JGZYES
3e8a5442fa
TLS 1.3 PSK 会话恢复: NewSessionTicket 签发/解析、ticket+binder 校验、selected_identity 回选、恢复握手免证书(pazessl -sess_in/-sess_out 端到端验证); 构建脚本输出 bin/ 并支持独立命令与 psftp; 修复 SFTP 二进制传输与 copy_id -P; 补充 tests/ 调试与 verify_tls
82 行
2.7 KiB
C
82 行
2.7 KiB
C
/* dbg_ecdsa_cert.c —— 定位 OpenSSL ECDSA 证书验签失败点 */
|
|
#include "paze/x509.h"
|
|
#include "paze/ecdsa.h"
|
|
#include "paze/hash.h"
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <time.h>
|
|
|
|
static uint8_t *read_file(const char *path, size_t *out_len) {
|
|
FILE *f = fopen(path, "rb");
|
|
if (!f) return NULL;
|
|
fseek(f, 0, SEEK_END);
|
|
long flen = ftell(f);
|
|
fseek(f, 0, SEEK_SET);
|
|
if (flen <= 0) { fclose(f); return NULL; }
|
|
uint8_t *buf = (uint8_t *)malloc((size_t)flen + 1);
|
|
if (!buf) { fclose(f); return NULL; }
|
|
size_t n = fread(buf, 1, (size_t)flen, f);
|
|
fclose(f);
|
|
buf[n] = 0;
|
|
*out_len = n;
|
|
return buf;
|
|
}
|
|
|
|
int main(int argc, char **argv) {
|
|
if (argc < 2) { printf("usage: dbg_ecdsa_cert cert.pem\n"); return 1; }
|
|
size_t clen;
|
|
uint8_t *cd = read_file(argv[1], &clen);
|
|
if (!cd) { printf("read failed\n"); return 1; }
|
|
|
|
paze_x509_cert_t cert;
|
|
paze_status_t st = paze_x509_load_pem(&cert, (const char *)cd);
|
|
printf("parse st=%d\n", st);
|
|
if (st != PAZE_OK) return 1;
|
|
|
|
printf("sig_alg=%d pk_kind=%d\n", cert.sig_alg, cert.pk_kind);
|
|
printf("tbs_der_len=%zu signature_len=%zu\n", cert.tbs_der_len, cert.signature_len);
|
|
printf("self_signed=%d\n", paze_x509_is_self_signed(&cert));
|
|
|
|
/* tbs hash */
|
|
uint8_t h[64];
|
|
paze_sha256(cert.tbs_der, cert.tbs_der_len, h);
|
|
printf("sha256(tbs)=");
|
|
for (int i = 0; i < 32; i++) printf("%02x", h[i]);
|
|
printf("\n");
|
|
|
|
/* signature hex */
|
|
printf("signature=");
|
|
for (size_t i = 0; i < cert.signature_len; i++) printf("%02x", cert.signature[i]);
|
|
printf("\n");
|
|
|
|
/* ECDSA 直接验签 */
|
|
st = paze_ecdsa_verify(&cert.ecdsa_pub, PAZE_RSA_HASH_SHA256, h, 32,
|
|
cert.signature, cert.signature_len);
|
|
printf("ecdsa_verify st=%d\n", st);
|
|
|
|
/* 完整 verify_signature */
|
|
st = paze_x509_verify_signature(&cert, &cert);
|
|
printf("x509_verify_signature st=%d\n", st);
|
|
|
|
/* verify_chain:加载同一文件作为 anchor */
|
|
{
|
|
paze_x509_cert_t anchor;
|
|
st = paze_x509_load_pem(&anchor, (const char *)cd);
|
|
printf("anchor parse st=%d\n", st);
|
|
if (st == PAZE_OK) {
|
|
int64_t now = (int64_t)time(NULL);
|
|
printf("now=%lld not_before=%lld not_after=%lld\n",
|
|
(long long)now, (long long)cert.not_before, (long long)cert.not_after);
|
|
printf("validity st=%d\n", paze_x509_check_validity(&cert, now));
|
|
st = paze_x509_verify_chain(&cert, 1, &anchor, 1, now);
|
|
printf("x509_verify_chain st=%d\n", st);
|
|
paze_x509_free(&anchor);
|
|
}
|
|
}
|
|
|
|
paze_x509_free(&cert);
|
|
free(cd);
|
|
return 0;
|
|
}
|