1/*	$OpenBSD: cmstest.c,v 1.8 2024/03/29 06:42:42 tb Exp $	*/
2/*
3 * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <err.h>
19#include <string.h>
20
21#include <openssl/bio.h>
22#include <openssl/err.h>
23#include <openssl/pem.h>
24#include <openssl/x509.h>
25
26#include <openssl/cms.h>
27
28static int verbose = 0;
29
30static const char cms_msg[] = "Hello CMS!\r\n";
31
32static const char cms_ca_1[] =
33    "-----BEGIN CERTIFICATE-----\n"
34    "MIICqDCCAZACCQD8ebR8e4kdvjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtU\n"
35    "ZXN0IENNUyBDQTAeFw0xOTA1MTExNTUzNTNaFw0yOTA1MDgxNTUzNTNaMBYxFDAS\n"
36    "BgNVBAMMC1Rlc3QgQ01TIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\n"
37    "AQEAoIiW3POGYfhY0BEgG8mIwouOI917M72jsuUE57ccjEXLWseItLb7r9vkiwW/\n"
38    "FYbz0UYkJW1JgpZmWaTGOgZGxj+WTzxh1aq7OHyJb6Pxwp9wGrGJu+BEqOZN/bi/\n"
39    "aQ1l8x7DxVJkFeI1+4QKDfmGYfWoVzQLgamO3u0vxz3Vi/XzX01ZomcZUYYx0lIq\n"
40    "hxAO665HoPUmecqYdLPquJNxdfiy37ieLJOmIsKZJtMcCZAxqhcCwE7I0196Ng3P\n"
41    "fK9Sl7BCyTBszb2YC2qOleuI2Wjg/7o1+hugopUkjxz0RGFu5s3K9PhCLwpqylXg\n"
42    "IXe9Vwi38gKawD3yjtDBRDNmIwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAvsvtc\n"
43    "cO0Eo0F6MvB0bjBIMHBkKyWcmD2c5gVFhbHyRD+XBVXNdn5CcBba2amm0VgShBpM\n"
44    "4e1rOtIH/Hf6nB3c/EjZvd16ryoTCTvzayac7sD2Y8IxF1JIAKvjFbu+LmzM/F5f\n"
45    "x3/WdY1qs5W7lO46i8xmSUAP88gohWP4cyVUAITNrh/RSOFaWUd5i1/vZ+iEexLI\n"
46    "rQWsweJleOxvA8SrXm2gAkqRWEncsxOrsX/MsPl7iJoebLhWbS3cOHhutWrfhdlC\n"
47    "2uT6K7SA9rn6qqmvI6mLkHJQpqq++Py2UTDo1u8VKa3ieYNUN070kgxpYiVBGs3L\n"
48    "aaACIcEs48gnTRWc\n"
49    "-----END CERTIFICATE-----\n";
50
51static const char cms_cert_1[] =
52    "-----BEGIN CERTIFICATE-----\n"
53    "MIICpDCCAYwCAQMwDQYJKoZIhvcNAQEFBQAwFjEUMBIGA1UEAwwLVGVzdCBDTVMg\n"
54    "Q0EwHhcNMTkwNTExMTU1MzU0WhcNMjkwNTA4MTU1MzU0WjAaMRgwFgYDVQQDDA9U\n"
55    "ZXN0IENNUyBDZXJ0IDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD\n"
56    "MLSuy+tc0AwfrlszgHJ3z7UEpJSn5mcKxquFnEC5DtchgQJ+cj5VFvB9A9G98ykQ\n"
57    "0IrHXNUTbS2yvf8ac1PlocuA8ggeDK4gPHCe097j0nUphhT0VzhwwFfP6Uo6VaR8\n"
58    "B7Qb3zFTz64bN66V89etZ5NQJKMdrh4oOh5nfxLKvCcTK+9U4ZrgeGVdVXmL6HJp\n"
59    "3m9CPobCBsC8DgI+zF/tg4GjDoVCJd6Tv5MRAmKiBrzTGglVeknkgiyIZ9C7gXU/\n"
60    "7NMUihmLlt+80zr+nL0P+MA924WV4fZJi1wtf6Eioalq6n/9i93nBRCeu8bEOBrT\n"
61    "pAre2oBEoULIJu7Ubx79AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADnLc6ZzApHq\n"
62    "Z8l4zrFKAG/O/oULPMRTA8/zXNQ60BMV10hVtTCxVNq59d48wEljuUOGLfM91rhj\n"
63    "gId8AOlsQbfRZE94DxlcaaAXaEjbkVSke56yfdLd4NqkIWrXGrFlbepj4b4ORAHh\n"
64    "85kPwDEDnpMgQ63LqNX3gru3xf2AGIa1Fck2ISkVafqW5TH0Y6dCeGGFTtnH/QUT\n"
65    "ofTm8uQ2vG9ERn+C1ooqJ2dyAckXFdmCcpor26vO/ZssMEKSee38ZNWR/01LEkOG\n"
66    "G0+AL7E1mJdlVOtp3DDFN0hoNY7PbVuuzT+mrAwGLhCp2jnf68iNdrIuDdIE6yvi\n"
67    "6WWvmmz+rC0=\n"
68    "-----END CERTIFICATE-----\n";
69
70static const char cms_key_1[] =
71    "-----BEGIN PRIVATE KEY-----\n"
72    "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDDMLSuy+tc0Awf\n"
73    "rlszgHJ3z7UEpJSn5mcKxquFnEC5DtchgQJ+cj5VFvB9A9G98ykQ0IrHXNUTbS2y\n"
74    "vf8ac1PlocuA8ggeDK4gPHCe097j0nUphhT0VzhwwFfP6Uo6VaR8B7Qb3zFTz64b\n"
75    "N66V89etZ5NQJKMdrh4oOh5nfxLKvCcTK+9U4ZrgeGVdVXmL6HJp3m9CPobCBsC8\n"
76    "DgI+zF/tg4GjDoVCJd6Tv5MRAmKiBrzTGglVeknkgiyIZ9C7gXU/7NMUihmLlt+8\n"
77    "0zr+nL0P+MA924WV4fZJi1wtf6Eioalq6n/9i93nBRCeu8bEOBrTpAre2oBEoULI\n"
78    "Ju7Ubx79AgMBAAECggEAD4XkGLKm+S6iiDJ5llL0x4qBPulH2UJ9l2HNakbO7ui7\n"
79    "OzLjW+MCCgpU/dw75ftcnLW5E7nSSEU6iSiLDTN2zKBdatfUxW8EuhOUcU0wQLYQ\n"
80    "E0lSiUwWdQEW+rX27US6XBLQxBav+ZZeplN7UvmdgXDnSkxfnJCoXVKh8GEuwWip\n"
81    "sM/Lwg8MSZK0o5qFVXtPp7kreB8CWlVyPYW5rDYy3k02R1t9k6WSdO2foPXe9rdZ\n"
82    "iiThkALcHdBcFF0NHrIkAgMdtcAxkDIwO2kOnGJQKDXu+txbzPYodMU0Z6eVnlIu\n"
83    "jh9ZjnZKBJgX6YVLVPRBwQXHXeGAnvMNm2WXH7SCAQKBgQDmMxvspc3K6HOqMoik\n"
84    "59Rq1gXIuaGH0uSMSiUMTkr4laJbh9WgZ6JTAfIPuhj1xKGfDK7LF9VjPQ104SgL\n"
85    "dCA1pV6nsuGS3j3vBnaMfmO7yr3yON+p/WDpKOgqC51Z3/pT8reJtMnyowQuDeYe\n"
86    "UVRVyeXA11nve0SSc97US4AtXQKBgQDZERtgs6ejiUJQXuflu9HDczEZ/pHfPI1y\n"
87    "+RU0tvI4860OTjerVJA2YBeOBLa9Y3hblvNpOU0SoVeMAGQLblEznJAl1nbaWqVY\n"
88    "kPgvtQcTOL/awEB90JklvSRqR82WJchMOHMG5SeqrpUx3Dg+cPH6nId0e8UCt3/U\n"
89    "W/u/5hP+IQKBgQDfReEmxaZ10MIm6P6p24Wm3dEcYBfxEjbEb0HBzspek1u3JWep\n"
90    "PfsuQavTXy/IaKBOENIUgBhjOZssqxnZChgXkD7frtulRNOTW5RuLkRzp3BWWJ1v\n"
91    "VifB3gBYj41d16UH+VnVQbnCEiUCuk5hR4bh8oJaaUV8xvW6ipItHNHErQKBgGoe\n"
92    "2uuj6UkiSbFRNL4z3JFZN6AlvNsOl3imHZ/v8Ou29dwQkVbJuNdckydzVoOwpZ7h\n"
93    "ZY8D3JJHHq3rYv3TqQ86c56MAv8tYbiy5yMrtZHIJMOlSeI4oSa6GZt8Dx5gylO5\n"
94    "JUMxtPrU70u5BiZAwYxsCi0AdYimfXAsqB9hNFUBAoGBAJPT7Xsr7NIkrbv+aYXj\n"
95    "rVVJ1qokUEKT6H1GmFXO3Fkw3kjPKS8VZloKOB7OiBC+AwMEQIflArCZ+PJdnVNO\n"
96    "48ntHnaeaZk8rKXsYdJsqMKgIxZYZuCIazZz9WHeYxn5vkH76Q3DrfqrneJ3HSU/\n"
97    "pFtLoXoGoVXRjAtpNvX7fh/G\n"
98    "-----END PRIVATE KEY-----\n";
99
100const char cms_ca_2[] =
101    "-----BEGIN CERTIFICATE-----\n"
102    "MIIBvTCCAW+gAwIBAgIQHioe49U1R3LcahmTCOUmoTAFBgMrZXAwXTEUMBIGA1UE\n"
103    "ChMLQ01TIFRlc3QgQ0ExHTAbBgNVBAsMFGNtc3Rlc3RAbGlicmVzc2wub3JnMSYw\n"
104    "JAYDVQQDDB1DTVMgVGVzdCBjbXN0ZXN0QGxpYnJlc3NsLm9yZzAeFw0yMzEwMDkw\n"
105    "OTAzNDhaFw0zMzEwMDkwOTAzNDhaMF0xFDASBgNVBAoTC0NNUyBUZXN0IENBMR0w\n"
106    "GwYDVQQLDBRjbXN0ZXN0QGxpYnJlc3NsLm9yZzEmMCQGA1UEAwwdQ01TIFRlc3Qg\n"
107    "Y21zdGVzdEBsaWJyZXNzbC5vcmcwKjAFBgMrZXADIQAYj6pY7cN0DnwmsYHVDLqJ\n"
108    "7/Futy5p4QJDKA/FSZ6+6KNFMEMwDgYDVR0PAQH/BAQDAgIEMBIGA1UdEwEB/wQI\n"
109    "MAYBAf8CAQAwHQYDVR0OBBYEFE7G7c7O2Vj79+Q786M7ssMd/lflMAUGAytlcANB\n"
110    "AOk+RHgs8D82saBM1nQMgIwEsNhYwbj3HhrRFDezYcnZeorBgiZTV3uQd2EndFdU\n"
111    "hcs4OYMCRorxqpUXX6EMtwQ=\n"
112    "-----END CERTIFICATE-----\n";
113
114const char cms_cert_2[] =
115    "-----BEGIN CERTIFICATE-----\n"
116    "MIIB5DCCAZagAwIBAgIQevuGe7FBHIc2pnQ4b4dsIzAFBgMrZXAwXTEUMBIGA1UE\n"
117    "ChMLQ01TIFRlc3QgQ0ExHTAbBgNVBAsMFGNtc3Rlc3RAbGlicmVzc2wub3JnMSYw\n"
118    "JAYDVQQDDB1DTVMgVGVzdCBjbXN0ZXN0QGxpYnJlc3NsLm9yZzAeFw0yMzEwMDkw\n"
119    "OTAzNDhaFw0zMzEwMDkwOTAzNDhaMD4xHTAbBgNVBAoTFENNUyB0ZXN0IGNlcnRp\n"
120    "ZmljYXRlMR0wGwYDVQQLDBRjbXN0ZXN0QGxpYnJlc3NsLm9yZzAqMAUGAytlcAMh\n"
121    "AFH47Z54SuXMN+i5CCvMVUZJZzSYsDcRY+lPtc+J8h2ko4GKMIGHMA4GA1UdDwEB\n"
122    "/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwQwHwYDVR0jBBgw\n"
123    "FoAUTsbtzs7ZWPv35Dvzozuywx3+V+UwNQYDVR0RBC4wLIIUY21zdGVzdC5saWJy\n"
124    "ZXNzbC5vcmeBFGNtc3Rlc3RAbGlicmVzc2wub3JnMAUGAytlcANBAAEqYppowFjF\n"
125    "fTZhNM3cIyFfmQthJV/+krEE2VTSoKgCokll+fXz1K9P+R3asgrVDoHjnBtvksIE\n"
126    "wup36c05XQA=\n"
127    "-----END CERTIFICATE-----\n";
128
129const char cms_key_2[] =
130    "-----BEGIN PRIVATE KEY-----\n"
131    "MC4CAQAwBQYDK2VwBCIEIO88YApnGRDewzSwtxAnBvhlTPz9MjSz51mEpE2oi+9g\n"
132    "-----END PRIVATE KEY-----\n";
133
134static void
135hexdump(const unsigned char *buf, size_t len)
136{
137	size_t i;
138
139	for (i = 1; i <= len; i++)
140		fprintf(stderr, " 0x%02x,%s", buf[i - 1], i % 8 ? "" : "\n");
141	if (len % 8 != 0)
142		fprintf(stderr, "\n");
143}
144
145static int
146test_cms_encrypt_decrypt(void)
147{
148	STACK_OF(X509) *certs = NULL;
149	CMS_ContentInfo *ci = NULL;
150	EVP_PKEY *pkey = NULL;
151	BIO *bio_mem = NULL;
152	BIO *bio_out = NULL;
153	X509 *cert = NULL;
154	size_t len;
155	long mem_len;
156	char *p;
157	int failed = 1;
158
159	if ((bio_out = BIO_new_fp(stdout, BIO_NOCLOSE)) == NULL)
160		errx(1, "failed to create BIO");
161
162	if ((certs = sk_X509_new_null()) == NULL)
163		errx(1, "failed to create certs");
164	if ((bio_mem = BIO_new_mem_buf(cms_cert_1, -1)) == NULL)
165		errx(1, "failed to create BIO for cert");
166	if ((cert = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL)
167		errx(1, "failed to read cert");
168	if (!sk_X509_push(certs, cert))
169		errx(1, "failed to push cert");
170
171	BIO_free(bio_mem);
172	if ((bio_mem = BIO_new_mem_buf(cms_key_1, -1)) == NULL)
173		errx(1, "failed to create BIO for key");
174	if ((pkey = PEM_read_bio_PrivateKey(bio_mem, NULL, NULL, NULL)) == NULL)
175		errx(1, "failed to read key");
176
177	BIO_free(bio_mem);
178	if ((bio_mem = BIO_new_mem_buf(cms_msg, -1)) == NULL)
179		errx(1, "failed to create BIO for message");
180
181	if ((ci = CMS_encrypt(certs, bio_mem, EVP_aes_256_cbc(), 0)) == NULL) {
182		fprintf(stderr, "FAIL: CMS_encrypt returned NULL\n");
183		ERR_print_errors_fp(stderr);
184		goto failure;
185	}
186
187	if (verbose) {
188		if (!CMS_ContentInfo_print_ctx(bio_out, ci, 0, NULL))
189			errx(1, "failed to print CMS ContentInfo");
190		if (!PEM_write_bio_CMS(bio_out, ci))
191			errx(1, "failed to print CMS PEM");
192	}
193
194	BIO_free(bio_mem);
195	if ((bio_mem = BIO_new(BIO_s_mem())) == NULL)
196		errx(1, "failed to create BIO for message");
197
198	if (!CMS_decrypt(ci, pkey, cert, NULL, bio_mem, 0)) {
199		fprintf(stderr, "FAIL: CMS_decrypt failed\n");
200		ERR_print_errors_fp(stderr);
201		goto failure;
202	}
203
204	if ((mem_len = BIO_get_mem_data(bio_mem, &p)) <= 0) {
205		fprintf(stderr, "FAIL: BIO_get_mem_data returned %ld\n",
206		    mem_len);
207		goto failure;
208	}
209	if ((len = strlen(cms_msg)) != (size_t)mem_len) {
210		fprintf(stderr, "FAIL: CMS decrypt returned %ld bytes, "
211		    "want %zu bytes\n", mem_len, len);
212		fprintf(stderr, "Got CMS data:\n");
213		hexdump(p, mem_len);
214		fprintf(stderr, "Want CMS data:\n");
215		hexdump(cms_msg, len);
216		goto failure;
217	}
218	if (memcmp(p, cms_msg, len) != 0) {
219		fprintf(stderr, "FAIL: CMS decrypt message differs");
220		fprintf(stderr, "Got CMS data:\n");
221		hexdump(p, mem_len);
222		fprintf(stderr, "Want CMS data:\n");
223		hexdump(cms_msg, len);
224		goto failure;
225	}
226
227	failed = 0;
228
229 failure:
230	BIO_free(bio_mem);
231	BIO_free(bio_out);
232	CMS_ContentInfo_free(ci);
233	EVP_PKEY_free(pkey);
234	sk_X509_free(certs);
235	X509_free(cert);
236
237	return failed;
238}
239
240static int
241test_cms_sign_verify(const char *ca_pem, const char *cert_pem,
242    const char *key_pem)
243{
244	STACK_OF(X509) *certs = NULL;
245	CMS_ContentInfo *ci = NULL;
246	X509_STORE *store = NULL;
247	EVP_PKEY *pkey = NULL;
248	BIO *bio_mem = NULL;
249	BIO *bio_out = NULL;
250	X509 *cert = NULL;
251	X509 *ca = NULL;
252	size_t len;
253	long mem_len;
254	char *p;
255	int failed = 1;
256
257	if ((bio_out = BIO_new_fp(stdout, BIO_NOCLOSE)) == NULL)
258		errx(1, "failed to create BIO");
259
260	if ((certs = sk_X509_new_null()) == NULL)
261		errx(1, "failed to create certs");
262	if ((bio_mem = BIO_new_mem_buf(cert_pem, -1)) == NULL)
263		errx(1, "failed to create BIO for cert");
264	if ((cert = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL)
265		errx(1, "failed to read cert");
266	if (!sk_X509_push(certs, cert))
267		errx(1, "failed to push cert");
268
269	BIO_free(bio_mem);
270	if ((bio_mem = BIO_new_mem_buf(ca_pem, -1)) == NULL)
271		errx(1, "failed to create BIO for cert");
272	if ((ca = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL)
273		errx(1, "failed to read cert");
274	if ((store = X509_STORE_new()) == NULL)
275		errx(1, "failed to create X509 store");
276	if (!X509_STORE_add_cert(store, ca))
277		errx(1, "failed to add cert to store");
278
279	BIO_free(bio_mem);
280	if ((bio_mem = BIO_new_mem_buf(key_pem, -1)) == NULL)
281		errx(1, "failed to create BIO for key");
282	if ((pkey = PEM_read_bio_PrivateKey(bio_mem, NULL, NULL, NULL)) == NULL)
283		errx(1, "failed to read key");
284
285	BIO_free(bio_mem);
286	if ((bio_mem = BIO_new_mem_buf(cms_msg, -1)) == NULL)
287		errx(1, "failed to create BIO for message");
288
289	if ((ci = CMS_sign(cert, pkey, NULL, bio_mem, 0)) == NULL) {
290		fprintf(stderr, "FAIL: CMS sign failed\n");
291		ERR_print_errors_fp(stderr);
292		goto failure;
293	}
294
295	if (verbose) {
296		if (!CMS_ContentInfo_print_ctx(bio_out, ci, 0, NULL))
297			errx(1, "failed to print CMS ContentInfo");
298		if (!PEM_write_bio_CMS(bio_out, ci))
299			errx(1, "failed to print CMS PEM");
300	}
301
302	BIO_free(bio_mem);
303	if ((bio_mem = BIO_new(BIO_s_mem())) == NULL)
304		errx(1, "failed to create BIO for message");
305
306	if (!CMS_verify(ci, certs, store, NULL, bio_mem, 0)) {
307		fprintf(stderr, "FAIL: CMS_verify failed\n");
308		ERR_print_errors_fp(stderr);
309		goto failure;
310	}
311
312	if ((mem_len = BIO_get_mem_data(bio_mem, &p)) <= 0) {
313		fprintf(stderr, "FAIL: BIO_get_mem_data returned %ld\n",
314		    mem_len);
315		goto failure;
316	}
317	if ((len = strlen(cms_msg)) != (size_t)mem_len) {
318		fprintf(stderr, "FAIL: CMS verify returned %ld bytes, "
319		    "want %zu bytes\n", mem_len, len);
320		fprintf(stderr, "Got CMS data:\n");
321		hexdump(p, mem_len);
322		fprintf(stderr, "Want CMS data:\n");
323		hexdump(cms_msg, len);
324		goto failure;
325	}
326	if (memcmp(p, cms_msg, len) != 0) {
327		fprintf(stderr, "FAIL: CMS verify message differs");
328		fprintf(stderr, "Got CMS data:\n");
329		hexdump(p, mem_len);
330		fprintf(stderr, "Want CMS data:\n");
331		hexdump(cms_msg, len);
332		goto failure;
333	}
334
335	failed = 0;
336
337 failure:
338	BIO_free(bio_mem);
339	BIO_free(bio_out);
340	CMS_ContentInfo_free(ci);
341	EVP_PKEY_free(pkey);
342	sk_X509_free(certs);
343	X509_free(cert);
344	X509_STORE_free(store);
345	X509_free(ca);
346
347	return failed;
348}
349
350int
351main(int argc, char **argv)
352{
353	int failed = 0;
354
355	ERR_load_crypto_strings();
356
357	failed |= test_cms_encrypt_decrypt();
358	failed |= test_cms_sign_verify(cms_ca_1, cms_cert_1, cms_key_1);
359	failed |= test_cms_sign_verify(cms_ca_2, cms_cert_2, cms_key_2);
360
361	return failed;
362}
363