# 构建文档

## 1. 环境准备

### 1.1 系统要求

- **操作系统**: Ubuntu 24.04 (WSL2)
- **Java**: OpenJDK 17+
- **Maven**: 3.6+
- **GCC**: 13+ (build-essential)
- **Tongsuo**: 8.4.0

### 1.2 依赖安装

```bash
sudo apt update
sudo apt install -y build-essential libpcre2-dev zlib1g-dev libssl-dev perl
sudo apt install -y openjdk-17-jdk-headless maven
```

## 2. 编译 Tongsuo

```bash
cd /mnt/d/workbench/gateway2
tar -xzf 8.4.0.tar.gz
cd Tongsuo-8.4.0
./config --prefix=/opt/tongsuo-8.4.0
make -j$(nproc)
sudo make install_sw
```

## 3. 编译 Nginx（链接 Tongsuo）

```bash
cd /mnt/d/workbench/gateway2/nginx-1.26.2
./configure \
  --with-http_ssl_module \
  --with-openssl-opt=no-shared \
  --with-cc-opt="-I/opt/tongsuo-8.4.0/include" \
  --with-ld-opt="-L/opt/tongsuo-8.4.0/lib64 -lssl -lcrypto -ldl -lpthread"
make -j$(nproc)
```

## 4. 编译 JNI 动态库

```bash
cd /mnt/d/workbench/gateway2/java-client
javac -h native src/main/java/com/gateway/ssl/jni/GmSSLJNI.java -d target/classes

cd native
gcc -shared -fPIC -o libgmssl_jni.so \
  -I/usr/lib/jvm/java-17-openjdk-amd64/include \
  -I/usr/lib/jvm/java-17-openjdk-amd64/include/linux \
  -I/opt/tongsuo-8.4.0/include \
  -L/opt/tongsuo-8.4.0/lib64 \
  gmssl_jni.c -lssl -lcrypto -ldl \
  -Wl,-rpath,/opt/tongsuo-8.4.0/lib64
```

## 5. 编译 Java 客户端

```bash
cd /mnt/d/workbench/gateway2/java-client
mvn clean package -Dmaven.test.skip=true
```

## 6. 生成测试证书

### 6.1 国密 SM2 证书

```bash
export LD_LIBRARY_PATH=/opt/tongsuo-8.4.0/lib64:$LD_LIBRARY_PATH
TONGSUO=/opt/tongsuo-8.4.0/bin/openssl
CERT_DIR=/mnt/d/workbench/gateway2/java-client/certs

# CA
$TONGSUO ecparam -genkey -name SM2 -out $CERT_DIR/ca-sm2-key.pem
$TONGSUO req -new -SM3 -key $CERT_DIR/ca-sm2-key.pem \
  -subj "/C=CN/O=GatewayTest/CN=SM2 Test CA" \
  -out $CERT_DIR/ca-sm2.csr
$TONGSUO x509 -req -SM3 -days 3650 \
  -signkey $CERT_DIR/ca-sm2-key.pem \
  -in $CERT_DIR/ca-sm2.csr \
  -out $CERT_DIR/ca-sm2-cert.pem

# 服务器签名证书
$TONGSUO ecparam -genkey -name SM2 -out $CERT_DIR/server-sm2-sign-key.pem
$TONGSUO req -new -SM3 -key $CERT_DIR/server-sm2-sign-key.pem \
  -subj "/C=CN/O=GatewayTest/CN=localhost" \
  -out $CERT_DIR/server-sm2-sign.csr
$TONGSUO x509 -req -SM3 -days 3650 \
  -CA $CERT_DIR/ca-sm2-cert.pem -CAkey $CERT_DIR/ca-sm2-key.pem \
  -in $CERT_DIR/server-sm2-sign.csr \
  -out $CERT_DIR/server-sm2-sign-cert.pem

# 服务器加密证书
$TONGSUO ecparam -genkey -name SM2 -out $CERT_DIR/server-sm2-enc-key.pem
$TONGSUO req -new -SM3 -key $CERT_DIR/server-sm2-enc-key.pem \
  -subj "/C=CN/O=GatewayTest/CN=localhost" \
  -out $CERT_DIR/server-sm2-enc.csr
$TONGSUO x509 -req -SM3 -days 3650 \
  -CA $CERT_DIR/ca-sm2-cert.pem -CAkey $CERT_DIR/ca-sm2-key.pem \
  -in $CERT_DIR/server-sm2-enc.csr \
  -out $CERT_DIR/server-sm2-enc-cert.pem

# 客户端证书
$TONGSUO ecparam -genkey -name SM2 -out $CERT_DIR/client-sm2-key.pem
$TONGSUO req -new -SM3 -key $CERT_DIR/client-sm2-key.pem \
  -subj "/C=CN/O=GatewayTest/CN=client" \
  -out $CERT_DIR/client-sm2.csr
$TONGSUO x509 -req -SM3 -days 3650 \
  -CA $CERT_DIR/ca-sm2-cert.pem -CAkey $CERT_DIR/ca-sm2-key.pem \
  -in $CERT_DIR/client-sm2.csr \
  -out $CERT_DIR/client-sm2-cert.pem
```

### 6.2 ECDSA 证书（Java 兼容）

```bash
$TONGSUO ecparam -genkey -name prime256v1 -out $CERT_DIR/ca-ecdsa-key.pem
$TONGSUO req -new -key $CERT_DIR/ca-ecdsa-key.pem \
  -subj "/C=CN/O=GatewayTest/CN=ECDSA Test CA" \
  -out $CERT_DIR/ca-ecdsa.csr
$TONGSUO x509 -req -days 3650 -sha256 \
  -signkey $CERT_DIR/ca-ecdsa-key.pem \
  -in $CERT_DIR/ca-ecdsa.csr \
  -out $CERT_DIR/ca-ecdsa-cert.pem

$TONGSUO ecparam -genkey -name prime256v1 -out $CERT_DIR/server-ecdsa-key.pem
$TONGSUO req -new -key $CERT_DIR/server-ecdsa-key.pem \
  -subj "/C=CN/O=GatewayTest/CN=localhost" \
  -out $CERT_DIR/server-ecdsa.csr
$TONGSUO x509 -req -days 3650 -sha256 \
  -signkey $CERT_DIR/server-ecdsa-key.pem \
  -in $CERT_DIR/server-ecdsa.csr \
  -out $CERT_DIR/server-ecdsa-cert.pem

$TONGSUO ecparam -genkey -name prime256v1 -out $CERT_DIR/client-ecdsa-key.pem
$TONGSUO req -new -key $CERT_DIR/client-ecdsa-key.pem \
  -subj "/C=CN/O=GatewayTest/CN=client-ecdsa" \
  -out $CERT_DIR/client-ecdsa.csr
$TONGSUO x509 -req -days 3650 -sha256 \
  -CA $CERT_DIR/ca-ecdsa-cert.pem -CAkey $CERT_DIR/ca-ecdsa-key.pem \
  -in $CERT_DIR/client-ecdsa.csr \
  -out $CERT_DIR/client-ecdsa-cert.pem
```

### 6.3 Java 密钥库

```bash
$TONGSUO pkcs12 -export -inkey $CERT_DIR/client-ecdsa-key.pem \
  -in $CERT_DIR/client-ecdsa-cert.pem \
  -certfile $CERT_DIR/ca-ecdsa-cert.pem \
  -out $CERT_DIR/client-ecdsa.p12 -password pass:changeit

$TONGSUO pkcs12 -export -nokeys \
  -in $CERT_DIR/ca-ecdsa-cert.pem \
  -out $CERT_DIR/truststore-ecdsa.p12 -password pass:changeit
```

## 7. 启动测试服务端

### 7.1 Tongsuo s_server

```bash
export LD_LIBRARY_PATH=/opt/tongsuo-8.4.0/lib64:$LD_LIBRARY_PATH
CERT_DIR=/mnt/d/workbench/gateway2/java-client/certs
TONGSUO=/opt/tongsuo-8.4.0/bin/openssl

# 单向认证 (7443)
$TONGSUO s_server -accept 7443 \
  -cert $CERT_DIR/server-ecdsa-cert.pem \
  -key $CERT_DIR/server-ecdsa-key.pem \
  -WWW -quiet &

# 双向认证 (7444)
$TONGSUO s_server -accept 7444 \
  -cert $CERT_DIR/server-ecdsa-cert.pem \
  -key $CERT_DIR/server-ecdsa-key.pem \
  -CAfile $CERT_DIR/ca-ecdsa-cert.pem \
  -verify 1 \
  -WWW -quiet &
```

## 8. 项目文件结构

```
java-client/
├── pom.xml                              # Maven 项目配置
├── nginx-gmssl.conf                     # Nginx 国密 SSL 配置模板
├── native/
│   ├── gmssl_jni.c                      # JNI C 实现
│   ├── com_gateway_ssl_jni_GmSSLJNI.h   # JNI 头文件
│   └── libgmssl_jni.so                  # 编译产物
├── certs/                               # 测试证书
└── src/main/java/com/gateway/ssl/
    ├── Main.java                        # 测试入口
    ├── config/                          # SSL 配置
    ├── http/                            # HTTPS 客户端
    ├── tcp/                             # TCP+SSL 客户端
    └── jni/                             # JNI 国密客户端
```