abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-08-14 01:53:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

start SKF engine

Browse Source
This commit is contained in:
Zhi Guan
2016-04-10 00:01:46 +02:00
parent 5cc6cfdf22
commit 70118dbcae
19 changed files with 778 additions and 234 deletions
Download Patch File Download Diff File Expand all files Collapse all files

218
ssl/gm_lib.c
View File

@@ -59,6 +59,11 @@
#include <openssl/evp.h>
#include <openssl/gmssl.h>
const char gmssl1_version_str[] - "GMSSLv1" OPENSSL_VERSION_PTEXT;
#define GM1_NUM_CIPHERS (sizeof(gm1_ciphers)/sizeof(SSL_CIPHER))
SSL3_ENC_METHOD GMSSLv1_1_enc_data = {
gmssl_enc,
gmssl_mac,
@@ -78,6 +83,12 @@ SSL3_ENC_METHOD GMSSLv1_1_enc_data = {
ssl3_handshake_write
};
/*
* ECDHE_XXX is the same as ECDHE_ECDSA_XXX in TLS
* ECC_XXX and RSA_XXX is similar with ECDH_ECDSA_XXX, ECDH_RSA_XXX,
* except that the ServerKeyExchange format is not null.
*/
OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
/* Cipher 1 */
@@ -85,15 +96,15 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_ECDHE_SM1_SM3,
GM1_CK_ECDHE_SM1_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_kEECDH,
SSL_aSM2,
SSL_SM1,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 2 */
@@ -101,15 +112,15 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_ECC_SM1_SM3,
GM1_CK_ECC_SM1_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_kECDHs,
SSL_aECDH,
SSL_SM1,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 3 */
@@ -117,15 +128,15 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_IBSDH_SM1_SM3,
GM1_CK_IBSDH_SM1_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_kEECDH,
SSL_aSM9,
SSL_SM1,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 4 */
@@ -133,15 +144,15 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_IBC_SM1_SHA1,
GM1_CK_IBC_SM1_SHA1,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_kECDHe,
SSL_aSM2,
SSL_SM1,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 5 */
@@ -149,15 +160,15 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_RSA_SM1_SM3,
GM1_CK_RSA_SM1_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_kEECDH,
SSL_aSM2,
SSL_SM1,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 6 */
@@ -165,15 +176,15 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_RSA_SM1_SHA1,
GM1_CK_RSA_SM1_SHA1,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_kEECDH,
SSL_aSM2,
SSL_SM1,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
@@ -182,15 +193,15 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_ECDHE_SM4_SM3,
GM1_CK_ECDHE_SM4_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_kEECDH,
SSL_aSM2,
SSL_SM4,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 8 */
@@ -198,15 +209,15 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_ECC_SM4_SM3,
GM1_CK_ECC_SM4_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_kECDHe,
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_SM4,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
@@ -217,13 +228,13 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
GM1_CK_IBSDH_SM4_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_SM4,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 10 */
@@ -231,32 +242,31 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
1,
GM1_TXT_IBC_SM4_SM3,
GM1_CK_IBC_SM4_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_kECDHe, /* fixed ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_SM4,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 11 */
{
1,
GM1_TXT_RSA_SM4_SM3,
GM1_CK_RSA_SM4_SM3,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_kRSA,
SSL_aRSA,
SSL_SM4,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
/* Cipher 12 */
@@ -266,16 +276,14 @@ OPENSSL_GLOBAL SSL_CIPHER gm1_ciphers[] = {
GM1_CK_RSA_SM4_SHA1,
SSL_kEECDH, /* ephemeral ECDH key exchange algorithm bits */
SSL_aSM2, /* auth algor bits */
SSL_SM1, /* symmetric encryption */
SSL_SM3, /* symmetric authentication */
SSL_GMV1_1, /* (major) protocol version */
SSL_NOT_EXP | SSL_STRONG_NONE, /* strength and export flags */
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, /* extra flags */
0, /* number of bits really used */
0, /* number of bits for algorithm */
SSL_SM4,
SSL_SM3,
SSL_GMV1,
SSL_NOT_EXP | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
};

14
ssl/ssl_algs.c
View File

@@ -61,7 +61,7 @@
#include <openssl/lhash.h>
#include "ssl_locl.h"
static int _SSL_library_init(void)
int SSL_library_init(void)
{
#ifndef OPENSSL_NO_DES
@@ -137,6 +137,10 @@ static int _SSL_library_init(void)
#ifndef OPENSSL_NO_ECDSA
EVP_add_digest(EVP_ecdsa());
#endif
#ifndef OPENSSL_NO_GMSSL
EVP_add_cipher(EVP_sms4_cbc());
EVP_add_digest(EVP_sm3());
#endif
/* If you want support for phased out ciphers, add the following */
#if 0
@@ -155,11 +159,3 @@ static int _SSL_library_init(void)
return (1);
}
int SSL_library_init(void)
{
EVP_add_cipher(EVP_sms4_cbc());
EVP_add_digest(EVP_sm3());
return _SSL_library_init();
}

37
ssl/ssl_ciph.c
View File

@@ -214,11 +214,17 @@ static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX] = {
*/
static int ssl_mac_pkey_id[SSL_MD_NUM_IDX] = {
EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef,
EVP_PKEY_HMAC, EVP_PKEY_HMAC
EVP_PKEY_HMAC, EVP_PKEY_HMAC,
#ifndef OPENSSL_NO_GMSSL
EVP_PKEY_HMAC
#endif
};
static int ssl_mac_secret_size[SSL_MD_NUM_IDX] = {
0, 0, 0, 0, 0, 0
0, 0, 0, 0, 0, 0,
#ifndef OPENSSL_NO_GMSSL
0
#endif
};
static int ssl_handshake_digest_flag[SSL_MD_NUM_IDX] = {
@@ -477,10 +483,11 @@ void ssl_load_ciphers(void)
EVP_MD_size(ssl_digest_methods[SSL_MD_SHA384_IDX]);
#ifndef OPENSSL_NO_GMSSL
ssl_cipher_methods[SSL_ENC_SM4_IDX] = EVP_get_cipherbyname(SN_sms4_cbc);
ssl_digest_methods[SSL_MD_SM3_IDX] = EVP_get_digestbyname(SN_sm3);
ssl_cipher_methods[SSL_ENC_SM4_IDX] = EVP_get_cipherbyname(SN_sms4_cbc);
ssl_digest_methods[SSL_MD_SM3_IDX] = EVP_get_digestbyname(SN_sm3);
ssl_mac_secret_size[SSL_MD_SM3_IDX] =
EVP_MD_size(ssl_digest_methods[SSL_MD_SM3_IDX]);
#endif
}
#ifndef OPENSSL_NO_COMP
@@ -604,9 +611,9 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
i = SSL_ENC_AES256GCM_IDX;
break;
#ifndef OPENSSL_NO_GMSSL
case SSL_SM4:
i = SSL_ENC_SM4_IDX;
break;
case SSL_SM4:
i = SSL_ENC_SM4_IDX;
break;
#endif
default:
i = -1;
@@ -642,9 +649,9 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
i = SSL_MD_GOST89MAC_IDX;
break;
#ifndef OPENSSL_NO_GMSSL
case SSL_SM3:
i = SSL_MD_SM3_IDX;
break;
case SSL_SM3:
i = SSL_MD_SM3_IDX;
break;
#endif
default:
i = -1;
@@ -701,10 +708,10 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
(evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA256")))
*enc = evp, *md = NULL;
#ifndef OPENSSL_NO_GMSSL
else if (c->algorithm_enc == SSL_SM4 &&
c->algorithm_mac == SSL_SM3 &&
(evp = EVP_get_cipherbyname("SM4-CBC-HMAC_SM3")))
*enc = evp, *md = NULL;
else if (c->algorithm_enc == SSL_SM4 &&
c->algorithm_mac == SSL_SM3 &&
(evp = EVP_get_cipherbyname("SM4-CBC-HMAC-SM3")))
*enc = evp, *md = NULL;
#endif
return (1);
} else

15
ssl/ssl_locl.h
View File

@@ -354,9 +354,9 @@
# define SSL_SEED 0x00000800L
# define SSL_AES128GCM 0x00001000L
# define SSL_AES256GCM 0x00002000L
#ifndef OPENSSL_NO_GMSSL
# define SSL_SM4 0x00004000L
#endif
# ifndef OPENSSL_NO_GMSSL
# define SSL_SM4 0x00004000L
# endif
# define SSL_AES (SSL_AES128|SSL_AES256|SSL_AES128GCM|SSL_AES256GCM)
# define SSL_CAMELLIA (SSL_CAMELLIA128|SSL_CAMELLIA256)
@@ -371,15 +371,18 @@
# define SSL_SHA384 0x00000020L
/* Not a real MAC, just an indication it is part of cipher */
# define SSL_AEAD 0x00000040L
#ifndef OPENSSL_NO_GMSSL
# define SSL_SM3 0x00000080L
#endif
# ifndef OPENSSL_NO_GMSSL
# define SSL_SM3 0x00000080L
# endif
/* Bits for algorithm_ssl (protocol version) */
# define SSL_SSLV2 0x00000001UL
# define SSL_SSLV3 0x00000002UL
# define SSL_TLSV1 SSL_SSLV3/* for now */
# define SSL_TLSV1_2 0x00000004UL
# ifndef OPENSSL_NO_GMSSL
// #define SSL_GMV1 0x00000008UL
# endif
/* Bits for algorithm2 (handshake digests and other extra flags) */

6
ssl/ssl_sess.c
View File

@@ -447,6 +447,12 @@ int ssl_get_new_session(SSL *s, int session)
} else if (s->version == DTLS1_2_VERSION) {
ss->ssl_version = DTLS1_2_VERSION;
ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
#ifndef OPENSSL_NO_GMSSL
} else if (s->version == GMSSL1_1_VERSION) {
ss->ssl_version = GMSSL1_1_VERSION;
ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
}
#endif
} else {
SSLerr(SSL_F_SSL_GET_NEW_SESSION, SSL_R_UNSUPPORTED_SSL_VERSION);
SSL_SESSION_free(ss);

56
ssl/ssl_stat.c
View File

@@ -951,6 +951,26 @@ const char *SSL_alert_desc_string(int value)
case TLS1_AD_UNKNOWN_PSK_IDENTITY:
str = "UP";
break;
#ifndef OPENSSL_NO_GMSSL
case GM1_AD_UNSUPPORTED_SITE2SITE:
str = "U2";
break;
case GM1_AD_NO_AREA:
str = "NA";
break;
case GM1_AD_UNSUPPORTED_AREATYPE:
str = "AT";
break;
case GM1_AD_BAD_IBCPARAM:
str = "BI";
break;
case GM1_AD_UNSUPPORTED_IBCPARAM:
str = "UI";
break;
case GM1_AD_IDENTITY_NEED:
str = "IN";
break;
#endif
default:
str = "UK";
break;
@@ -1054,24 +1074,24 @@ const char *SSL_alert_desc_string_long(int value)
str = "unknown PSK identity";
break;
#ifndef OPENSSL_NO_GMSSL
case GM1_AD_UNSUPPORTED_SITE2SITE:
str = "unsupported site2site";
break;
case GM1_AD_NO_AREA:
str = "no area";
break;
case GM1_AD_UNSUPPORTED_AREATYPE:
str = "unsupported areatype";
break;
case GM1_AD_BAD_IBCPARAM:
str = "bad ibc parameters";
break;
case GM1_AD_UNSUPPORTED_IBCPARAM:
str = "unsupported ibcparam";
break;
case GM1_AD_IDENTITY_NEED:
str = "identity need";
break;
case GM1_AD_UNSUPPORTED_SITE2SITE:
str = "unsupported site2site";
break;
case GM1_AD_NO_AREA:
str = "no area";
break;
case GM1_AD_UNSUPPORTED_AREATYPE:
str = "unsupported areatype";
break;
case GM1_AD_BAD_IBCPARAM:
str = "bad ibc parameters";
break;
case GM1_AD_UNSUPPORTED_IBCPARAM:
str = "unsupported ibc parameters";
break;
case GM1_AD_IDENTITY_NEED:
str = "identity need";
break;
#endif
default:
str = "unknown";

4
ssl/ssl_txt.c
View File

@@ -129,8 +129,8 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
else if (x->ssl_version == DTLS1_BAD_VER)
s = "DTLSv1-bad";
#ifndef OPENSSL_NO_GMSSL
else if (x->ssl_version == GMSSL1_1_VERSION)
s = "GMSSLv1.1";
else if (x->ssl_version == GMSSL1_1_VERSION)
s = "GMSSLv1.1";
#endif
else
s = "unknown";