JGZYES
6da27731b5
- tls_handshake12.c: 完整 TLS 1.2 client/server 状态机(ECDHE-RSA/ECDSA/RSA AES-GCM + CHACHA20-POLY1305)，支持 1.3 收到 1.2 ServerHello/ClientHello 后回退 - tls_record.c: 修正 TLS 1.2 AEAD-GCM 两处 RFC 偏差: AAD length 字段应为明文长度 ctlen(RFC 5246 6.2.3.3)原为 ct+16; GCMNonce = fixed_iv(4) || explicit_nonce(8)(RFC 5288 3)原顺序相反 - tls_handshake13.c: CV/Finished transcript 处理、1.3 套件记录版本修正、链式证书构造 - x509.c: AttributeTypeAndValue 补 SEQUENCE; validity 2050 年前用 UTCTime - apps/pazessl: s_client/s_server 增加 -tls1_2 - 新增 build.ps1、build/run_tls_test.ps1、build/run_openssl_interop.ps1 验证: 自测 4/4(1.2/1.3 双向 + 回退); OpenSSL 互操作 4/4(s_client/s_server 双向 1.2/1.3)
92 行
4.4 KiB
PowerShell
92 行
4.4 KiB
PowerShell
# OpenSSL interop 测试(一次性)
|
|
# 四组: pazessl s_server ↔ openssl s_client (1.3/1.2)
|
|
# openssl s_server ↔ pazessl s_client (1.3/1.2)
|
|
$ErrorActionPreference = "Continue"
|
|
$Root = "F:\TLS-SSH"
|
|
$exe = Join-Path $Root "build\pazessl.exe"
|
|
$openssl = "C:\Program Files\Git\usr\bin\openssl.exe"
|
|
$key = Join-Path $Root "build\key.pem"
|
|
$cert = Join-Path $Root "build\cert.pem"
|
|
$empty = Join-Path $Root "build\empty.in"
|
|
|
|
# 空 stdin 文件(openssl s_client 握手后 EOF 立即关闭)
|
|
if (-not (Test-Path $empty)) { New-Item -ItemType File -Path $empty -Force | Out-Null }
|
|
|
|
$pass = 0; $fail = 0
|
|
|
|
function Test-Case($tag) {
|
|
Write-Host ""
|
|
Write-Host "== $tag =="
|
|
}
|
|
|
|
function Test-PazesslSrv($tag, $port, $srvExtra, $cliArgs) {
|
|
$sout = Join-Path $Root "build\i_$tag.srv.out.log"
|
|
$serr = Join-Path $Root "build\i_$tag.srv.err.log"
|
|
$cout = Join-Path $Root "build\i_$tag.cli.out.log"
|
|
$cerr = Join-Path $Root "build\i_$tag.cli.err.log"
|
|
$srv = Start-Process -FilePath $exe -ArgumentList (@("s_server","-accept",$port,"-cert",$cert,"-key",$key) + $srvExtra) `
|
|
-NoNewWindow -PassThru -RedirectStandardOutput $sout -RedirectStandardError $serr
|
|
Start-Sleep -Milliseconds 1200
|
|
$cli = Start-Process -FilePath $openssl -ArgumentList $cliArgs -NoNewWindow -PassThru `
|
|
-RedirectStandardOutput $cout -RedirectStandardError $cerr -RedirectStandardInput $empty
|
|
$null = $cli.WaitForExit(8000)
|
|
if (-not $cli.HasExited) { Stop-Process -Id $cli.Id -Force }
|
|
if (-not $srv.HasExited) { Stop-Process -Id $srv.Id -Force }
|
|
$t = ""
|
|
if (Test-Path $cerr) { $t = Get-Content $cerr -Raw -ErrorAction SilentlyContinue }
|
|
$ok = $t -match "Protocol version: TLSv"
|
|
Write-Host "server=$($cli.ExitCode) proto=$($t -replace '(?s).*Protocol version: (TLSv[0-9.]+).*','$1')"
|
|
if ($t -notmatch "Protocol version:") { Get-Content $cerr -ErrorAction SilentlyContinue | Select-Object -First 6 | ForEach-Object { Write-Host "C: $_" } }
|
|
return $ok
|
|
}
|
|
|
|
function Test-OpensslSrv($tag, $port, $srvExtra, $cliArgs, $expectVer) {
|
|
$sout = Join-Path $Root "build\i_$tag.srv.out.log"
|
|
$serr = Join-Path $Root "build\i_$tag.srv.err.log"
|
|
$cout = Join-Path $Root "build\i_$tag.cli.out.log"
|
|
$cerr = Join-Path $Root "build\i_$tag.cli.err.log"
|
|
$srv = Start-Process -FilePath $openssl -ArgumentList (@("s_server","-accept",$port,"-cert",$cert,"-key",$key,"-quiet") + $srvExtra) `
|
|
-NoNewWindow -PassThru -RedirectStandardOutput $sout -RedirectStandardError $serr
|
|
Start-Sleep -Milliseconds 1200
|
|
$cli = Start-Process -FilePath $exe -ArgumentList $cliArgs -NoNewWindow -PassThru `
|
|
-RedirectStandardOutput $cout -RedirectStandardError $cerr
|
|
$ok = $false
|
|
for ($i = 0; $i -lt 20; $i++) {
|
|
Start-Sleep -Milliseconds 500
|
|
if (Test-Path $cerr) {
|
|
$t = Get-Content $cerr -Raw -ErrorAction SilentlyContinue
|
|
if ($t -match "Connected \(TLS 0$expectVer") { $ok = $true; break }
|
|
}
|
|
if ($cli.HasExited) { break }
|
|
}
|
|
if (-not $cli.HasExited) { Stop-Process -Id $cli.Id -Force }
|
|
if (-not $srv.HasExited) { Stop-Process -Id $srv.Id -Force }
|
|
Write-Host "client-ok=$ok"
|
|
if (Test-Path $cerr) { Get-Content $cerr -ErrorAction SilentlyContinue | Select-Object -Last 4 | ForEach-Object { Write-Host "C: $_" } }
|
|
return $ok
|
|
}
|
|
|
|
# 1) pazessl s_server (1.3) ↔ openssl s_client -tls1_3
|
|
Test-Case "1. pazessl-srv / openssl-cli 1.3"
|
|
$r = Test-PazesslSrv "p2o13" "14500" @() @("s_client","-connect","127.0.0.1:14500","-tls1_3","-brief")
|
|
if ($r) { $pass++ } else { $fail++ }
|
|
|
|
# 2) pazessl s_server (1.2) ↔ openssl s_client -tls1_2
|
|
Test-Case "2. pazessl-srv / openssl-cli 1.2"
|
|
$r = Test-PazesslSrv "p2o12" "14501" @("-tls1_2") @("s_client","-connect","127.0.0.1:14501","-tls1_2","-brief")
|
|
if ($r) { $pass++ } else { $fail++ }
|
|
|
|
# 3) openssl s_server (1.3) ↔ pazessl s_client
|
|
Test-Case "3. openssl-srv / pazessl-cli 1.3"
|
|
$r = Test-OpensslSrv "o2p13" "14502" @("-tls1_3") @("s_client","-connect","127.0.0.1:14502") "304"
|
|
if ($r) { $pass++ } else { $fail++ }
|
|
|
|
# 4) openssl s_server (1.2) ↔ pazessl s_client -tls1_2
|
|
Test-Case "4. openssl-srv / pazessl-cli 1.2"
|
|
$r = Test-OpensslSrv "o2p12" "14503" @("-tls1_2") @("s_client","-connect","127.0.0.1:14503","-tls1_2") "303"
|
|
if ($r) { $pass++ } else { $fail++ }
|
|
|
|
Write-Host ""
|
|
Write-Host "== RESULT: pass=$pass fail=$fail =="
|
|
exit $fail
|