Skip to content

Commit 83c5ff2

Browse files
TrisiaTrisia
committed
修复了ECC_SM4_SM3套件在秘钥交换过程中的错误
1. 签名使用SM2默认ID：1234567812345678，而不是证书使用者。 2. 修复了被签名的加密证书长度问题，证书有一个3Byte用于容纳长度的空间。在服务端的秘钥交换过程少了3Byte。
1 parent c20175f commit 83c5ff2

1 file changed

Lines changed: 20 additions & 18 deletions

File tree

‎ssl/statem/statem_gmtls.c‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ static int gmtls_process_sm9_params(SSL *s, PACKET *pkt, int *al, int ibe)
281281
if (!(sm9->params = d2i_SM9PublicParameters(NULL, &p,
282282
PACKET_remaining(&params)))) {
283283
*al = SSL_AD_DECODE_ERROR;
284-
SSLerr(SSL_F_GMTLS_PROCESS_SM9_PARAMS, ERR_R_INTERNAL_ERROR);// rename this error
284+
SSLerr(SSL_F_GMTLS_PROCESS_SM9_PARAMS, ERR_R_INTERNAL_ERROR);// rename this error
285285
return 0;
286286
}
287287
/* check there is no remaining data */
@@ -525,8 +525,8 @@ static int gmtls_construct_ske_sm2dhe(SSL *s, unsigned char **p, int *l, int *al
525525
s2n(siglen, d);
526526
d += siglen;
527527

528-
*l += d - *p;
529-
*p = d;
528+
*l += d - *p;
529+
*p = d;
530530
*al = -1;
531531
ret = 1;
532532

@@ -599,7 +599,7 @@ static int gmtls_process_ske_sm2dhe(SSL *s, PACKET *pkt, int *al)
599599
}
600600

601601
// s->s3->peer_tmp need to be free-ed when error happed?
602-
602+
603603

604604
/* get ECDHEParams length */
605605
paramslen = PACKET_data(pkt) - ecparams;
@@ -745,10 +745,11 @@ static int gmtls_construct_ske_sm2(SSL *s, unsigned char **p, int *l, int *al)
745745
SSLerr(SSL_F_GMTLS_CONSTRUCT_SKE_SM2, ERR_R_EVP_LIB);
746746
goto end;
747747
}
748-
if (!(id = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0))) {
749-
SSLerr(SSL_F_GMTLS_CONSTRUCT_SKE_SM2, ERR_R_EVP_LIB);
750-
goto end;
751-
}
748+
// if (!(id = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0))) {
749+
// SSLerr(SSL_F_GMTLS_CONSTRUCT_SKE_SM2, ERR_R_EVP_LIB);
750+
// goto end;
751+
// }
752+
id = SM2_DEFAULT_ID;
752753
zlen = sizeof(z);
753754
if (!SM2_compute_id_digest(EVP_sm3(), id, strlen(id), z, &zlen,
754755
EVP_PKEY_get0_EC_KEY(pkey))) {
@@ -776,7 +777,7 @@ static int gmtls_construct_ske_sm2(SSL *s, unsigned char **p, int *l, int *al)
776777
SSL3_RANDOM_SIZE) <= 0
777778
|| EVP_SignUpdate(md_ctx, &(s->s3->server_random[0]),
778779
SSL3_RANDOM_SIZE) <= 0
779-
|| EVP_SignUpdate(md_ctx, buf, n) <= 0) {
780+
|| EVP_SignUpdate(md_ctx, buf, n+3) <= 0) {
780781
SSLerr(SSL_F_GMTLS_CONSTRUCT_SKE_SM2, ERR_R_EVP_LIB);
781782
goto end;
782783
}
@@ -802,7 +803,7 @@ static int gmtls_construct_ske_sm2(SSL *s, unsigned char **p, int *l, int *al)
802803
end:
803804
OPENSSL_free(buf);
804805
EVP_MD_CTX_free(md_ctx);
805-
OPENSSL_free(id);
806+
// OPENSSL_free(id);
806807
return ret;
807808
}
808809

@@ -865,10 +866,11 @@ static int gmtls_process_ske_sm2(SSL *s, PACKET *pkt, int *al)
865866
}
866867

867868
/* prepare sm2 z value */
868-
if (!(id = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0))) {
869-
SSLerr(SSL_F_GMTLS_PROCESS_SKE_SM2, ERR_R_EVP_LIB);
870-
goto end;
871-
}
869+
// if (!(id = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0))) {
870+
// SSLerr(SSL_F_GMTLS_PROCESS_SKE_SM2, ERR_R_EVP_LIB);
871+
// goto end;
872+
// }
873+
id = SM2_DEFAULT_ID;
872874
zlen = sizeof(z);
873875
if (!SM2_compute_id_digest(EVP_sm3(), id, strlen(id), z, &zlen,
874876
EVP_PKEY_get0_EC_KEY(pkey))) {
@@ -885,7 +887,7 @@ static int gmtls_process_ske_sm2(SSL *s, PACKET *pkt, int *al)
885887
SSL3_RANDOM_SIZE) <= 0
886888
|| EVP_VerifyUpdate(md_ctx, &(s->s3->server_random[0]),
887889
SSL3_RANDOM_SIZE) <= 0
888-
|| EVP_VerifyUpdate(md_ctx, buf, n) <= 0) {
890+
|| EVP_VerifyUpdate(md_ctx, buf, n+3) <= 0) {
889891
SSLerr(SSL_F_GMTLS_PROCESS_SKE_SM2, ERR_R_EVP_LIB);
890892
goto end;
891893
}
@@ -903,7 +905,7 @@ static int gmtls_process_ske_sm2(SSL *s, PACKET *pkt, int *al)
903905
end:
904906
OPENSSL_free(buf);
905907
EVP_MD_CTX_free(md_ctx);
906-
OPENSSL_free(id);
908+
// OPENSSL_free(id);
907909
return ret;
908910
}
909911

@@ -2185,8 +2187,8 @@ int gmtls_construct_client_key_exchange(SSL *s)
21852187
err:
21862188
if (al != -1)
21872189
ssl3_send_alert(s, SSL3_AL_FATAL, al);
2188-
OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen);
2189-
s->s3->tmp.pms = NULL;
2190+
OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen);
2191+
s->s3->tmp.pms = NULL;
21902192
ossl_statem_set_error(s);
21912193
return 0;
21922194
}

0 commit comments

Comments
 (0)