mrpre / atls Goto Github PK

A light TLS implementation used for learning: TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 GMSSL 1.1(国密SSL) based on libcrypto.so.

Makefile 0.49% C 97.24% C++ 2.27%

atls's Introduction

Atls

A lite TLS implementation used for learning(TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 GMSSL 1.1 ) based on libcrypto.so.

1.Not supporting multiplethreading.
2.The memory used for Atls(handshaked session) is less than 1k + 2*EVP_CIPHER_CTX(OpenSSL).

For daemon using

make
./daemon_server

You can also specify the newer libcrypto.so by using cryptodir where the OpenSSL being compiled and installed to.
make cryptodir=/$YOURPATH/openssl/.openssl

For GMSSL, the version of libcrypto.so must be greater than OpenSSL-1.1.1a. Because the openssl-1.1.1 is in developing and may be changed greatly, please create issues if you have any question.

For Nginx using(Version 1.13.12)

Add void *a_tls; into struct ngx_connection_s.
compile like./configure --add-module=/$YOURPATH/a_tls/ --with-stream --with-http_ssl_module --with-stream_ssl_module --with-openssl=/$YOURPATH/openssl/.

Common Directives

stream {
    ....
    server {
        listen 443;
        a_tls_certificate ecc.pem;
        a_tls_certificate_key ecc.key;
        a_tls_certificate rsa.pem;
        a_tls_certificate_key rsa.key;
    }
}

GMSSL Directives

stream {
    ....
    server {
        listen 443;
        a_tls_certificate gm.cert;
        a_tls_certificate_key gm.key;
        a_tls_sign_certificate gm.cert;
        a_tls_sign_certificate_key gm.key;
    }
}

You can also mix SM2 certificate and TLS certificate to support both TLS and GMSSL.

Tips

For using GMSSL, plz using 360 GM browser and then change your client's local time before 01/01/2018(caues the daemon certificate has expired).

BUG reporting

1: Using Wireshark to capture the TLS packet.
2: Using make DEBUG=1 and paste the log info.
3: Certificates and Keys(Option).
4: Nginx configure file(Option).
5: Send to [email protected].

atls's People

Contributors

Stargazers

Watchers

atls's Issues

x希望支持三十六、 alert 子协议

360浏览器连接atls时抓包发现告警提示解密失败

为何Not supporting multiplethreading？

编译出错

_crypto.c:317:17: error: ‘NID_sm4_cbc’ undeclared here (not in a function)
0xe013, NID_sm4_cbc, 16, 16, 16, A_CRYPTO_NID_SM3,
^
a_tls_lib.c: In function ‘a_tls_cfg_set_sign_key’:
a_tls_lib.c:1721:41: error: ‘NID_sm2’ undeclared (first use in this function)
if (EC_GROUP_get_curve_name(grp) != NID_sm2) {
^
a_tls_lib.c:1721:41: note: each undeclared identifier is reported only once for each function it appears in
a_tls_lib.c: In function ‘a_tls_cfg_set_sign_cert’:
a_tls_lib.c:1759:41: error: ‘NID_sm2’ undeclared (first use in this function)
if (EC_GROUP_get_curve_name(grp) != NID_sm2) {
^
a_tls_lib.c: In function ‘a_tls_cfg_set_cert’:
a_tls_lib.c:1827:29: error: ‘EVP_PKEY_RSA_PSS’ undeclared (first use in this function)
} else if ((type == EVP_PKEY_RSA_PSS) && cfg->pkey[A_CRYPTO_NID_RSAPSS]) {
^
a_tls_lib.c:1836:49: error: ‘NID_sm2’ undeclared (first use in this function)
if (EC_GROUP_get_curve_name(grp) == NID_sm2
^
a_tls_lib.c: In function ‘a_tls_cfg_set_key’:
a_tls_lib.c:1920:45: error: ‘NID_sm2’ undeclared (first use in this function)
if (EC_GROUP_get_curve_name(grp) == NID_sm2) {
^
Makefile:20: recipe for target 'a_crypto.o' failed
make: *** [a_crypto.o] Error 1

nginx1.13.12+gmssl是哪个版本？谢谢

请问能否给个 atls 访问 HTTPS 的 client示例

你好：
关注了您的https://github.com/mrpre/atls项目，可是没有访问 HTTPS 的 client 示例，能否给一个，最好push出来.

多谢~

没有client exchange数据包

使用 nginx-1.13.12.tar.gz 结合openssl-1.1.1b。
stream {
upstream http_up {
server 127.0.0.1:80;
}

server {
	listen 443;
	proxy_pass   http_up;
	a_tls_certificate ../conf/mycert.pem;
	a_tls_certificate_key ../conf/mykey.pem;
	a_tls_sign_certificate ../conf/mycert_enc.pem;
	a_tls_sign_certificate_key ../conf/mykey_enc.pem;
}

}
没有client exchange数据包。谢谢！是openssl版本问题？

能不能多点注释啊

写的很简洁，不过有些还是看不懂，请求多点注释吧- -

crypto/objects/objects.txt 格式怎么理解呢？谢谢

像gmssl库添加了如下信息，不知道具体啥意思？麻烦指点，谢谢！

SM2 OIDs

sm-scheme 301 : sm2p256v1
sm-scheme 301 1 : sm2sign
sm-scheme 301 2 : sm2exchange
sm-scheme 301 3 : sm2encrypt
sm-scheme 501 : SM2Sign-with-SM3 : sm2sign-with-sm3
sm-scheme 502 : SM2Sign-with-SHA1 : sm2sign-with-sha1

请问在apache httpd上能用吗？

能在apache上编译吗