mirror of
https://github.com/guanzhi/GmSSL.git
synced 2026-05-07 00:46:17 +08:00
TLS 1.3 server auth only
This commit is contained in:
Zhi Guan
@@ -226,12 +226,10 @@ int main(int argc, char **argv)
|
||||
return tls12_client_main(argc, argv);
|
||||
} else if (!strcmp(*argv, "tls12_server")) {
|
||||
return tls12_server_main(argc, argv);
|
||||
/*
|
||||
} else if (!strcmp(*argv, "tls13_client")) {
|
||||
return tls13_client_main(argc, argv);
|
||||
} else if (!strcmp(*argv, "tls13_server")) {
|
||||
return tls13_server_main(argc, argv);
|
||||
*/
|
||||
} else if (!strcmp(*argv, "sdfutil")) {
|
||||
return sdfutil_main(argc, argv);
|
||||
} else if (!strcmp(*argv, "skfutil")) {
|
||||
|
||||
@@ -47,147 +47,156 @@
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#include <unistd.h>
|
||||
#include <sys/types.h>
|
||||
#include <arpa/inet.h>
|
||||
#include <sys/socket.h>
|
||||
#include <netinet/in.h>
|
||||
#include <gmssl/tls.h>
|
||||
#include <gmssl/error.h>
|
||||
|
||||
|
||||
// TLSv1.2客户单和TLCP客户端可能没有什么区别
|
||||
|
||||
static int client_ciphers[] = { TLS_cipher_sm4_gcm_sm3 };
|
||||
|
||||
static const char *http_get =
|
||||
"GET / HTTP/1.1\r\n"
|
||||
"Hostname: aaa\r\n"
|
||||
"\r\n\r\n";
|
||||
|
||||
void print_usage(const char *prog)
|
||||
{
|
||||
printf("Usage: %s [options]\n", prog);
|
||||
printf(" -host <str>\n");
|
||||
printf(" -port <num>\n");
|
||||
printf(" -cacerts <file>\n");
|
||||
printf(" -cert <file>\n");
|
||||
printf(" -key <file>\n");
|
||||
}
|
||||
static const char *options = "-host str [-port num] [-cacert file] [-cert file -key file -pass str]";
|
||||
|
||||
int tls13_client_main(int argc , char *argv[])
|
||||
int tls13_client_main(int argc, char *argv[])
|
||||
{
|
||||
int ret = -1;
|
||||
char *prog = argv[0];
|
||||
char *host = NULL;
|
||||
int port = 443;
|
||||
char *cacertfile = NULL;
|
||||
char *certfile = NULL;
|
||||
char *keyfile = NULL;
|
||||
char *pass = NULL;
|
||||
struct sockaddr_in server;
|
||||
int sock;
|
||||
TLS_CTX ctx;
|
||||
TLS_CONNECT conn;
|
||||
char buf[100] = {0};
|
||||
size_t len = sizeof(buf);
|
||||
|
||||
char *cacertsfile = NULL;
|
||||
char *certfile = NULL;
|
||||
char *keyfile = NULL;
|
||||
|
||||
FILE *cacertsfp = NULL;
|
||||
FILE *certfp = NULL;
|
||||
FILE *keyfp = NULL;
|
||||
SM2_KEY sign_key;
|
||||
|
||||
|
||||
if (argc < 2) {
|
||||
print_usage(prog);
|
||||
return 0;
|
||||
}
|
||||
char send_buf[1024] = {0};
|
||||
size_t send_len;
|
||||
|
||||
argc--;
|
||||
argv++;
|
||||
if (argc < 1) {
|
||||
fprintf(stderr, "usage: %s %s\n", prog, options);
|
||||
return 1;
|
||||
}
|
||||
while (argc >= 1) {
|
||||
if (!strcmp(*argv, "-help")) {
|
||||
print_usage(prog);
|
||||
printf("usage: %s %s\n", prog, options);
|
||||
return 0;
|
||||
|
||||
} else if (!strcmp(*argv, "-host")) {
|
||||
if (--argc < 1) goto bad;
|
||||
host = *(++argv);
|
||||
|
||||
} else if (!strcmp(*argv, "-port")) {
|
||||
if (--argc < 1) goto bad;
|
||||
port = atoi(*(++argv));
|
||||
|
||||
} else if (!strcmp(*argv, "-cacerts")) {
|
||||
} else if (!strcmp(*argv, "-cacert")) {
|
||||
if (--argc < 1) goto bad;
|
||||
cacertsfile = *(++argv);
|
||||
|
||||
cacertfile = *(++argv);
|
||||
} else if (!strcmp(*argv, "-cert")) {
|
||||
if (--argc < 1) goto bad;
|
||||
certfile = *(++argv);
|
||||
|
||||
} else if (!strcmp(*argv, "-key")) {
|
||||
if (--argc < 1) goto bad;
|
||||
keyfile = *(++argv);
|
||||
|
||||
} else if (!strcmp(*argv, "-pass")) {
|
||||
if (--argc < 1) goto bad;
|
||||
pass = *(++argv);
|
||||
} else {
|
||||
print_usage(prog);
|
||||
fprintf(stderr, "%s: invalid option '%s'\n", prog, *argv);
|
||||
return 1;
|
||||
bad:
|
||||
fprintf(stderr, "%s: option '%s' argument required\n", prog, *argv);
|
||||
return 0;
|
||||
}
|
||||
argc--;
|
||||
argv++;
|
||||
}
|
||||
|
||||
if (!host /*|| !certfile || !keyfile */) {
|
||||
print_usage(prog);
|
||||
if (!host) {
|
||||
fprintf(stderr, "%s: '-in' option required\n", prog);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (cacertsfile) {
|
||||
if (!(cacertsfp = fopen(cacertsfile, "r"))) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
if (certfile) {
|
||||
if (!(certfp = fopen(certfile, "r"))) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
if (keyfile) {
|
||||
if (!(keyfp = fopen(keyfile, "r"))) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (sm2_private_key_info_decrypt_from_pem(&sign_key, "password", keyfp) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
memset(&ctx, 0, sizeof(ctx));
|
||||
memset(&conn, 0, sizeof(conn));
|
||||
|
||||
if (tls13_connect(&conn, host, port, cacertsfp, certfp, &sign_key) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
server.sin_addr.s_addr = inet_addr(host);
|
||||
server.sin_family = AF_INET;
|
||||
server.sin_port = htons(port);
|
||||
|
||||
|
||||
if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
|
||||
fprintf(stderr, "%s: open socket error : %s\n", prog, strerror(errno));
|
||||
goto end;
|
||||
}
|
||||
if (connect(sock, (struct sockaddr *)&server , sizeof(server)) < 0) {
|
||||
fprintf(stderr, "%s: connect error : %s\n", prog, strerror(errno));
|
||||
goto end;
|
||||
}
|
||||
|
||||
// 这个client 发收了一个消息就结束了
|
||||
if (tls_send(&conn, (uint8_t *)"12345\n", 6) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
if (tls_ctx_init(&ctx, TLS_protocol_tls13, TLS_client_mode) != 1
|
||||
|| tls_ctx_set_cipher_suites(&ctx, client_ciphers, sizeof(client_ciphers)/sizeof(client_ciphers[0])) != 1
|
||||
|| tls_ctx_set_ca_certificates(&ctx, cacertfile, TLS_DEFAULT_VERIFY_DEPTH) != 1
|
||||
|| tls_ctx_set_certificate_and_key(&ctx, certfile, keyfile, pass) != 1) {
|
||||
fprintf(stderr, "%s: context init error\n", prog);
|
||||
goto end;
|
||||
}
|
||||
if (tls_init(&conn, &ctx) != 1
|
||||
|| tls_set_socket(&conn, sock) != 1
|
||||
|| tls_do_handshake(&conn) != 1) {
|
||||
fprintf(stderr, "%s: error\n", prog);
|
||||
goto end;
|
||||
}
|
||||
|
||||
for (;;) {
|
||||
memset(buf, 0, sizeof(buf));
|
||||
len = sizeof(buf);
|
||||
if (tls_recv(&conn, (uint8_t *)buf, &len) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
size_t sentlen;
|
||||
|
||||
memset(send_buf, 0, sizeof(send_buf));
|
||||
if (!fgets(send_buf, sizeof(send_buf), stdin)) {
|
||||
if (feof(stdin)) {
|
||||
tls_shutdown(&conn);
|
||||
goto end;
|
||||
} else {
|
||||
continue;
|
||||
}
|
||||
}
|
||||
if (len > 0) {
|
||||
if (tls_send(&conn, (uint8_t *)send_buf, strlen(send_buf), &sentlen) != 1) {
|
||||
fprintf(stderr, "%s: send error\n", prog);
|
||||
goto end;
|
||||
}
|
||||
|
||||
{
|
||||
memset(buf, 0, sizeof(buf));
|
||||
len = sizeof(buf);
|
||||
if (tls_recv(&conn, (uint8_t *)buf, sizeof(len), &len) != 1) {
|
||||
goto end;
|
||||
}
|
||||
buf[len] = 0;
|
||||
printf("%s\n", buf);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return 1;
|
||||
bad:
|
||||
fprintf(stderr, "%s: command error\n", prog);
|
||||
|
||||
end:
|
||||
close(sock);
|
||||
tls_ctx_cleanup(&ctx);
|
||||
tls_cleanup(&conn);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -47,127 +47,176 @@
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/types.h>
|
||||
#include <arpa/inet.h>
|
||||
#include <sys/socket.h>
|
||||
#include <netinet/in.h>
|
||||
#include <gmssl/mem.h>
|
||||
#include <gmssl/sm2.h>
|
||||
#include <gmssl/tls.h>
|
||||
#include <gmssl/error.h>
|
||||
|
||||
|
||||
static void print_usage(const char *prog)
|
||||
{
|
||||
printf("Usage: %s [options]\n", prog);
|
||||
printf(" -port <num>\n");
|
||||
printf(" -cert <file>\n");
|
||||
printf(" -signkey <file>\n");
|
||||
}
|
||||
static const char *options = "[-port num] -cert file -key file -pass str [-cacert file]";
|
||||
|
||||
int tls13_server_main(int argc , char *argv[])
|
||||
int tls13_server_main(int argc , char **argv)
|
||||
{
|
||||
int ret = -1;
|
||||
int ret = 1;
|
||||
char *prog = argv[0];
|
||||
int port = 443;
|
||||
char *certfile = NULL;
|
||||
char *signkeyfile = NULL;
|
||||
FILE *certfp = NULL;
|
||||
FILE *signkeyfp = NULL;
|
||||
SM2_KEY signkey;
|
||||
char *keyfile = NULL;
|
||||
char *pass = NULL;
|
||||
char *cacertfile = NULL;
|
||||
|
||||
int server_ciphers[] = { TLS_cipher_sm4_gcm_sm3, };
|
||||
uint8_t verify_buf[4096];
|
||||
|
||||
|
||||
TLS_CTX ctx;
|
||||
TLS_CONNECT conn;
|
||||
char buf[1600] = {0};
|
||||
size_t len = sizeof(buf);
|
||||
|
||||
if (argc < 2) {
|
||||
print_usage(prog);
|
||||
return 0;
|
||||
}
|
||||
int sock;
|
||||
struct sockaddr_in server_addr;
|
||||
struct sockaddr_in client_addr;
|
||||
socklen_t client_addrlen;
|
||||
int conn_sock;
|
||||
|
||||
|
||||
argc--;
|
||||
argv++;
|
||||
while (argc >= 1) {
|
||||
if (!strcmp(*argv, "-help")) {
|
||||
print_usage(prog);
|
||||
return 0;
|
||||
|
||||
if (argc < 1) {
|
||||
fprintf(stderr, "usage: %s %s\n", prog, options);
|
||||
return 1;
|
||||
}
|
||||
|
||||
while (argc > 0) {
|
||||
if (!strcmp(*argv, "-help")) {
|
||||
printf("usage: %s %s\n", prog, options);
|
||||
return 0;
|
||||
} else if (!strcmp(*argv, "-port")) {
|
||||
if (--argc < 1) goto bad;
|
||||
port = atoi(*(++argv));
|
||||
|
||||
} else if (!strcmp(*argv, "-cert")) {
|
||||
if (--argc < 1) goto bad;
|
||||
certfile = *(++argv);
|
||||
|
||||
} else if (!strcmp(*argv, "-signkey")) {
|
||||
} else if (!strcmp(*argv, "-key")) {
|
||||
if (--argc < 1) goto bad;
|
||||
signkeyfile = *(++argv);
|
||||
|
||||
keyfile = *(++argv);
|
||||
} else if (!strcmp(*argv, "-pass")) {
|
||||
if (--argc < 1) goto bad;
|
||||
pass = *(++argv);
|
||||
} else if (!strcmp(*argv, "-cacert")) {
|
||||
if (--argc < 1) goto bad;
|
||||
cacertfile = *(++argv);
|
||||
} else {
|
||||
print_usage(prog);
|
||||
return 0;
|
||||
fprintf(stderr, "%s: invalid option '%s'\n", prog, *argv);
|
||||
return 1;
|
||||
bad:
|
||||
fprintf(stderr, "%s: option '%s' argument required\n", prog, *argv);
|
||||
return 1;
|
||||
}
|
||||
argc--;
|
||||
argv++;
|
||||
}
|
||||
|
||||
if (!certfile || !signkeyfile) {
|
||||
print_usage(prog);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!(certfp = fopen(certfile, "r"))) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
if (!(signkeyfp = fopen(signkeyfile, "r"))) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (sm2_private_key_info_decrypt_from_pem(&signkey, "password", signkeyfp) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
if (!certfile) {
|
||||
fprintf(stderr, "%s: '-cert' option required\n", prog);
|
||||
return 1;
|
||||
}
|
||||
if (!keyfile) {
|
||||
fprintf(stderr, "%s: '-key' option required\n", prog);
|
||||
return 1;
|
||||
}
|
||||
if (!pass) {
|
||||
fprintf(stderr, "%s: '-pass' option required\n", prog);
|
||||
return 1;
|
||||
}
|
||||
|
||||
memset(&ctx, 0, sizeof(ctx));
|
||||
memset(&conn, 0, sizeof(conn));
|
||||
if (tls13_accept(&conn, port, certfp, &signkey, certfp) != 1) {
|
||||
|
||||
if (tls_ctx_init(&ctx, TLS_protocol_tls13, TLS_server_mode) != 1
|
||||
|| tls_ctx_set_cipher_suites(&ctx, server_ciphers, sizeof(server_ciphers)/sizeof(int)) != 1
|
||||
|| tls_ctx_set_certificate_and_key(&ctx, certfile, keyfile, pass) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
// 我要做一个反射的服务器，接收到用户的输入之后，再反射回去
|
||||
for (;;) {
|
||||
|
||||
// 接收一个消息
|
||||
// 按道理说第二次执行的时候是不可能成功的了，因此客户端没有数据发过来
|
||||
do {
|
||||
len = sizeof(buf);
|
||||
if (tls_recv(&conn, (uint8_t *)buf, &len) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
} while (!len);
|
||||
|
||||
|
||||
// 把这个消息再发回去
|
||||
if (tls_send(&conn, (uint8_t *)buf, len) != 1) {
|
||||
if (cacertfile) {
|
||||
if (tls_ctx_set_ca_certificates(&ctx, cacertfile, TLS_DEFAULT_VERIFY_DEPTH) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
fprintf(stderr, "-----------------\n\n\n\n\n\n");
|
||||
// Socket
|
||||
if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
|
||||
error_print();
|
||||
return 1;
|
||||
}
|
||||
server_addr.sin_family = AF_INET;
|
||||
server_addr.sin_addr.s_addr = INADDR_ANY;
|
||||
server_addr.sin_port = htons(port);
|
||||
if (bind(sock, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0) {
|
||||
error_print();
|
||||
perror("tlcp_accept: bind: ");
|
||||
goto end;
|
||||
}
|
||||
puts("start listen ...\n");
|
||||
listen(sock, 1);
|
||||
|
||||
|
||||
|
||||
restart:
|
||||
|
||||
client_addrlen = sizeof(client_addr);
|
||||
if ((conn_sock = accept(sock, (struct sockaddr *)&client_addr, &client_addrlen)) < 0) {
|
||||
error_print();
|
||||
goto end;
|
||||
}
|
||||
puts("socket connected\n");
|
||||
|
||||
if (tls_init(&conn, &ctx) != 1
|
||||
|| tls_set_socket(&conn, conn_sock) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (tls_do_handshake(&conn) != 1) {
|
||||
error_print(); // 为什么这个会触发呢？
|
||||
return -1;
|
||||
}
|
||||
|
||||
for (;;) {
|
||||
|
||||
int rv;
|
||||
size_t sentlen;
|
||||
|
||||
do {
|
||||
len = sizeof(buf);
|
||||
if ((rv = tls_recv(&conn, (uint8_t *)buf, sizeof(buf), &len)) != 1) {
|
||||
if (rv < 0) fprintf(stderr, "%s: recv failure\n", prog);
|
||||
else fprintf(stderr, "%s: Disconnected by remote\n", prog);
|
||||
|
||||
//close(conn.sock);
|
||||
tls_cleanup(&conn);
|
||||
goto restart;
|
||||
}
|
||||
} while (!len);
|
||||
|
||||
if (tls_send(&conn, (uint8_t *)buf, len, &sentlen) != 1) {
|
||||
fprintf(stderr, "%s: send failure, close connection\n", prog);
|
||||
close(conn.sock);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
return 1;
|
||||
bad:
|
||||
fprintf(stderr, "%s: command error\n", prog);
|
||||
|
||||
return 0;
|
||||
end:
|
||||
return ret;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user