18 +646,22 @@ MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt)
return dtls_process_hello_verify(s, pkt);
case TLS_ST_CR_CERT:
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s))
return tls_process_server_certificate(s, pkt);
else
#endif
return tls_process_server_certificate(s, pkt);
case TLS_ST_CR_CERT_STATUS:
return tls_process_cert_status(s, pkt);
case TLS_ST_CR_KEY_EXCH:
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s))
return gmtls_process_server_key_exchange(s, pkt);
else
#endif
return tls_process_server_key_exchange(s, pkt);
case TLS_ST_CR_CERT_REQ:

137
ssl/statem/statem_gmtls.c
View File

@@ -1,137 +0,0 @@
/* ====================================================================
* Copyright (c) 2014 - 2017 The GmSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the GmSSL Project.
* (http://gmssl.org/)"
*
* 4. The name "GmSSL Project" must not be used to endorse or promote
* products derived from this software without prior written
* permission. For written permission, please contact
* guanzhi1980@gmail.com.
*
* 5. Products derived from this software may not be called "GmSSL"
* nor may "GmSSL" appear in their names without prior written
* permission of the GmSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the GmSSL Project
* (http://gmssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE GmSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*/
#include <stdio.h>
#include <openssl/opensslconf.h>
# include "../ssl_locl.h"
# include "statem_locl.h"
# include "internal/constant_time_locl.h"
# include <openssl/buffer.h>
# include <openssl/rand.h>
# include <openssl/objects.h>
# include <openssl/evp.h>
# include <openssl/hmac.h>
# include <openssl/x509.h>
# include <openssl/x509v3.h>
# include <openssl/bn.h>
# include <openssl/sm2.h>
# include <openssl/crypto.h>
int gmtls_construct_server_certificate(SSL *s)
{
SSLerr(SSL_F_GMTLS_CONSTRUCT_SERVER_CERTIFICATE,
SSL_R_NOT_IMPLEMENTED);
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
ossl_statem_set_error(s);
return 0;
}
int gmtls_construct_server_key_exchange(SSL *s)
{
SSLerr(SSL_F_GMTLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
SSL_R_NOT_IMPLEMENTED);
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
ossl_statem_set_error(s);
return 0;
}
int gmtls_construct_client_certificate(SSL *s)
{
SSLerr(SSL_F_GMTLS_CONSTRUCT_CLIENT_CERTIFICATE,
SSL_R_NOT_IMPLEMENTED);
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
ossl_statem_set_error(s);
return 0;
}
int gmtls_construct_client_key_exchange(SSL *s)
{
SSLerr(SSL_F_GMTLS_CONSTRUCT_CLIENT_KEY_EXCHANGE,
SSL_R_NOT_IMPLEMENTED);
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
ossl_statem_set_error(s);
return 0;
}
MSG_PROCESS_RETURN gmtls_process_server_certificate(SSL *s, PACKET *pkt)
{
SSLerr(SSL_F_GMTLS_PROCESS_SERVER_CERTIFICATE,
SSL_R_NOT_IMPLEMENTED);
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
ossl_statem_set_error(s);
return MSG_PROCESS_ERROR;
}
MSG_PROCESS_RETURN gmtls_process_server_key_exchange(SSL *s, PACKET *pkt)
{
SSLerr(SSL_F_GMTLS_PROCESS_SERVER_KEY_EXCHANGE,
SSL_R_NOT_IMPLEMENTED);
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
ossl_statem_set_error(s);
return MSG_PROCESS_ERROR;
}
MSG_PROCESS_RETURN gmtls_process_client_certificate(SSL *s, PACKET *pkt)
{
SSLerr(SSL_F_GMTLS_PROCESS_CLIENT_CERTIFICATE,
SSL_R_NOT_IMPLEMENTED);
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
ossl_statem_set_error(s);
return MSG_PROCESS_ERROR;
}
MSG_PROCESS_RETURN gmtls_process_client_key_exchange(SSL *s, PACKET *pkt)
{
SSLerr(SSL_F_GMTLS_PROCESS_CLIENT_KEY_EXCHANGE,
SSL_R_NOT_IMPLEMENTED);
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
ossl_statem_set_error(s);
return MSG_PROCESS_ERROR;
}

22
ssl/statem/statem_srvr.c
View File

@@ -640,14 +640,20 @@ int ossl_statem_server_construct_message(SSL *s)
return tls_construct_server_hello(s);
case TLS_ST_SW_CERT:
return SSL_IS_GMTLS(s) ?
tls_construct_server_certificate(s)
: tls_construct_server_certificate(s);
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s))
return tls_construct_server_certificate(s)
else
#endif
return tls_construct_server_certificate(s);
case TLS_ST_SW_KEY_EXCH:
return (s->version == GMTLS_VERSION) ?
gmtls_construct_server_key_exchange(s)
: tls_construct_server_key_exchange(s);
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s))
return gmtls_construct_server_key_exchange(s)
else
#endif
return tls_construct_server_key_exchange(s);
case TLS_ST_SW_CERT_REQ:
return tls_construct_certificate_request(s);
@@ -754,15 +760,19 @@ MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt)
return tls_process_client_hello(s, pkt);
case TLS_ST_SR_CERT:
#ifndef OPENSSL_NO_GMTLS_METHOD
if (SSL_IS_GMTLS(s))
return tls_process_client_certificate(s, pkt);
else
#endif
return tls_process_client_certificate(s, pkt);
case TLS_ST_SR_KEY_EXCH:
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s))
return gmtls_process_client_key_exchange(s, pkt);
else
#endif
return tls_process_client_key_exchange(s, pkt);
case TLS_ST_SR_CERT_VRFY:

24
ssl/t1_lib.c
View File

@@ -722,7 +722,7 @@ static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
tlsext_sigalg_ecdsa(md)
static const unsigned char tls12_sigalgs[] = {
#ifndef OPENSSL_NO_GMTLS_METHOD
#ifndef OPENSSL_NO_SM2
TLSEXT_hash_sm3, TLSEXT_signature_sm2sign,
#endif
tlsext_sigalg(TLSEXT_hash_sha512)
@@ -3264,7 +3264,7 @@ static const tls12_lookup tls12_md[] = {
{NID_id_GostR3411_94, TLSEXT_hash_gostr3411},
{NID_id_GostR3411_2012_256, TLSEXT_hash_gostr34112012_256},
{NID_id_GostR3411_2012_512, TLSEXT_hash_gostr34112012_512},
#ifndef OPENSSL_NO_GMTLS_METHOD
#ifndef OPENSSL_NO_SM3
{NID_sm3, TLSEXT_hash_sm3},
#endif
};
@@ -3272,7 +3272,7 @@ static const tls12_lookup tls12_md[] = {
static const tls12_lookup tls12_sig[] = {
{EVP_PKEY_RSA, TLSEXT_signature_rsa},
{EVP_PKEY_DSA, TLSEXT_signature_dsa},
#ifndef OPENSSL_NO_GMTLS_METHOD
#ifndef OPENSSL_NO_SM2
{EVP_PKEY_EC, TLSEXT_signature_sm2sign},
#else
{EVP_PKEY_EC, TLSEXT_signature_ecdsa},
@@ -3343,7 +3343,7 @@ static const tls12_hash_info tls12_md_info[] = {
TLSEXT_hash_gostr34112012_256},
{NID_id_GostR3411_2012_512, 256, SSL_MD_GOST12_512_IDX,
TLSEXT_hash_gostr34112012_512},
#ifndef OPENSSL_NO_GMTLS_METHOD
#ifndef OPENSSL_NO_SM3
{NID_sm3, 128, SSL_MD_SM3_IDX, TLSEXT_hash_sm3},
#endif
};
@@ -3388,7 +3388,7 @@ static int tls12_get_pkey_idx(unsigned char sig_alg)
case TLSEXT_signature_ecdsa:
return SSL_PKEY_ECC;
#endif
# ifndef OPENSSL_NO_GMTLS_METHOD
# ifndef OPENSSL_NO_SM2
case TLSEXT_signature_sm2sign:
return SSL_PKEY_SM2_SIGN;
# endif
@@ -3455,7 +3455,7 @@ void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op)
const unsigned char *sigalgs;
size_t i, sigalgslen;
int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
int have_sm2sign = 0;
#endif
/*
@@ -3484,7 +3484,7 @@ void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op)
have_ecdsa = 1;
break;
#endif
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
case TLSEXT_signature_sm2sign:
if (!have_sm2sign && tls12_sigalg_allowed(s, op, sigalgs))
have_sm2sign = 1;
@@ -3499,7 +3499,7 @@ void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op)
*pmask_a |= SSL_aDSS;
if (!have_ecdsa)
*pmask_a |= SSL_aECDSA;
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
if (!have_sm2sign)
*pmask_a |= SSL_aSM2;
#endif
@@ -3666,7 +3666,7 @@ int tls1_process_sigalgs(SSL *s)
if (pmd[SSL_PKEY_ECC] == NULL)
pmd[SSL_PKEY_ECC] = EVP_get_digestbynid(NID_sha1);
#endif
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
if (pmd[SSL_PKEY_SM2_SIGN] == NULL)
pmd[SSL_PKEY_SM2_SIGN] = EVP_get_digestbynid(NID_sm3);
#endif
@@ -3961,13 +3961,13 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
default_nid = NID_ecdsa_with_SHA1;
break;
#ifndef OPENSSL_NO_GMTLS_METHOD
#ifndef OPENSSL_NO_SM2
case SSL_PKEY_SM2_ENC:
rsign = TLSEXT_signature_sm2sign;
default_nid = NID_sm2sign_with_sm3;
break;
#endif
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
case SSL_PKEY_SM2_SIGN:
rsign = TLSEXT_signature_sm2sign;
default_nid = NID_sm2sign_with_sm3;
@@ -4150,7 +4150,7 @@ void tls1_set_cert_validity(SSL *s)
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST01);
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_256);
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_512);
#ifndef OPENSSL_NO_GMTLS
#ifndef OPENSSL_NO_SM2
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_SM2_SIGN);
#endif
}