abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-08-07 21:53:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update tls12, tlcp

Browse Source
This commit is contained in:
Zhi Guan
2026-05-27 16:52:58 +08:00
parent e9c3cbc74f
commit 4df5b2c898
7 changed files with 87 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
src/tls.c
View File

@@ -2678,19 +2678,12 @@ int tls_ctx_set_key_update_seq_num_limit(TLS_CTX *ctx, size_t max_seq_num)
} }
int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx) int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx)
{ {
size_t i; size_t i;
memset(conn, 0, sizeof(*conn)); memset(conn, 0, sizeof(*conn));
conn->protocol = ctx->protocol; conn->protocol = ctx->protocol;
/* /*
@@ -2700,7 +2693,6 @@ int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx)
conn->cipher_suites_cnt = ctx->cipher_suites_cnt; conn->cipher_suites_cnt = ctx->cipher_suites_cnt;
*/ */
if (ctx->certslen > TLS_MAX_CERTIFICATES_SIZE) { if (ctx->certslen > TLS_MAX_CERTIFICATES_SIZE) {
error_print(); error_print();
return -1; return -1;
@@ -2722,15 +2714,12 @@ int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx)
conn->ca_certs_len = ctx->cacertslen; conn->ca_certs_len = ctx->cacertslen;
*/ */
conn->sign_key = ctx->signkey; conn->sign_key = ctx->signkey;
conn->kenc_key = ctx->kenckey; conn->kenc_key = ctx->kenckey;
conn->ctx = ctx; conn->ctx = ctx;
conn->key_exchanges_cnt = ctx->key_exchanges_cnt; conn->key_exchanges_cnt = ctx->key_exchanges_cnt;
conn->new_session_ticket = ctx->new_session_ticket; conn->new_session_ticket = ctx->new_session_ticket;
@@ -2739,16 +2728,21 @@ int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx)
if (ctx->supported_groups_cnt && ctx->signature_algorithms_cnt) { if (ctx->supported_groups_cnt && ctx->signature_algorithms_cnt) {
conn->key_exchange_modes |= TLS_KE_CERT_DHE; conn->key_exchange_modes |= TLS_KE_CERT_DHE;
} }
if (!conn->key_exchange_modes) {
error_print(); if (ctx->protocol == TLS_protocol_tls13) {
return -1; if (!conn->key_exchange_modes) {
error_print();
return -1;
}
fprintf(stderr, "%s %d: conn->key_exchange_modes = %d\n", __FILE__, __LINE__, conn->key_exchange_modes);
if (conn->key_exchange_modes & (TLS_KE_CERT_DHE|TLS_KE_PSK_DHE)) {
conn->key_share = 1;
}
} }
fprintf(stderr, "%s %d: conn->key_exchange_modes = %d\n", __FILE__, __LINE__, conn->key_exchange_modes);
if (conn->key_exchange_modes & (TLS_KE_CERT_DHE|TLS_KE_PSK_DHE)) {
conn->key_share = 1;
}
conn->signed_certificate_timestamp = ctx->signed_certificate_timestamp; conn->signed_certificate_timestamp = ctx->signed_certificate_timestamp;
@@ -2761,7 +2755,6 @@ int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx)
conn->pre_shared_key = 1; conn->pre_shared_key = 1;
} }
return 1; return 1;
} }

29
tools/tlcp_client.c
View File

@@ -41,34 +41,7 @@ static const char *help =
" -outcerts file Save server certificates to a PEM file\n" " -outcerts file Save server certificates to a PEM file\n"
" -quiet Without printing any status message\n" " -quiet Without printing any status message\n"
"\n" "\n"
"Examples\n" #include "tlcp_help.h"
"\n"
" gmssl tlcp_client -host www.pbc.gov.cn -get / -outcerts certs.pem\n"
"\n"
" gmssl tlcp_client -host www.pbc.gov.cn -port 443\n"
"\n"
"Examples\n"
"\n"
" gmssl sm2keygen -pass 1234 -out rootcakey.pem\n"
" gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 -key rootcakey.pem -pass 1234 -out rootcacert.pem -key_usage keyCertSign -key_usage cRLSign -ca\n"
" gmssl sm2keygen -pass 1234 -out cakey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN \"Sub CA\" -key cakey.pem -pass 1234 -out careq.pem\n"
" gmssl reqsign -in careq.pem -days 365 -key_usage keyCertSign -ca -path_len_constraint 0 -cacert rootcacert.pem -key rootcakey.pem -pass 1234 -out cacert.pem\n"
"\n"
" gmssl sm2keygen -pass 1234 -out signkey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key signkey.pem -pass 1234 -out signreq.pem\n"
" gmssl reqsign -in signreq.pem -days 365 -key_usage digitalSignature -cacert cacert.pem -key cakey.pem -pass 1234 -out signcert.pem\n"
"\n"
" gmssl sm2keygen -pass 1234 -out enckey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key enckey.pem -pass 1234 -out encreq.pem\n"
" gmssl reqsign -in encreq.pem -days 365 -key_usage keyEncipherment -cacert cacert.pem -key cakey.pem -pass 1234 -out enccert.pem\n"
"\n"
" cat signcert.pem > double_certs.pem\n"
" cat enccert.pem >> double_certs.pem\n"
" cat cacert.pem >> double_certs.pem\n"
"\n"
" sudo gmssl tlcp_server -port 443 -cert double_certs.pem -key signkey.pem -pass 1234 -ex_key enckey.pem -ex_pass 1234\n"
" gmssl tlcp_client -host 127.0.0.1 -cacert rootcacert.pem\n"
"\n"; "\n";

38
tools/tlcp_help.h Normal file
View File

@@ -0,0 +1,38 @@
/*
* Copyright 2014-2026 The GmSSL Project. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the License); you may
* not use this file except in compliance with the License.
*
* http://www.apache.org/licenses/LICENSE-2.0
*/
"Examples\n"
"\n"
" gmssl tlcp_client -host www.pbc.gov.cn -get / -outcerts certs.pem\n"
"\n"
" gmssl tlcp_client -host www.pbc.gov.cn -port 443\n"
"\n"
"Examples\n"
"\n"
" gmssl sm2keygen -pass 1234 -out rootcakey.pem\n"
" gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 -key rootcakey.pem -pass 1234 -out rootcacert.pem -key_usage keyCertSign -key_usage cRLSign -ca\n"
" gmssl sm2keygen -pass 1234 -out cakey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN \"Sub CA\" -key cakey.pem -pass 1234 -out careq.pem\n"
" gmssl reqsign -in careq.pem -days 365 -key_usage keyCertSign -ca -path_len_constraint 0 -cacert rootcacert.pem -key rootcakey.pem -pass 1234 -out cacert.pem\n"
"\n"
" gmssl sm2keygen -pass 1234 -out signkey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key signkey.pem -pass 1234 -out signreq.pem\n"
" gmssl reqsign -in signreq.pem -days 365 -key_usage digitalSignature -cacert cacert.pem -key cakey.pem -pass 1234 -out signcert.pem\n"
"\n"
" gmssl sm2keygen -pass 1234 -out enckey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key enckey.pem -pass 1234 -out encreq.pem\n"
" gmssl reqsign -in encreq.pem -days 365 -key_usage keyEncipherment -cacert cacert.pem -key cakey.pem -pass 1234 -out enccert.pem\n"
"\n"
" cat signcert.pem > double_certs.pem\n"
" cat enccert.pem >> double_certs.pem\n"
" cat cacert.pem >> double_certs.pem\n"
"\n"
" gmssl tlcp_server -port 443 -cert double_certs.pem -key signkey.pem -pass 1234 -ex_key enckey.pem -ex_pass 1234\n"
" gmssl tlcp_client -host 127.0.0.1 -cacert rootcacert.pem\n"

23
tools/tlcp_server.c
View File

@@ -30,28 +30,7 @@ static const char *help =
" -pass str Password to decrypt private key\n" " -pass str Password to decrypt private key\n"
" -cacert file CA certificate for client certificate verification\n" " -cacert file CA certificate for client certificate verification\n"
"\n" "\n"
"Examples\n" #include "tlcp_help.h"
"\n"
" gmssl sm2keygen -pass 1234 -out rootcakey.pem\n"
" gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 -key rootcakey.pem -pass 1234 -out rootcacert.pem -key_usage keyCertSign -key_usage cRLSign -ca\n"
" gmssl sm2keygen -pass 1234 -out cakey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN \"Sub CA\" -key cakey.pem -pass 1234 -out careq.pem\n"
" gmssl reqsign -in careq.pem -days 365 -key_usage keyCertSign -ca -path_len_constraint 0 -cacert rootcacert.pem -key rootcakey.pem -pass 1234 -out cacert.pem\n"
"\n"
" gmssl sm2keygen -pass 1234 -out signkey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key signkey.pem -pass 1234 -out signreq.pem\n"
" gmssl reqsign -in signreq.pem -days 365 -key_usage digitalSignature -cacert cacert.pem -key cakey.pem -pass 1234 -out signcert.pem\n"
"\n"
" gmssl sm2keygen -pass 1234 -out enckey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key enckey.pem -pass 1234 -out encreq.pem\n"
" gmssl reqsign -in encreq.pem -days 365 -key_usage keyEncipherment -cacert cacert.pem -key cakey.pem -pass 1234 -out enccert.pem\n"
"\n"
" cat signcert.pem > double_certs.pem\n"
" cat enccert.pem >> double_certs.pem\n"
" cat cacert.pem >> double_certs.pem\n"
"\n"
" sudo gmssl tlcp_server -port 443 -cert double_certs.pem -key signkey.pem -pass 1234 -ex_key enckey.pem -ex_pass 1234\n"
" gmssl tlcp_client -host 127.0.0.1 -cacert rootcacert.pem\n"
"\n"; "\n";
int tlcp_server_main(int argc , char **argv) int tlcp_server_main(int argc , char **argv)

23
tools/tls12_client.c
View File

@@ -35,28 +35,7 @@ static const char *help =
" -key file Client's encrypted private key in PEM format\n" " -key file Client's encrypted private key in PEM format\n"
" -pass str Password to decrypt private key\n" " -pass str Password to decrypt private key\n"
"\n" "\n"
"Examples\n" #include "tls12_help.h"
"\n"
" gmssl sm2keygen -pass 1234 -out rootcakey.pem\n"
" gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 \\\n"
" -key rootcakey.pem -pass 1234 -out rootcacert.pem \\\n"
" -key_usage keyCertSign -key_usage cRLSign -ca\n"
"\n"
" gmssl sm2keygen -pass 1234 -out cakey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN \"Sub CA\" \\\n"
" -key cakey.pem -pass 1234 -out careq.pem\n"
" gmssl reqsign -in careq.pem -days 365 -key_usage keyCertSign -cacert rootcacert.pem -key rootcakey.pem -pass 1234 \\\n"
" -out cacert.pem -ca -path_len_constraint 0\n"
"\n"
" gmssl sm2keygen -pass 1234 -out signkey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key signkey.pem -pass 1234 -out signreq.pem\n"
" gmssl reqsign -in signreq.pem -days 365 -key_usage digitalSignature -cacert cacert.pem -key cakey.pem -pass 1234 -out signcert.pem\n"
"\n"
" cat signcert.pem > certs.pem\n"
" cat cacert.pem >> certs.pem\n"
"\n"
" sudo gmssl tls12_server -port 4430 -cert certs.pem -key signkey.pem -pass 1234\n"
" gmssl tls12_client -host 127.0.0.1 -port 4430 -cacert rootcacert.pem\n"
"\n"; "\n";
int tls12_client_main(int argc, char *argv[]) int tls12_client_main(int argc, char *argv[])

32
tools/tls12_help.h Normal file
View File

@@ -0,0 +1,32 @@
/*
* Copyright 2014-2026 The GmSSL Project. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the License); you may
* not use this file except in compliance with the License.
*
* http://www.apache.org/licenses/LICENSE-2.0
*/
"Examples\n"
"\n"
" gmssl sm2keygen -pass 1234 -out rootcakey.pem\n"
" gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 \\\n"
" -key rootcakey.pem -pass 1234 -out rootcacert.pem \\\n"
" -key_usage keyCertSign -key_usage cRLSign -ca\n"
"\n"
" gmssl sm2keygen -pass 1234 -out cakey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN \"Sub CA\" \\\n"
" -key cakey.pem -pass 1234 -out careq.pem\n"
" gmssl reqsign -in careq.pem -days 365 -key_usage keyCertSign -cacert rootcacert.pem -key rootcakey.pem -pass 1234 \\\n"
" -out cacert.pem -ca -path_len_constraint 0\n"
"\n"
" gmssl sm2keygen -pass 1234 -out signkey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key signkey.pem -pass 1234 -out signreq.pem\n"
" gmssl reqsign -in signreq.pem -days 365 -key_usage digitalSignature -cacert cacert.pem -key cakey.pem -pass 1234 -out signcert.pem\n"
"\n"
" cat signcert.pem > certs.pem\n"
" cat cacert.pem >> certs.pem\n"
"\n"
" gmssl tls12_server -port 4430 -cert certs.pem -key signkey.pem -pass 1234\n"
" gmssl tls12_client -host 127.0.0.1 -port 4430 -cacert rootcacert.pem\n"

23
tools/tls12_server.c
View File

@@ -29,28 +29,7 @@ static const char *help =
" -pass str Password to decrypt private key\n" " -pass str Password to decrypt private key\n"
" -cacert file CA certificate for client certificate verification\n" " -cacert file CA certificate for client certificate verification\n"
"\n" "\n"
"Examples\n" #include "tls12_help.h"
"\n"
" gmssl sm2keygen -pass 1234 -out rootcakey.pem\n"
" gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 \\\n"
" -key rootcakey.pem -pass 1234 -out rootcacert.pem \\\n"
" -key_usage keyCertSign -key_usage cRLSign -ca\n"
"\n"
" gmssl sm2keygen -pass 1234 -out cakey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN \"Sub CA\" \\\n"
" -key cakey.pem -pass 1234 -out careq.pem\n"
" gmssl reqsign -in careq.pem -days 365 -key_usage keyCertSign -cacert rootcacert.pem -key rootcakey.pem -pass 1234 \\\n"
" -out cacert.pem -ca -path_len_constraint 0\n"
"\n"
" gmssl sm2keygen -pass 1234 -out signkey.pem\n"
" gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key signkey.pem -pass 1234 -out signreq.pem\n"
" gmssl reqsign -in signreq.pem -days 365 -key_usage digitalSignature -cacert cacert.pem -key cakey.pem -pass 1234 -out signcert.pem\n"
"\n"
" cat signcert.pem > certs.pem\n"
" cat cacert.pem >> certs.pem\n"
"\n"
" sudo gmssl tls12_server -port 4430 -cert certs.pem -key signkey.pem -pass 1234\n"
" gmssl tls12_client -host 127.0.0.1 -port 4430 -cacert rootcacert.pem\n"
"\n"; "\n";