Skip to main content

curl + 铜锁，支持国密HTTPS

curl 命令行工具可以用于发起 HTTPS 请求，但是不支持国密 TLCP 协议，铜锁 curl项目在 curl 的基础上，基于 Tongsuo 支持 curl 命令行国密 HTTPS 通信，即 HTTPS over TLCP，同时支持 libcurl 的国密 HTTPS 通信。

铜锁官网下载 curl​

https://www.tongsuo.net/releases/

基于源码构建铜锁 curl​

# 基于Tongsuo，需要先构建Tongsuo
git clone https://github.com/Tongsuo-Project/Tongsuo

cd Tongsuo
./config --prefix=/opt/tongsuo enable-ntls
make -j
make install

cd ../

git clone https://github.com/Tongsuo-Project/curl.git

cd curl

git apply tongsuo.patch

# 依赖autoconf, automake, libtool
autoreconf -fi

# 依赖pkg-config，否则可能出现configure: error: --with-openssl was given but OpenSSL could not be detected
# 如果configure失败，可能是curl依赖的库不存在，比如brotli，可以安装依赖库，或者关闭该选项，例如增加--without-brotli
LDFLAGS=-Wl,-rpath=/opt/tongsuo/lib64 ./configure --enable-warnings --enable-werror --with-openssl=/opt/tongsuo

make -j
# 默认curl命令行会安装到/usr/local/bin，libcurl会安装到/usr/local/lib
make install

curl 命令行使用国密 HTTPS​

新增命令行选项：

  • --tlcp，使用TLCPv1.1协议
  • --sign-cert，设置客户端签名证书
  • --sign-key，设置客户端签名私钥
  • --enc-cert，设置客户端加密证书
  • --enc-key，设置客户端加密私钥
# 使用TLCP通信
curl --tlcp -kv https://127.0.0.1

# 设置密码套件
curl --tlcp -kv --ciphers "ECC-SM2-SM4-GCM-SM3:ECC-SM2-SM4-CBC-SM3" https://127.0.0.1

# 设置客户端证书
curl --tlcp -kv --sign-cert /path/to/sign_cert --sign-key /path/to/sign_key --enc-cert /path/to/enc_cert --enc-key /path/to/enc_key https://127.0.0.1

基于 libcurl 国密通信示例​

示例1：TLCP 1.1，套件 ECC-SM2-SM4-CBC-SM3​

#include <stdio.h>
#include <curl/curl.h>

int main(int argc, char **argv)
{
    CURL *curl;
    CURLcode res;

    curl = curl_easy_init();
    if (curl) {
        curl_easy_setopt(curl, CURLOPT_URL, "https://127.0.0.1:443");
        curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_NTLSv1_1);
        curl_easy_setopt(curl, CURLOPT_SSL_CIPHER_LIST, "ECC-SM2-SM4-CBC-SM3");

        /* optional */
        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0);
        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0);

        res = curl_easy_perform(curl);

        if(res != CURLE_OK)
            fprintf(stderr, "curl_easy_perform() failed: %s\n",
                    curl_easy_strerror(res));

        curl_easy_cleanup(curl);
    }

    return 0;
}
// gcc https-tlcp.c -o https-tlcp -I/usr/local/curl/include -lcurl -L/usr/local/curl/lib -Wl,-rpath=/usr/local/curl/lib

示例2：TLCP 1.1，套件 ECDHE-SM2-SM4-CBC-SM3，设置客户端双证书​

#include <stdio.h>
#include <curl/curl.h>

int main(int argc, char **argv)
{
    CURL *curl;
    CURLcode res;

    curl = curl_easy_init();
    if (curl) {
        curl_easy_setopt(curl, CURLOPT_URL, "https://127.0.0.1:443");
        curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_NTLSv1_1);
        curl_easy_setopt(curl, CURLOPT_SSL_CIPHER_LIST,
                         "ECDHE-SM2-SM4-CBC-SM3");

        curl_easy_setopt(curl, CURLOPT_SSLSIGNCERT, "sm2_sign.crt");
        curl_easy_setopt(curl, CURLOPT_SSLSIGNKEY, "sm2_sign.key");
        curl_easy_setopt(curl, CURLOPT_SSLENCCERT, "sm2_enc.crt");
        curl_easy_setopt(curl, CURLOPT_SSLENCKEY, "sm2_enc.key");

        /* optional */
        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0);
        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0);

        res = curl_easy_perform(curl);

        if(res != CURLE_OK)
            fprintf(stderr, "curl_easy_perform() failed: %s\n",
                    curl_easy_strerror(res));

        curl_easy_cleanup(curl);
    }

    return 0;
}
// gcc https-tlcp-doublecerts.c -o https-tlcp-doublecerts -I/usr/local/curl/include -lcurl -L/usr/local/curl/lib -Wl,-rpath=/usr/local/curl/lib