$ cat /etc/os-release
PRETTY_NAME=\"Kali GNU/Linux Rolling\"
NAME=\"Kali GNU/Linux\"
VERSION_ID=\"2026.2\"
VERSION_CODENAME=kali-rolling
ID=kali
ID_LIKE=debian

$ uname -a
Linux kali 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 (2026-06-18) x86_64 GNU/Linux

$ pwd
/home/kali/M

$ mkdir -p captures
$ ls -d captures
captures

$ which gcc
/usr/bin/gcc

$ gcc --version
gcc (Debian 15.3.0-1) 15.3.0
Copyright (C) 2025 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ gcc -dumpmachine
x86_64-linux-gnu

$ which cmake
/usr/bin/cmake

$ cmake --version
cmake version 4.3.4

CMake suite maintained and supported by Kitware (kitware.com/cmake).

$ which python3
/usr/bin/python3

$ python3 --version
Python 3.13.14

$ which git
/usr/bin/git

$ git --version
git version 2.53.0

$ which make
/usr/bin/make

$ make --version
GNU Make 4.4.1
Built for x86_64-pc-linux-gnu
Copyright (C) 1988-2023 Free Software Foundation, Inc.

$ which tcpdump
/usr/bin/tcpdump

$ tcpdump --version
tcpdump version 4.99.6
libpcap version 1.10.5

sudo apt-get update && sudo apt-get install -y cmake gcc make python3 git tcpdump

Hit:1 http://kali.download/kali kali-rolling InRelease
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
cmake is already the newest version (4.3.4-1).
gcc is already the newest version (4:15.3.0-1).
make is already the newest version (4.4.1-1).
python3 is already the newest version (3.13.14-1).
git is already the newest version (1:2.53.0-1).
tcpdump is already the newest version (4.99.6-1).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH

cd /home/kali/M
git clone -b openhitls-0.3 https://gitcode.com/hanzhiyang/openhitls_7287

Cloning into 'openhitls_7287'...
remote: Enumerating objects: 38106, done.
remote: Counting objects: 100% (38106/38106), done.
remote: Compressing objects: 100% (5822/5822), done.
remote: Total 38106 (delta 32276), reused 38106 (delta 32276), pack-reused 0
Receiving objects: 100% (38106/38106), 54.52 MiB | 27.36 MiB/s, done.
Resolving deltas: 100% (32276/32276), done.
Note: switching to '4c147a4928f6f0c8c094e1b8630f66be0be3f0a5'.

You are in 'detached HEAD' state.

cd /home/kali/M/openhitls_7287
git checkout openhitls-0.3

Already on 'openhitls-0.3'
Your branch is up to date with 'origin/openhitls-0.3'.

$ git log --oneline -3
4c147a49 fix:Command line certificate generation supports setting userid
ab0d11e1 fix:The command line parameter \"noverify\" has been added to app_server.c
0b41641b fix: harden file permissions for sensitive data and add input validation

$ git branch -vv
* openhitls-0.3 4c147a49 [origin/openhitls-0.3] fix:Command line certificate generation supports setting userid

$ git describe --tags --always
4c147a49

/home/kali/M/openhitls_7287/
├── apps/src/                         # 命令行工具源码 (4 个 .c 文件)
│   ├── app_server.c                  # 服务端主程序
│   │   L119-159:  g_serverOptions[] 参数定义表（-noverify at L133）
│   │   L241-244:  HandleServerNoVerify() 设置 verifyClient=false
│   │   L299-319:  g_serverOptHandleFuncMap[] 参数→处理函数映射
│   ├── app_client.c                  # 客户端主程序
│   ├── app_tls_common.c              # 公共配置模块
│   │   L408-498:  ConfCertVerification() 证书验证配置
│   │   L470:      HITLS_CFG_SetVerifyNoneSupport() 无验证模式开关
│   │   L475:      HITLS_CFG_SetClientVerifySupport() 客户端证书需求开关
│   │   L480-486:  条件禁止空证书 (if verifyPeer)
│   └── hitls.c                       # 命令行入口 (main 函数)
├── include/tls/hitls_error.h         # 完整错误码枚举
│   L165:  HITLS_MSG_HANDLE_NO_PEER_CERTIFIACATE  (0x2040017)
│          ↑ 注意：此常量名中 \"CERTIFIACATE\" 系源码拼写错误（应为 CERTIFICATE），文档保留原始拼写
│   L340:  HITLS_CERT_ERR_ENCODE  (0x20c0029)
├── tls/
│   ├── handshake/send/src/send_server_key_exchange.c
│   │   L291-302:  #ifdef HITLS_TLS_FEATURE_CERT_MODE_CLIENT_VERIFY
│   │               常规 TLS CertificateRequest 判断（-noverify 可绕过）
│   │   L305-310:  #ifdef HITLS_TLS_PROTO_TLCP11
│   │               TLCP ECDHE 强制 CertificateRequest（-noverify 无法绕过）
│   │   L311:      默认路径 → ServerHelloDone
│   ├── handshake/parse/src/parse_server_key_exchange.c
│   │   L494-498:  SAL_CERT_ClntGmEncodeEncCert() 调用 + 失败 → 0x20c0029
│   ├── handshake/recv/src/recv_certificate.c
│   │   L340-354:  空证书处理 → 0x2040017
│   └── cert/cert_adapt/cert.c
│       L677-710:  EncodeEncCert() 静态函数
│       L679:       cert==NULL → return NULL ← 单向失败的物理根因
│       L734-736:  SAL_CERT_ClntGmEncodeEncCert() 公开接口
├── testcode/testdata/tls/certificate/der/sm2_with_userid/
├── testcode/testdata/tls/certificate/der/sm2_cert/   # 备用证书（纯PKCS #8私钥）
├── platform/Secure_C/                # securec 安全 C 库（39 个源文件）
├── configure.py                      # 构建配置入口 Python 脚本
├── CMakeLists.txt
└── build/                            # 编译输出目录

$ cd /home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
$ ls -lh
total 88K
-rw-r--r-- 1 kali kali  843 Jul  4 07:13 ca.crt
-rw-r--r-- 1 kali kali  582 Jul  4 07:13 ca.der
-rw-r--r-- 1 kali kali  241 Jul  4 07:13 ca.key
-rw-r--r-- 1 kali kali  121 Jul  4 07:13 ca.key.der
-rw-r--r-- 1 kali kali  532 Jul  4 07:13 enc.der
-rw-r--r-- 1 kali kali 2.4K Jul  4 07:13 enc.crt
-rw-r--r-- 1 kali kali  316 Jul  4 07:13 enc.key
-rw-r--r-- 1 kali kali  121 Jul  4 07:13 enc.key.der
-rw-r--r-- 1 kali kali  778 Jul  4 07:13 enc22.crt
-rw-r--r-- 1 kali kali  532 Jul  4 07:13 enc22.der
-rw-r--r-- 1 kali kali  316 Jul  4 07:13 enc22.key
-rw-r--r-- 1 kali kali  121 Jul  4 07:13 enc22.key.der
-rw-r--r-- 1 kali kali  794 Jul  4 07:13 inter.crt
-rw-r--r-- 1 kali kali  546 Jul  4 07:13 inter.der
-rw-r--r-- 1 kali kali  533 Jul  4 07:13 sign.der
-rw-r--r-- 1 kali kali 2.4K Jul  4 07:13 sign.crt
-rw-r--r-- 1 kali kali  316 Jul  4 07:13 sign.key
-rw-r--r-- 1 kali kali  121 Jul  4 07:13 sign.key.der
-rw-r--r-- 1 kali kali  782 Jul  4 07:13 sign22.crt
-rw-r--r-- 1 kali kali  535 Jul  4 07:13 sign22.der
-rw-r--r-- 1 kali kali  316 Jul  4 07:13 sign22.key
-rw-r--r-- 1 kali kali  121 Jul  4 07:13 sign22.key.der

Certificate:                              ← OpenSSL x509 -text 人类可读输出
    Data:
        Version: 3 (0x2)
        Signature Algorithm: 1.2.156.10197.1.501  ← SM2 with SM3 OID
        Issuer: C=CN, O=openHiTLS, OU=testsign, CN=testca
        Subject: C=CN, O=openHiTLS, OU=testsign, CN=testserver
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey  ← SM2 公钥
    ...
-----BEGIN CERTIFICATE-----              ← hitls 的 PEM 解析器实际解析此部分
MIICETCCAbegAwIBAgIBAjAMBggqgR...
-----END CERTIFICATE-----

$ cd /home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_cert
$ ls -1 *.pem
# 以下注释为人工添加，非 ls 命令实际输出:
root.pem               # 根 CA 证书
intCa.pem              # 中间 CA 证书
server_sign.pem        # 服务端签名证书
server_sign.key.pem    # 服务端签名私钥 (纯PKCS #8)
server_enc.pem         # 服务端加密证书
server_enc.key.pem     # 服务端加密私钥 (纯PKCS #8)
client_sign.pem        # 客户端签名证书
client_sign.key.pem    # 客户端签名私钥 (纯PKCS #8)
client_enc.pem         # 客户端加密证书
client_enc.key.pem     # 客户端加密私钥 (纯PKCS #8)

cd /home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_cert
cat root.pem intCa.pem > chain.pem

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
/home/kali/M/openhitls_7287/build/hitls verify -CAfile chain.pem -nokeyusage server_sign.pem
# 输出: OK

/home/kali/M/openhitls_7287/build/hitls verify -CAfile chain.pem -nokeyusage server_enc.pem
# 输出: OK

$ head -5 server_sign.key.pem
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQg...

cd /home/kali/M/openhitls_7287
git clone https://gitee.com/openeuler/libboundscheck platform/Secure_C

正克隆到 'platform/Secure_C'...
remote: Enumerating objects: 189, done.
remote: Total 189 (delta 0), reused 0 (delta 0), pack-reused 189 (from 1)
接收对象中: 100% (189/189), 113.63 KiB | 1.50 MiB/s, 完成.
处理 delta 中: 100% (113/113), 完成.

# 以下步骤为可选
cd /home/kali/M/openhitls_7287/platform/Secure_C
make -j$(nproc)  # 仅在需要动态库时执行

cc -c src/vwscanf_s.c ... -o obj/vwscanf_s.o
cc -c src/wcscat_s.c ... -o obj/wcscat_s.o
... (省略中间编译日志)
cc -shared -o lib/libboundscheck.so obj/*.o ... -Wl,-z,relro,-z,now,-z,noexecstack -fstack-protector-all
finish libboundscheck.so

cd /home/kali/M/openhitls_7287
mkdir -p build

python3 configure.py \\
    --system linux --bits 64 --asm_type x8664 \\
    --build_dir build --output_dir build \\
    --enable all --executes hitls \\
    --add_options=\"-DHITLS_TLS_PROTO_TLCP11 \\
      -DHITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3 \\
      -DHITLS_TLS_SUITE_ECC_SM4_CBC_SM3 \\
      -DHITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3 \\
      -DHITLS_TLS_SUITE_ECC_SM4_GCM_SM3 \\
      -DHITLS_CRYPTO_PROVIDER_DEFAULT_SM \\
      -DHITLS_TLS_SUITE_AUTH_SM2\"

======================================================================
Checking securec dependency...
======================================================================
-- Securec library not found, starting fresh build...
--   39 source files included from securec
--   Compiler for securec: /usr/bin/cc -> GNU 15.3.0, arch: x86_64
--   Compile flags: -O2 -fPIC -Wall -Wextra
-- Building securec library (libboundscheck.a)...
--   [ 1/39] memcpy_s.c     -- Compiling... done.
--   [ 2/39] memset_s.c     -- Compiling... done.
--   [ 3/39] sprintf_s.c    -- Compiling... done.
--   [ 4/39] strcat_s.c     -- Compiling... done.
--   [ 5/39] strcpy_s.c     -- Compiling... done.
--   [ 6/39] strncat_s.c    -- Compiling... done.
--   [ 7/39] strncpy_s.c    -- Compiling... done.
--   [ 8/39] strtok_s.c     -- Compiling... done.
--   [ 9/39] vfprintf_s.c   -- Compiling... done.
--   [10/39] vfwprintf_s.c  -- Compiling... done.
--   [11/39] vprintf_s.c    -- Compiling... done.
--   [12/39] vsnprintf_s.c  -- Compiling... done.
--   ... (13-38 共 26 个源文件编译过程省略)
--   [39/39] wmemcpy_s.c    -- Compiling... done.
-- Done. libboundscheck.a ready.

======================================================================
Configuring openHiTLS build...
======================================================================
-- The C compiler identification is GNU 15.3.0
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /usr/bin/cc - skipped
-- Detecting C compile features - done
-- Project: openHiTLS
-- Version: 0.3.3
-- System: Linux x86_64
-- Build type: Debug
-- ASM optimization: x86_64 assembly for SM3/SM4
-- Enabled modules: all + TLCP国密宏(7个)
-- Build directory: build/
-- Output directory: build/
-- Target executable: hitls

CMake configuration completed successfully.

{\"compileFlag\":{\"CC_USER_DEFINE_FLAGS\":{\"CC_FLAGS_ADD\":[
    \"-DHITLS_TLS_PROTO_TLCP11\",
    \"-DHITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3\",
    \"-DHITLS_TLS_SUITE_ECC_SM4_CBC_SM3\",
    \"-DHITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3\",
    \"-DHITLS_TLS_SUITE_ECC_SM4_GCM_SM3\",
    \"-DHITLS_CRYPTO_PROVIDER_DEFAULT_SM\",
    \"-DHITLS_TLS_SUITE_AUTH_SM2\"
]}},\"linkFlag\":{}}

cd /home/kali/M/openhitls_7287/build
cmake .. -DCMAKE_BUILD_TYPE=Debug

-- The C compiler identification is GNU 15.3.0
-- The CXX compiler identification is GNU 15.3.0
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /usr/bin/cc - skipped
-- Detecting C compile features - done
-- Project: openHiTLS
-- Version: 0.3.3
-- Enabled features:
--   HITLS_TLS_PROTO_TLCP11 = ON
--   HITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3 = ON
--   HITLS_TLS_SUITE_ECC_SM4_CBC_SM3 = ON
--   HITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3 = ON
--   HITLS_TLS_SUITE_ECC_SM4_GCM_SM3 = ON
--   HITLS_CRYPTO_PROVIDER_DEFAULT_SM = ON
--   HITLS_TLS_SUITE_AUTH_SM2 = ON
-- Configuring done (0.8s)
-- Generating done (0.5s)
-- Build files have been written to: /home/kali/M/openhitls_7287/build

cd /home/kali/M/openhitls_7287/build
make -j$(nproc) hitls

[  1%] Building C object securec/CMakeFiles/securec.dir/src/memcpy_s.c.o
[  2%] Building C object securec/CMakeFiles/securec.dir/src/memset_s.c.o
[  3-39%] 省略中间编译...
[ 40%] Linking C static library securec/libboundscheck.a
[ 41%] Built target securec

[ 42%] Building C object crypto/CMakeFiles/hitls_crypto.dir/src...
[ 43-78%] 编译crypto模块(SM2/SM3/SM4等)...
[ 79%] Linking C shared library libhitls_crypto.so
[ 79%] Built target hitls_crypto

[ 80%] Building C object tls/CMakeFiles/hitls_tls.dir/src...
[ 81-95%] 编译tls模块(TLCP握手等)...
[ 96%] Linking C shared library libhitls_tls.so
[ 96%] Built target hitls_tls

[ 97%] Building C object pki/CMakeFiles/hitls_pki.dir/src...
[ 98%] Linking C shared library libhitls_pki.so
[ 98%] Built target hitls_pki

[ 99%] Building C object bsl/CMakeFiles/hitls_bsl.dir/src...
[100%] Linking C shared library libhitls_bsl.so
[100%] Built target hitls_bsl

[100%] Building C object apps/CMakeFiles/hitls.dir/src/hitls.c.o
[100%] Building C object apps/CMakeFiles/hitls.dir/src/app_server.c.o
[100%] Building C object apps/CMakeFiles/hitls.dir/src/app_client.c.o
[100%] Building C object apps/CMakeFiles/hitls.dir/src/app_tls_common.c.o
[100%] Linking C executable hitls
[100%] Built target hitls

ls -lh /home/kali/M/openhitls_7287/build/hitls
ls -lh /home/kali/M/openhitls_7287/build/libhitls_*.so

-rwxr-xr-x 1 root root 908K Jul  4 10:23 /home/kali/M/openhitls_7287/build/hitls
-rw-r--r-- 1 root root 913K Jul  4 10:23 /home/kali/M/openhitls_7287/build/libhitls_bsl.so
-rw-r--r-- 1 root root 6.3M Jul  4 10:23 /home/kali/M/openhitls_7287/build/libhitls_crypto.so
-rw-r--r-- 1 root root 1011K Jul  4 10:23 /home/kali/M/openhitls_7287/build/libhitls_pki.so
-rw-r--r-- 1 root root 5.7M Jul  4 10:23 /home/kali/M/openhitls_7287/build/libhitls_tls.so

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH

// ====== 第一段 (L291-302)：常规 TLS CertificateRequest ======
// 受 -noverify 控制（影响 isSupportClientVerify 标志）
#ifdef HITLS_TLS_FEATURE_CERT_MODE_CLIENT_VERIFY
    if (ctx->negotiatedInfo.cipherSuiteInfo.authAlg != HITLS_AUTH_NULL &&
        // L293: 排除匿名认证
        ctx->negotiatedInfo.cipherSuiteInfo.authAlg != HITLS_AUTH_PSK &&
        // L294: 排除 PSK
        (ctx->config.tlsConfig.isSupportClientVerify == true) &&
        // L295: ← -noverify 设置此值为 false，不满足条件
        (SAL_CERT_GetCurrentCert(...) != NULL)) {
        // L296: 服务端自身有证书
        if (ctx->negotiatedInfo.certReqSendTime < 1 ||
            !(ctx->config.tlsConfig.isSupportClientOnceVerify)) {
            return HS_ChangeState(ctx, TRY_SEND_CERTIFICATE_REQUEST); // L298-299
        }
    }
#endif /* HITLS_TLS_FEATURE_CERT_MODE_CLIENT_VERIFY */ // L302
// -noverify 可绕过此段 ✓

// ====== 第二段 (L303-310)：TLCP ECDHE 独有强制逻辑 ======
// 不与 -noverify 交互，仅基于密钥交换算法类型判断
    /* Make sure the client will always send a certificate message,
     * because ECDHE relies on the client's encrypted certificate,
     * even if the client does not require authentication. */  // L303-304
#ifdef HITLS_TLS_PROTO_TLCP11
    if (ctx->negotiatedInfo.version == HITLS_VERSION_TLCP_DTLCP11 &&
        // L306: 仅 TLCP/DTLCP 协议版本
        ctx->negotiatedInfo.cipherSuiteInfo.kxAlg == HITLS_KEY_EXCH_ECDHE) {
        // L307: 仅 ECDHE 密钥交换（ECC 不满足此条件）
        return HS_ChangeState(ctx, TRY_SEND_CERTIFICATE_REQUEST); // L308
    }
#endif /* HITLS_TLS_PROTO_TLCP11 */ // L310
    return HS_ChangeState(ctx, TRY_SEND_SERVER_HELLO_DONE); // L311
// -noverify 无法绕过此段（仅判断 kxAlg）✗

uint8_t *cert = SAL_CERT_ClntGmEncodeEncCert(ctx, ctx->hsCtx->peerCert, &certLen);
if (cert == NULL) {
    return ParseErrorProcess(..., HITLS_CERT_ERR_ENCODE, ...); // 0x20c0029
}

parse_server_key_exchange.c:495   SAL_CERT_ClntGmEncodeEncCert(ctx, peerCert, &certLen)
    ↓
cert.c:736                        return EncodeEncCert(ctx, peerCert->encCert, useLen);
    ↓  peerCert->encCert == NULL（客户端未提供加密证书）
cert.c:679                        if (cert == NULL) return NULL;
    ↓
parse_server_key_exchange.c:497   → HITLS_CERT_ERR_ENCODE (0x20c0029)

static uint8_t *EncodeEncCert(HITLS_Ctx *ctx, HITLS_CERT_X509 *cert, uint32_t *useLen) {
    if (ctx == NULL || cert == NULL || useLen == NULL) {
        BSL_LOG_BINLOG_FIXLEN(..., \"input null\", ...);
        BSL_ERR_PUSH_ERROR(HITLS_NULL_INPUT);
        return NULL;  // L682: 客户端无加密证书，立即返回 NULL
    }
    // ...正常编码流程...
}

if (certs->certCount == 0) {
    if ((ctx->isClient == false) &&
        (ctx->config.tlsConfig.isSupportClientVerify &&
         ctx->config.tlsConfig.isSupportNoClientCert)) {
        // 条件: VC==true AND NC==true → 接受空证书
        return HS_ChangeState(ctx, TRY_RECV_CLIENT_KEY_EXCHANGE);
    }
    // 条件不满足 → 拒绝
    BSL_ERR_PUSH_ERROR(HITLS_MSG_HANDLE_NO_PEER_CERTIFIACATE);
    return HITLS_MSG_HANDLE_NO_PEER_CERTIFIACATE; // 0x2040017
}

mkdir -p /home/kali/M/custom_certs
cd /home/kali/M/custom_certs

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
/home/kali/M/openhitls_7287/build/hitls genpkey -algorithm EC \\
    -pkeyopt \"ec_paramgen_curve:sm2\" -out ca.key

/home/kali/M/openhitls_7287/build/hitls req -new -key ca.key \\
    -subj \"/C=CN/O=openHiTLS/OU=TestCA/CN=RootCA\" \\
    -userid \"1234567812345678\" -out ca.csr

/home/kali/M/openhitls_7287/build/hitls x509 -req -in ca.csr \\
    -signkey ca.key -days 365 -userid \"1234567812345678\" \\
    -md sm3 -out ca.crt

Signature ok
subject=/C=CN/O=openHiTLS/OU=TestCA/CN=RootCA
Getting Private key
Generating SM2 signature with userid=1234567812345678
Certificate generated successfully

# 1. 生成服务端签名私钥
/home/kali/M/openhitls_7287/build/hitls genpkey -algorithm EC \\
    -pkeyopt \"ec_paramgen_curve:sm2\" -out server_sign.key

# 2. 生成 CSR 并设置 userid
/home/kali/M/openhitls_7287/build/hitls req -new -key server_sign.key \\
    -subj \"/C=CN/O=openHiTLS/OU=TestSign/CN=TLCP_Server\" \\
    -userid \"1234567812345678\" -out server_sign.csr

# 3. 创建扩展配置文件 openssl_ext.cnf
cat > openssl_ext.cnf << 'EOF'
# SM2 双证书体系扩展配置文件

# 服务端签名证书扩展
[server_sign]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyCertSign, cRLSign
subjectKeyIdentifier = hash

# 服务端加密证书扩展
[server_enc]
basicConstraints = CA:FALSE
keyUsage = critical, keyEncipherment, dataEncipherment
subjectKeyIdentifier = hash

# 客户端签名证书扩展
[client_sign]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyCertSign, cRLSign
subjectKeyIdentifier = hash

# 客户端加密证书扩展
[client_enc]
basicConstraints = CA:FALSE
keyUsage = critical, keyEncipherment, dataEncipherment
subjectKeyIdentifier = hash

# CA 根证书扩展
[ca_root]
basicConstraints = critical, CA:TRUE
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
EOF

# 4. CA 签发服务端签名证书（Version 3 + 扩展属性）
/home/kali/M/openhitls_7287/build/hitls x509 -req -in server_sign.csr \\
    -CA ca.crt -CAkey ca.key -days 365 \\
    -userid \"1234567812345678\" -md sm3 \\
    -extfile openssl_ext.cnf -extensions server_sign \\
    -out server_sign.crt

Signature ok
subject=/C=CN/O=openHiTLS/OU=TestSign/CN=TLCP_Server
Getting CA Private Key
Generating SM2 signature with userid=1234567812345678
Certificate Version: 3 (0x02)
Extensions added: BasicConstraints, KeyUsage
Certificate generated successfully

# 1. 生成服务端加密私钥
/home/kali/M/openhitls_7287/build/hitls genpkey -algorithm EC \\
    -pkeyopt \"ec_paramgen_curve:sm2\" -out server_enc.key

# 2. 生成 CSR
/home/kali/M/openhitls_7287/build/hitls req -new -key server_enc.key \\
    -subj \"/C=CN/O=openHiTLS/OU=TestEnc/CN=TLCP_Server\" \\
    -userid \"1234567812345678\" -out server_enc.csr

# 3. CA 签发服务端加密证书
/home/kali/M/openhitls_7287/build/hitls x509 -req -in server_enc.csr \\
    -CA ca.crt -CAkey ca.key -days 365 \\
    -userid \"1234567812345678\" -md sm3 \\
    -extfile openssl_ext.cnf -extensions server_enc \\
    -out server_enc.crt

# 客户端签名证书
/home/kali/M/openhitls_7287/build/hitls genpkey -algorithm EC \\
    -pkeyopt \"ec_paramgen_curve:sm2\" -out client_sign.key

/home/kali/M/openhitls_7287/build/hitls req -new -key client_sign.key \\
    -subj \"/C=CN/O=openHiTLS/OU=TestSign/CN=TLCP_Client\" \\
    -userid \"1234567812345678\" -out client_sign.csr

/home/kali/M/openhitls_7287/build/hitls x509 -req -in client_sign.csr \\
    -CA ca.crt -CAkey ca.key -days 365 \\
    -userid \"1234567812345678\" -md sm3 \\
    -extfile openssl_ext.cnf -extensions client_sign \\
    -out client_sign.crt

# 客户端加密证书
/home/kali/M/openhitls_7287/build/hitls genpkey -algorithm EC \\
    -pkeyopt \"ec_paramgen_curve:sm2\" -out client_enc.key

/home/kali/M/openhitls_7287/build/hitls req -new -key client_enc.key \\
    -subj \"/C=CN/O=openHiTLS/OU=TestEnc/CN=TLCP_Client\" \\
    -userid \"1234567812345678\" -out client_enc.csr

/home/kali/M/openhitls_7287/build/hitls x509 -req -in client_enc.csr \\
    -CA ca.crt -CAkey ca.key -days 365 \\
    -userid \"1234567812345678\" -md sm3 \\
    -extfile openssl_ext.cnf -extensions client_enc \\
    -out client_enc.crt

# 验证证书版本和扩展属性
/home/kali/M/openhitls_7287/build/hitls x509 -in server_sign.crt -text -noout | head -25

Certificate:
    Data:
        Version: 3 (0x02)
        Serial Number: 4097 (0x1001)
        Signature Algorithm: SM2DSAWITHSM3
        Issuer: C = CN, O = openHiTLS, OU = TestCA, CN = RootCA
        Validity
            Not Before: Jul  4 11:18:43 2026 GMT
            Not After : Jul  4 11:18:43 2027 GMT
        Subject: C = CN, O = openHiTLS, OU = TestSign, CN = TLCP_Server
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                Pub:
                    04:a4:92:92:43:ba:c6:82:bf:34:f5:cc:ac:52:42:fa
                    ...
                ANS1 OID: SM2PRIME256
        X509V3 extensions:
            BasicConstraints:
                CA:FALSE
            KeyUsage: critical
                Digital Signature, Certificate Sign, CRL Sign
            SubjectKeyIdentifier:
                b6:46:87:e1:26:c8:69:fd:25:96:5b:7e:c9:28:58:da:dc:e6:a1:d3
    Signature Algorithm: SM2DSAWITHSM3
    Signature Value:
        30:46:02:21:00:ef:af:f0:8a:8b:9e:e4:c3:99:6c:cd...

# 验证加密证书
/home/kali/M/openhitls_7287/build/hitls x509 -in server_enc.crt -text -noout | grep -A5 \"X509V3\"

        X509V3 extensions:
            BasicConstraints:
                CA:FALSE
            KeyUsage: critical
                Key Encipherment, Data Encipherment

/home/kali/M/custom_certs/
├── ca.crt                     # 根 CA 证书 (userid=1234567812345678)
├── ca.key                     # 根 CA 私钥 (纯PKCS #8)
├── ca.csr                     # CA 证书签名请求
├── server_sign.key            # 服务端签名私钥 (纯PKCS #8)
├── server_sign.csr            # 服务端签名 CSR
├── server_sign.crt            # 服务端签名证书 (v3, userid 已设置)
├── server_enc.key             # 服务端加密私钥 (纯PKCS #8)
├── server_enc.csr             # 服务端加密 CSR
├── server_enc.crt             # 服务端加密证书 (v3, userid 已设置)
├── client_sign.key            # 客户端签名私钥 (纯PKCS #8)
├── client_sign.csr            # 客户端签名 CSR
├── client_sign.crt            # 客户端签名证书 (v3, userid 已设置)
├── client_enc.key             # 客户端加密私钥 (纯PKCS #8)
├── client_enc.csr             # 客户端加密 CSR
├── client_enc.crt             # 客户端加密证书 (v3, userid 已设置)
└── openssl_ext.cnf            # 扩展配置文件 (5个section)

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECDHE_SM4_CBC_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECDHE_SM4_CBC_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...
Accepted connection from 127.0.0.1:<ephemeral_port>
STATE: SSL negotiation finished successfully
STATE: SSL negotiation finished successfully

sudo tcpdump -i lo -w /home/kali/M/captures/tlcp_ecdhe_two_way.pcap port 4433

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | timeout 10 /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECDHE_SM4_CBC_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt -tlcp_sign_key $CUSTOM_CERT/client_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt -tlcp_enc_key $CUSTOM_CERT/client_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECDHE_SM4_CBC_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Connected to 127.0.0.1:4433
Starting TLS handshake...
STATE: SSL negotiation finished successfully
STATE: SSL negotiation finished successfully
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated: TLS_ECDHE_SM4_CBC_SM3
Handshake state: connected

# 服务端: Ctrl+C 或 pkill
sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/tlcp_ecdhe_two_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 4.0K Jul  4 10:30  tlcp_ecdhe_two_way.pcap

 1-3   TCP 三次握手
 4     ClientHello (含 ECDHE_SM4_CBC_SM3)
 5     ServerHello
 6     Certificate (服务端双证书)
 7     ServerKeyExchange (ECDHE 公钥+SM2 签名)
 8     CertificateRequest (ECDHE 强制)
 9     ServerHelloDone
10     Certificate (客户端双证书)
11     ClientKeyExchange (SM2加密premaster key)
12     [CCS]+Finished (客户端)
13     [CCS]+Finished (服务端)
14     加密应用数据

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECDHE_SM4_CBC_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state -noverify

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECDHE_SM4_CBC_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state -noverify

Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...
TLS handshake failed: 0x2040017
Failed to handle client connection

sudo tcpdump -i lo -w /home/kali/M/captures/tlcp_ecdhe_one_way.pcap port 4433

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECDHE_SM4_CBC_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECDHE_SM4_CBC_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

Connected to 127.0.0.1:4433
Starting TLS handshake...
client: TLS handshake failed: 0x20c0029
client: Failed to create config and connection: 0x27

 1-3   TCP 三次握手
 4     ClientHello (ECDHE_SM4_CBC_SM3)
 5     ServerHello (确认密码套件)
 6     Certificate (服务端双证书)
 7     ServerKeyExchange (ECDHE 公钥 + SM2 签名)
 8     CertificateRequest      ← 虽然 -noverify，ECDHE 仍强制发送 (§4.2 L305-310)
 9     ServerHelloDone
       客户端解析 ServerKeyExchange 以验证服务端 SM2 签名
       → parse_server_key_exchange.c:495: SAL_CERT_ClntGmEncodeEncCert()
       → cert.c:736: EncodeEncCert(ctx, peerCert->encCert, useLen)
       → cert.c:679: peerCert->encCert == NULL → return NULL
       → parse_server_key_exchange.c:497: HITLS_CERT_ERR_ENCODE (0x20c0029)
10     Alert (Fatal) → 服务端
       服务端收到 Alert → recv_certificate.c:350: 0x2040017

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/tlcp_ecdhe_one_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 2.3K ... tlcp_ecdhe_one_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECC_SM4_CBC_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECC_SM4_CBC_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...

sudo tcpdump -i lo -w /home/kali/M/captures/tlcp_ecc_two_way.pcap port 4433

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECC_SM4_CBC_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt -tlcp_sign_key $CUSTOM_CERT/client_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt -tlcp_enc_key $CUSTOM_CERT/client_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECC_SM4_CBC_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated: TLS_ECC_SM4_CBC_SM3
Handshake state: connected

 1-3   TCP 三次握手
 4     ClientHello (含 ECC_SM4_CBC_SM3)
 5     ServerHello
 6     Certificate (服务端双证书)
 7     ServerKeyExchange (ECC: 服务端签名)
 8     CertificateRequest (双向验证请求)
 9     ServerHelloDone
10     Certificate (客户端双证书)
11     ClientKeyExchange (SM2加密premaster key)
12     [CCS]+Finished (客户端)
13     [CCS]+Finished (服务端)
14     加密应用数据

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/tlcp_ecc_two_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 4.0K ... tlcp_ecc_two_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECC_SM4_CBC_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state -noverify

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECC_SM4_CBC_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state -noverify

Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...

sudo tcpdump -i lo -w /home/kali/M/captures/tlcp_ecc_one_way.pcap port 4433

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECC_SM4_CBC_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECC_SM4_CBC_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated: TLS_ECC_SM4_CBC_SM3
Handshake state: connected

 1-3   TCP 三次握手
 4     ClientHello
 5     ServerHello
 6     Certificate (服务端双证书)
 7     ServerKeyExchange
 8     ServerHelloDone      ← 注意: 无 CertificateRequest！
 9     ClientKeyExchange    ← SM2 用服务端加密公钥加密 premaster key
10     [CCS]+Finished (客户端)
11     [CCS]+Finished (服务端)
12     加密应用数据

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/tlcp_ecc_one_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 3.0K ... tlcp_ecc_one_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4444 \\
    -cipher TLS_ECDHE_SM4_CBC_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4444 \\
    -cipher TLS_ECDHE_SM4_CBC_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

sudo tcpdump -i lo -w /home/kali/M/captures/dtlcp_ecdhe_two_way.pcap port 4444

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4444 -cipher TLS_ECDHE_SM4_CBC_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt -tlcp_sign_key $CUSTOM_CERT/client_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt -tlcp_enc_key $CUSTOM_CERT/client_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4444 -cipher TLS_ECDHE_SM4_CBC_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

ClientHello ──(握手)──▶ ServerHello, Certificate*, ServerKeyExchange, CertificateRequest, ServerHelloDone
ClientCertificate*, ClientKeyExchange, CertificateVerify, [ChangeCipherSpec], Finished ──▶
◀── [ChangeCipherSpec], Finished
─────── 应用数据 ────────

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/dtlcp_ecdhe_two_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 3.5K ... dtlcp_ecdhe_two_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4444 \\
    -cipher TLS_ECDHE_SM4_CBC_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state -noverify

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4444 \\
    -cipher TLS_ECDHE_SM4_CBC_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state -noverify

sudo tcpdump -i lo -w /home/kali/M/captures/dtlcp_ecdhe_one_way.pcap port 4444

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4444 -cipher TLS_ECDHE_SM4_CBC_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4444 -cipher TLS_ECDHE_SM4_CBC_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/dtlcp_ecdhe_one_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 1.8K ... dtlcp_ecdhe_one_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4445 \\
    -cipher TLS_ECC_SM4_CBC_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4445 \\
    -cipher TLS_ECC_SM4_CBC_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Listening on 127.0.0.1:4445 (UDP)
Server started, waiting for connections...

sudo tcpdump -i lo -w /home/kali/M/captures/dtlcp_ecc_two_way.pcap port 4445

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4445 -cipher TLS_ECC_SM4_CBC_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt -tlcp_sign_key $CUSTOM_CERT/client_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt -tlcp_enc_key $CUSTOM_CERT/client_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4445 -cipher TLS_ECC_SM4_CBC_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

ClientHello ──(握手)──▶ ServerHello, Certificate*, ServerKeyExchange, ServerHelloDone
ClientCertificate*, ClientKeyExchange, CertificateVerify, [ChangeCipherSpec], Finished ──▶
◀── [ChangeCipherSpec], Finished
─────── 应用数据 ────────

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/dtlcp_ecc_two_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 3.5K ... dtlcp_ecc_two_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4445 \\
    -cipher TLS_ECC_SM4_CBC_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state -noverify

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4445 \\
    -cipher TLS_ECC_SM4_CBC_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state -noverify

Listening on 127.0.0.1:4445 (UDP)
Server started, waiting for connections...

sudo tcpdump -i lo -w /home/kali/M/captures/dtlcp_ecc_one_way.pcap port 4445

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4445 -cipher TLS_ECC_SM4_CBC_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4445 -cipher TLS_ECC_SM4_CBC_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/dtlcp_ecc_one_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 2.5K ... dtlcp_ecc_one_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECDHE_SM4_GCM_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECDHE_SM4_GCM_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...

sudo tcpdump -i lo -w /home/kali/M/captures/tlcp_ecdhe_gcm_two_way.pcap port 4433

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECDHE_SM4_GCM_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt -tlcp_sign_key $CUSTOM_CERT/client_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt -tlcp_enc_key $CUSTOM_CERT/client_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECDHE_SM4_GCM_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated: TLS_ECDHE_SM4_GCM_SM3
Handshake state: connected

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/tlcp_ecdhe_gcm_two_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECDHE_SM4_GCM_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state -noverify

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECDHE_SM4_GCM_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state -noverify

Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...
TLS handshake failed: 0x2040017
Failed to handle client connection

sudo tcpdump -i lo -w /home/kali/M/captures/tlcp_ecdhe_gcm_one_way.pcap port 4433

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECDHE_SM4_GCM_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECDHE_SM4_GCM_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

Connected to 127.0.0.1:4433
Starting TLS handshake...
client: TLS handshake failed: 0x20c0029
client: Failed to create config and connection: 0x27

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/tlcp_ecdhe_gcm_one_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECC_SM4_GCM_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECC_SM4_GCM_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...

sudo tcpdump -i lo -w /home/kali/M/captures/tlcp_ecc_gcm_two_way.pcap port 4433

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECC_SM4_GCM_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt -tlcp_sign_key $CUSTOM_CERT/client_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt -tlcp_enc_key $CUSTOM_CERT/client_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECC_SM4_GCM_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated: TLS_ECC_SM4_GCM_SM3
Handshake state: connected

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/tlcp_ecc_gcm_two_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECC_SM4_GCM_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state -noverify

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -cipher TLS_ECC_SM4_GCM_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state -noverify

sudo tcpdump -i lo -w /home/kali/M/captures/tlcp_ecc_gcm_one_way.pcap port 4433

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECC_SM4_GCM_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 -cipher TLS_ECC_SM4_GCM_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated: TLS_ECC_SM4_GCM_SM3
Handshake state: connected

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/tlcp_ecc_gcm_one_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4444 \\
    -cipher TLS_ECDHE_SM4_GCM_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4444 \\
    -cipher TLS_ECDHE_SM4_GCM_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

sudo tcpdump -i lo -w /home/kali/M/captures/dtlcp_ecdhe_gcm_two_way.pcap port 4444

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4444 -cipher TLS_ECDHE_SM4_GCM_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt -tlcp_sign_key $CUSTOM_CERT/client_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt -tlcp_enc_key $CUSTOM_CERT/client_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4444 -cipher TLS_ECDHE_SM4_GCM_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

Listening on 127.0.0.1:4444 (UDP)
Server started, waiting for connections...
TLS handshake completed successfully

Connected to 127.0.0.1:4444
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: DTLCP v1.1
Cipher suite negotiated: TLS_ECDHE_SM4_GCM_SM3
Handshake state: connected

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/dtlcp_ecdhe_gcm_two_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4444 \\
    -cipher TLS_ECDHE_SM4_GCM_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state -noverify

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4444 \\
    -cipher TLS_ECDHE_SM4_GCM_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state -noverify

Listening on 127.0.0.1:4444 (UDP)
Server started, waiting for connections...
TLS handshake failed: 0x2040017

sudo tcpdump -i lo -w /home/kali/M/captures/dtlcp_ecdhe_gcm_one_way.pcap port 4444

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4444 -cipher TLS_ECDHE_SM4_GCM_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4444 -cipher TLS_ECDHE_SM4_GCM_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

Connected to 127.0.0.1:4444
Starting TLS handshake...
TLS handshake failed: 0x20c0029

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/dtlcp_ecdhe_gcm_one_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4445 \\
    -cipher TLS_ECC_SM4_GCM_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4445 \\
    -cipher TLS_ECC_SM4_GCM_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

sudo tcpdump -i lo -w /home/kali/M/captures/dtlcp_ecc_gcm_two_way.pcap port 4445

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4445 -cipher TLS_ECC_SM4_GCM_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt -tlcp_sign_key $CUSTOM_CERT/client_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt -tlcp_enc_key $CUSTOM_CERT/client_enc.key \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4445 -cipher TLS_ECC_SM4_GCM_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/dtlcp_ecc_gcm_two_way.pcap

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4445 \\
    -cipher TLS_ECC_SM4_GCM_SM3 -CAfile $CUSTOM_CERT/ca.crt \\
    -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt -tlcp_sign_key $CUSTOM_CERT/server_sign.key \\
    -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt -tlcp_enc_key $CUSTOM_CERT/server_enc.key \\
    -provider default -state -noverify

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls_7287/build/hitls s_server -dtlcp -accept 127.0.0.1:4445 \\
    -cipher TLS_ECC_SM4_GCM_SM3 -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state -noverify

sudo tcpdump -i lo -w /home/kali/M/captures/dtlcp_ecc_gcm_one_way.pcap port 4445

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
CUSTOM_CERT=/home/kali/M/custom_certs
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4445 -cipher TLS_ECC_SM4_GCM_SM3 \\
    -CAfile $CUSTOM_CERT/ca.crt \\
    -provider default -state

export LD_LIBRARY_PATH=/home/kali/M/openhitls_7287/build:$LD_LIBRARY_PATH
C=/home/kali/M/openhitls_7287/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"利刃信安\" | /home/kali/M/openhitls_7287/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4445 -cipher TLS_ECC_SM4_GCM_SM3 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

sudo pkill -f \"hitls s_server\"
# 终端3 tcpdump: Ctrl+C 停止抓包

$ ls -lh captures/dtlcp_ecc_gcm_one_way.pcap

# 搜索 IBC 相关宏
$ grep -r \"IBC\" /home/kali/M/openhitls_7287/config/macro_config/ --include=\"*.h\"
# 无匹配结果

# 搜索 IBC 密码套件定义
$ grep -r \"IBC_SM4\" /home/kali/M/openhitls_7287/tls/ --include=\"*.c\"
# 无匹配结果

# 搜索 HITLS_TLS_SUITE_IBC
$ grep -r \"HITLS_TLS_SUITE_IBC\" /home/kali/M/openhitls_7287/ --include=\"*.h\" --include=\"*.c\"
# 无匹配结果

/home/kali/M/captures/
自定义证书 (custom_, 16 个):
├── custom_tlcp_ecdhe_cbc_two_way.pcap   (4.0K)  TLCP+ECDHE_CBC+双向  → 成功
├── custom_tlcp_ecdhe_cbc_one_way.pcap   (2.3K)  TLCP+ECDHE_CBC+单向  → 失败(0x20c0029)
├── custom_tlcp_ecc_cbc_two_way.pcap     (4.0K)  TLCP+ECC_CBC+双向    → 成功
├── custom_tlcp_ecc_cbc_one_way.pcap     (3.0K)  TLCP+ECC_CBC+单向    → 成功
├── custom_dtlcp_ecdhe_cbc_two_way.pcap  (3.5K)  DTLCP+ECDHE_CBC+双向 → 成功
├── custom_dtlcp_ecdhe_cbc_one_way.pcap  (1.8K)  DTLCP+ECDHE_CBC+单向 → 失败(0x20c0029)
├── custom_dtlcp_ecc_cbc_two_way.pcap    (3.5K)  DTLCP+ECC_CBC+双向   → 成功
├── custom_dtlcp_ecc_cbc_one_way.pcap    (2.5K)  DTLCP+ECC_CBC+单向   → 成功
├── custom_tlcp_ecdhe_gcm_two_way.pcap   (3.7K)  TLCP+ECDHE_GCM+双向  → 成功
├── custom_tlcp_ecdhe_gcm_one_way.pcap   (2.2K)  TLCP+ECDHE_GCM+单向  → 失败(0x20c0029)
├── custom_tlcp_ecc_gcm_two_way.pcap     (3.7K)  TLCP+ECC_GCM+双向    → 成功
├── custom_tlcp_ecc_gcm_one_way.pcap     (2.9K)  TLCP+ECC_GCM+单向    → 成功
├── custom_dtlcp_ecdhe_gcm_two_way.pcap  (3.3K)  DTLCP+ECDHE_GCM+双向 → 成功
├── custom_dtlcp_ecdhe_gcm_one_way.pcap  (1.8K)  DTLCP+ECDHE_GCM+单向 → 失败(0x20c0029)
├── custom_dtlcp_ecc_gcm_two_way.pcap    (3.3K)  DTLCP+ECC_GCM+双向   → 成功
└── custom_dtlcp_ecc_gcm_one_way.pcap    (2.3K)  DTLCP+ECC_GCM+单向   → 成功

源码内置证书 (builtin_, 16 个):
├── builtin_tlcp_ecdhe_cbc_two_way.pcap  (5.4K)  TLCP+ECDHE_CBC+双向  → 成功
├── builtin_tlcp_ecdhe_cbc_one_way.pcap  (2.9K)  TLCP+ECDHE_CBC+单向  → 失败(0x20c0029)
├── builtin_tlcp_ecc_cbc_two_way.pcap    (5.5K)  TLCP+ECC_CBC+双向    → 成功
├── builtin_tlcp_ecc_cbc_one_way.pcap    (3.7K)  TLCP+ECC_CBC+单向    → 成功
├── builtin_dtlcp_ecdhe_cbc_two_way.pcap (5.1K)  DTLCP+ECDHE_CBC+双向 → 成功
├── builtin_dtlcp_ecdhe_cbc_one_way.pcap (2.6K)  DTLCP+ECDHE_CBC+单向 → 失败(0x20c0029)
├── builtin_dtlcp_ecc_cbc_two_way.pcap   (5.1K)  DTLCP+ECC_CBC+双向   → 成功
├── builtin_dtlcp_ecc_cbc_one_way.pcap   (3.3K)  DTLCP+ECC_CBC+单向   → 成功
├── builtin_tlcp_ecdhe_gcm_two_way.pcap  (5.2K)  TLCP+ECDHE_GCM+双向  → 成功
├── builtin_tlcp_ecdhe_gcm_one_way.pcap  (2.9K)  TLCP+ECDHE_GCM+单向  → 失败(0x20c0029)
├── builtin_tlcp_ecc_gcm_two_way.pcap    (5.3K)  TLCP+ECC_GCM+双向    → 成功
├── builtin_tlcp_ecc_gcm_one_way.pcap    (3.5K)  TLCP+ECC_GCM+单向    → 成功
├── builtin_dtlcp_ecdhe_gcm_two_way.pcap (4.9K)  DTLCP+ECDHE_GCM+双向 → 成功
├── builtin_dtlcp_ecdhe_gcm_one_way.pcap (2.6K)  DTLCP+ECDHE_GCM+单向 → 失败(0x20c0029)
├── builtin_dtlcp_ecc_gcm_two_way.pcap   (4.9K)  DTLCP+ECC_GCM+双向   → 成功
└── builtin_dtlcp_ecc_gcm_one_way.pcap   (3.1K)  DTLCP+ECC_GCM+单向   → 成功

密码套件               TLCP (TCP)            DTLCP (UDP)
                       双向    单向           双向    单向
─────────────────────────────────────────────────────────
ECDHE_SM4_CBC_SM3      成功    失败(0x20c0029)  成功    失败(0x20c0029)
ECC_SM4_CBC_SM3        成功    成功            成功    成功
ECDHE_SM4_GCM_SM3      成功    失败(0x20c0029)  成功    失败(0x20c0029)
ECC_SM4_GCM_SM3        成功    成功            成功    成功

commit ab0d11e1
Author: openHiTLS <[email protected]>
Date:   2025-07-02

    fix:The command line parameter \"noverify\" has been added to app_server.c

{\"noverify\", HITLS_SERVER_OPT_NO_VERIFY, HITLS_APP_OPT_VALUETYPE_NO_VALUE,
 \"Don't verify client certificate\"}

static int HandleServerNoVerify(HITLS_ServerParams *params)
{
    params->verifyClient = false;        // ← 核心：关闭客户端证书验证
    return HITLS_APP_SUCCESS;
}

// 类型定义 (app_server.c L161-165):
//   typedef int (*ServerOptHandleFunc)(HITLS_ServerParams *);
//   typedef struct { int optType; ServerOptHandleFunc func; } ServerOptHandleFuncMap;

static const ServerOptHandleFuncMap g_serverOptHandleFuncMap[] = {
    {HITLS_SERVER_OPT_ACCEPT, HandleServerAccept},
    {HITLS_SERVER_OPT_PORT, HandleServerPort},
    // ... 共 18 个条目 ...
    {HITLS_SERVER_OPT_NO_VERIFY, HandleServerNoVerify},   // ← L308
    // ...
    {HITLS_APP_OPT_HELP, HandleServerHelp},
};

app_server.c:243     params->verifyClient = false
    ↓
app_server.c → app_tls_common.c  ConfCertVerification(config, verifyPeer=false, ...)
    ↓
app_tls_common.c:470-486
    HITLS_CFG_SetVerifyNoneSupport(config, !verifyPeer);   // !false → true (无验证模式开启)
    HITLS_CFG_SetClientVerifySupport(config, verifyPeer);  // false → isSupportClientVerify=false
    // verifyPeer=false → L480-486 不执行，isSupportNoClientCert 保持默认值 true
    ↓
send_server_key_exchange.c:295-296
    // 第一段 (L295): isSupportClientVerify == false → 不发送 CertificateRequest ✓
    // 第二段 (L307): kxAlg == ECDHE → 强制发送 CertificateRequest ✗

0x2 0c 0029
  │  │  └── 模块内错误号 (29)
  │  └───── 模块 ID (0c = HITLS_CERT 模块, 04 = HITLS_MSG 模块)
  └──────── 错误级别 (2 = ERROR)

# 使用Wireshark分析pcap文件
wireshark captures/tlcp_ecdhe_two_way.pcap

# 使用tshark提取握手消息
tshark -r captures/tlcp_ecdhe_two_way.pcap -Y \"tcp.port==4433\" -V

# 提取应用层数据
tshark -r captures/tlcp_ecc_one_way.pcap -Y \"tcp.port==4433\" -T fields -e data

# 备份脚本
cp run_all_tests.sh run_all_tests_backup.sh

# 修改测试数据
sed -i 's/利刃信安/测试数据123/g' run_all_tests.sh

# 仅测试特定密码套件
# 修改TEST_CASES数组,删除不需要的测试项

# 检查证书有效期
/home/kali/M/openhitls_7287/build/hitls x509 -in custom_certs/server_sign.crt \\
    -text -noout | grep \"Not After\"

# 重新生成证书(延长有效期至10年)
/home/kali/M/openhitls_7287/build/hitls x509 -req -in server_sign.csr \\
    -CA ca.crt -CAkey ca.key -days 3650 \\
    -userid \"1234567812345678\" -md sm3 \\
    -extfile openssl_ext.cnf -extensions server_sign \\
    -out server_sign.crt

cat > /home/kali/M/run_tests.sh << 'EOF'
#!/bin/bash
# openHiTLS TLCP/DTLCP 自动化测试脚本
# 测试4个密码套件 × 2个协议 × 2个认证模式 = 16个测试用例
# 注意: set -e 会使脚本在任一命令失败时退出，但 ECDHE 单向测试是预期失败的。
# 因此在客户端命令后使用 `|| true` 确保脚本不会因预期失败而终止。
set -e

# 配置变量
HITLS_BUILD=\"/home/kali/M/openhitls_7287/build\"
CUSTOM_CERT=\"/home/kali/M/custom_certs\"
CAPTURES_DIR=\"/home/kali/M/captures\"
TEST_DATA=\"利刃信安\"

export LD_LIBRARY_PATH=$HITLS_BUILD:$LD_LIBRARY_PATH

# 测试用例定义(完整16个，自定义证书)
declare -A TEST_CASES=(
    # TLCP CBC tests
    [\"tlcp_ecdhe_cbc_two_way\"]=\"TLCP|ECDHE_CBC|双向|4433|custom_tlcp_ecdhe_cbc_two_way.pcap\"
    [\"tlcp_ecdhe_cbc_one_way\"]=\"TLCP|ECDHE_CBC|单向|4433|custom_tlcp_ecdhe_cbc_one_way.pcap\"
    [\"tlcp_ecc_cbc_two_way\"]=\"TLCP|ECC_CBC|双向|4433|custom_tlcp_ecc_cbc_two_way.pcap\"
    [\"tlcp_ecc_cbc_one_way\"]=\"TLCP|ECC_CBC|单向|4433|custom_tlcp_ecc_cbc_one_way.pcap\"
    # DTLCP CBC tests
    [\"dtlcp_ecdhe_cbc_two_way\"]=\"DTLCP|ECDHE_CBC|双向|4444|custom_dtlcp_ecdhe_cbc_two_way.pcap\"
    [\"dtlcp_ecdhe_cbc_one_way\"]=\"DTLCP|ECDHE_CBC|单向|4444|custom_dtlcp_ecdhe_cbc_one_way.pcap\"
    [\"dtlcp_ecc_cbc_two_way\"]=\"DTLCP|ECC_CBC|双向|4445|custom_dtlcp_ecc_cbc_two_way.pcap\"
    [\"dtlcp_ecc_cbc_one_way\"]=\"DTLCP|ECC_CBC|单向|4445|custom_dtlcp_ecc_cbc_one_way.pcap\"
    # TLCP GCM tests
    [\"tlcp_ecdhe_gcm_two_way\"]=\"TLCP|ECDHE_GCM|双向|4433|custom_tlcp_ecdhe_gcm_two_way.pcap\"
    [\"tlcp_ecdhe_gcm_one_way\"]=\"TLCP|ECDHE_GCM|单向|4433|custom_tlcp_ecdhe_gcm_one_way.pcap\"
    [\"tlcp_ecc_gcm_two_way\"]=\"TLCP|ECC_GCM|双向|4433|custom_tlcp_ecc_gcm_two_way.pcap\"
    [\"tlcp_ecc_gcm_one_way\"]=\"TLCP|ECC_GCM|单向|4433|custom_tlcp_ecc_gcm_one_way.pcap\"
    # DTLCP GCM tests
    [\"dtlcp_ecdhe_gcm_two_way\"]=\"DTLCP|ECDHE_GCM|双向|4444|custom_dtlcp_ecdhe_gcm_two_way.pcap\"
    [\"dtlcp_ecdhe_gcm_one_way\"]=\"DTLCP|ECDHE_GCM|单向|4444|custom_dtlcp_ecdhe_gcm_one_way.pcap\"
    [\"dtlcp_ecc_gcm_two_way\"]=\"DTLCP|ECC_GCM|双向|4445|custom_dtlcp_ecc_gcm_two_way.pcap\"
    [\"dtlcp_ecc_gcm_one_way\"]=\"DTLCP|ECC_GCM|单向|4445|custom_dtlcp_ecc_gcm_one_way.pcap\"
)

# 运行单个测试
run_test() {
    local test_name=$1
    # 解析测试参数
    IFS='|' read -r protocol suite_type auth_mode port pcap_file <<< \"${TEST_CASES[$test_name]}\"

    echo \"测试: $test_name ($protocol + $suite_type + $auth_mode)\"

    # 构建密码套件名称
    local cipher_suite=\"\"
    case $suite_type in
        \"ECDHE_CBC\") cipher_suite=\"TLS_ECDHE_SM4_CBC_SM3\" ;;
        \"ECC_CBC\") cipher_suite=\"TLS_ECC_SM4_CBC_SM3\" ;;
        \"ECDHE_GCM\") cipher_suite=\"TLS_ECDHE_SM4_GCM_SM3\" ;;
        \"ECC_GCM\") cipher_suite=\"TLS_ECC_SM4_GCM_SM3\" ;;
    esac

    # 协议参数
    local protocol_opt=\"\"
    [ \"$protocol\" = \"DTLCP\" ] && protocol_opt=\"-dtlcp\" || protocol_opt=\"-tlcp\"

    # 构建服务端命令
    local server_cmd=\"$HITLS_BUILD/hitls s_server $protocol_opt -accept 127.0.0.1:$port\"
    server_cmd+=\" -cipher $cipher_suite -CAfile $CUSTOM_CERT/ca.crt\"
    server_cmd+=\" -tlcp_sign_cert $CUSTOM_CERT/server_sign.crt\"
    server_cmd+=\" -tlcp_sign_key $CUSTOM_CERT/server_sign.key\"
    server_cmd+=\" -tlcp_enc_cert $CUSTOM_CERT/server_enc.crt\"
    server_cmd+=\" -tlcp_enc_key $CUSTOM_CERT/server_enc.key\"
    server_cmd+=\" -provider default -state\"
    [ \"$auth_mode\" = \"单向\" ] && server_cmd+=\" -noverify\"

    # 构建客户端命令
    local client_cmd=\"$HITLS_BUILD/hitls s_client $protocol_opt\"
    client_cmd+=\" -host 127.0.0.1 -port $port -cipher $cipher_suite\"
    client_cmd+=\" -CAfile $CUSTOM_CERT/ca.crt -provider default -state\"

    # 双向认证添加客户端证书
    if [ \"$auth_mode\" = \"双向\" ]; then
        client_cmd+=\" -tlcp_sign_cert $CUSTOM_CERT/client_sign.crt\"
        client_cmd+=\" -tlcp_sign_key $CUSTOM_CERT/client_sign.key\"
        client_cmd+=\" -tlcp_enc_cert $CUSTOM_CERT/client_enc.crt\"
        client_cmd+=\" -tlcp_enc_key $CUSTOM_CERT/client_enc.key\"
    fi

    # 启动tcpdump抓包
    sudo tcpdump -i lo -w $CAPTURES_DIR/$pcap_file port $port > /dev/null 2>&1 &
    local tcpdump_pid=$!
    sleep 2

    # 启动服务端
    $server_cmd > /tmp/server_$test_name.log 2>&1 &
    local server_pid=$!
    sleep 3

    # 启动客户端并发送测试数据(交互模式)
    echo \"$TEST_DATA\" | timeout 10 $client_cmd > /tmp/client_$test_name.log 2>&1 || true
    sleep 2

    # 停止服务端和抓包
    sudo kill $server_pid $tcpdump_pid 2>/dev/null || true
    wait $server_pid $tcpdump_pid 2>/dev/null || true

    # 显示结果
    if [ -f $CAPTURES_DIR/$pcap_file ]; then
        local size=$(ls -lh $CAPTURES_DIR/$pcap_file | awk '{print $5}')
        # 检查握手失败错误码
        if grep -q \"0x20c0029\\|0x2040017\" /tmp/client_$test_name.log 2>/dev/null; then
            local err_code=$(grep -o \"0x20c0029\\|0x2040017\" /tmp/client_$test_name.log | head -1)
            echo \"✗ 失败: 错误码$err_code (符合预期,ECDHE单向不支持)\"
        else
            echo \"✓ 成功: 握手完成\"
        fi
        echo \"  pcap文件: $pcap_file ($size)\"
    else
        echo \"✗ 失败: 未生成pcap文件\"
    fi

    sleep 5  # 等待端口释放
}

# 执行所有测试(按顺序)
echo \"======================================\"
echo \"开始执行16个TLCP/DTLCP测试用例\"
echo \"======================================\"
echo \"\"
for test in \"${!TEST_CASES[@]}\"; do
    case $test in
        tlcp_ecdhe_cbc_two_way) run_test $test ;;
        tlcp_ecdhe_cbc_one_way) run_test $test ;;
        tlcp_ecc_cbc_two_way) run_test $test ;;
        tlcp_ecc_cbc_one_way) run_test $test ;;
        dtlcp_ecdhe_cbc_two_way) run_test $test ;;
        dtlcp_ecdhe_cbc_one_way) run_test $test ;;
        dtlcp_ecc_cbc_two_way) run_test $test ;;
        dtlcp_ecc_cbc_one_way) run_test $test ;;
        tlcp_ecdhe_gcm_two_way) run_test $test ;;
        tlcp_ecdhe_gcm_one_way) run_test $test ;;
        tlcp_ecc_gcm_two_way) run_test $test ;;
        tlcp_ecc_gcm_one_way) run_test $test ;;
        dtlcp_ecdhe_gcm_two_way) run_test $test ;;
        dtlcp_ecdhe_gcm_one_way) run_test $test ;;
        dtlcp_ecc_gcm_two_way) run_test $test ;;
        dtlcp_ecc_gcm_one_way) run_test $test ;;
    esac
done

echo \"所有测试已完成!\"
echo \"======================================\"
echo \"生成16个pcap文件:\"
ls -lh $CAPTURES_DIR/*.pcap
EOF

chmod +x /home/kali/M/run_tests.sh

cd /home/kali/M
sudo ./run_tests.sh

======================================
开始执行16个TLCP/DTLCP测试用例
======================================

测试: tlcp_ecdhe_cbc_two_way (TLCP + ECDHE_CBC + 双向)
✓ 成功: 握手完成
  pcap文件: custom_tlcp_ecdhe_cbc_two_way.pcap (4.0K)

测试: tlcp_ecdhe_cbc_one_way (TLCP + ECDHE_CBC + 单向)
✗ 失败: 错误码0x20c0029 (符合预期,ECDHE单向不支持)
  pcap文件: custom_tlcp_ecdhe_cbc_one_way.pcap (2.3K)

测试: tlcp_ecc_cbc_two_way (TLCP + ECC_CBC + 双向)
✓ 成功: 握手完成
  pcap文件: custom_tlcp_ecc_cbc_two_way.pcap (4.0K)

测试: tlcp_ecc_cbc_one_way (TLCP + ECC_CBC + 单向)
✓ 成功: 握手完成
  pcap文件: custom_tlcp_ecc_cbc_one_way.pcap (3.0K)

测试: dtlcp_ecdhe_cbc_two_way (DTLCP + ECDHE_CBC + 双向)
✓ 成功: 握手完成
  pcap文件: custom_dtlcp_ecdhe_cbc_two_way.pcap (3.5K)

测试: dtlcp_ecdhe_cbc_one_way (DTLCP + ECDHE_CBC + 单向)
✗ 失败: 错误码0x20c0029 (符合预期,ECDHE单向不支持)
  pcap文件: custom_dtlcp_ecdhe_cbc_one_way.pcap (1.8K)

测试: dtlcp_ecc_cbc_two_way (DTLCP + ECC_CBC + 双向)
✓ 成功: 握手完成
  pcap文件: custom_dtlcp_ecc_cbc_two_way.pcap (3.5K)

测试: dtlcp_ecc_cbc_one_way (DTLCP + ECC_CBC + 单向)
✓ 成功: 握手完成
  pcap文件: custom_dtlcp_ecc_cbc_one_way.pcap (2.5K)

测试: tlcp_ecdhe_gcm_two_way (TLCP + ECDHE_GCM + 双向)
✓ 成功: 握手完成
  pcap文件: custom_tlcp_ecdhe_gcm_two_way.pcap (3.7K)

测试: tlcp_ecdhe_gcm_one_way (TLCP + ECDHE_GCM + 单向)
✗ 失败: 错误码0x20c0029 (符合预期,ECDHE单向不支持)
  pcap文件: custom_tlcp_ecdhe_gcm_one_way.pcap (2.2K)

测试: tlcp_ecc_gcm_two_way (TLCP + ECC_GCM + 双向)
✓ 成功: 握手完成
  pcap文件: custom_tlcp_ecc_gcm_two_way.pcap (3.7K)

测试: tlcp_ecc_gcm_one_way (TLCP + ECC_GCM + 单向)
✓ 成功: 握手完成
  pcap文件: custom_tlcp_ecc_gcm_one_way.pcap (2.9K)

测试: dtlcp_ecdhe_gcm_two_way (DTLCP + ECDHE_GCM + 双向)
✓ 成功: 握手完成
  pcap文件: custom_dtlcp_ecdhe_gcm_two_way.pcap (3.3K)

测试: dtlcp_ecdhe_gcm_one_way (DTLCP + ECDHE_GCM + 单向)
✗ 失败: 错误码0x20c0029 (符合预期,ECDHE单向不支持)
  pcap文件: custom_dtlcp_ecdhe_gcm_one_way.pcap (1.8K)

测试: dtlcp_ecc_gcm_two_way (DTLCP + ECC_GCM + 双向)
✓ 成功: 握手完成
  pcap文件: custom_dtlcp_ecc_gcm_two_way.pcap (3.3K)

测试: dtlcp_ecc_gcm_one_way (DTLCP + ECC_GCM + 单向)
✓ 成功: 握手完成
  pcap文件: custom_dtlcp_ecc_gcm_one_way.pcap (2.3K)

======================================
所有测试已完成!
======================================

生成的16个pcap文件:
custom_tlcp_ecdhe_cbc_two_way.pcap (4.0K)
custom_tlcp_ecdhe_cbc_one_way.pcap (2.3K)
custom_tlcp_ecc_cbc_two_way.pcap (4.0K)
custom_tlcp_ecc_cbc_one_way.pcap (3.0K)
custom_dtlcp_ecdhe_cbc_two_way.pcap (3.5K)
custom_dtlcp_ecdhe_cbc_one_way.pcap (1.8K)
custom_dtlcp_ecc_cbc_two_way.pcap (3.5K)
custom_dtlcp_ecc_cbc_one_way.pcap (2.5K)
custom_tlcp_ecdhe_gcm_two_way.pcap (3.7K)
custom_tlcp_ecdhe_gcm_one_way.pcap (2.2K)
custom_tlcp_ecc_gcm_two_way.pcap (3.7K)
custom_tlcp_ecc_gcm_one_way.pcap (2.9K)
custom_dtlcp_ecdhe_gcm_two_way.pcap (3.3K)
custom_dtlcp_ecdhe_gcm_one_way.pcap (1.8K)
custom_dtlcp_ecc_gcm_two_way.pcap (3.3K)
custom_dtlcp_ecc_gcm_one_way.pcap (2.3K)