支持国密ssl的curl编译和测试验证(上)

以下以ubuntu 22.04环境为例进行编译

本次编译采用铜锁ssl+nghttp2+curl，使得编译出来的curl可以支持国密ssl，并且可以支持http2协议。

废话少说，直接上编译过程:

1. 编译铜锁ssl库

git clone https://github.com/Tongsuo-Project/Tongsuo


cd Tongsuo

./config --prefix=/opt/tongsuo enable-ntls
make -j
sudo make install
1
2
3
4
5
6
7
8
9
10

2. 编译nghttp2库

git clone https://github.com/tatsuhiro-t/nghttp2.git


cd nghttp2

autoreconf -i
automake
autoconf


./configure --prefix=/opt/nghttp2
make
sudo make install


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

3. 编译curl

git clone https://github.com/Tongsuo-Project/curl.git


cd curl
git apply tongsuo.patch

autoreconf -fi


 LDFLAGS=-Wl,-rpath=/opt/tongsuo/lib64:/opt/nghttp2/lib ./configure --enable-warnings --enable-werror --with-openssl=/opt/tongsuo --with-nghttp2=/opt/nghttp2 --prefix=/opt/gmcurl --disable-shared

make
sudo make install

1
2
3
4
5
6
7
8
9
10
11
12
13
14

这里通过rpath指定了生成的curl依赖的libcrypto.so和libssl.so的目录为/opt/tongsuo/lib64，libnghttp2.so的目录为/opt/nghttp2/lib，并且以静态链接的方式链接到libcurl。

4. 验证

4.1 查看版本信息

通过curl的 --version选项查看相关信息：

命令：
/opt/gmcurl/curl --version

输出：

curl 8.5.0-DEV (x86_64-pc-linux-gnu) libcurl/8.5.0-DEV OpenSSL/3.0.3 zlib/1.2.11 nghttp2/1.60.0-DEV
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS HSTS HTTP2 HTTPS-proxy IPv6 Largefile libz NTLM SSL threadsafe TLS-SRP UnixSockets

1
2
3
4
5
6
7
8
9
10

从上面看到程序已经支持http2协议了。

在进行相关功能测试之前，需要准备一个支持国密和http2协议能力的tengine服务器。

4.2 验证国密ssl握手功能

然后测试和支持国密https的web服务器的国密ssl握手：

命令：
 /opt/gmcurl/bin/curl --tlcp "https://www.test.com:9443/" -kv

输出：
 
* Host www.test.com:9441 was resolved.
* IPv6: (none)
* IPv4: 127.0.0.1
*   Trying 127.0.0.1:9441...
* Connected to www.test.com (127.0.0.1) port 9441
* ALPN: curl offers h2,http/1.1
* (101) (OUT), , Unknown (1):
* (101) (IN), , Unknown (2):
* (101) (IN), , Unknown (11):
* (101) (IN), , Unknown (12):
* (101) (IN), , Unknown (14):
* (101) (OUT), , Unknown (16):
* (101) (OUT), , Change cipher spec (1):
* (101) (OUT), , Unknown (20):
* (101) (IN), , Unknown (20):
* SSL connection using NTLSv1.1 / ECC-SM2-SM4-GCM-SM3 / UNDEF / SM2
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*  subject: C=CN; ST=BJ; L=HaiDian; O=Beijing JNTA Technology LTD.; OU=BSRC of TASS; CN=server sign (SM2)
*  start date: May 23 02:45:48 2019 GMT
*  expire date: Jul  1 02:45:48 2023 GMT
*  issuer: C=CN; ST=BJ; L=HaiDian; O=Beijing JNTA Technology LTD.; OU=SORB of TASS; CN=Test CA (SM2)
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
*   Certificate level 0: Public key type SM2/SM2 (256/128 Bits/secBits), signed using SM2-with-SM3
*   Certificate level 1: Public key type SM2/SM2 (256/128 Bits/secBits), signed using SM2-with-SM3
* using HTTP/1.x
> GET / HTTP/1.1
> Host: www.test.com:9441
> User-Agent: curl/8.5.0-DEV
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: Tengine/3.1.0
< Date: Mon, 26 Feb 2024 02:21:21 GMT
< Content-Type: text/plain
< Content-Length: 91
< Connection: keep-alive
< Content-Type: text/html;charset=utf-8
< 
* Connection #0 to host www.test.com left intact


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

可以看到已经可以支持国密ssl握手了。

4.3 验证http2协议功能

命令：
 /opt/gmcurl/bin/curl --http "https://www.test.com:9443/" -kv

输出：

* Host www.test.com:9441 was resolved.
* IPv6: (none)
* IPv4: 127.0.0.1
*   Trying 127.0.0.1:9441...
* Connected to www.test.com (127.0.0.1) port 9441
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*  subject: C=cn; ST=cd; L=Default City; O=Default Company Ltd
*  start date: Aug 23 07:31:25 2019 GMT
*  expire date: Aug 22 07:31:25 2020 GMT
*  issuer: C=cn; ST=cd; L=Default City; O=Default Company Ltd
*  SSL certificate verify result: self-signed certificate (18), continuing anyway.
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA1
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://www.test.com:9441/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: www.test.com:9441]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.5.0-DEV]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: www.test.com:9441
> User-Agent: curl/8.5.0-DEV
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/2 200 
< server: Tengine/3.1.0
< date: Mon, 26 Feb 2024 02:44:16 GMT
< content-type: text/plain
< content-length: 90
< content-type: text/html;charset=utf-8
< 
* Connection #0 to host www.test.com left intact
tengine ntls test OK, ssl_protocol is TLSv1.3 (NTLSv1.1 表示国密，其他表示国际)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

下文进一步对铜锁ssl通过curl进行测试验证：

支持国密ssl的curl编译和测试验证(下)