背景
OpenSSL支持标准的SSL协议,但并不支持国密SSL协议。本文描述了C语言使用国密版OpenSSL开发一个简单的客户端程序,连接国密Web网站,发送HTTP请求,并接收HTTP应答。
环境
Centos7 X64。
国密OpenSSL。下载参https://www.gmssl.cn/gmssl/index.jsp?go=gmsdk
将国密OpenSSL 展开为/usr/local/gmssl_10
源码
#include <netinet/in.h>
#include <netdb.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <string.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <unistd.h>
#include <fcntl.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/gm.h>
#define MAXBUF 4096
int main(int argc, char *argv[])
{
struct sockaddr_in serveraddr;
struct hostent *host;
int sockfd, len;
SSL *ssl = NULL;
int bi = 0;
if (argc < 4) {
printf("./%s addr port uri sig.pem sig.key enc.pem enc.key\n", argv[0]);
printf("optional: sig.pem sig.key enc.pem enc.key\n");
exit(1);
}
if (argc == 8)
{
bi = 1;
}
char *addr = argv[1];
int port = atoi(argv[2]);
char *uri = argv[3];
char *sigCrt = argv[4];
char *sigKey = argv[5];
char *encCrt = argv[6];
char *encKey = argv[7];
// 国密SSL初始化
GM_load_library();
// 国密SSL生成SSL_CTX
const SSL_METHOD *method = GMv1_1_client_method();
SSL_CTX *ctx = SSL_CTX_new(method);
if (!ctx)
{
printf("create ctx is failed.\n");
exit(1);
}
// load gm sign keypair
if(bi)
{
if (SSL_CTX_use_certificate_chain_file(ctx, sigCrt) <= 0)
{
printf("unable to get certificate from '%s'\n",sigCrt);
//ERR_print_errors(bio_err);
exit(1);
}
if (SSL_CTX_use_PrivateKey_file(ctx, sigKey, SSL_FILETYPE_PEM) <= 0)
{
printf("unable to get private key from '%s'\n",sigKey);
//ERR_print_errors(bio_err);
exit(1);
}
}
// load gm enc keypair
if(bi)
{
if (SSL_CTX_use_encrypt_cert_file(ctx, encCrt) <= 0)
{
printf("unable to get certificate(enc) from '%s'\n",encCrt);
//ERR_print_errors(bio_err);
exit(1);
}
if (SSL_CTX_use_encrypt_PrivateKey_file(ctx, encKey, SSL_FILETYPE_PEM) <= 0)
{
printf("unable to get private key(enc) from '%s'\n",encKey);
//ERR_print_errors(bio_err);
exit(1);
}
}
if((host = gethostbyname(addr))==0)
{
printf("Error resolving host %s\n", addr);
exit(1);
}
char *ip = inet_ntoa(*(struct in_addr*)host->h_addr_list[0]);
sockfd = socket(AF_INET, SOCK_STREAM, 0);
bzero(&serveraddr, sizeof(serveraddr));
serveraddr.sin_family = AF_INET;
inet_pton(AF_INET, ip, &serveraddr.sin_addr.s_addr);
serveraddr.sin_port = htons(port);
int ok = connect(sockfd, (struct sockaddr *)&serveraddr, sizeof(serveraddr));
if(ok != 0)
{
printf("connnect failed\n");
exit(0);
}
ssl = SSL_new(ctx);
if (ssl == NULL) {
printf("SSL_new error.\n");
exit(0);
}
SSL_set_fd(ssl, sockfd);
if (SSL_connect(ssl) == -1) {
printf("SSL_connect fail.\n");
ERR_print_errors_fp(stderr);
exit(1);
}
else
{
printf("Connected with %s encryption\n", SSL_get_cipher(ssl));
}
// send http request
{
char request[1024] = { 0 };
sprintf(request, "GET %s HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0\r\nHost: %s:%s\r\nConnection: close\r\n\r\n", argv[3], argv[1], argv[2]);
len = SSL_write(ssl, request, strlen(request));
if (len < 0)
{
printf("send failed\n");
}
else
{
printf("send OK, %d bytes:\n%s\n", strlen(request), request);
}
}
// read http response
{
char buffer[MAXBUF + 1];
memset(buffer, 0, MAXBUF + 1);
len = SSL_read(ssl, buffer, MAXBUF);
if (len > 0) {
printf("read OK, %d bytes: \n%s\n", len, buffer);
}
else
{
printf("recv failed\n");
goto finish;
}
}
finish:
SSL_shutdown(ssl);
SSL_free(ssl);
close(sockfd);
SSL_CTX_free(ctx);
return 0;
}
测试运行
编译
gcc -o test -ldl -lm test.c /usr/local/gmssl_10/lib/libssl.a /usr/local/gmssl_10/lib/libcrypto.a -I/usr/local/gmssl_10/include
运行
单向国密SSL网站
./test demo.gmssl.cn 443 /
双向国密SSL网站
./test demo.gmssl.cn 444 /cert.jsp sig.crt sig.key enc.crt enc.key
备注
1)搭建单向/双向国密web服务器,可以参见https://www.gmssl.cn,提供nginx/apache/tomcat支持。
2)申请国密双证书,参见https://www.gmssl.cn/gmssl/index.jsp?go=ca
3)https://demo.gmssl.cn是一个单向国密Web网站
4)https://demo.gmssl.cn:444是一个双向国密Web网站
小结
通过使用国密OpenSSL,C语言很容易编程来使用国密SSL连接国密Web网站。www.gmssl.cn提供了全部免费的测试组件,并且支持双向国密SSL,可供学习和测试。