Skip to content

Commit cbb3647

Browse files
Anton-DodonovAnton-Dodonov
committed
gost2
1 parent f0c890b commit cbb3647

File tree

15 files changed

+749
-9
lines changed

15 files changed

+749
-9
lines changed

‎common/crypto/sm2/sm2.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,15 @@ func GenerateCertificate(privKey *sm2.PrivateKey, domain string, isCA bool, expi
6464
Bytes: certDER,
6565
})
6666

67-
// Encode private key
67+
// Encode private key in PKCS8 format for better compatibility
68+
privKeyBytes, err := sm2x509.MarshalSm2UnecryptedPrivateKey(privKey)
69+
if err != nil {
70+
return nil, nil, fmt.Errorf("failed to marshal SM2 private key: %w", err)
71+
}
72+
6873
privKeyPEM := pem.EncodeToMemory(&pem.Block{
6974
Type: "PRIVATE KEY",
70-
Bytes: privKey.D.Bytes(),
75+
Bytes: privKeyBytes,
7176
})
7277

7378
return certPEM, privKeyPEM, nil

‎common/crypto/x509/x509.go‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"time"
1414

1515
"github.com/pedroalbanese/gogost/gost3410"
16+
"github.com/pedroalbanese/gogost/gost34112012256"
1617
)
1718

1819
// SignatureAlgorithm represents the algorithm used to sign the certificate
@@ -319,7 +320,7 @@ func createTBSCertificate(template *Certificate, sigAlg SignatureAlgorithm) ([]b
319320
publicKeyOID = asn1.ObjectIdentifier{1, 2, 643, 7, 1, 1, 1, 1}
320321
}
321322

322-
// Create the basic certificate structure
323+
// Create the basic certificate structure with proper ASN.1 tags
323324
tbs := struct {
324325
Version int `asn1:"optional,explicit,default:0,tag:0"`
325326
SerialNumber *big.Int
@@ -334,7 +335,9 @@ func createTBSCertificate(template *Certificate, sigAlg SignatureAlgorithm) ([]b
334335
Algorithm pkix.AlgorithmIdentifier
335336
PublicKey asn1.BitString
336337
}
337-
Extensions []pkix.Extension `asn1:"optional,tag:3"`
338+
IssuerUniqueID asn1.BitString `asn1:"optional,tag:1"`
339+
SubjectUniqueID asn1.BitString `asn1:"optional,tag:2"`
340+
Extensions []pkix.Extension `asn1:"optional,tag:3"`
338341
}{
339342
Version: template.Version,
340343
SerialNumber: template.SerialNumber,
@@ -358,11 +361,13 @@ func createTBSCertificate(template *Certificate, sigAlg SignatureAlgorithm) ([]b
358361
Algorithm: publicKeyOID,
359362
},
360363
PublicKey: asn1.BitString{
361-
Bytes: []byte{}, // Placeholder - will be filled by actual public key
362-
BitLength: 0,
364+
Bytes: []byte{0x04, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, // Placeholder GOST public key
365+
BitLength: 256,
363366
},
364367
},
365-
Extensions: template.Extensions,
368+
IssuerUniqueID: asn1.BitString{},
369+
SubjectUniqueID: asn1.BitString{},
370+
Extensions: template.Extensions,
366371
}
367372

368373
// Encode to ASN.1 DER
@@ -400,7 +405,18 @@ func signWithGOST(data []byte, priv *gost3410.PrivateKey, sigAlg SignatureAlgori
400405

401406
func signWithGOSTReverseDigest(data []byte, priv *gost3410.PrivateKeyReverseDigest, sigAlg SignatureAlgorithm) ([]byte, error) {
402407
// Use GOST signing with reverse digest
403-
return priv.Sign(rand.Reader, data, nil)
408+
// First, we need to hash the data with GOST hash function
409+
hash := gost34112012256.New()
410+
hash.Write(data)
411+
hashed := hash.Sum(nil)
412+
413+
// Sign the hash
414+
signature, err := priv.Sign(rand.Reader, hashed, nil)
415+
if err != nil {
416+
return nil, fmt.Errorf("failed to sign with GOST: %w", err)
417+
}
418+
419+
return signature, nil
404420
}
405421

406422
func getPublicKeyAlgorithm(pub interface{}) PublicKeyAlgorithm {

‎common/protocol/tls/cert/cert.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,7 @@ func GenerateSM2(parent *Certificate, opts ...SM2Option) (*Certificate, error) {
274274
CommonName: "",
275275
},
276276
NotBefore: time.Now().Add(time.Hour * -1),
277-
NotAfter: time.Now().Add(time.Hour),
277+
NotAfter: time.Now().Add(time.Hour * 24 * 365), // 1 year default
278278
KeyUsage: sm2x509.KeyUsageKeyEncipherment | sm2x509.KeyUsageDigitalSignature,
279279
ExtKeyUsage: []sm2x509.ExtKeyUsage{sm2x509.ExtKeyUsageServerAuth},
280280
BasicConstraintsValid: true,

‎run_vless_sm2.sh‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/bin/bash
2+
3+
echo "=== VLESS Server with SM2 Certificate ==="
4+
echo
5+
6+
# Check if certificate exists, if not create it
7+
if [ ! -f "test_cert_sm2.crt" ] || [ ! -f "test_cert_sm2.key" ]; then
8+
echo "📝 Creating SM2 certificate..."
9+
./make_cert_sm2.sh > /dev/null 2>&1
10+
if [ $? -eq 0 ]; then
11+
echo "✅ Certificate created successfully"
12+
else
13+
echo "❌ Failed to create certificate"
14+
exit 1
15+
fi
16+
else
17+
echo "✅ Certificate already exists"
18+
fi
19+
20+
echo
21+
echo "🔧 Creating VLESS server configuration..."
22+
23+
# Create VLESS server configuration
24+
cat > vless_sm2.json << 'EOF'
25+
{
26+
"log": {
27+
"loglevel": "info"
28+
},
29+
"inbounds": [
30+
{
31+
"port": 443,
32+
"protocol": "vless",
33+
"settings": {
34+
"clients": [
35+
{
36+
"id": "b831381d-6324-4d53-ad4f-8cda48b30811"
37+
}
38+
],
39+
"decryption": "none"
40+
},
41+
"streamSettings": {
42+
"network": "tcp",
43+
"security": "tls",
44+
"tlsSettings": {
45+
"certificates": [
46+
{
47+
"certificateFile": "test_cert_sm2.crt",
48+
"keyFile": "test_cert_sm2.key",
49+
"certificateType": "sm2"
50+
}
51+
]
52+
}
53+
}
54+
}
55+
],
56+
"outbounds": [
57+
{
58+
"protocol": "freedom"
59+
}
60+
]
61+
}
62+
EOF
63+
64+
echo "✅ Configuration file created: vless_sm2.json"
65+
echo
66+
echo "🚀 Starting VLESS server with SM2 certificate..."
67+
echo "📋 Server details:"
68+
echo " - Port: 443"
69+
echo " - Protocol: VLESS"
70+
echo " - Security: TLS with SM2 certificate"
71+
echo " - Client ID: b831381d-6324-4d53-ad4f-8cda48b30811"
72+
echo
73+
echo "Press Ctrl+C to stop the server"
74+
echo
75+
76+
# Start the server
77+
./xray -c vless_sm2.json

‎run_vless_sm2_fixed.sh‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#!/bin/bash
2+
3+
echo "=== VLESS Server with SM2 Certificate ==="
4+
echo
5+
6+
# Check if certificate exists, if not create it
7+
if [ ! -f "test_cert_sm2.crt" ] || [ ! -f "test_cert_sm2.key" ]; then
8+
echo "📝 Creating SM2 certificate..."
9+
./make_cert_sm2.sh > /dev/null 2>&1
10+
if [ $? -eq 0 ]; then
11+
echo "✅ Certificate created successfully"
12+
else
13+
echo "❌ Failed to create certificate"
14+
exit 1
15+
fi
16+
else
17+
echo "✅ Certificate already exists"
18+
fi
19+
20+
echo
21+
echo "🔧 Creating VLESS server configuration..."
22+
23+
# Create VLESS server configuration
24+
cat > vless_sm2_fixed.json << 'EOF'
25+
{
26+
"log": {
27+
"loglevel": "info"
28+
},
29+
"inbounds": [
30+
{
31+
"port": 443,
32+
"protocol": "vless",
33+
"settings": {
34+
"clients": [
35+
{
36+
"id": "b831381d-6324-4d53-ad4f-8cda48b30811"
37+
}
38+
],
39+
"decryption": "none"
40+
},
41+
"streamSettings": {
42+
"network": "tcp",
43+
"security": "tls",
44+
"tlsSettings": {
45+
"certificates": [
46+
{
47+
"certificateFile": "test_cert_sm2.crt",
48+
"keyFile": "test_cert_sm2.key"
49+
}
50+
]
51+
}
52+
}
53+
}
54+
],
55+
"outbounds": [
56+
{
57+
"protocol": "freedom"
58+
}
59+
]
60+
}
61+
EOF
62+
63+
echo "✅ Configuration file created: vless_sm2_fixed.json"
64+
echo
65+
echo "🚀 Starting VLESS server with SM2 certificate..."
66+
echo "📋 Server details:"
67+
echo " - Port: 443"
68+
echo " - Protocol: VLESS"
69+
echo " - Security: TLS with SM2 certificate"
70+
echo " - Client ID: b831381d-6324-4d53-ad4f-8cda48b30811"
71+
echo
72+
echo "Press Ctrl+C to stop the server"
73+
echo
74+
75+
# Start the server
76+
./xray -c vless_sm2_fixed.json

‎run_vmess_ecdsa.sh‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#!/bin/bash
2+
3+
echo "=== VMess Server with ECDSA Certificate ==="
4+
echo
5+
6+
# Check if certificate exists, if not create it
7+
if [ ! -f "test_cert_ecdsa.crt" ] || [ ! -f "test_cert_ecdsa.key" ]; then
8+
echo "📝 Creating ECDSA certificate..."
9+
./xray tls cert --algorithm=ecdsa --domain=example.com --name="Test Server ECDSA" --org="Test Organization" --file=test_cert_ecdsa > /dev/null 2>&1
10+
if [ $? -eq 0 ]; then
11+
echo "✅ Certificate created successfully"
12+
else
13+
echo "❌ Failed to create certificate"
14+
exit 1
15+
fi
16+
else
17+
echo "✅ Certificate already exists"
18+
fi
19+
20+
echo
21+
echo "🔧 Creating VMess server configuration..."
22+
23+
# Create VMess server configuration
24+
cat > vmess_ecdsa.json << 'EOF'
25+
{
26+
"log": {
27+
"loglevel": "info"
28+
},
29+
"inbounds": [
30+
{
31+
"port": 443,
32+
"protocol": "vmess",
33+
"settings": {
34+
"clients": [
35+
{
36+
"id": "b831381d-6324-4d53-ad4f-8cda48b30811",
37+
"alterId": 0
38+
}
39+
]
40+
},
41+
"streamSettings": {
42+
"network": "tcp",
43+
"security": "tls",
44+
"tlsSettings": {
45+
"certificates": [
46+
{
47+
"certificateFile": "test_cert_ecdsa.crt",
48+
"keyFile": "test_cert_ecdsa.key"
49+
}
50+
]
51+
}
52+
}
53+
}
54+
],
55+
"outbounds": [
56+
{
57+
"protocol": "freedom"
58+
}
59+
]
60+
}
61+
EOF
62+
63+
echo "✅ Configuration file created: vmess_ecdsa.json"
64+
echo
65+
echo "🚀 Starting VMess server with ECDSA certificate..."
66+
echo "📋 Server details:"
67+
echo " - Port: 443"
68+
echo " - Protocol: VMess"
69+
echo " - Security: TLS with ECDSA certificate"
70+
echo " - Client ID: b831381d-6324-4d53-ad4f-8cda48b30811"
71+
echo
72+
echo "Press Ctrl+C to stop the server"
73+
echo
74+
75+
# Start the server
76+
./xray -c vmess_ecdsa.json

0 commit comments

Comments
 (0)