JGZYES
6da27731b5
- tls_handshake12.c: 完整 TLS 1.2 client/server 状态机(ECDHE-RSA/ECDSA/RSA AES-GCM + CHACHA20-POLY1305)，支持 1.3 收到 1.2 ServerHello/ClientHello 后回退 - tls_record.c: 修正 TLS 1.2 AEAD-GCM 两处 RFC 偏差: AAD length 字段应为明文长度 ctlen(RFC 5246 6.2.3.3)原为 ct+16; GCMNonce = fixed_iv(4) || explicit_nonce(8)(RFC 5288 3)原顺序相反 - tls_handshake13.c: CV/Finished transcript 处理、1.3 套件记录版本修正、链式证书构造 - x509.c: AttributeTypeAndValue 补 SEQUENCE; validity 2050 年前用 UTCTime - apps/pazessl: s_client/s_server 增加 -tls1_2 - 新增 build.ps1、build/run_tls_test.ps1、build/run_openssl_interop.ps1 验证: 自测 4/4(1.2/1.3 双向 + 回退); OpenSSL 互操作 4/4(s_client/s_server 双向 1.2/1.3)
60 行
2.9 KiB
PowerShell
60 行
2.9 KiB
PowerShell
# TLS 1.2/1.3 自测脚本(一次性)
|
|
$ErrorActionPreference = "Continue"
|
|
$Root = "F:\TLS-SSH"
|
|
$exe = Join-Path $Root "build\pazessl.exe"
|
|
$key = Join-Path $Root "build\key.pem"
|
|
$cert = Join-Path $Root "build\cert.pem"
|
|
|
|
# 1) 生成证书(若不存在)
|
|
if (-not (Test-Path $cert)) {
|
|
& $exe req -x509 -newkey rsa:2048 -keyout $key -out $cert -days 365 -subj /CN=localhost 2>&1 | Out-Null
|
|
if ($LASTEXITCODE -ne 0) { Write-Host "FAIL: req"; exit 1 }
|
|
}
|
|
|
|
function Test-Conn($tag, $port, $serverArgs, $clientArgs) {
|
|
$sout = Join-Path $Root "build\srv_$tag.out.log"
|
|
$serr = Join-Path $Root "build\srv_$tag.err.log"
|
|
$cout = Join-Path $Root "build\cli_$tag.out.log"
|
|
$cerr = Join-Path $Root "build\cli_$tag.err.log"
|
|
# 启动服务端(输出重定向到文件)
|
|
$srv = Start-Process -FilePath $exe -ArgumentList $serverArgs -NoNewWindow -PassThru `
|
|
-RedirectStandardOutput $sout -RedirectStandardError $serr
|
|
Start-Sleep -Milliseconds 1200
|
|
$alive = -not $srv.HasExited
|
|
# 启动客户端(中继只读,握手后阻塞,故用轮询判据)
|
|
$cli = Start-Process -FilePath $exe -ArgumentList $clientArgs -NoNewWindow -PassThru `
|
|
-RedirectStandardOutput $cout -RedirectStandardError $cerr
|
|
$ok = $false
|
|
for ($i = 0; $i -lt 20; $i++) {
|
|
Start-Sleep -Milliseconds 500
|
|
if ($cli.HasExited) { break }
|
|
if (Test-Path $cerr) {
|
|
$t = Get-Content $cerr -Raw -ErrorAction SilentlyContinue
|
|
if ($t -match "Connected \(TLS 03") { $ok = $true; break }
|
|
}
|
|
}
|
|
if (-not $cli.HasExited) { Stop-Process -Id $cli.Id -Force }
|
|
if (-not $srv.HasExited) { Stop-Process -Id $srv.Id -Force }
|
|
Write-Host "== $tag =="
|
|
Write-Host "server-alive=$alive client-ok=$ok"
|
|
if (Test-Path $cerr) { Get-Content $cerr | ForEach-Object { Write-Host "C: $_" } }
|
|
if (Test-Path $serr) { Get-Content $serr | ForEach-Object { Write-Host "S: $_" } }
|
|
return $ok
|
|
}
|
|
|
|
# TLS 1.2 自测
|
|
Test-Conn "tls1_2-self" "14433" @("s_server","-accept","14433","-cert",$cert,"-key",$key,"-tls1_2") `
|
|
@("s_client","-connect","127.0.0.1:14433","-tls1_2")
|
|
|
|
# TLS 1.3 自测(默认版本)
|
|
Test-Conn "tls1_3-self" "14434" @("s_server","-accept","14434","-cert",$cert,"-key",$key) `
|
|
@("s_client","-connect","127.0.0.1:14434")
|
|
|
|
# 回退场景 A: 客户端默认(先试 1.3) ↔ 服务端仅 1.2 → 客户端回退到 1.2
|
|
Test-Conn "fallback-cli" "14435" @("s_server","-accept","14435","-cert",$cert,"-key",$key,"-tls1_2") `
|
|
@("s_client","-connect","127.0.0.1:14435")
|
|
|
|
# 回退场景 B: 客户端仅 1.2 ↔ 服务端默认(先试 1.3) → 服务端回退到 1.2
|
|
Test-Conn "fallback-srv" "14436" @("s_server","-accept","14436","-cert",$cert,"-key",$key) `
|
|
@("s_client","-connect","127.0.0.1:14436","-tls1_2")
|