Skip to content

Commit 7340259

Browse files
dayu521dayu521
committed
ca
1 parent fc51f51 commit 7340259

14 files changed

Lines changed: 334 additions & 80 deletions

‎README.md‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212

1313
[harddns](https://github.com/stealth/harddns)
1414

15+
[openssl-sign-by-ca](https://github.com/zozs/openssl-sign-by-ca/)
16+
1517
### 编译
1618

1719
需要c++20,使用xmake构建
@@ -30,16 +32,19 @@ windows使用最新编译器
3032
xmake run hcpp
3133
```
3234

33-
#### 例子
34-
35-
当前测试了三个主机,`github.com`,`gitee.com`,`www.baidu.com`.这三者由mitm代理.使用下面的自签名的`ca证书`,签名了服务的证书.服务的证书包含了上述三个主机名
35+
#### 运行
3636

37-
其余主机都是正常的http proxy或者http tunnel代理
37+
当前会在配置文件指定的目录(例如 ~/.config/hcpp/)下生成自签名的ca密钥和ca证书
3838

39-
[ca证书](doc/cert/ca.crt),可以导入浏览器
39+
浏览器需要信任该ca证书
4040

41-
下面的证书和密钥需要放到程序运行目录
41+
使用curl直接进行测试
4242

43-
- 使用的[证书](doc/cert/server.crt.pem),由密钥生成,被ca签名
43+
```shell
44+
curl -i -x http://localhost:55555 -v --cacert ~/.config/hcpp/ca.cert.pem 'https://gitee.com'
45+
```
4446

45-
- 使用的[密钥](doc/cert/server.key.pem)
47+
或者
48+
```shell
49+
curl -i -x http://localhost:55555 -vk 'https://gitee.com'
50+
```

‎action_xmake.lua‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ target("hcpp")
5656
add_packages("lsf",{public = true})
5757

5858
add_includedirs("src",{public = true})
59-
add_files("src/*.cpp","src/https/*.cpp","src/http/*.cpp","src/dns/*.cc")
59+
add_files("src/*.cpp","src/https/*.cpp","src/http/*.cpp","src/dns/*.cc","src/certificate/*.cpp")
6060
add_files("main.cpp")
6161

6262
set_policy("build.c++.modules", true)

‎main.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,9 @@ int main(int argc, char **argv)
6565

6666
hcpp::httpserver hs;
6767
hcpp::mimt_https_server mhs;
68-
c->config_to(mhs);
68+
if(!c->config_to(mhs)){
69+
return -1;
70+
}
6971

7072
hs.attach_tunnel([&mhs](auto &&c, auto h, auto s)
7173
{

‎src/certificate/cert.cpp‎

Lines changed: 66 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
#include "cert.h"
22

33
#include <cstring>
4+
#include <stdexcept>
5+
6+
#include <openssl/bio.h>
47

58
// X509_new
69
namespace hcpp
@@ -77,9 +80,8 @@ namespace hcpp
7780

7881
// Issuer
7982
// https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4
80-
void add_issuer(X509 *cert, std::string_view name2)
83+
void set_issuer(X509 *cert, const std::vector<name_entry> &ne)
8184
{
82-
// auto issuer = X509_NAME_new();
8385
// * country,
8486
// * organization,
8587
// * organizational unit,
@@ -89,24 +91,10 @@ namespace hcpp
8991
// x serial number.
9092

9193
// * locality
92-
struct name_entry
93-
{
94-
int nid_;
95-
const char *nid_val_;
96-
int nid_val_len_;
97-
};
98-
name_entry issuer[] = {
99-
{NID_countryName, "CN", sizeof("CN") - 1},
100-
{NID_organizationName, "NoBody", sizeof("NoBody") - 1},
101-
{NID_organizationalUnitName, "XX", sizeof("XX") - 1},
102-
{NID_stateOrProvinceName, "JS", sizeof("JS") - 1},
103-
{NID_commonName, "SelfCA", sizeof("SelfCA") - 1},
104-
{NID_localityName, "SQ", sizeof("SQ") - 1},
105-
};
10694

10795
auto name = X509_NAME_new();
10896

109-
for (auto &&i : issuer)
97+
for (auto &&i : ne)
11098
{
11199
X509_NAME_add_entry_by_NID(name, i.nid_, MBSTRING_ASC, (const unsigned char *)i.nid_val_, i.nid_val_len_, -1, 0);
112100
}
@@ -132,10 +120,18 @@ namespace hcpp
132120

133121
// Subject
134122
// https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6
135-
void set_subject(X509 *cert)
123+
void set_subject(X509 *cert, const std::vector<name_entry> &ne)
136124
{
125+
auto name = X509_NAME_new();
126+
127+
for (auto &&i : ne)
128+
{
129+
X509_NAME_add_entry_by_NID(name, i.nid_, MBSTRING_ASC, (const unsigned char *)i.nid_val_, i.nid_val_len_, -1, 0);
130+
}
131+
X509_set_subject_name(cert, name);
132+
X509_NAME_free(name);
137133
// X509_set_subject_name get X509_NAME hashes or get and set issuer or subject names
138-
X509_set_subject_name(cert, X509_get_issuer_name(cert));
134+
// X509_set_subject_name(cert, X509_get_issuer_name(cert));
139135
}
140136

141137
// Subject Public Key Info
@@ -207,15 +203,22 @@ namespace hcpp
207203

208204
// Subject Alternative Name
209205
// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6
210-
void add_DNS_SAN(X509 *caCert, std::string_view dns_name)
206+
void add_DNS_SAN(X509 *caCert, const std::vector<std::string> &dns_names)
211207
{
208+
if (dns_names.empty())
209+
{
210+
return;
211+
}
212212
GENERAL_NAMES *gens = sk_GENERAL_NAME_new_null();
213213

214-
GENERAL_NAME *gen_dns = GENERAL_NAME_new();
215-
ASN1_IA5STRING *ia5 = ASN1_IA5STRING_new();
216-
ASN1_STRING_set(ia5, dns_name.data(), dns_name.length());
217-
GENERAL_NAME_set0_value(gen_dns, GEN_DNS, ia5);
218-
sk_GENERAL_NAME_push(gens, gen_dns);
214+
for (auto &dns_name : dns_names)
215+
{
216+
GENERAL_NAME *gen_dns = GENERAL_NAME_new();
217+
ASN1_IA5STRING *ia5 = ASN1_IA5STRING_new();
218+
ASN1_STRING_set(ia5, dns_name.data(), dns_name.length());
219+
GENERAL_NAME_set0_value(gen_dns, GEN_DNS, ia5);
220+
sk_GENERAL_NAME_push(gens, gen_dns);
221+
}
219222

220223
// in_addr_t ipv4 = inet_addr("10.0.0.1");
221224
// GENERAL_NAME *gen_ip = GENERAL_NAME_new();
@@ -272,14 +275,51 @@ namespace hcpp
272275
return pkey_array;
273276
}
274277

278+
X509 *make_x509(const std::string_view cert)
279+
{
280+
auto bp = BIO_new_mem_buf(cert.data(), cert.size());
281+
if (bp == nullptr)
282+
{
283+
throw std::runtime_error("bio 打开失败");
284+
}
285+
auto c = PEM_read_bio_X509(bp, NULL, 0, NULL);
286+
if (c == nullptr)
287+
{
288+
throw std::runtime_error("make_x509 failed");
289+
}
290+
BIO_free(bp);
291+
return c;
292+
}
293+
294+
EVP_PKEY *make_pkey(const std::string_view pkey)
295+
{
296+
auto bp = BIO_new_mem_buf(pkey.data(), pkey.size());
297+
if (bp == nullptr)
298+
{
299+
throw std::runtime_error("bio 打开失败");
300+
}
301+
auto p = PEM_read_bio_PrivateKey(bp, nullptr, nullptr, nullptr);
302+
if (p == nullptr)
303+
{
304+
throw std::runtime_error("读取密钥错误");
305+
}
306+
BIO_free(bp);
307+
return p;
308+
}
309+
310+
void add_issuer(X509 *cert, X509 *ca_cert)
311+
{
312+
X509_set_issuer_name(cert, X509_get_subject_name(ca_cert));
313+
}
314+
275315
void test()
276316
{
277317

278318
auto cert = X509_new();
279319

280320
auto pkey = generate_pkey();
281321
// if (pkey == NULL)
282-
// CHECK(false);
322+
// CHECK(false);
283323
// print_key(pkey);
284324

285325
// set_version(cert);

‎src/certificate/cert.h‎

Lines changed: 33 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,53 @@
77
#include <openssl/rand.h>
88

99
#include <string>
10+
#include <vector>
1011

1112
namespace hcpp
1213
{
13-
X509 * make_x509();
14-
EVP_PKEY * make_pkey();
14+
struct name_entry
15+
{
16+
int nid_;
17+
const char *nid_val_;
18+
int nid_val_len_;
19+
};
20+
21+
X509 *make_x509();
22+
EVP_PKEY *make_pkey();
1523
void set_version(X509 *cert);
1624
void set_serialNumber(X509 *cert);
17-
void add_issuer(X509 *cert,std::string_view name);
18-
void set_validity(X509 *cert,std::size_t days=365*10);
19-
void set_subject(X509 *cert);
25+
void set_issuer(X509 *cert, const std::vector<name_entry> &ne = {
26+
{NID_countryName, "CN", sizeof("CN") - 1},
27+
{NID_organizationName, "NoBody", sizeof("NoBody") - 1},
28+
{NID_organizationalUnitName, "JS", sizeof("JS") - 1},
29+
{NID_stateOrProvinceName, "JS", sizeof("JS") - 1},
30+
{NID_commonName, "SQ", sizeof("SQ") - 1},
31+
{NID_localityName, "SQ", sizeof("SQ") - 1},
32+
});
33+
void set_validity(X509 *cert, std::size_t days = 365 * 10);
34+
void set_subject(X509 *cert, const std::vector<name_entry> &ne = {
35+
{NID_countryName, "CN", sizeof("CN") - 1},
36+
{NID_organizationName, "NoBody", sizeof("NoBody") - 1},
37+
{NID_organizationalUnitName, "JS", sizeof("JS") - 1},
38+
{NID_stateOrProvinceName, "JS", sizeof("JS") - 1},
39+
{NID_commonName, "SQ", sizeof("SQ") - 1},
40+
{NID_localityName, "SQ", sizeof("SQ") - 1},
41+
});
2042
void set_pubkey(X509 *cert, EVP_PKEY *pkey);
2143
void add_ca_key_usage(X509 *cert);
2244
void add_SKI(X509 *cert);
2345
void add_AKI(X509 *cert);
24-
void add_DNS_SAN(X509 *cert, std::string_view dns_name);
46+
void add_DNS_SAN(X509 *cert, const std::vector<std::string> &dns_names);
2547
void add_ca_BS(X509 *cert);
2648
void sign(X509 *cert, EVP_PKEY *pkey);
2749

2850
std::string make_pem_str(X509 *cert);
2951
std::string make_pem_str(EVP_PKEY *pkey);
52+
53+
X509 *make_x509(const std::string_view cert);
54+
EVP_PKEY *make_pkey(const std::string_view pkey);
55+
56+
void add_issuer(X509 *cert, X509 *ca_cert);
3057
} // namespace hcpp
3158

3259
#endif /* SRC_CERTIFICATE_CERT */

0 commit comments

Comments
 (0)