1/* $OpenBSD: cmstest.c,v 1.8 2024/03/29 06:42:42 tb Exp $ */ 2/* 3 * Copyright (c) 2019 Joel Sing <jsing@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18#include <err.h> 19#include <string.h> 20 21#include <openssl/bio.h> 22#include <openssl/err.h> 23#include <openssl/pem.h> 24#include <openssl/x509.h> 25 26#include <openssl/cms.h> 27 28static int verbose = 0; 29 30static const char cms_msg[] = "Hello CMS!\r\n"; 31 32static const char cms_ca_1[] = 33 "-----BEGIN CERTIFICATE-----\n" 34 "MIICqDCCAZACCQD8ebR8e4kdvjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtU\n" 35 "ZXN0IENNUyBDQTAeFw0xOTA1MTExNTUzNTNaFw0yOTA1MDgxNTUzNTNaMBYxFDAS\n" 36 "BgNVBAMMC1Rlc3QgQ01TIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\n" 37 "AQEAoIiW3POGYfhY0BEgG8mIwouOI917M72jsuUE57ccjEXLWseItLb7r9vkiwW/\n" 38 "FYbz0UYkJW1JgpZmWaTGOgZGxj+WTzxh1aq7OHyJb6Pxwp9wGrGJu+BEqOZN/bi/\n" 39 "aQ1l8x7DxVJkFeI1+4QKDfmGYfWoVzQLgamO3u0vxz3Vi/XzX01ZomcZUYYx0lIq\n" 40 "hxAO665HoPUmecqYdLPquJNxdfiy37ieLJOmIsKZJtMcCZAxqhcCwE7I0196Ng3P\n" 41 "fK9Sl7BCyTBszb2YC2qOleuI2Wjg/7o1+hugopUkjxz0RGFu5s3K9PhCLwpqylXg\n" 42 "IXe9Vwi38gKawD3yjtDBRDNmIwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAvsvtc\n" 43 "cO0Eo0F6MvB0bjBIMHBkKyWcmD2c5gVFhbHyRD+XBVXNdn5CcBba2amm0VgShBpM\n" 44 "4e1rOtIH/Hf6nB3c/EjZvd16ryoTCTvzayac7sD2Y8IxF1JIAKvjFbu+LmzM/F5f\n" 45 "x3/WdY1qs5W7lO46i8xmSUAP88gohWP4cyVUAITNrh/RSOFaWUd5i1/vZ+iEexLI\n" 46 "rQWsweJleOxvA8SrXm2gAkqRWEncsxOrsX/MsPl7iJoebLhWbS3cOHhutWrfhdlC\n" 47 "2uT6K7SA9rn6qqmvI6mLkHJQpqq++Py2UTDo1u8VKa3ieYNUN070kgxpYiVBGs3L\n" 48 "aaACIcEs48gnTRWc\n" 49 "-----END CERTIFICATE-----\n"; 50 51static const char cms_cert_1[] = 52 "-----BEGIN CERTIFICATE-----\n" 53 "MIICpDCCAYwCAQMwDQYJKoZIhvcNAQEFBQAwFjEUMBIGA1UEAwwLVGVzdCBDTVMg\n" 54 "Q0EwHhcNMTkwNTExMTU1MzU0WhcNMjkwNTA4MTU1MzU0WjAaMRgwFgYDVQQDDA9U\n" 55 "ZXN0IENNUyBDZXJ0IDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD\n" 56 "MLSuy+tc0AwfrlszgHJ3z7UEpJSn5mcKxquFnEC5DtchgQJ+cj5VFvB9A9G98ykQ\n" 57 "0IrHXNUTbS2yvf8ac1PlocuA8ggeDK4gPHCe097j0nUphhT0VzhwwFfP6Uo6VaR8\n" 58 "B7Qb3zFTz64bN66V89etZ5NQJKMdrh4oOh5nfxLKvCcTK+9U4ZrgeGVdVXmL6HJp\n" 59 "3m9CPobCBsC8DgI+zF/tg4GjDoVCJd6Tv5MRAmKiBrzTGglVeknkgiyIZ9C7gXU/\n" 60 "7NMUihmLlt+80zr+nL0P+MA924WV4fZJi1wtf6Eioalq6n/9i93nBRCeu8bEOBrT\n" 61 "pAre2oBEoULIJu7Ubx79AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADnLc6ZzApHq\n" 62 "Z8l4zrFKAG/O/oULPMRTA8/zXNQ60BMV10hVtTCxVNq59d48wEljuUOGLfM91rhj\n" 63 "gId8AOlsQbfRZE94DxlcaaAXaEjbkVSke56yfdLd4NqkIWrXGrFlbepj4b4ORAHh\n" 64 "85kPwDEDnpMgQ63LqNX3gru3xf2AGIa1Fck2ISkVafqW5TH0Y6dCeGGFTtnH/QUT\n" 65 "ofTm8uQ2vG9ERn+C1ooqJ2dyAckXFdmCcpor26vO/ZssMEKSee38ZNWR/01LEkOG\n" 66 "G0+AL7E1mJdlVOtp3DDFN0hoNY7PbVuuzT+mrAwGLhCp2jnf68iNdrIuDdIE6yvi\n" 67 "6WWvmmz+rC0=\n" 68 "-----END CERTIFICATE-----\n"; 69 70static const char cms_key_1[] = 71 "-----BEGIN PRIVATE KEY-----\n" 72 "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDDMLSuy+tc0Awf\n" 73 "rlszgHJ3z7UEpJSn5mcKxquFnEC5DtchgQJ+cj5VFvB9A9G98ykQ0IrHXNUTbS2y\n" 74 "vf8ac1PlocuA8ggeDK4gPHCe097j0nUphhT0VzhwwFfP6Uo6VaR8B7Qb3zFTz64b\n" 75 "N66V89etZ5NQJKMdrh4oOh5nfxLKvCcTK+9U4ZrgeGVdVXmL6HJp3m9CPobCBsC8\n" 76 "DgI+zF/tg4GjDoVCJd6Tv5MRAmKiBrzTGglVeknkgiyIZ9C7gXU/7NMUihmLlt+8\n" 77 "0zr+nL0P+MA924WV4fZJi1wtf6Eioalq6n/9i93nBRCeu8bEOBrTpAre2oBEoULI\n" 78 "Ju7Ubx79AgMBAAECggEAD4XkGLKm+S6iiDJ5llL0x4qBPulH2UJ9l2HNakbO7ui7\n" 79 "OzLjW+MCCgpU/dw75ftcnLW5E7nSSEU6iSiLDTN2zKBdatfUxW8EuhOUcU0wQLYQ\n" 80 "E0lSiUwWdQEW+rX27US6XBLQxBav+ZZeplN7UvmdgXDnSkxfnJCoXVKh8GEuwWip\n" 81 "sM/Lwg8MSZK0o5qFVXtPp7kreB8CWlVyPYW5rDYy3k02R1t9k6WSdO2foPXe9rdZ\n" 82 "iiThkALcHdBcFF0NHrIkAgMdtcAxkDIwO2kOnGJQKDXu+txbzPYodMU0Z6eVnlIu\n" 83 "jh9ZjnZKBJgX6YVLVPRBwQXHXeGAnvMNm2WXH7SCAQKBgQDmMxvspc3K6HOqMoik\n" 84 "59Rq1gXIuaGH0uSMSiUMTkr4laJbh9WgZ6JTAfIPuhj1xKGfDK7LF9VjPQ104SgL\n" 85 "dCA1pV6nsuGS3j3vBnaMfmO7yr3yON+p/WDpKOgqC51Z3/pT8reJtMnyowQuDeYe\n" 86 "UVRVyeXA11nve0SSc97US4AtXQKBgQDZERtgs6ejiUJQXuflu9HDczEZ/pHfPI1y\n" 87 "+RU0tvI4860OTjerVJA2YBeOBLa9Y3hblvNpOU0SoVeMAGQLblEznJAl1nbaWqVY\n" 88 "kPgvtQcTOL/awEB90JklvSRqR82WJchMOHMG5SeqrpUx3Dg+cPH6nId0e8UCt3/U\n" 89 "W/u/5hP+IQKBgQDfReEmxaZ10MIm6P6p24Wm3dEcYBfxEjbEb0HBzspek1u3JWep\n" 90 "PfsuQavTXy/IaKBOENIUgBhjOZssqxnZChgXkD7frtulRNOTW5RuLkRzp3BWWJ1v\n" 91 "VifB3gBYj41d16UH+VnVQbnCEiUCuk5hR4bh8oJaaUV8xvW6ipItHNHErQKBgGoe\n" 92 "2uuj6UkiSbFRNL4z3JFZN6AlvNsOl3imHZ/v8Ou29dwQkVbJuNdckydzVoOwpZ7h\n" 93 "ZY8D3JJHHq3rYv3TqQ86c56MAv8tYbiy5yMrtZHIJMOlSeI4oSa6GZt8Dx5gylO5\n" 94 "JUMxtPrU70u5BiZAwYxsCi0AdYimfXAsqB9hNFUBAoGBAJPT7Xsr7NIkrbv+aYXj\n" 95 "rVVJ1qokUEKT6H1GmFXO3Fkw3kjPKS8VZloKOB7OiBC+AwMEQIflArCZ+PJdnVNO\n" 96 "48ntHnaeaZk8rKXsYdJsqMKgIxZYZuCIazZz9WHeYxn5vkH76Q3DrfqrneJ3HSU/\n" 97 "pFtLoXoGoVXRjAtpNvX7fh/G\n" 98 "-----END PRIVATE KEY-----\n"; 99 100const char cms_ca_2[] = 101 "-----BEGIN CERTIFICATE-----\n" 102 "MIIBvTCCAW+gAwIBAgIQHioe49U1R3LcahmTCOUmoTAFBgMrZXAwXTEUMBIGA1UE\n" 103 "ChMLQ01TIFRlc3QgQ0ExHTAbBgNVBAsMFGNtc3Rlc3RAbGlicmVzc2wub3JnMSYw\n" 104 "JAYDVQQDDB1DTVMgVGVzdCBjbXN0ZXN0QGxpYnJlc3NsLm9yZzAeFw0yMzEwMDkw\n" 105 "OTAzNDhaFw0zMzEwMDkwOTAzNDhaMF0xFDASBgNVBAoTC0NNUyBUZXN0IENBMR0w\n" 106 "GwYDVQQLDBRjbXN0ZXN0QGxpYnJlc3NsLm9yZzEmMCQGA1UEAwwdQ01TIFRlc3Qg\n" 107 "Y21zdGVzdEBsaWJyZXNzbC5vcmcwKjAFBgMrZXADIQAYj6pY7cN0DnwmsYHVDLqJ\n" 108 "7/Futy5p4QJDKA/FSZ6+6KNFMEMwDgYDVR0PAQH/BAQDAgIEMBIGA1UdEwEB/wQI\n" 109 "MAYBAf8CAQAwHQYDVR0OBBYEFE7G7c7O2Vj79+Q786M7ssMd/lflMAUGAytlcANB\n" 110 "AOk+RHgs8D82saBM1nQMgIwEsNhYwbj3HhrRFDezYcnZeorBgiZTV3uQd2EndFdU\n" 111 "hcs4OYMCRorxqpUXX6EMtwQ=\n" 112 "-----END CERTIFICATE-----\n"; 113 114const char cms_cert_2[] = 115 "-----BEGIN CERTIFICATE-----\n" 116 "MIIB5DCCAZagAwIBAgIQevuGe7FBHIc2pnQ4b4dsIzAFBgMrZXAwXTEUMBIGA1UE\n" 117 "ChMLQ01TIFRlc3QgQ0ExHTAbBgNVBAsMFGNtc3Rlc3RAbGlicmVzc2wub3JnMSYw\n" 118 "JAYDVQQDDB1DTVMgVGVzdCBjbXN0ZXN0QGxpYnJlc3NsLm9yZzAeFw0yMzEwMDkw\n" 119 "OTAzNDhaFw0zMzEwMDkwOTAzNDhaMD4xHTAbBgNVBAoTFENNUyB0ZXN0IGNlcnRp\n" 120 "ZmljYXRlMR0wGwYDVQQLDBRjbXN0ZXN0QGxpYnJlc3NsLm9yZzAqMAUGAytlcAMh\n" 121 "AFH47Z54SuXMN+i5CCvMVUZJZzSYsDcRY+lPtc+J8h2ko4GKMIGHMA4GA1UdDwEB\n" 122 "/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwQwHwYDVR0jBBgw\n" 123 "FoAUTsbtzs7ZWPv35Dvzozuywx3+V+UwNQYDVR0RBC4wLIIUY21zdGVzdC5saWJy\n" 124 "ZXNzbC5vcmeBFGNtc3Rlc3RAbGlicmVzc2wub3JnMAUGAytlcANBAAEqYppowFjF\n" 125 "fTZhNM3cIyFfmQthJV/+krEE2VTSoKgCokll+fXz1K9P+R3asgrVDoHjnBtvksIE\n" 126 "wup36c05XQA=\n" 127 "-----END CERTIFICATE-----\n"; 128 129const char cms_key_2[] = 130 "-----BEGIN PRIVATE KEY-----\n" 131 "MC4CAQAwBQYDK2VwBCIEIO88YApnGRDewzSwtxAnBvhlTPz9MjSz51mEpE2oi+9g\n" 132 "-----END PRIVATE KEY-----\n"; 133 134static void 135hexdump(const unsigned char *buf, size_t len) 136{ 137 size_t i; 138 139 for (i = 1; i <= len; i++) 140 fprintf(stderr, " 0x%02x,%s", buf[i - 1], i % 8 ? "" : "\n"); 141 if (len % 8 != 0) 142 fprintf(stderr, "\n"); 143} 144 145static int 146test_cms_encrypt_decrypt(void) 147{ 148 STACK_OF(X509) *certs = NULL; 149 CMS_ContentInfo *ci = NULL; 150 EVP_PKEY *pkey = NULL; 151 BIO *bio_mem = NULL; 152 BIO *bio_out = NULL; 153 X509 *cert = NULL; 154 size_t len; 155 long mem_len; 156 char *p; 157 int failed = 1; 158 159 if ((bio_out = BIO_new_fp(stdout, BIO_NOCLOSE)) == NULL) 160 errx(1, "failed to create BIO"); 161 162 if ((certs = sk_X509_new_null()) == NULL) 163 errx(1, "failed to create certs"); 164 if ((bio_mem = BIO_new_mem_buf(cms_cert_1, -1)) == NULL) 165 errx(1, "failed to create BIO for cert"); 166 if ((cert = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL) 167 errx(1, "failed to read cert"); 168 if (!sk_X509_push(certs, cert)) 169 errx(1, "failed to push cert"); 170 171 BIO_free(bio_mem); 172 if ((bio_mem = BIO_new_mem_buf(cms_key_1, -1)) == NULL) 173 errx(1, "failed to create BIO for key"); 174 if ((pkey = PEM_read_bio_PrivateKey(bio_mem, NULL, NULL, NULL)) == NULL) 175 errx(1, "failed to read key"); 176 177 BIO_free(bio_mem); 178 if ((bio_mem = BIO_new_mem_buf(cms_msg, -1)) == NULL) 179 errx(1, "failed to create BIO for message"); 180 181 if ((ci = CMS_encrypt(certs, bio_mem, EVP_aes_256_cbc(), 0)) == NULL) { 182 fprintf(stderr, "FAIL: CMS_encrypt returned NULL\n"); 183 ERR_print_errors_fp(stderr); 184 goto failure; 185 } 186 187 if (verbose) { 188 if (!CMS_ContentInfo_print_ctx(bio_out, ci, 0, NULL)) 189 errx(1, "failed to print CMS ContentInfo"); 190 if (!PEM_write_bio_CMS(bio_out, ci)) 191 errx(1, "failed to print CMS PEM"); 192 } 193 194 BIO_free(bio_mem); 195 if ((bio_mem = BIO_new(BIO_s_mem())) == NULL) 196 errx(1, "failed to create BIO for message"); 197 198 if (!CMS_decrypt(ci, pkey, cert, NULL, bio_mem, 0)) { 199 fprintf(stderr, "FAIL: CMS_decrypt failed\n"); 200 ERR_print_errors_fp(stderr); 201 goto failure; 202 } 203 204 if ((mem_len = BIO_get_mem_data(bio_mem, &p)) <= 0) { 205 fprintf(stderr, "FAIL: BIO_get_mem_data returned %ld\n", 206 mem_len); 207 goto failure; 208 } 209 if ((len = strlen(cms_msg)) != (size_t)mem_len) { 210 fprintf(stderr, "FAIL: CMS decrypt returned %ld bytes, " 211 "want %zu bytes\n", mem_len, len); 212 fprintf(stderr, "Got CMS data:\n"); 213 hexdump(p, mem_len); 214 fprintf(stderr, "Want CMS data:\n"); 215 hexdump(cms_msg, len); 216 goto failure; 217 } 218 if (memcmp(p, cms_msg, len) != 0) { 219 fprintf(stderr, "FAIL: CMS decrypt message differs"); 220 fprintf(stderr, "Got CMS data:\n"); 221 hexdump(p, mem_len); 222 fprintf(stderr, "Want CMS data:\n"); 223 hexdump(cms_msg, len); 224 goto failure; 225 } 226 227 failed = 0; 228 229 failure: 230 BIO_free(bio_mem); 231 BIO_free(bio_out); 232 CMS_ContentInfo_free(ci); 233 EVP_PKEY_free(pkey); 234 sk_X509_free(certs); 235 X509_free(cert); 236 237 return failed; 238} 239 240static int 241test_cms_sign_verify(const char *ca_pem, const char *cert_pem, 242 const char *key_pem) 243{ 244 STACK_OF(X509) *certs = NULL; 245 CMS_ContentInfo *ci = NULL; 246 X509_STORE *store = NULL; 247 EVP_PKEY *pkey = NULL; 248 BIO *bio_mem = NULL; 249 BIO *bio_out = NULL; 250 X509 *cert = NULL; 251 X509 *ca = NULL; 252 size_t len; 253 long mem_len; 254 char *p; 255 int failed = 1; 256 257 if ((bio_out = BIO_new_fp(stdout, BIO_NOCLOSE)) == NULL) 258 errx(1, "failed to create BIO"); 259 260 if ((certs = sk_X509_new_null()) == NULL) 261 errx(1, "failed to create certs"); 262 if ((bio_mem = BIO_new_mem_buf(cert_pem, -1)) == NULL) 263 errx(1, "failed to create BIO for cert"); 264 if ((cert = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL) 265 errx(1, "failed to read cert"); 266 if (!sk_X509_push(certs, cert)) 267 errx(1, "failed to push cert"); 268 269 BIO_free(bio_mem); 270 if ((bio_mem = BIO_new_mem_buf(ca_pem, -1)) == NULL) 271 errx(1, "failed to create BIO for cert"); 272 if ((ca = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL)) == NULL) 273 errx(1, "failed to read cert"); 274 if ((store = X509_STORE_new()) == NULL) 275 errx(1, "failed to create X509 store"); 276 if (!X509_STORE_add_cert(store, ca)) 277 errx(1, "failed to add cert to store"); 278 279 BIO_free(bio_mem); 280 if ((bio_mem = BIO_new_mem_buf(key_pem, -1)) == NULL) 281 errx(1, "failed to create BIO for key"); 282 if ((pkey = PEM_read_bio_PrivateKey(bio_mem, NULL, NULL, NULL)) == NULL) 283 errx(1, "failed to read key"); 284 285 BIO_free(bio_mem); 286 if ((bio_mem = BIO_new_mem_buf(cms_msg, -1)) == NULL) 287 errx(1, "failed to create BIO for message"); 288 289 if ((ci = CMS_sign(cert, pkey, NULL, bio_mem, 0)) == NULL) { 290 fprintf(stderr, "FAIL: CMS sign failed\n"); 291 ERR_print_errors_fp(stderr); 292 goto failure; 293 } 294 295 if (verbose) { 296 if (!CMS_ContentInfo_print_ctx(bio_out, ci, 0, NULL)) 297 errx(1, "failed to print CMS ContentInfo"); 298 if (!PEM_write_bio_CMS(bio_out, ci)) 299 errx(1, "failed to print CMS PEM"); 300 } 301 302 BIO_free(bio_mem); 303 if ((bio_mem = BIO_new(BIO_s_mem())) == NULL) 304 errx(1, "failed to create BIO for message"); 305 306 if (!CMS_verify(ci, certs, store, NULL, bio_mem, 0)) { 307 fprintf(stderr, "FAIL: CMS_verify failed\n"); 308 ERR_print_errors_fp(stderr); 309 goto failure; 310 } 311 312 if ((mem_len = BIO_get_mem_data(bio_mem, &p)) <= 0) { 313 fprintf(stderr, "FAIL: BIO_get_mem_data returned %ld\n", 314 mem_len); 315 goto failure; 316 } 317 if ((len = strlen(cms_msg)) != (size_t)mem_len) { 318 fprintf(stderr, "FAIL: CMS verify returned %ld bytes, " 319 "want %zu bytes\n", mem_len, len); 320 fprintf(stderr, "Got CMS data:\n"); 321 hexdump(p, mem_len); 322 fprintf(stderr, "Want CMS data:\n"); 323 hexdump(cms_msg, len); 324 goto failure; 325 } 326 if (memcmp(p, cms_msg, len) != 0) { 327 fprintf(stderr, "FAIL: CMS verify message differs"); 328 fprintf(stderr, "Got CMS data:\n"); 329 hexdump(p, mem_len); 330 fprintf(stderr, "Want CMS data:\n"); 331 hexdump(cms_msg, len); 332 goto failure; 333 } 334 335 failed = 0; 336 337 failure: 338 BIO_free(bio_mem); 339 BIO_free(bio_out); 340 CMS_ContentInfo_free(ci); 341 EVP_PKEY_free(pkey); 342 sk_X509_free(certs); 343 X509_free(cert); 344 X509_STORE_free(store); 345 X509_free(ca); 346 347 return failed; 348} 349 350int 351main(int argc, char **argv) 352{ 353 int failed = 0; 354 355 ERR_load_crypto_strings(); 356 357 failed |= test_cms_encrypt_decrypt(); 358 failed |= test_cms_sign_verify(cms_ca_1, cms_cert_1, cms_key_1); 359 failed |= test_cms_sign_verify(cms_ca_2, cms_cert_2, cms_key_2); 360 361 return failed; 362} 363