openHiTLSTLCP/DTLCP编译与抓包完整操作记录"

admin
admin
admin
0
文章
0
评论
2026-10-21 22:15:23 网络安全文章 来源：ZONE.CI 全球网 0 阅读模式

cover_image

openHiTLS TLCP/DTLCP 编译与抓包完整操作记录

原创

利刃信安
利刃信安

利刃信安

2026年7月2日 01:30
北京

在小说阅读器读本章

去阅读

openHiTLS TLCP/DTLCP 编译与抓包完整操作记录

一、获取源码

1.1 克隆 openHiTLS 主仓库

cd /home/kali/M
git clone https://gitcode.com/openhitls/openhitls.git

输出：

┌──(kali㉿kali)-[~]
└─$ sudo -i

┌──(root㉿kali)-[~]
└─# cd /home/kali/M

┌──(root㉿kali)-[/home/kali/M]
└─# git clone https://gitcode.com/openhitls/openhitls.git
正克隆到 'openhitls'...
remote: Enumerating objects: 40601, done.
remote: Counting objects: 100% (4625/4625), done.
remote: Compressing objects: 100% (459/459), done.
remote: Total 40601 (delta 4332), reused 4168 (delta 4166), pack-reused 35976 (from 1)
接收对象中: 100% (40601/40601), 57.41 MiB | 11.15 MiB/s, 完成.
处理 delta 中: 100% (26901/26901), 完成.

1.2 切换到稳定版本 openhitls-0.3.3

cd /home/kali/M/openhitls
git checkout openhitls-0.3.3

输出：

┌──(root㉿kali)-[/home/kali/M]
└─# cd /home/kali/M/openhitls

┌──(root㉿kali)-[/home/kali/M/openhitls]
└─# git checkout openhitls-0.3.3
注意：正在切换到 'openhitls-0.3.3'。

您正处于分离头指针状态。您可以查看、做试验性的修改及提交，并且您可以在切换
回一个分支时，丢弃在此状态下所做的提交而不对分支造成影响。

如果您想要通过创建分支来保留在此状态下所做的提交，您可以通过在 switch 命令
中添加参数 -c 来实现（现在或稍后）。例如：

  git switch -c <新分支名>

或者撤销此操作：

  git switch -

通过将配置变量 advice.detachedHead 设置为 false 来关闭此建议

HEAD 目前位于 dd08164c fix:Fix the issue where the chain is not cleared when only one certificate is loaded in HITLS_CFG_UseCertificateChainBuffer

1.3 克隆安全函数库 Secure\_C（非子模块，需手动克隆到 platform/ 目录）

cd /home/kali/M/openhitls
git clone https://gitee.com/openeuler/libboundscheck platform/Secure_C

输出：

┌──(root㉿kali)-[/home/kali/M/openhitls]
└─# cd /home/kali/M/openhitls

┌──(root㉿kali)-[/home/kali/M/openhitls]
└─# git clone https://gitee.com/openeuler/libboundscheck platform/Secure_C
正克隆到 'platform/Secure_C'...
remote: Enumerating objects: 189, done.
remote: Total 189 (delta 0), reused 0 (delta 0), pack-reused 189 (from 1)
接收对象中: 100% (189/189), 113.63 KiB | 1.50 MiB/s, 完成.
处理 delta 中: 100% (113/113), 完成.

二、编译 Secure\_C 安全库

cd /home/kali/M/openhitls/platform/Secure_C
make -j$(nproc)

输出（截取尾部）：

cc -c src/vwscanf_s.c ... -o obj/vwscanf_s.o
cc -c src/wcscat_s.c ... -o obj/wcscat_s.o
... (省略中间编译日志)
cc -shared -o lib/libboundscheck.so obj/*.o ... -Wl,-z,relro,-z,now,-z,noexecstack -fstack-protector-all
finish libboundscheck.so

产物：/home/kali/M/openhitls/platform/Secure_C/lib/libboundscheck.so

三、配置并编译 openHiTLS 主程序

3.1 使用 configure.py 生成 CMake 配置

关键：必须显式启用 TLCP 国密协议相关编译宏，HITLS_BUILD_PROFILE=full 不足以启用国密 provider。HITLS_CRYPTO_PROVIDER_DEFAULT_SM 将 SM2/SM3/SM4 集成到默认 Provider，是 0.3.3 版本可用性的必要条件。

cd /home/kali/M/openhitls
mkdir -p build

python3 configure.py \\
    --enable hitls_bsl hitls_crypto hitls_tls hitls_pki hitls_auth \\
    --system linux --bits 64 --asm_type x8664 \\
    --lib_type shared static \\
    --executes hitls \\
    --add_options \"-DHITLS_TLS_PROTO_TLCP11 -DHITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3 -DHITLS_TLS_SUITE_ECC_SM4_CBC_SM3 -DHITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3 -DHITLS_TLS_SUITE_ECC_SM4_GCM_SM3 -DHITLS_CRYPTO_PROVIDER_DEFAULT_SM -DHITLS_TLS_SUITE_AUTH_SM2\" \\
    -m --build_dir build

编译宏说明：

编译宏 作用
HITLS_TLS_PROTO_TLCP11 启用 TLCP 1.1 协议支持
HITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3 ECDHE\_SM4\_CBC\_SM3 密码套件
HITLS_TLS_SUITE_ECC_SM4_CBC_SM3 ECC\_SM4\_CBC\_SM3 密码套件
HITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3 ECDHE\_SM4\_GCM\_SM3 密码套件
HITLS_TLS_SUITE_ECC_SM4_GCM_SM3 ECC\_SM4\_GCM\_SM3 密码套件
HITLS_CRYPTO_PROVIDER_DEFAULT_SM SM2/SM3/SM4 集成到默认 Provider
HITLS_TLS_SUITE_AUTH_SM2 SM2 身份认证

configure.py 无错误输出（空输出表示成功）。

3.2 CMake 生成构建文件

cd /home/kali/M/openhitls/build
cmake -DCMAKE_BUILD_TYPE=Debug ..

输出（截取尾部）：

┌──(root㉿kali)-[/home/…/M/openhitls/platform/Secure_C]
└─# cd /home/kali/M/openhitls

┌──(root㉿kali)-[/home/kali/M/openhitls]
└─# mkdir -p build

┌──(root㉿kali)-[/home/kali/M/openhitls]
└─# python3 configure.py \\
    --enable hitls_bsl hitls_crypto hitls_tls hitls_pki hitls_auth \\
    --system linux --bits 64 --asm_type x8664 \\
    --lib_type shared static \\
    --executes hitls \\
    --add_options \"-DHITLS_TLS_PROTO_TLCP11 -DHITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3 -DHITLS_TLS_SUITE_ECC_SM4_CBC_SM3 -DHITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3 -DHITLS_TLS_SUITE_ECC_SM4_GCM_SM3 -DHITLS_CRYPTO_PROVIDER_DEFAULT_SM -DHITLS_TLS_SUITE_AUTH_SM2\" \\
    -m --build_dir build

┌──(root㉿kali)-[/home/kali/M/openhitls]
└─# cd /home/kali/M/openhitls/build

┌──(root㉿kali)-[/home/kali/M/openhitls/build]
└─# cmake -DCMAKE_BUILD_TYPE=Debug ..
-- The C compiler identification is GNU 15.3.0
-- The CXX compiler identification is GNU 15.3.0
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /usr/bin/cc - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Check for working CXX compiler: /usr/bin/c++ - skipped
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Configuring securec dependency...
--
-- === Configuring libboundscheck (Secure C) ===
-- Searching for sources in: /home/kali/M/openhitls/platform/Secure_C/src
-- Found 39 securec source files
-- System: Linux
-- Compiler: GNU 15.3.0
-- Securec library configured:
--   Source dir:   /home/kali/M/openhitls/platform/Secure_C/src
--   Include dir:  /home/kali/M/openhitls/platform/Secure_C/include
--   Output dir:   /home/kali/M/openhitls/platform/Secure_C/lib
--   Library type: STATIC
--   Library name: libboundscheck.a (Linux/macOS) / boundscheck.lib (Windows)
-- ========================================
--
-- The ASM compiler identification is GNU
-- Found assembler: /usr/bin/cc
-- Provider library for apps: libhitls.so
-- Configuring done (0.4s)
-- Generating done (0.2s)
-- Build files have been written to: /home/kali/M/openhitls/build

3.3 编译

make -j$(nproc) hitls

输出（截取尾部）：

[100%] Built target handshake-objs
[100%] Linking C shared library libhitls_tls.so
[100%] Built target hitls_tls-shared
[100%] Linking C executable hitls
[100%] Built target hitls

3.4 验证产物

ls -la /home/kali/M/openhitls/build/hitls
file /home/kali/M/openhitls/build/hitls

输出：

┌──(root㉿kali)-[/home/kali/M/openhitls/build]
└─# ls -la /home/kali/M/openhitls/build/hitls
-rwxr-xr-x 1 root root 925152  7月 1日 12:29 /home/kali/M/openhitls/build/hitls

┌──(root㉿kali)-[/home/kali/M/openhitls/build]
└─# file /home/kali/M/openhitls/build/hitls
/home/kali/M/openhitls/build/hitls: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, with debug_info, not stripped

mkdir -p /home/kali/M/captures

LD_LIBRARY_PATH=/home/kali/M/openhitls/build /home/kali/M/openhitls/build/hitls help

输出（首部）：

┌──(root㉿kali)-[/home/kali/M/openhitls/build]
└─# mkdir -p /home/kali/M/captures

┌──(root㉿kali)-[/home/kali/M/openhitls/build]
└─# LD_LIBRARY_PATH=/home/kali/M/openhitls/build

┌──(root㉿kali)-[/home/kali/M/openhitls/build]
└─# /home/kali/M/openhitls/build/hitls help
function: HiTLS supports the following commands:
help         rand         enc          pkcs12
rsa          x509         list         dgst
crl          genrsa       verify       pkey
genpkey      req          mac          kdf
prime        s_client     s_server     pkeyutl

四、创建测试脚本

测试证书路径（均为 DER 格式，openHiTLS 源码内置）：

/home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_with_userid/
├── ca.crt          # 根 CA 证书
├── ca.key          # 根 CA 私钥
├── inter.crt       # 中间 CA 证书
├── inter.key       # 中间 CA 私钥
├── sign.crt        # SM2 签名证书
├── sign.key        # SM2 签名私钥
├── enc.crt         # SM2 加密证书
└── enc.key         # SM2 加密私钥

4.1 服务端脚本 — server\_tlcp.sh（TLCP 服务端）

#!/bin/bash
export LD_LIBRARY_PATH=/home/kali/M/openhitls/build
C=/home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls/build/hitls s_server -tlcp -accept 127.0.0.1:4433 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

参数说明：

  • • -tlcp：强制使用 TLCP 1.1 协议（GB/T 38636-2020）
  • • -accept 127.0.0.1:4433：监听地址和端口
  • • -CAfile：根 CA 证书（用于验证客户端证书链）
  • • -chainCAfile：中间 CA 证书
  • • -tlcp_sign_cert / -tlcp_sign_key：签名证书与私钥（SM2 签名密钥对）
  • • -tlcp_enc_cert / -tlcp_enc_key：加密证书与私钥（SM2 加密密钥对）
  • • -provider default：使用默认加密服务提供商
  • • -state：输出详细握手状态信息

4.2 服务端脚本 — server\_dtlcp.sh（DTLCP 服务端）

#!/bin/bash
export LD_LIBRARY_PATH=/home/kali/M/openhitls/build
C=/home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_with_userid
/home/kali/M/openhitls/build/hitls s_server -dtlcp -accept 127.0.0.1:4433 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

4.3 客户端脚本 — client\_tlcp\_bidir.sh（TLCP 双向，提供客户端证书）

#!/bin/bash
export LD_LIBRARY_PATH=/home/kali/M/openhitls/build
C=/home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"tlcp_bidir_test\" | /home/kali/M/openhitls/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

4.4 客户端脚本 — client\_tlcp\_unidir.sh（TLCP 单向，不提供客户端证书）

#!/bin/bash
export LD_LIBRARY_PATH=/home/kali/M/openhitls/build
C=/home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"tlcp_unidir_test\" | /home/kali/M/openhitls/build/hitls s_client -tlcp \\
    -host 127.0.0.1 -port 4433 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

4.5 客户端脚本 — client\_dtlcp\_bidir.sh（DTLCP 双向）

#!/bin/bash
export LD_LIBRARY_PATH=/home/kali/M/openhitls/build
C=/home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"dtlcp_bidir_test\" | /home/kali/M/openhitls/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4433 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -tlcp_sign_cert $C/sign.crt -tlcp_sign_key $C/sign.key \\
    -tlcp_enc_cert $C/enc.crt -tlcp_enc_key $C/enc.key \\
    -provider default -state

4.6 客户端脚本 — client\_dtlcp\_unidir.sh（DTLCP 单向）

#!/bin/bash
export LD_LIBRARY_PATH=/home/kali/M/openhitls/build
C=/home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_with_userid
echo \"dtlcp_unidir_test\" | /home/kali/M/openhitls/build/hitls s_client -dtlcp \\
    -host 127.0.0.1 -port 4433 \\
    -CAfile $C/ca.crt -chainCAfile $C/inter.crt \\
    -provider default -state

五、测试一：TLCP 双向身份鉴别

方法：服务端（终端3）和客户端（终端4）均携带 SM2 签名+加密双证书。终端5 使用 tcpdump 抓 lo 口流量。

5.1 启动抓包（终端5）

sudo tcpdump -i lo -w /home/kali/M/captures/02_tlcp_two_way.pcap port 4433

输出：

┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i lo -w /home/kali/M/captures/02_tlcp_two_way.pcap port 4433
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes

5.2 启动服务端（终端3）

bash /home/kali/M/server_tlcp.sh

输出：

┌──(kali㉿kali)-[~]
└─$ sudo -i

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/server_tlcp.sh
Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...
Accepted connection from 127.0.0.1:55718
Starting TLS handshake with client...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Received 15 bytes from client:
tlcp_bidir_test
Sent 51 bytes response to client
Connection 1 completed
Accepted connection from 127.0.0.1:59498
Starting TLS handshake with client...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Received 15 bytes from client:
tlcp_bidir_test
Sent 51 bytes response to client
Connection 2 completed
Accepted connection from 127.0.0.1:59504
Starting TLS handshake with client...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Received 15 bytes from client:
tlcp_bidir_test
Sent 51 bytes response to client
Connection 3 completed

5.3 启动客户端（终端4）

bash /home/kali/M/client_tlcp_bidir.sh

输出：

┌──(kali㉿kali)-[~]
└─$ sudo -i

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_tlcp_bidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Interactive mode - type messages (Ctrl+C to exit):
Response: HTTP/1.1 200 OK
Content-Length: 12

Hello World!
Client completed successfully

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_tlcp_bidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Interactive mode - type messages (Ctrl+C to exit):
Response: HTTP/1.1 200 OK
Content-Length: 12

Hello World!
Client completed successfully

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_tlcp_bidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Interactive mode - type messages (Ctrl+C to exit):
Response: HTTP/1.1 200 OK
Content-Length: 12

Hello World!
Client completed successfully

结果：握手成功，通过 TLCP v1.1 建立了 SM4 加密隧道，客户端向服务端发送 \"tlcp\_bidir\_test\" 字符串，收到服务端返回的 \"Hello World!\"。

5.4 停止服务端和抓包

sudo pkill -f \"hitls s_server\"
sleep 1
sudo pkill tcpdump

5.5 抓包文件

02_tlcp_two_way.pcap   16,333 bytes

六、测试二：TLCP 单向身份鉴别

方法：服务端（终端3）携带双证书并配置 CA 链（默认要求客户端证书）。客户端（终端4）仅携带 -CAfile/-chainCAfile 验证服务端，不提供自身证书。

6.1 启动抓包（终端5）

sudo tcpdump -i lo -w /home/kali/M/captures/01_tlcp_one_way.pcap port 4433

输出：

┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i lo -w /home/kali/M/captures/01_tlcp_one_way.pcap port 4433
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes

6.2 启动服务端（终端3）

bash /home/kali/M/server_tlcp.sh

输出：

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/server_tlcp.sh
Listening on 127.0.0.1:4433 (TCP)
Server started, waiting for connections...
Accepted connection from 127.0.0.1:45362
Starting TLS handshake with client...
TLS handshake failed: 0x2040017
Failed to handle client connection
Connection 1 completed
Accepted connection from 127.0.0.1:37132
Starting TLS handshake with client...
TLS handshake failed: 0x2040017
Failed to handle client connection
Connection 2 completed
Accepted connection from 127.0.0.1:37134
Starting TLS handshake with client...
TLS handshake failed: 0x2040017
Failed to handle client connection
Connection 3 completed

6.3 启动客户端（终端4，不提供客户端证书）

bash /home/kali/M/client_tlcp_unidir.sh

输出：

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_tlcp_unidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
client: TLS handshake failed: 0x20c0029
client: Failed to create config and connection: 0x27

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_tlcp_unidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
client: TLS handshake failed: 0x20c0029
client: Failed to create config and connection: 0x27

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_tlcp_unidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
client: TLS handshake failed: 0x20c0029
client: Failed to create config and connection: 0x27

结果：握手失败，错误码 0x20c0029（证书添加/加载失败）。服务端在 CertificateRequest 阶段向客户端要求证书，但客户端未配置签名+加密双证书，握手中断。

6.4 停止服务端和抓包

sudo pkill -f \"hitls s_server\"
sleep 1
sudo pkill tcpdump

6.5 抓包文件

01_tlcp_one_way.pcap   8,780 bytes

说明：虽然握手失败，但抓包中保留了 ClientHello → ServerHello → Certificate → ServerKeyExchange → CertificateRequest → ServerHelloDone 的完整交互序列，以及客户端返回空 Certificate 后的 Alert。可用于分析 TLCP 单向鉴别场景中的协议报文。

七、测试三：DTLCP 双向身份鉴别

方法：服务端和客户端均携带双证书，使用 DTLCP 协议（UDP 承载）。参数与 TLCP 一致，仅将 -tlcp 替换为 -dtlcp。

7.1 启动抓包（终端5）

sudo tcpdump -i lo -w /home/kali/M/captures/04_dtlcp_two_way.pcap port 4433

输出：

┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i lo -w /home/kali/M/captures/04_dtlcp_two_way.pcap port 4433
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes

7.2 启动服务端（终端3）

bash /home/kali/M/server_dtlcp.sh

输出：

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/server_dtlcp.sh
Listening on 127.0.0.1:4433 (UDP)
Server started, waiting for connections...
Starting TLS handshake with client...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Received 16 bytes from client:
dtlcp_bidir_test
Sent 51 bytes response to client
Connection 1 completed
Starting TLS handshake with client...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Failed to read client data: 0x20a000b
Connection 2 completed
Starting TLS handshake with client...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Failed to read client data: 0x20a000b
Connection 3 completed
Starting TLS handshake with client...

7.3 启动客户端（终端4）

bash /home/kali/M/client_dtlcp_bidir.sh

输出：

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_dtlcp_bidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Interactive mode - type messages (Ctrl+C to exit):
Response: HTTP/1.1 200 OK
Content-Length: 12

Hello World!
Client completed successfully

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_dtlcp_bidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Interactive mode - type messages (Ctrl+C to exit):
Client completed successfully

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_dtlcp_bidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
TLS handshake completed successfully
Protocol version: TLCP v1.1
Cipher suite negotiated
Handshake state: connected
Interactive mode - type messages (Ctrl+C to exit):
Client completed successfully

结果：握手成功。协议版本标识为 \"TLCP v1.1\"（DTLCP 基于 TLCP 在 UDP 上的适配，版本标识仍沿用 TLCP v1.1）。

7.4 停止服务端和抓包

sudo pkill -f \"hitls s_server\"
sleep 1
sudo pkill tcpdump

7.5 抓包文件

04_dtlcp_two_way.pcap   15,228 bytes

八、测试四：DTLCP 单向身份鉴别

方法：服务端携带双证书，客户端不提供自身证书。

8.1 启动抓包（终端5）

sudo tcpdump -i lo -w /home/kali/M/captures/03_dtlcp_one_way.pcap port 4433

输出：

┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i lo -w /home/kali/M/captures/03_dtlcp_one_way.pcap port 4433
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes

8.2 启动服务端（终端3）

bash /home/kali/M/server_dtlcp.sh

输出：

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/server_dtlcp.sh
Listening on 127.0.0.1:4433 (UDP)
Server started, waiting for connections...
Starting TLS handshake with client...
TLS handshake failed: 0x2040017
Failed to handle client connection
Connection 1 completed
Starting TLS handshake with client...
TLS handshake failed: 0x2040017
Failed to handle client connection
Connection 2 completed
Starting TLS handshake with client...
TLS handshake failed: 0x2040017
Failed to handle client connection
Connection 3 completed
Starting TLS handshake with client...

8.3 启动客户端（终端4，不提供客户端证书）

bash /home/kali/M/client_dtlcp_unidir.sh

输出：

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_dtlcp_unidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
client: TLS handshake failed: 0x20c0029
client: Failed to create config and connection: 0x27

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_dtlcp_unidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
client: TLS handshake failed: 0x20c0029
client: Failed to create config and connection: 0x27

┌──(root㉿kali)-[~]
└─# bash /home/kali/M/client_dtlcp_unidir.sh
Connected to 127.0.0.1:4433
Starting TLS handshake...
client: TLS handshake failed: 0x20c0029
client: Failed to create config and connection: 0x27

结果：握手失败，错误码 0x20c0029，与服务端要求客户端证书一致。

8.4 停止服务端和抓包

sudo pkill -f \"hitls s_server\"
sleep 1
sudo pkill tcpdump

8.5 抓包文件

03_dtlcp_one_way.pcap   7,899 bytes

九、交付：4个数据包总览

ls -la /home/kali/M/captures/

输出：

┌──(root㉿kali)-[~]
└─# ls -la /home/kali/M/captures/
总计 60
drwxr-xr-x 2 root    root     4096  7月 1日 12:51 .
drwxrwxrwx 4 root    root     4096  7月 1日 12:39 ..
-rw-r--r-- 1 tcpdump tcpdump  8780  7月 1日 12:46 01_tlcp_one_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 16333  7月 1日 12:41 02_tlcp_two_way.pcap
-rw-r--r-- 1 tcpdump tcpdump  7899  7月 1日 12:53 03_dtlcp_one_way.pcap
-rw-r--r-- 1 tcpdump tcpdump 15228  7月 1日 12:49 04_dtlcp_two_way.pcap

9.1 pcap 内容验证

for f in /home/kali/M/captures/*.pcap; do
    echo \"=== $(basename $f) ===\"
    tcpdump -r \"$f\" -nn | head -15
    echo \"\"
done

输出：

01\_tlcp\_one\_way.pcap（TLCP 单向，TCP 握手失败）

┌──(root㉿kali)-[~]
└─# for f in /home/kali/M/captures/*.pcap; do
    echo \"=== $(basename $f) ===\"
    tcpdump -r \"$f\" -nn | head -15
    echo \"\"
done

=== 01_tlcp_one_way.pcap ===
reading from file /home/kali/M/captures/01_tlcp_one_way.pcap, link-type EN10MB (Ethernet), snapshot length 262144
12:46:13.250839 IP 127.0.0.1.45362 > 127.0.0.1.4433: Flags [S], seq 3300490400, win 65495, options [mss 65495,sackOK,TS val 2226550677 ecr 0,nop,wscale 10], length 0
12:46:13.250846 IP 127.0.0.1.4433 > 127.0.0.1.45362: Flags [S.], seq 46529753, ack 3300490401, win 65483, options [mss 65495,sackOK,TS val 836346331 ecr 2226550677,nop,wscale 10], length 0
12:46:13.250852 IP 127.0.0.1.45362 > 127.0.0.1.4433: Flags [.], ack 1, win 64, options [nop,nop,TS val 2226550677 ecr 836346331], length 0
12:46:13.250950 IP 127.0.0.1.45362 > 127.0.0.1.4433: Flags [P.], seq 1:79, ack 1, win 64, options [nop,nop,TS val 2226550677 ecr 836346331], length 78
12:46:13.250953 IP 127.0.0.1.4433 > 127.0.0.1.45362: Flags [.], ack 79, win 64, options [nop,nop,TS val 836346331 ecr 2226550677], length 0
12:46:13.254965 IP 127.0.0.1.4433 > 127.0.0.1.45362: Flags [P.], seq 1:1902, ack 79, win 64, options [nop,nop,TS val 836346335 ecr 2226550677], length 1901
12:46:13.255076 IP 127.0.0.1.45362 > 127.0.0.1.4433: Flags [.], ack 1902, win 84, options [nop,nop,TS val 2226550681 ecr 836346335], length 0
12:46:13.256938 IP 127.0.0.1.45362 > 127.0.0.1.4433: Flags [P.], seq 79:176, ack 1902, win 84, options [nop,nop,TS val 2226550683 ecr 836346335], length 97
12:46:13.257001 IP 127.0.0.1.4433 > 127.0.0.1.45362: Flags [P.], seq 1902:1909, ack 176, win 64, options [nop,nop,TS val 836346337 ecr 2226550683], length 7
12:46:13.257068 IP 127.0.0.1.4433 > 127.0.0.1.45362: Flags [R.], seq 1909, ack 176, win 64, options [nop,nop,TS val 836346337 ecr 2226550683], length 0
12:46:22.214506 IP 127.0.0.1.37132 > 127.0.0.1.4433: Flags [S], seq 1833535807, win 65495, options [mss 65495,sackOK,TS val 928550738 ecr 0,nop,wscale 10], length 0
12:46:22.214516 IP 127.0.0.1.4433 > 127.0.0.1.37132: Flags [S.], seq 1949242838, ack 1833535808, win 65483, options [mss 65495,sackOK,TS val 1780669965 ecr 928550738,nop,wscale 10], length 0
12:46:22.214524 IP 127.0.0.1.37132 > 127.0.0.1.4433: Flags [.], ack 1, win 64, options [nop,nop,TS val 928550738 ecr 1780669965], length 0
12:46:22.214786 IP 127.0.0.1.37132 > 127.0.0.1.4433: Flags [P.], seq 1:79, ack 1, win 64, options [nop,nop,TS val 928550738 ecr 1780669965], length 78
12:46:22.214789 IP 127.0.0.1.4433 > 127.0.0.1.37132: Flags [.], ack 79, win 64, options [nop,nop,TS val 1780669965 ecr 928550738], length 0

02\_tlcp\_two\_way.pcap（TLCP 双向，握手成功 + 应用数据）

┌──(root㉿kali)-[~]
└─# for f in /home/kali/M/captures/*.pcap; do
    echo \"=== $(basename $f) ===\"
    tcpdump -r \"$f\" -nn | head -15
    echo \"\"
done

=== 02_tlcp_two_way.pcap ===
reading from file /home/kali/M/captures/02_tlcp_two_way.pcap, link-type EN10MB (Ethernet), snapshot length 262144
12:41:09.946808 IP 127.0.0.1.55718 > 127.0.0.1.4433: Flags [S], seq 1470452005, win 65495, options [mss 65495,sackOK,TS val 4209665706 ecr 0,nop,wscale 10], length 0
12:41:09.946924 IP 127.0.0.1.4433 > 127.0.0.1.55718: Flags [S.], seq 2194274755, ack 1470452006, win 65483, options [mss 65495,sackOK,TS val 4153713132 ecr 4209665706,nop,wscale 10], length 0
12:41:09.946932 IP 127.0.0.1.55718 > 127.0.0.1.4433: Flags [.], ack 1, win 64, options [nop,nop,TS val 4209665706 ecr 4153713132], length 0
12:41:09.947089 IP 127.0.0.1.55718 > 127.0.0.1.4433: Flags [P.], seq 1:79, ack 1, win 64, options [nop,nop,TS val 4209665706 ecr 4153713132], length 78
12:41:09.947093 IP 127.0.0.1.4433 > 127.0.0.1.55718: Flags [.], ack 79, win 64, options [nop,nop,TS val 4153713132 ecr 4209665706], length 0
12:41:09.954698 IP 127.0.0.1.4433 > 127.0.0.1.55718: Flags [P.], seq 1:1902, ack 79, win 64, options [nop,nop,TS val 4153713140 ecr 4209665706], length 1901
12:41:09.954770 IP 127.0.0.1.55718 > 127.0.0.1.4433: Flags [.], ack 1902, win 84, options [nop,nop,TS val 4209665714 ecr 4153713140], length 0
12:41:09.955768 IP 127.0.0.1.55718 > 127.0.0.1.4433: Flags [P.], seq 79:1962, ack 1902, win 84, options [nop,nop,TS val 4209665715 ecr 4153713140], length 1883
12:41:09.956782 IP 127.0.0.1.4433 > 127.0.0.1.55718: Flags [P.], seq 1902:1993, ack 1962, win 83, options [nop,nop,TS val 4153713142 ecr 4209665715], length 91
12:41:09.957213 IP 127.0.0.1.55718 > 127.0.0.1.4433: Flags [P.], seq 1962:2031, ack 1993, win 84, options [nop,nop,TS val 4209665716 ecr 4153713142], length 69
12:41:09.957481 IP 127.0.0.1.4433 > 127.0.0.1.55718: Flags [P.], seq 1993:2110, ack 2031, win 83, options [nop,nop,TS val 4153713143 ecr 4209665716], length 117
12:41:09.957532 IP 127.0.0.1.55718 > 127.0.0.1.4433: Flags [P.], seq 2031:2100, ack 2110, win 84, options [nop,nop,TS val 4209665717 ecr 4153713143], length 69
12:41:09.957543 IP 127.0.0.1.4433 > 127.0.0.1.55718: Flags [P.], seq 2110:2179, ack 2100, win 83, options [nop,nop,TS val 4153713143 ecr 4209665717], length 69
12:41:09.957564 IP 127.0.0.1.4433 > 127.0.0.1.55718: Flags [R.], seq 2179, ack 2100, win 83, options [nop,nop,TS val 4153713143 ecr 4209665717], length 0
12:41:25.843699 IP 127.0.0.1.59498 > 127.0.0.1.4433: Flags [S], seq 1434616062, win 65495, options [mss 65495,sackOK,TS val 7932366 ecr 0,nop,wscale 10], length 0

03\_dtlcp\_one\_way.pcap（DTLCP 单向，UDP 握手失败）

┌──(root㉿kali)-[~]
└─# for f in /home/kali/M/captures/*.pcap; do
    echo \"=== $(basename $f) ===\"
    tcpdump -r \"$f\" -nn | head -15
    echo \"\"
done

=== 03_dtlcp_one_way.pcap ===
reading from file /home/kali/M/captures/03_dtlcp_one_way.pcap, link-type EN10MB (Ethernet), snapshot length 262144
12:51:52.836081 IP 127.0.0.1.4433 > 127.0.0.1.58571: UDP, length 15
12:52:08.763535 IP 127.0.0.1.58962 > 127.0.0.1.4433: UDP, length 95
12:52:08.763698 IP 127.0.0.1.4433 > 127.0.0.1.58962: UDP, length 112
12:52:08.763725 IP 127.0.0.1.4433 > 127.0.0.1.58962: UDP, length 1472
12:52:08.763918 IP 127.0.0.1.4433 > 127.0.0.1.58962: UDP, length 421
12:52:08.764688 IP 127.0.0.1.58962 > 127.0.0.1.4433: UDP, length 137
12:52:08.764820 IP 127.0.0.1.4433 > 127.0.0.1.58962: UDP, length 15
12:52:12.397219 IP 127.0.0.1.47187 > 127.0.0.1.4433: UDP, length 95
12:52:12.397466 IP 127.0.0.1.4433 > 127.0.0.1.47187: UDP, length 112
12:52:12.397509 IP 127.0.0.1.4433 > 127.0.0.1.47187: UDP, length 1472
12:52:12.397604 IP 127.0.0.1.4433 > 127.0.0.1.47187: UDP, length 422
12:52:12.398220 IP 127.0.0.1.47187 > 127.0.0.1.4433: UDP, length 137
12:52:12.398408 IP 127.0.0.1.4433 > 127.0.0.1.47187: UDP, length 15
12:52:15.408682 IP 127.0.0.1.35086 > 127.0.0.1.4433: UDP, length 95
12:52:15.408843 IP 127.0.0.1.4433 > 127.0.0.1.35086: UDP, length 112

04\_dtlcp\_two\_way.pcap（DTLCP 双向，握手成功 + 应用数据）

┌──(root㉿kali)-[~]
└─# for f in /home/kali/M/captures/*.pcap; do
    echo \"=== $(basename $f) ===\"
    tcpdump -r \"$f\" -nn | head -15
    echo \"\"
done

=== 04_dtlcp_two_way.pcap ===
reading from file /home/kali/M/captures/04_dtlcp_two_way.pcap, link-type EN10MB (Ethernet), snapshot length 262144
12:48:41.910301 IP 127.0.0.1.51938 > 127.0.0.1.4433: UDP, length 95
12:48:41.910665 IP 127.0.0.1.4433 > 127.0.0.1.51938: UDP, length 112
12:48:41.910699 IP 127.0.0.1.4433 > 127.0.0.1.51938: UDP, length 1472
12:48:41.910793 IP 127.0.0.1.4433 > 127.0.0.1.51938: UDP, length 423
12:48:41.912517 IP 127.0.0.1.51938 > 127.0.0.1.4433: UDP, length 1472
12:48:41.912765 IP 127.0.0.1.51938 > 127.0.0.1.4433: UDP, length 500
12:48:41.913707 IP 127.0.0.1.4433 > 127.0.0.1.51938: UDP, length 107
12:48:41.913929 IP 127.0.0.1.51938 > 127.0.0.1.4433: UDP, length 93
12:48:41.913983 IP 127.0.0.1.4433 > 127.0.0.1.51938: UDP, length 125
12:48:41.914011 IP 127.0.0.1.4433 > 127.0.0.1.51938: UDP, length 77
12:48:41.914027 IP 127.0.0.1.51938 > 127.0.0.1.4433: UDP, length 77
12:48:45.489428 IP 127.0.0.1.34398 > 127.0.0.1.4433: UDP, length 95
12:48:45.489874 IP 127.0.0.1.4433 > 127.0.0.1.34398: UDP, length 112
12:48:45.489897 IP 127.0.0.1.4433 > 127.0.0.1.34398: UDP, length 1472
12:48:45.489989 IP 127.0.0.1.4433 > 127.0.0.1.34398: UDP, length 422

9.2 汇总

文件名 协议 认证方式 大小 状态 报文特征
01\_tlcp\_one\_way.pcap TLCP(TCP) 单向 8,780B 失败 ClientHello→CertificateRequest→空Certificate→Alert→RST
02\_tlcp\_two\_way.pcap TLCP(TCP) 双向 16,333B 成功 完整握手×3+ApplicationData×12
03\_dtlcp\_one\_way.pcap DTLCP(UDP) 单向 7,899B 失败 18个UDP包，Certificate 分片，空 Certificate
04\_dtlcp\_two\_way.pcap DTLCP(UDP) 双向 15,228B 成功 33个UDP包，完整握手+ApplicationData×12

十、关键注意事项

10.1 版本选择

必须使用 openhitls-0.3.3 标签。主分支的编译方式不同（纯 CMake），且测试中某些宏在最新版本中已移除或更名（如 HITLS_CRYPTO_PROVIDER_DEFAULT_SM），导致 SM 算法不可用。

10.2 编译宏

仅使用 -DHITLS_BUILD_PROFILE=full 不足以启用 TLCP 国密 provider。必须显式指定 HITLS_TLS_PROTO_TLCP11 和 HITLS_CRYPTO_PROVIDER_DEFAULT_SM 等宏。

10.3 服务端强制客户端证书

openHiTLS 0.3.3 的服务端通过 -CAfile + -chainCAfile 即启用客户端证书验证，无法通过命令行关闭。要实现真正\"单向鉴别\"（服务端不验证客户端证书），需修改源码调用 HITLS_CFG_SetClientVerifySupport(config, false)。

10.4 终端分离

服务端（s\_server）和客户端（s\_client）必须在不同终端中运行。tcpdump 再占用一个独立终端。

10.5 库路径

运行 hitls 前必须设置 LD_LIBRARY_PATH 指向编译输出目录，否则报错找不到 libhitls\_tls.so 等动态库。

10.6 证书格式

内置测试证书为 DER 格式，命令行默认即 DER，无需 -certform/-keyform 参数。不可用 cat 拼接 DER 证书（与 PEM 不同）。

10.7 常见错误码

错误码 含义 出现场景 原因
0x2040017 缺少客户端证书 服务端 客户端未提供签名+加密双证书
0x20c0029 证书添加/加载失败 客户端 握手中断，对端要求证书
0x20a000c 不支持的密码套件 ClientHello SM 算法未集成到默认 Provider
0x20c001f 证书链验证失败 握手 缺少 -CAfile 或 -chainCAfile

版权声明

本站仅做备份收录，仅供研究与教学参考之用。
读者将信息用于其他用途的，全部法律及连带责任由读者自行承担，本站不承担任何责任。

ZONE.CI 全球网 | 安全领域涉猎者-乌云独行地带
ZONE.CI 全球网
安全领域涉猎者-乌云独行地带
openHiTLSTLCP/DTLCP编译与抓包完整操作记录" 网络安全文章

openHiTLSTLCP/DTLCP编译与抓包完整操作记录"

本文详细记录了在KaliLinux上编译openHiTLS0.3.3版本并启用TLCP/DTLCP国密协议的完整过程，包括获取源码、编译Secure_C安全库、通过configure.py配置关键编译宏（如HITLS_TLS_PROTO_TLCP11等）以及最终生成可执行文件。操作步骤清晰，验证了产物为64位可执行文件。
10-210 评论
从内测用户到合作伙伴：我们如何用WorkBuddy把AI落地到各行各业，三个月帮客户赚回成本" 网络安全文章

从内测用户到合作伙伴：我们如何用WorkBuddy把AI落地到各行各业，三个月帮客户赚回成本"

本文为WorkBuddy企业版推广软文，作者以合作伙伴视角展示该AIAgent平台在安全测试、开发、电商及法律等领域的落地案例，强调其自动化工作流能显著提升产能。文章解析了企业版的多租户隔离与审计合规优势，并推销配套的部署定制服务，建议有重复性脑力劳动的企业结合业务实际评估引入。
10-210 评论
ZONE.CI 全球网 | 安全领域涉猎者-乌云独行地带
安全领域涉猎者-乌云独行地带
ZONE.CI 全球网
评论：0   参与：  0