079a4b2e55a2be03f23c88e0a482af012d9b92b5
[openssl.git] / test / recipes / 80-test_cms.t
1 #! /usr/bin/perl
2
3 use strict;
4 use warnings;
5
6 use POSIX;
7 use File::Spec::Functions qw/catfile/;
8 use File::Compare qw/compare_text/;
9 use OpenSSL::Test qw/:DEFAULT top_dir top_file/;
10 use OpenSSL::Test::Utils;
11
12 setup("test_cms");
13
14 my $smdir    = top_dir("test", "smime-certs");
15 my $smcont   = top_file("test", "smcont.txt");
16 my ($no_ec, $no_ec2m, $no_zlib) = disabled qw/ec ec2m zlib/;
17
18 plan tests => 4;
19
20 my @smime_pkcs7_tests = (
21
22     [ "signed content DER format, RSA key",
23       [ "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
24         "-certfile", catfile($smdir, "smroot.pem"),
25         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "test.cms" ],
26       [ "-verify", "-in", "test.cms", "-inform", "DER",
27         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
28     ],
29
30     [ "signed detached content DER format, RSA key",
31       [ "-sign", "-in", $smcont, "-outform", "DER",
32         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "test.cms" ],
33       [ "-verify", "-in", "test.cms", "-inform", "DER",
34         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt",
35         "-content", $smcont ]
36     ],
37
38     [ "signed content test streaming BER format, RSA",
39       [ "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
40         "-stream",
41         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "test.cms" ],
42       [ "-verify", "-in", "test.cms", "-inform", "DER",
43         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
44     ],
45
46     [ "signed content DER format, DSA key",
47       [ "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
48         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "test.cms" ],
49       [ "-verify", "-in", "test.cms", "-inform", "DER",
50         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
51     ],
52
53     [ "signed detached content DER format, DSA key",
54       [ "-sign", "-in", $smcont, "-outform", "DER",
55         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "test.cms" ],
56       [ "-verify", "-in", "test.cms", "-inform", "DER",
57         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt",
58         "-content", $smcont ]
59     ],
60
61     [ "signed detached content DER format, add RSA signer",
62       [ "-resign", "-inform", "DER", "-in", "test.cms", "-outform", "DER",
63         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "test2.cms" ],
64       [ "-verify", "-in", "test2.cms", "-inform", "DER",
65         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt",
66         "-content", $smcont ]
67     ],
68
69     [ "signed content test streaming BER format, DSA key",
70       [ "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
71         "-stream",
72         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "test.cms" ],
73       [ "-verify", "-in", "test.cms", "-inform", "DER",
74         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
75     ],
76
77     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys",
78       [ "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
79         "-signer", catfile($smdir, "smrsa1.pem"),
80         "-signer", catfile($smdir, "smrsa2.pem"),
81         "-signer", catfile($smdir, "smdsa1.pem"),
82         "-signer", catfile($smdir, "smdsa2.pem"),
83         "-stream", "-out", "test.cms" ],
84       [ "-verify", "-in", "test.cms", "-inform", "DER",
85         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
86     ],
87
88     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, no attributes",
89       [ "-sign", "-in", $smcont, "-outform", "DER", "-noattr", "-nodetach",
90         "-signer", catfile($smdir, "smrsa1.pem"),
91         "-signer", catfile($smdir, "smrsa2.pem"),
92         "-signer", catfile($smdir, "smdsa1.pem"),
93         "-signer", catfile($smdir, "smdsa2.pem"),
94         "-stream", "-out", "test.cms" ],
95       [ "-verify", "-in", "test.cms", "-inform", "DER",
96         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
97     ],
98
99     [ "signed content test streaming S/MIME format, 2 DSA and 2 RSA keys",
100       [ "-sign", "-in", $smcont, "-nodetach",
101         "-signer", catfile($smdir, "smrsa1.pem"),
102         "-signer", catfile($smdir, "smrsa2.pem"),
103         "-signer", catfile($smdir, "smdsa1.pem"),
104         "-signer", catfile($smdir, "smdsa2.pem"),
105         "-stream", "-out", "test.cms" ],
106       [ "-verify", "-in", "test.cms",
107         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
108     ],
109
110     [ "signed content test streaming multipart S/MIME format, 2 DSA and 2 RSA keys",
111       [ "-sign", "-in", $smcont,
112         "-signer", catfile($smdir, "smrsa1.pem"),
113         "-signer", catfile($smdir, "smrsa2.pem"),
114         "-signer", catfile($smdir, "smdsa1.pem"),
115         "-signer", catfile($smdir, "smdsa2.pem"),
116         "-stream", "-out", "test.cms" ],
117       [ "-verify", "-in", "test.cms",
118         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
119     ],
120
121     [ "enveloped content test streaming S/MIME format, 3 recipients",
122       [ "-encrypt", "-in", $smcont,
123         "-stream", "-out", "test.cms",
124         catfile($smdir, "smrsa1.pem"),
125         catfile($smdir, "smrsa2.pem"),
126         catfile($smdir, "smrsa3.pem") ],
127       [ "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
128         "-in", "test.cms", "-out", "smtst.txt" ]
129     ],
130
131     [ "enveloped content test streaming S/MIME format, 3 recipients, 3rd used",
132       [ "-encrypt", "-in", $smcont,
133         "-stream", "-out", "test.cms",
134         catfile($smdir, "smrsa1.pem"),
135         catfile($smdir, "smrsa2.pem"),
136         catfile($smdir, "smrsa3.pem") ],
137       [ "-decrypt", "-recip", catfile($smdir, "smrsa3.pem"),
138         "-in", "test.cms", "-out", "smtst.txt" ]
139     ],
140
141     [ "enveloped content test streaming S/MIME format, 3 recipients, key only used",
142       [ "-encrypt", "-in", $smcont,
143         "-stream", "-out", "test.cms",
144         catfile($smdir, "smrsa1.pem"),
145         catfile($smdir, "smrsa2.pem"),
146         catfile($smdir, "smrsa3.pem") ],
147       [ "-decrypt", "-inkey", catfile($smdir, "smrsa3.pem"),
148         "-in", "test.cms", "-out", "smtst.txt" ]
149     ],
150
151     [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients",
152       [ "-encrypt", "-in", $smcont,
153         "-aes256", "-stream", "-out", "test.cms",
154         catfile($smdir, "smrsa1.pem"),
155         catfile($smdir, "smrsa2.pem"),
156         catfile($smdir, "smrsa3.pem") ],
157       [ "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
158         "-in", "test.cms", "-out", "smtst.txt" ]
159     ],
160
161 );
162
163 my @smime_cms_tests = (
164
165     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, keyid",
166       [ "-sign", "-in", $smcont, "-outform", "DER", "-nodetach", "-keyid",
167         "-signer", catfile($smdir, "smrsa1.pem"),
168         "-signer", catfile($smdir, "smrsa2.pem"),
169         "-signer", catfile($smdir, "smdsa1.pem"),
170         "-signer", catfile($smdir, "smdsa2.pem"),
171         "-stream", "-out", "test.cms" ],
172       [ "-verify", "-in", "test.cms", "-inform", "DER",
173         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
174     ],
175
176     [ "signed content test streaming PEM format, 2 DSA and 2 RSA keys",
177       [ "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
178         "-signer", catfile($smdir, "smrsa1.pem"),
179         "-signer", catfile($smdir, "smrsa2.pem"),
180         "-signer", catfile($smdir, "smdsa1.pem"),
181         "-signer", catfile($smdir, "smdsa2.pem"),
182         "-stream", "-out", "test.cms" ],
183       [ "-verify", "-in", "test.cms", "-inform", "PEM",
184         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
185     ],
186
187     [ "signed content MIME format, RSA key, signed receipt request",
188       [ "-sign", "-in", $smcont, "-signer", catfile($smdir, "smrsa1.pem"), "-nodetach",
189         "-receipt_request_to", "test\@openssl.org", "-receipt_request_all",
190         "-out", "test.cms" ],
191       [ "-verify", "-in", "test.cms",
192         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
193     ],
194
195     [ "signed receipt MIME format, RSA key",
196       [ "-sign_receipt", "-in", "test.cms",
197         "-signer", catfile($smdir, "smrsa2.pem"),
198         "-out", "test2.cms" ],
199       [ "-verify_receipt", "test2.cms", "-in", "test.cms",
200         "-CAfile", catfile($smdir, "smroot.pem") ]
201     ],
202
203     [ "enveloped content test streaming S/MIME format, 3 recipients, keyid",
204       [ "-encrypt", "-in", $smcont,
205         "-stream", "-out", "test.cms", "-keyid",
206         catfile($smdir, "smrsa1.pem"),
207         catfile($smdir, "smrsa2.pem"),
208         catfile($smdir, "smrsa3.pem") ],
209       [ "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
210         "-in", "test.cms", "-out", "smtst.txt" ]
211     ],
212
213     [ "enveloped content test streaming PEM format, KEK",
214       [ "-encrypt", "-in", $smcont, "-outform", "PEM", "-aes128",
215         "-stream", "-out", "test.cms",
216         "-secretkey", "000102030405060708090A0B0C0D0E0F",
217         "-secretkeyid", "C0FEE0" ],
218       [ "-decrypt", "-in", "test.cms", "-out", "smtst.txt", "-inform", "PEM",
219         "-secretkey", "000102030405060708090A0B0C0D0E0F",
220         "-secretkeyid", "C0FEE0" ]
221     ],
222
223     [ "enveloped content test streaming PEM format, KEK, key only",
224       [ "-encrypt", "-in", $smcont, "-outform", "PEM", "-aes128",
225         "-stream", "-out", "test.cms",
226         "-secretkey", "000102030405060708090A0B0C0D0E0F",
227         "-secretkeyid", "C0FEE0" ],
228       [ "-decrypt", "-in", "test.cms", "-out", "smtst.txt", "-inform", "PEM",
229         "-secretkey", "000102030405060708090A0B0C0D0E0F" ]
230     ],
231
232     [ "data content test streaming PEM format",
233       [ "-data_create", "-in", $smcont, "-outform", "PEM", "-nodetach",
234         "-stream", "-out", "test.cms" ],
235       [ "-data_out", "-in", "test.cms", "-inform", "PEM", "-out", "smtst.txt" ]
236     ],
237
238     [ "encrypted content test streaming PEM format, 128 bit RC2 key",
239       [ "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
240         "-rc2", "-secretkey", "000102030405060708090A0B0C0D0E0F",
241         "-stream", "-out", "test.cms" ],
242       [ "-EncryptedData_decrypt", "-in", "test.cms", "-inform", "PEM",
243         "-secretkey", "000102030405060708090A0B0C0D0E0F", "-out", "smtst.txt" ]
244     ],
245
246     [ "encrypted content test streaming PEM format, 40 bit RC2 key",
247       [ "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
248         "-rc2", "-secretkey", "0001020304",
249         "-stream", "-out", "test.cms" ],
250       [ "-EncryptedData_decrypt", "-in", "test.cms", "-inform", "PEM",
251         "-secretkey", "0001020304", "-out", "smtst.txt" ]
252     ],
253
254     [ "encrypted content test streaming PEM format, triple DES key",
255       [ "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
256         "-des3", "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
257         "-stream", "-out", "test.cms" ],
258       [ "-EncryptedData_decrypt", "-in", "test.cms", "-inform", "PEM",
259         "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
260         "-out", "smtst.txt" ]
261     ],
262
263     [ "encrypted content test streaming PEM format, 128 bit AES key",
264       [ "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
265         "-aes128", "-secretkey", "000102030405060708090A0B0C0D0E0F",
266         "-stream", "-out", "test.cms" ],
267       [ "-EncryptedData_decrypt", "-in", "test.cms", "-inform", "PEM",
268         "-secretkey", "000102030405060708090A0B0C0D0E0F", "-out", "smtst.txt" ]
269     ],
270
271 );
272
273 my @smime_cms_comp_tests = (
274
275     [ "compressed content test streaming PEM format",
276       [ "-compress", "-in", $smcont, "-outform", "PEM", "-nodetach",
277         "-stream", "-out", "test.cms" ],
278       [ "-uncompress", "-in", "test.cms", "-inform", "PEM", "-out", "smtst.txt" ]
279     ]
280
281 );
282
283 my @smime_cms_param_tests = (
284     [ "signed content test streaming PEM format, RSA keys, PSS signature",
285       [ "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
286         "-signer", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:pss",
287         "-out", "test.cms" ],
288       [ "-verify", "-in", "test.cms", "-inform", "PEM",
289         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
290     ],
291
292     [ "signed content test streaming PEM format, RSA keys, PSS signature, no attributes",
293       [ "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach", "-noattr",
294         "-signer", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:pss",
295         "-out", "test.cms" ],
296       [ "-verify", "-in", "test.cms", "-inform", "PEM",
297         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
298     ],
299
300     [ "signed content test streaming PEM format, RSA keys, PSS signature, SHA384 MGF1",
301       [ "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
302         "-signer", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:pss",
303         "-keyopt", "rsa_mgf1_md:sha384", "-out", "test.cms" ],
304       [ "-verify", "-in", "test.cms", "-inform", "PEM",
305         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
306     ],
307
308     [ "enveloped content test streaming S/MIME format, OAEP default parameters",
309       [ "-encrypt", "-in", $smcont,
310         "-stream", "-out", "test.cms",
311         "-recip", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:oaep" ],
312       [ "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
313         "-in", "test.cms", "-out", "smtst.txt" ]
314     ],
315
316     [ "enveloped content test streaming S/MIME format, OAEP SHA256",
317       [ "-encrypt", "-in", $smcont,
318         "-stream", "-out", "test.cms",
319         "-recip", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:oaep",
320         "-keyopt", "rsa_oaep_md:sha256" ],
321       [ "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
322         "-in", "test.cms", "-out", "smtst.txt" ]
323     ],
324
325     [ "enveloped content test streaming S/MIME format, ECDH",
326       [ "-encrypt", "-in", $smcont,
327         "-stream", "-out", "test.cms",
328         "-recip", catfile($smdir, "smec1.pem") ],
329       [ "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
330         "-in", "test.cms", "-out", "smtst.txt" ]
331     ],
332
333     [ "enveloped content test streaming S/MIME format, ECDH, key identifier",
334       [ "-encrypt", "-keyid", "-in", $smcont,
335         "-stream", "-out", "test.cms",
336         "-recip", catfile($smdir, "smec1.pem") ],
337       [ "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
338         "-in", "test.cms", "-out", "smtst.txt" ]
339     ],
340
341     [ "enveloped content test streaming S/MIME format, ECDH, AES128, SHA256 KDF",
342       [ "-encrypt", "-in", $smcont,
343         "-stream", "-out", "test.cms",
344         "-recip", catfile($smdir, "smec1.pem"), "-aes128", "-keyopt", "ecdh_kdf_md:sha256" ],
345       [ "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
346         "-in", "test.cms", "-out", "smtst.txt" ]
347     ],
348
349     [ "enveloped content test streaming S/MIME format, ECDH, K-283, cofactor DH",
350       [ "-encrypt", "-in", $smcont,
351         "-stream", "-out", "test.cms",
352         "-recip", catfile($smdir, "smec2.pem"), "-aes128",
353         "-keyopt", "ecdh_kdf_md:sha256", "-keyopt", "ecdh_cofactor_mode:1" ],
354       [ "-decrypt", "-recip", catfile($smdir, "smec2.pem"),
355         "-in", "test.cms", "-out", "smtst.txt" ]
356     ],
357
358     [ "enveloped content test streaming S/MIME format, X9.42 DH",
359       [ "-encrypt", "-in", $smcont,
360         "-stream", "-out", "test.cms",
361         "-recip", catfile($smdir, "smdh.pem"), "-aes128" ],
362       [ "-decrypt", "-recip", catfile($smdir, "smdh.pem"),
363         "-in", "test.cms", "-out", "smtst.txt" ]
364     ]
365     );
366
367 subtest "CMS => PKCS#7 compatibility tests\n" => sub {
368     plan tests => scalar @smime_pkcs7_tests;
369
370     foreach (@smime_pkcs7_tests) {
371       SKIP: {
372           my $skip_reason = check_availability($$_[0]);
373           skip $skip_reason, 1 if $skip_reason;
374
375           ok(run(app(["openssl", "cms", @{$$_[1]}]))
376              && run(app(["openssl", "smime", @{$$_[2]}]))
377              && compare_text($smcont, "smtst.txt") == 0,
378              $$_[0]);
379         }
380     }
381 };
382 subtest "CMS <= PKCS#7 compatibility tests\n" => sub {
383     plan tests => scalar @smime_pkcs7_tests;
384
385     foreach (@smime_pkcs7_tests) {
386       SKIP: {
387           my $skip_reason = check_availability($$_[0]);
388           skip $skip_reason, 1 if $skip_reason;
389
390           ok(run(app(["openssl", "smime", @{$$_[1]}]))
391              && run(app(["openssl", "cms", @{$$_[2]}]))
392              && compare_text($smcont, "smtst.txt") == 0,
393              $$_[0]);
394         }
395     }
396 };
397
398 subtest "CMS <=> CMS consistency tests\n" => sub {
399     plan tests => (scalar @smime_pkcs7_tests) + (scalar @smime_cms_tests);
400
401     foreach (@smime_pkcs7_tests) {
402       SKIP: {
403           my $skip_reason = check_availability($$_[0]);
404           skip $skip_reason, 1 if $skip_reason;
405
406           ok(run(app(["openssl", "cms", @{$$_[1]}]))
407              && run(app(["openssl", "cms", @{$$_[2]}]))
408              && compare_text($smcont, "smtst.txt") == 0,
409              $$_[0]);
410         }
411     }
412     foreach (@smime_cms_tests) {
413       SKIP: {
414           my $skip_reason = check_availability($$_[0]);
415           skip $skip_reason, 1 if $skip_reason;
416
417           ok(run(app(["openssl", "cms", @{$$_[1]}]))
418              && run(app(["openssl", "cms", @{$$_[2]}]))
419              && compare_text($smcont, "smtst.txt") == 0,
420              $$_[0]);
421         }
422     }
423 };
424
425 subtest "CMS <=> CMS consistency tests, modified key parameters\n" => sub {
426     plan tests =>
427         (scalar @smime_cms_param_tests) + (scalar @smime_cms_comp_tests);
428
429     foreach (@smime_cms_param_tests) {
430       SKIP: {
431           my $skip_reason = check_availability($$_[0]);
432           skip $skip_reason, 1 if $skip_reason;
433
434           ok(run(app(["openssl", "cms", @{$$_[1]}]))
435              && run(app(["openssl", "cms", @{$$_[2]}]))
436              && compare_text($smcont, "smtst.txt") == 0,
437              $$_[0]);
438         }
439     }
440
441   SKIP: {
442       skip("Zlib not supported: compression tests skipped",
443            scalar @smime_cms_comp_tests)
444           if $no_zlib;
445
446       foreach (@smime_cms_comp_tests) {
447         SKIP: {
448             my $skip_reason = check_availability($$_[0]);
449             skip $skip_reason, 1 if $skip_reason;
450
451             ok(run(app(["openssl", "cms", @{$$_[1]}]))
452                && run(app(["openssl", "cms", @{$$_[2]}]))
453                && compare_text($smcont, "smtst.txt") == 0,
454                $$_[0]);
455           }
456       }
457     }
458 };
459
460 unlink "test.cms";
461 unlink "test2.cms";
462 unlink "smtst.txt";
463
464 sub check_availability {
465     my $tnam = shift;
466
467     return "$tnam: skipped, EC disabled\n"
468         if ($no_ec && $tnam =~ /ECDH/);
469     return "$tnam: skipped, ECDH disabled\n"
470         if ($no_ec && $tnam =~ /ECDH/);
471     return "$tnam: skipped, EC2M disabled\n"
472         if ($no_ec2m && $tnam =~ /K-283/);
473     return "";
474 }