1 /* $OpenBSD: cmstest.c,v 1.4 2021/03/22 20:31:34 tb Exp $ */
2 /*
3 * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 #include <err.h>
19 #include <string.h>
20
21 #include <openssl/bio.h>
22 #include <openssl/err.h>
23 #include <openssl/pem.h>
24 #include <openssl/x509.h>
25
26 #include <openssl/cms.h>
27
28 static int verbose = 0;
29
30 static const char cms_msg[] = "Hello CMS!\r\n";
31
32 static const char cms_ca_1[] = \
33 "-----BEGIN CERTIFICATE-----\n"
34 "MIICqDCCAZACCQD8ebR8e4kdvjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtU\n"
35 "ZXN0IENNUyBDQTAeFw0xOTA1MTExNTUzNTNaFw0yOTA1MDgxNTUzNTNaMBYxFDAS\n"
36 "BgNVBAMMC1Rlc3QgQ01TIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\n"
37 "AQEAoIiW3POGYfhY0BEgG8mIwouOI917M72jsuUE57ccjEXLWseItLb7r9vkiwW/\n"
38 "FYbz0UYkJW1JgpZmWaTGOgZGxj+WTzxh1aq7OHyJb6Pxwp9wGrGJu+BEqOZN/bi/\n"
39 "aQ1l8x7DxVJkFeI1+4QKDfmGYfWoVzQLgamO3u0vxz3Vi/XzX01ZomcZUYYx0lIq\n"
40 "hxAO665HoPUmecqYdLPquJNxdfiy37ieLJOmIsKZJtMcCZAxqhcCwE7I0196Ng3P\n"
41 "fK9Sl7BCyTBszb2YC2qOleuI2Wjg/7o1+hugopUkjxz0RGFu5s3K9PhCLwpqylXg\n"
42 "IXe9Vwi38gKawD3yjtDBRDNmIwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAvsvtc\n"
43 "cO0Eo0F6MvB0bjBIMHBkKyWcmD2c5gVFhbHyRD+XBVXNdn5CcBba2amm0VgShBpM\n"
44 "4e1rOtIH/Hf6nB3c/EjZvd16ryoTCTvzayac7sD2Y8IxF1JIAKvjFbu+LmzM/F5f\n"
45 "x3/WdY1qs5W7lO46i8xmSUAP88gohWP4cyVUAITNrh/RSOFaWUd5i1/vZ+iEexLI\n"
46 "rQWsweJleOxvA8SrXm2gAkqRWEncsxOrsX/MsPl7iJoebLhWbS3cOHhutWrfhdlC\n"
47 "2uT6K7SA9rn6qqmvI6mLkHJQpqq++Py2UTDo1u8VKa3ieYNUN070kgxpYiVBGs3L\n"
48 "aaACIcEs48gnTRWc\n"
49 "-----END CERTIFICATE-----\n";
50
51 static const char cms_cert_1[] = \
52 "-----BEGIN CERTIFICATE-----\n"
53 "MIICpDCCAYwCAQMwDQYJKoZIhvcNAQEFBQAwFjEUMBIGA1UEAwwLVGVzdCBDTVMg\n"
54 "Q0EwHhcNMTkwNTExMTU1MzU0WhcNMjkwNTA4MTU1MzU0WjAaMRgwFgYDVQQDDA9U\n"
55 "ZXN0IENNUyBDZXJ0IDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD\n"
56 "MLSuy+tc0AwfrlszgHJ3z7UEpJSn5mcKxquFnEC5DtchgQJ+cj5VFvB9A9G98ykQ\n"
57 "0IrHXNUTbS2yvf8ac1PlocuA8ggeDK4gPHCe097j0nUphhT0VzhwwFfP6Uo6VaR8\n"
58 "B7Qb3zFTz64bN66V89etZ5NQJKMdrh4oOh5nfxLKvCcTK+9U4ZrgeGVdVXmL6HJp\n"
59 "3m9CPobCBsC8DgI+zF/tg4GjDoVCJd6Tv5MRAmKiBrzTGglVeknkgiyIZ9C7gXU/\n"
60 "7NMUihmLlt+80zr+nL0P+MA924WV4fZJi1wtf6Eioalq6n/9i93nBRCeu8bEOBrT\n"
61 "pAre2oBEoULIJu7Ubx79AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADnLc6ZzApHq\n"
62 "Z8l4zrFKAG/O/oULPMRTA8/zXNQ60BMV10hVtTCxVNq59d48wEljuUOGLfM91rhj\n"
63 "gId8AOlsQbfRZE94DxlcaaAXaEjbkVSke56yfdLd4NqkIWrXGrFlbepj4b4ORAHh\n"
64 "85kPwDEDnpMgQ63LqNX3gru3xf2AGIa1Fck2ISkVafqW5TH0Y6dCeGGFTtnH/QUT\n"
65 "ofTm8uQ2vG9ERn+C1ooqJ2dyAckXFdmCcpor26vO/ZssMEKSee38ZNWR/01LEkOG\n"
66 "G0+AL7E1mJdlVOtp3DDFN0hoNY7PbVuuzT+mrAwGLhCp2jnf68iNdrIuDdIE6yvi\n"
67 "6WWvmmz+rC0=\n"
68 "-----END CERTIFICATE-----\n";
69
70 static const char cms_key_1[] = \
71 "-----BEGIN PRIVATE KEY-----\n"
72 "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDDMLSuy+tc0Awf\n"
73 "rlszgHJ3z7UEpJSn5mcKxquFnEC5DtchgQJ+cj5VFvB9A9G98ykQ0IrHXNUTbS2y\n"
74 "vf8ac1PlocuA8ggeDK4gPHCe097j0nUphhT0VzhwwFfP6Uo6VaR8B7Qb3zFTz64b\n"
75 "N66V89etZ5NQJKMdrh4oOh5nfxLKvCcTK+9U4ZrgeGVdVXmL6HJp3m9CPobCBsC8\n"
76 "DgI+zF/tg4GjDoVCJd6Tv5MRAmKiBrzTGglVeknkgiyIZ9C7gXU/7NMUihmLlt+8\n"
77 "0zr+nL0P+MA924WV4fZJi1wtf6Eioalq6n/9i93nBRCeu8bEOBrTpAre2oBEoULI\n"
78 "Ju7Ubx79AgMBAAECggEAD4XkGLKm+S6iiDJ5llL0x4qBPulH2UJ9l2HNakbO7ui7\n"
79 "OzLjW+MCCgpU/dw75ftcnLW5E7nSSEU6iSiLDTN2zKBdatfUxW8EuhOUcU0wQLYQ\n"
80 "E0lSiUwWdQEW+rX27US6XBLQxBav+ZZeplN7UvmdgXDnSkxfnJCoXVKh8GEuwWip\n"
81 "sM/Lwg8MSZK0o5qFVXtPp7kreB8CWlVyPYW5rDYy3k02R1t9k6WSdO2foPXe9rdZ\n"
82 "iiThkALcHdBcFF0NHrIkAgMdtcAxkDIwO2kOnGJQKDXu+txbzPYodMU0Z6eVnlIu\n"
83 "jh9ZjnZKBJgX6YVLVPRBwQXHXeGAnvMNm2WXH7SCAQKBgQDmMxvspc3K6HOqMoik\n"
84 "59Rq1gXIuaGH0uSMSiUMTkr4laJbh9WgZ6JTAfIPuhj1xKGfDK7LF9VjPQ104SgL\n"
85 "dCA1pV6nsuGS3j3vBnaMfmO7yr3yON+p/WDpKOgqC51Z3/pT8reJtMnyowQuDeYe\n"
86 "UVRVyeXA11nve0SSc97US4AtXQKBgQDZERtgs6ejiUJQXuflu9HDczEZ/pHfPI1y\n"
87 "+RU0tvI4860OTjerVJA2YBeOBLa9Y3hblvNpOU0SoVeMAGQLblEznJAl1nbaWqVY\n"
88 "kPgvtQcTOL/awEB90JklvSRqR82WJchMOHMG5SeqrpUx3Dg+cPH6nId0e8UCt3/U\n"
89 "W/u/5hP+IQKBgQDfReEmxaZ10MIm6P6p24Wm3dEcYBfxEjbEb0HBzspek1u3JWep\n"
90 "PfsuQavTXy/IaKBOENIUgBhjOZssqxnZChgXkD7frtulRNOTW5RuLkRzp3BWWJ1v\n"
91 "VifB3gBYj41d16UH+VnVQbnCEiUCuk5hR4bh8oJaaUV8xvW6ipItHNHErQKBgGoe\n"
92 "2uuj6UkiSbFRNL4z3JFZN6AlvNsOl3imHZ/v8Ou29dwQkVbJuNdckydzVoOwpZ7h\n"
93 "ZY8D3JJHHq3rYv3TqQ86c56MAv8tYbiy5yMrtZHIJMOlSeI4oSa6GZt8Dx5gylO5\n"
94 "JUMxtPrU70u5BiZAwYxsCi0AdYimfXAsqB9hNFUBAoGBAJPT7Xsr7NIkrbv+aYXj\n"
95 "rVVJ1qokUEKT6H1GmFXO3Fkw3kjPKS8VZloKOB7OiBC+AwMEQIflArCZ+PJdnVNO\n"
96 "48ntHnaeaZk8rKXsYdJsqMKgIxZYZuCIazZz9WHeYxn5vkH76Q3DrfqrneJ3HSU/\n"
97 "pFtLoXoGoVXRjAtpNvX7fh/G\n"
98 "-----END PRIVATE KEY-----\n";
99
100 static void
hexdump(const unsigned char * buf,size_t len)101 hexdump(const unsigned char *buf, size_t len)
102 {
103 size_t i;
104
105 for (i = 1; i <= len; i++)
106 fprintf(stderr, " 0x%02x,%s", buf[i - 1], i % 8 ? "" : "\n");
107 if (len % 8 != 0)
108 fprintf(stderr, "\n");
109 }
110
111 static int
test_cms_encrypt_decrypt(void)112 test_cms_encrypt_decrypt(void)
113 {
114 STACK_OF(X509) *certs = NULL;
115 CMS_ContentInfo *ci = NULL;
116 EVP_PKEY *pkey = NULL;
117 BIO *bio_mem = NULL;
118 BIO *bio_out = NULL;
119 X509 *cert = NULL;
120 size_t len;
121 char *p;
122 int failed = 1;
123
124 if ((bio_out = BIO_new_fp(stdout, BIO_NOCLOSE)) == NULL)
125 errx(1, "failed to create BIO");
126
127 if ((certs = sk_X509_new_null()) == NULL)
128 errx(1, "failed to create certs");
129 if ((bio_mem = BIO_new_mem_buf(cms_cert_1, -1)) == NULL)
130 errx(1, "failed to create BIO for cert");
131 if ((cert = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL)
132 errx(1, "failed to read cert");
133 if (!sk_X509_push(certs, cert))
134 errx(1, "failed to push cert");
135
136 BIO_free(bio_mem);
137 if ((bio_mem = BIO_new_mem_buf(cms_key_1, -1)) == NULL)
138 errx(1, "failed to create BIO for key");
139 if ((pkey = PEM_read_bio_PrivateKey(bio_mem, NULL, NULL, NULL)) == NULL)
140 errx(1, "failed to read key");
141
142 BIO_free(bio_mem);
143 if ((bio_mem = BIO_new_mem_buf(cms_msg, -1)) == NULL)
144 errx(1, "failed to create BIO for message");
145
146 if ((ci = CMS_encrypt(certs, bio_mem, EVP_aes_256_cbc(), 0)) == NULL) {
147 fprintf(stderr, "FAIL: CMS_encrypt returned NULL\n");
148 ERR_print_errors_fp(stderr);
149 goto failure;
150 }
151
152 if (verbose) {
153 if (!CMS_ContentInfo_print_ctx(bio_out, ci, 0, NULL))
154 errx(1, "failed to print CMS ContentInfo");
155 if (!PEM_write_bio_CMS(bio_out, ci))
156 errx(1, "failed to print CMS PEM");
157 }
158
159 BIO_free(bio_mem);
160 if ((bio_mem = BIO_new(BIO_s_mem())) == NULL)
161 errx(1, "failed to create BIO for message");
162
163 if (!CMS_decrypt(ci, pkey, cert, NULL, bio_mem, 0)) {
164 fprintf(stderr, "FAIL: CMS_decrypt failed\n");
165 ERR_print_errors_fp(stderr);
166 goto failure;
167 }
168
169 if ((len = BIO_get_mem_data(bio_mem, &p)) != strlen(cms_msg)) {
170 fprintf(stderr, "FAIL: CMS decrypt returned %li bytes, "
171 "want %zi bytes\n", len, strlen(cms_msg));
172 fprintf(stderr, "Got CMS data:\n");
173 hexdump(p, len);
174 fprintf(stderr, "Want CMS data:\n");
175 hexdump(cms_msg, strlen(cms_msg));
176 goto failure;
177 }
178 if (memcmp(p, cms_msg, len) != 0) {
179 fprintf(stderr, "FAIL: CMS decrypt message differs");
180 fprintf(stderr, "Got CMS data:\n");
181 hexdump(p, len);
182 fprintf(stderr, "Want CMS data:\n");
183 hexdump(cms_msg, strlen(cms_msg));
184 goto failure;
185 }
186
187 failed = 0;
188
189 failure:
190 BIO_free(bio_mem);
191 BIO_free(bio_out);
192 CMS_ContentInfo_free(ci);
193 EVP_PKEY_free(pkey);
194 sk_X509_free(certs);
195 X509_free(cert);
196
197 return failed;
198 }
199
200 static int
test_cms_sign_verify(void)201 test_cms_sign_verify(void)
202 {
203 STACK_OF(X509) *certs = NULL;
204 CMS_ContentInfo *ci = NULL;
205 X509_STORE *store = NULL;
206 EVP_PKEY *pkey = NULL;
207 BIO *bio_mem = NULL;
208 BIO *bio_out = NULL;
209 X509 *cert = NULL;
210 X509 *ca = NULL;
211 size_t len;
212 char *p;
213 int failed = 1;
214
215 if ((bio_out = BIO_new_fp(stdout, BIO_NOCLOSE)) == NULL)
216 errx(1, "failed to create BIO");
217
218 if ((certs = sk_X509_new_null()) == NULL)
219 errx(1, "failed to create certs");
220 if ((bio_mem = BIO_new_mem_buf(cms_cert_1, -1)) == NULL)
221 errx(1, "failed to create BIO for cert");
222 if ((cert = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL)
223 errx(1, "failed to read cert");
224 if (!sk_X509_push(certs, cert))
225 errx(1, "failed to push cert");
226
227 BIO_free(bio_mem);
228 if ((bio_mem = BIO_new_mem_buf(cms_ca_1, -1)) == NULL)
229 errx(1, "failed to create BIO for cert");
230 if ((ca = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL)
231 errx(1, "failed to read cert");
232 if ((store = X509_STORE_new()) == NULL)
233 errx(1, "failed to create X509 store");
234 if (!X509_STORE_add_cert(store, ca))
235 errx(1, "failed to add cert to store");
236
237 BIO_free(bio_mem);
238 if ((bio_mem = BIO_new_mem_buf(cms_key_1, -1)) == NULL)
239 errx(1, "failed to create BIO for key");
240 if ((pkey = PEM_read_bio_PrivateKey(bio_mem, NULL, NULL, NULL)) == NULL)
241 errx(1, "failed to read key");
242
243 BIO_free(bio_mem);
244 if ((bio_mem = BIO_new_mem_buf(cms_msg, -1)) == NULL)
245 errx(1, "failed to create BIO for message");
246
247 if ((ci = CMS_sign(cert, pkey, NULL, bio_mem, 0)) == NULL) {
248 fprintf(stderr, "FAIL: CMS sign failed\n");
249 ERR_print_errors_fp(stderr);
250 goto failure;
251 }
252
253 if (verbose) {
254 if (!CMS_ContentInfo_print_ctx(bio_out, ci, 0, NULL))
255 errx(1, "failed to print CMS ContentInfo");
256 if (!PEM_write_bio_CMS(bio_out, ci))
257 errx(1, "failed to print CMS PEM");
258 }
259
260 BIO_free(bio_mem);
261 if ((bio_mem = BIO_new(BIO_s_mem())) == NULL)
262 errx(1, "failed to create BIO for message");
263
264 if (!CMS_verify(ci, certs, store, NULL, bio_mem, 0)) {
265 fprintf(stderr, "FAIL: CMS_verify failed\n");
266 ERR_print_errors_fp(stderr);
267 goto failure;
268 }
269
270 if ((len = BIO_get_mem_data(bio_mem, &p)) != strlen(cms_msg)) {
271 fprintf(stderr, "FAIL: CMS verify returned %li bytes, "
272 "want %zi bytes\n", len, strlen(cms_msg));
273 fprintf(stderr, "Got CMS data:\n");
274 hexdump(p, len);
275 fprintf(stderr, "Want CMS data:\n");
276 hexdump(cms_msg, strlen(cms_msg));
277 goto failure;
278 }
279 if (memcmp(p, cms_msg, len) != 0) {
280 fprintf(stderr, "FAIL: CMS verify message differs");
281 fprintf(stderr, "Got CMS data:\n");
282 hexdump(p, len);
283 fprintf(stderr, "Want CMS data:\n");
284 hexdump(cms_msg, strlen(cms_msg));
285 goto failure;
286 }
287
288 failed = 0;
289
290 failure:
291 BIO_free(bio_mem);
292 BIO_free(bio_out);
293 CMS_ContentInfo_free(ci);
294 EVP_PKEY_free(pkey);
295 sk_X509_free(certs);
296 X509_free(cert);
297 X509_STORE_free(store);
298 X509_free(ca);
299
300 return failed;
301 }
302
303 int
main(int argc,char ** argv)304 main(int argc, char **argv)
305 {
306 int failed = 0;
307
308 ERR_load_crypto_strings();
309
310 failed |= test_cms_encrypt_decrypt();
311 failed |= test_cms_sign_verify();
312
313 return failed;
314 }
315