test/recipes/80-test_cms.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9
  10 use strict;
  11 use warnings;
  12
  13 use POSIX;
  14 use File::Spec::Functions qw/catfile/;
  15 use File::Compare qw/compare_text compare/;
  16 use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file/;
  17
  18 use OpenSSL::Test::Utils;
  19
  20 BEGIN {
  21     setup("test_cms");
  22 }
  23
  24 use lib srctop_dir('Configurations');
  25 use lib bldtop_dir('.');
  26
  27 my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
  28
  29 plan skip_all => "CMS is not supported by this OpenSSL build"
  30     if disabled("cms");
  31
  32 my $provpath = bldtop_dir("providers");
  33
  34 # Some tests require legacy algorithms to be included.
  35 my @legacyprov = ("-provider-path", $provpath,
  36                   "-provider", "default",
  37                   "-provider", "legacy" );
  38 my @defaultprov = ("-provider-path", $provpath,
  39                    "-provider", "default");
  40
  41 my @config = ( );
  42 my $provname = 'default';
  43
  44 my $datadir = srctop_dir("test", "recipes", "80-test_cms_data");
  45 my $smdir    = srctop_dir("test", "smime-certs");
  46 my $smcont   = srctop_file("test", "smcont.txt");
  47 my $smcont_zero = srctop_file("test", "smcont_zero.txt");
  48 my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib)
  49     = disabled qw/des dh dsa ec ec2m rc2 zlib/;
  50
  51 $no_rc2 = 1 if disabled("legacy");
  52
  53 plan tests => 11;
  54
  55 unless ($no_fips) {
  56     @config = ( "-config", srctop_file("test", "fips-and-base.cnf") );
  57     $provname = 'fips';
  58 }
  59
  60 $ENV{OPENSSL_TEST_LIBCTX} = "1";
  61 my @prov = ("-provider-path", $provpath,
  62             @config,
  63             "-provider", $provname);
  64
  65 my @smime_pkcs7_tests = (
  66
  67     [ "signed content DER format, RSA key",
  68       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
  69         "-certfile", catfile($smdir, "smroot.pem"),
  70         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
  71       [ "{cmd2}",  @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
  72         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
  73       \&final_compare
  74     ],
  75
  76     [ "signed detached content DER format, RSA key",
  77       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
  78         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
  79       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
  80         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt",
  81         "-content", $smcont ],
  82       \&final_compare
  83     ],
  84
  85     [ "signed content test streaming BER format, RSA",
  86       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
  87         "-stream",
  88         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
  89       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
  90         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
  91       \&final_compare
  92     ],
  93
  94     [ "signed content DER format, DSA key",
  95       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
  96         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
  97       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
  98         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
  99       \&final_compare
 100     ],
 101
 102     [ "signed detached content DER format, DSA key",
 103       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 104         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
 105       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 106         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt",
 107         "-content", $smcont ],
 108       \&final_compare
 109     ],
 110
 111     [ "signed detached content DER format, add RSA signer (with DSA existing)",
 112       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 113         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
 114       [ "{cmd1}", @prov, "-resign", "-in", "{output}.cms", "-inform", "DER", "-outform", "DER",
 115         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}2.cms" ],
 116       [ "{cmd2}", @prov, "-verify", "-in", "{output}2.cms", "-inform", "DER",
 117         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt",
 118         "-content", $smcont ],
 119       \&final_compare
 120     ],
 121
 122     [ "signed content test streaming BER format, DSA key",
 123       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 124         "-nodetach", "-stream",
 125         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
 126       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 127         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 128       \&final_compare
 129     ],
 130
 131     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys",
 132       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 133         "-nodetach", "-stream",
 134         "-signer", catfile($smdir, "smrsa1.pem"),
 135         "-signer", catfile($smdir, "smrsa2.pem"),
 136         "-signer", catfile($smdir, "smdsa1.pem"),
 137         "-signer", catfile($smdir, "smdsa2.pem"),
 138         "-out", "{output}.cms" ],
 139       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 140         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 141       \&final_compare
 142     ],
 143
 144     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, no attributes",
 145       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 146         "-noattr", "-nodetach", "-stream",
 147         "-signer", catfile($smdir, "smrsa1.pem"),
 148         "-signer", catfile($smdir, "smrsa2.pem"),
 149         "-signer", catfile($smdir, "smdsa1.pem"),
 150         "-signer", catfile($smdir, "smdsa2.pem"),
 151         "-out", "{output}.cms" ],
 152       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 153         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 154       \&final_compare
 155     ],
 156
 157     [ "signed content S/MIME format, RSA key SHA1",
 158       [ "{cmd1}", @defaultprov, "-sign", "-in", $smcont, "-md", "sha1",
 159         "-certfile", catfile($smdir, "smroot.pem"),
 160         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
 161       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 162         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 163       \&final_compare
 164     ],
 165
 166     [ "signed zero-length content S/MIME format, RSA key SHA1",
 167       [ "{cmd1}", @defaultprov, "-sign", "-in", $smcont_zero, "-md", "sha1",
 168         "-certfile", catfile($smdir, "smroot.pem"),
 169         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
 170       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 171         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 172       \&zero_compare
 173     ],
 174
 175     [ "signed content test streaming S/MIME format, 2 DSA and 2 RSA keys",
 176       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-nodetach",
 177         "-signer", catfile($smdir, "smrsa1.pem"),
 178         "-signer", catfile($smdir, "smrsa2.pem"),
 179         "-signer", catfile($smdir, "smdsa1.pem"),
 180         "-signer", catfile($smdir, "smdsa2.pem"),
 181         "-stream", "-out", "{output}.cms" ],
 182       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 183         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 184       \&final_compare
 185     ],
 186
 187     [ "signed content test streaming multipart S/MIME format, 2 DSA and 2 RSA keys",
 188       [ "{cmd1}", @prov, "-sign", "-in", $smcont,
 189         "-signer", catfile($smdir, "smrsa1.pem"),
 190         "-signer", catfile($smdir, "smrsa2.pem"),
 191         "-signer", catfile($smdir, "smdsa1.pem"),
 192         "-signer", catfile($smdir, "smdsa2.pem"),
 193         "-stream", "-out", "{output}.cms" ],
 194       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 195         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 196       \&final_compare
 197     ],
 198
 199     [ "enveloped content test streaming S/MIME format, DES, 3 recipients",
 200       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 201         "-stream", "-out", "{output}.cms",
 202         catfile($smdir, "smrsa1.pem"),
 203         catfile($smdir, "smrsa2.pem"),
 204         catfile($smdir, "smrsa3.pem") ],
 205       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
 206         "-in", "{output}.cms", "-out", "{output}.txt" ],
 207       \&final_compare
 208     ],
 209
 210     [ "enveloped content test streaming S/MIME format, DES, 3 recipients, 3rd used",
 211       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 212         "-stream", "-out", "{output}.cms",
 213         catfile($smdir, "smrsa1.pem"),
 214         catfile($smdir, "smrsa2.pem"),
 215         catfile($smdir, "smrsa3.pem") ],
 216       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smrsa3.pem"),
 217         "-in", "{output}.cms", "-out", "{output}.txt" ],
 218       \&final_compare
 219     ],
 220
 221     [ "enveloped content test streaming S/MIME format, DES, 3 recipients, key only used",
 222       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 223         "-stream", "-out", "{output}.cms",
 224         catfile($smdir, "smrsa1.pem"),
 225         catfile($smdir, "smrsa2.pem"),
 226         catfile($smdir, "smrsa3.pem") ],
 227       [ "{cmd2}", @defaultprov, "-decrypt", "-inkey", catfile($smdir, "smrsa3.pem"),
 228         "-in", "{output}.cms", "-out", "{output}.txt" ],
 229       \&final_compare
 230     ],
 231
 232     [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients",
 233       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 234         "-aes256", "-stream", "-out", "{output}.cms",
 235         catfile($smdir, "smrsa1.pem"),
 236         catfile($smdir, "smrsa2.pem"),
 237         catfile($smdir, "smrsa3.pem") ],
 238       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
 239         "-in", "{output}.cms", "-out", "{output}.txt" ],
 240       \&final_compare
 241     ],
 242
 243 );
 244
 245 my @smime_cms_tests = (
 246
 247     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, keyid",
 248       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 249         "-nodetach", "-keyid",
 250         "-signer", catfile($smdir, "smrsa1.pem"),
 251         "-signer", catfile($smdir, "smrsa2.pem"),
 252         "-signer", catfile($smdir, "smdsa1.pem"),
 253         "-signer", catfile($smdir, "smdsa2.pem"),
 254         "-stream", "-out", "{output}.cms" ],
 255       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 256         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 257       \&final_compare
 258     ],
 259
 260     [ "signed content test streaming PEM format, 2 DSA and 2 RSA keys",
 261       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 262         "-signer", catfile($smdir, "smrsa1.pem"),
 263         "-signer", catfile($smdir, "smrsa2.pem"),
 264         "-signer", catfile($smdir, "smdsa1.pem"),
 265         "-signer", catfile($smdir, "smdsa2.pem"),
 266         "-stream", "-out", "{output}.cms" ],
 267       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 268         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 269       \&final_compare
 270     ],
 271
 272     [ "signed content MIME format, RSA key, signed receipt request",
 273       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-nodetach",
 274         "-signer", catfile($smdir, "smrsa1.pem"),
 275         "-receipt_request_to", "test\@openssl.org", "-receipt_request_all",
 276         "-out", "{output}.cms" ],
 277       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 278         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 279       \&final_compare
 280     ],
 281
 282     [ "signed receipt MIME format, RSA key",
 283       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-nodetach",
 284         "-signer", catfile($smdir, "smrsa1.pem"),
 285         "-receipt_request_to", "test\@openssl.org", "-receipt_request_all",
 286         "-out", "{output}.cms" ],
 287       [ "{cmd1}", @prov, "-sign_receipt", "-in", "{output}.cms",
 288         "-signer", catfile($smdir, "smrsa2.pem"), "-out", "{output}2.cms" ],
 289       [ "{cmd2}", @prov, "-verify_receipt", "{output}2.cms", "-in", "{output}.cms",
 290         "-CAfile", catfile($smdir, "smroot.pem") ]
 291     ],
 292
 293     [ "enveloped content test streaming S/MIME format, DES, 3 recipients, keyid",
 294       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 295         "-stream", "-out", "{output}.cms", "-keyid",
 296         catfile($smdir, "smrsa1.pem"),
 297         catfile($smdir, "smrsa2.pem"),
 298         catfile($smdir, "smrsa3.pem") ],
 299       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
 300         "-in", "{output}.cms", "-out", "{output}.txt" ],
 301       \&final_compare
 302     ],
 303
 304     [ "enveloped content test streaming PEM format, AES-256-CBC cipher, KEK",
 305       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, "-outform", "PEM", "-aes128",
 306         "-stream", "-out", "{output}.cms",
 307         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 308         "-secretkeyid", "C0FEE0" ],
 309       [ "{cmd2}", @prov, "-decrypt", "-in", "{output}.cms", "-out", "{output}.txt",
 310         "-inform", "PEM",
 311         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 312         "-secretkeyid", "C0FEE0" ],
 313       \&final_compare
 314     ],
 315
 316     [ "enveloped content test streaming PEM format, AES-256-GCM cipher, KEK",
 317       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, "-outform", "PEM", "-aes-128-gcm",
 318         "-stream", "-out", "{output}.cms",
 319         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 320         "-secretkeyid", "C0FEE0" ],
 321       [ "{cmd2}", "-decrypt", "-in", "{output}.cms", "-out", "{output}.txt",
 322         "-inform", "PEM",
 323         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 324         "-secretkeyid", "C0FEE0" ],
 325       \&final_compare
 326     ],
 327
 328     [ "enveloped content test streaming PEM format, KEK, key only",
 329       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, "-outform", "PEM", "-aes128",
 330         "-stream", "-out", "{output}.cms",
 331         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 332         "-secretkeyid", "C0FEE0" ],
 333       [ "{cmd2}", @prov, "-decrypt", "-in", "{output}.cms", "-out", "{output}.txt",
 334         "-inform", "PEM",
 335         "-secretkey", "000102030405060708090A0B0C0D0E0F" ],
 336       \&final_compare
 337     ],
 338
 339     [ "data content test streaming PEM format",
 340       [ "{cmd1}", @prov, "-data_create", "-in", $smcont, "-outform", "PEM",
 341         "-nodetach", "-stream", "-out", "{output}.cms" ],
 342       [ "{cmd2}", @prov, "-data_out", "-in", "{output}.cms", "-inform", "PEM",
 343         "-out", "{output}.txt" ],
 344       \&final_compare
 345     ],
 346
 347     [ "encrypted content test streaming PEM format, 128 bit RC2 key",
 348       [ "{cmd1}", @legacyprov, "-EncryptedData_encrypt",
 349         "-in", $smcont, "-outform", "PEM",
 350         "-rc2", "-secretkey", "000102030405060708090A0B0C0D0E0F",
 351         "-stream", "-out", "{output}.cms" ],
 352       [ "{cmd2}", @legacyprov, "-EncryptedData_decrypt", "-in", "{output}.cms",
 353         "-inform", "PEM",
 354         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 355         "-out", "{output}.txt" ],
 356       \&final_compare
 357     ],
 358
 359     [ "encrypted content test streaming PEM format, 40 bit RC2 key",
 360       [ "{cmd1}", @legacyprov, "-EncryptedData_encrypt",
 361         "-in", $smcont, "-outform", "PEM",
 362         "-rc2", "-secretkey", "0001020304",
 363         "-stream", "-out", "{output}.cms" ],
 364       [ "{cmd2}", @legacyprov, "-EncryptedData_decrypt", "-in", "{output}.cms",
 365         "-inform", "PEM",
 366         "-secretkey", "0001020304", "-out", "{output}.txt" ],
 367       \&final_compare
 368     ],
 369
 370     [ "encrypted content test streaming PEM format, triple DES key",
 371       [ "{cmd1}", @prov, "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
 372         "-des3", "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
 373         "-stream", "-out", "{output}.cms" ],
 374       [ "{cmd2}", @prov, "-EncryptedData_decrypt", "-in", "{output}.cms",
 375         "-inform", "PEM",
 376         "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
 377         "-out", "{output}.txt" ],
 378       \&final_compare
 379     ],
 380
 381     [ "encrypted content test streaming PEM format, 128 bit AES key",
 382       [ "{cmd1}", @prov, "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
 383         "-aes128", "-secretkey", "000102030405060708090A0B0C0D0E0F",
 384         "-stream", "-out", "{output}.cms" ],
 385       [ "{cmd2}", @prov, "-EncryptedData_decrypt", "-in", "{output}.cms",
 386         "-inform", "PEM",
 387         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 388         "-out", "{output}.txt" ],
 389       \&final_compare
 390     ],
 391 );
 392
 393 my @smime_cms_cades_tests = (
 394
 395     [ "signed content DER format, RSA key, CAdES-BES compatible",
 396       [ "{cmd1}", @prov, "-sign", "-cades", "-in", $smcont, "-outform", "DER",
 397          "-nodetach",
 398         "-certfile", catfile($smdir, "smroot.pem"),
 399         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
 400       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 401         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 402       \&final_compare
 403     ],
 404
 405     [ "signed content DER format, RSA key, SHA256 md, CAdES-BES compatible",
 406       [ "{cmd1}", @prov, "-sign", "-cades", "-md", "sha256", "-in", $smcont, "-outform",
 407         "DER", "-nodetach", "-certfile", catfile($smdir, "smroot.pem"),
 408         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
 409       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 410         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 411       \&final_compare
 412     ],
 413
 414     [ "signed content DER format, RSA key, SHA512 md, CAdES-BES compatible",
 415       [ "{cmd1}", @prov, "-sign", "-cades", "-md", "sha512", "-in", $smcont, "-outform",
 416         "DER", "-nodetach", "-certfile", catfile($smdir, "smroot.pem"),
 417         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
 418       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 419         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 420       \&final_compare
 421     ],
 422
 423     [ "signed content DER format, RSA key, SHA256 md, CAdES-BES compatible",
 424       [ "{cmd1}", @prov, "-sign", "-cades", "-binary",  "-nodetach", "-nosmimecap", "-md", "sha256",
 425         "-in", $smcont, "-outform", "DER",
 426         "-certfile", catfile($smdir, "smroot.pem"),
 427         "-signer", catfile($smdir, "smrsa1.pem"),
 428         "-outform", "DER", "-out", "{output}.cms"  ],
 429       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 430         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 431       \&final_compare
 432     ],
 433
 434     [ "resigned content DER format, RSA key, SHA256 md, CAdES-BES compatible",
 435       [ "{cmd1}", @prov, "-sign", "-cades", "-binary",  "-nodetach", "-nosmimecap", "-md", "sha256",
 436         "-in", $smcont, "-outform", "DER",
 437         "-certfile", catfile($smdir, "smroot.pem"),
 438         "-signer", catfile($smdir, "smrsa1.pem"),
 439         "-outform", "DER", "-out", "{output}.cms"  ],
 440       [ "{cmd1}", @prov, "-resign", "-cades", "-binary", "-nodetach", "-nosmimecap", "-md", "sha256",
 441         "-inform", "DER", "-in", "{output}.cms",
 442         "-certfile", catfile($smdir, "smroot.pem"),
 443         "-signer", catfile($smdir, "smrsa2.pem"),
 444         "-outform", "DER", "-out", "{output}2.cms" ],
 445
 446       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}2.cms", "-inform", "DER",
 447         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 448       \&final_compare
 449     ],
 450 );
 451
 452 my @smime_cms_cades_ko_tests = (
 453     [ "sign content DER format, RSA key, not CAdES-BES compatible",
 454       [ @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
 455         "-certfile", catfile($smdir, "smroot.pem"),
 456         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
 457       "fail to verify token since requiring CAdES-BES compatibility",
 458       [ @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 459         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 460       \&final_compare
 461     ]
 462 );
 463
 464 # cades options test - check that some combinations are rejected
 465 my @smime_cms_cades_invalid_option_tests = (
 466     [
 467         [ "-cades", "-noattr" ],
 468     ],[
 469         [ "-verify", "-cades", "-noattr" ],
 470     ],[
 471         [ "-verify", "-cades", "-noverify" ],
 472     ],
 473 );
 474
 475 my @smime_cms_comp_tests = (
 476
 477     [ "compressed content test streaming PEM format",
 478       [ "{cmd1}", @prov, "-compress", "-in", $smcont, "-outform", "PEM", "-nodetach",
 479         "-stream", "-out", "{output}.cms" ],
 480       [ "{cmd2}", @prov, "-uncompress", "-in", "{output}.cms", "-inform", "PEM",
 481         "-out", "{output}.txt" ],
 482       \&final_compare
 483     ]
 484
 485 );
 486
 487 my @smime_cms_param_tests = (
 488     [ "signed content test streaming PEM format, RSA keys, PSS signature",
 489       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 490         "-signer", catfile($smdir, "smrsa1.pem"),
 491         "-keyopt", "rsa_padding_mode:pss",
 492         "-out", "{output}.cms" ],
 493       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 494         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 495       \&final_compare
 496     ],
 497
 498     [ "signed content test streaming PEM format, RSA keys, PSS signature, saltlen=max",
 499       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 500         "-signer", catfile($smdir, "smrsa1.pem"),
 501         "-keyopt", "rsa_padding_mode:pss", "-keyopt", "rsa_pss_saltlen:max",
 502         "-out", "{output}.cms" ],
 503       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 504         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 505       \&final_compare
 506     ],
 507
 508     [ "signed content test streaming PEM format, RSA keys, PSS signature, no attributes",
 509       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 510         "-noattr",
 511         "-signer", catfile($smdir, "smrsa1.pem"),
 512         "-keyopt", "rsa_padding_mode:pss",
 513         "-out", "{output}.cms" ],
 514       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 515         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 516       \&final_compare
 517     ],
 518
 519     [ "signed content test streaming PEM format, RSA keys, PSS signature, SHA384 MGF1",
 520       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 521         "-signer", catfile($smdir, "smrsa1.pem"),
 522         "-keyopt", "rsa_padding_mode:pss", "-keyopt", "rsa_mgf1_md:sha384",
 523         "-out", "{output}.cms" ],
 524       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 525         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
 526       \&final_compare
 527     ],
 528
 529     [ "enveloped content test streaming S/MIME format, DES, OAEP default parameters",
 530       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 531         "-stream", "-out", "{output}.cms",
 532         "-recip", catfile($smdir, "smrsa1.pem"),
 533         "-keyopt", "rsa_padding_mode:oaep" ],
 534       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
 535         "-in", "{output}.cms", "-out", "{output}.txt" ],
 536       \&final_compare
 537     ],
 538
 539     [ "enveloped content test streaming S/MIME format, DES, OAEP SHA256",
 540       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 541         "-stream", "-out", "{output}.cms",
 542         "-recip", catfile($smdir, "smrsa1.pem"),
 543         "-keyopt", "rsa_padding_mode:oaep",
 544         "-keyopt", "rsa_oaep_md:sha256" ],
 545       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
 546         "-in", "{output}.cms", "-out", "{output}.txt" ],
 547       \&final_compare
 548     ],
 549
 550     [ "enveloped content test streaming S/MIME format, DES, ECDH",
 551       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 552         "-stream", "-out", "{output}.cms",
 553         "-recip", catfile($smdir, "smec1.pem") ],
 554       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
 555         "-in", "{output}.cms", "-out", "{output}.txt" ],
 556       \&final_compare
 557     ],
 558
 559     [ "enveloped content test streaming S/MIME format, DES, ECDH, 2 recipients, key only used",
 560       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 561         "-stream", "-out", "{output}.cms",
 562         catfile($smdir, "smec1.pem"),
 563         catfile($smdir, "smec3.pem") ],
 564       [ "{cmd2}", @defaultprov, "-decrypt", "-inkey", catfile($smdir, "smec3.pem"),
 565         "-in", "{output}.cms", "-out", "{output}.txt" ],
 566       \&final_compare
 567     ],
 568
 569     [ "enveloped content test streaming S/MIME format, ECDH, DES, key identifier",
 570       [ "{cmd1}", @defaultprov, "-encrypt", "-keyid", "-in", $smcont,
 571         "-stream", "-out", "{output}.cms",
 572         "-recip", catfile($smdir, "smec1.pem") ],
 573       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
 574         "-in", "{output}.cms", "-out", "{output}.txt" ],
 575       \&final_compare
 576     ],
 577
 578     [ "enveloped content test streaming S/MIME format, ECDH, AES-128-CBC, SHA256 KDF",
 579       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 580         "-stream", "-out", "{output}.cms",
 581         "-recip", catfile($smdir, "smec1.pem"), "-aes128",
 582         "-keyopt", "ecdh_kdf_md:sha256" ],
 583       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
 584         "-in", "{output}.cms", "-out", "{output}.txt" ],
 585       \&final_compare
 586     ],
 587
 588     [ "enveloped content test streaming S/MIME format, ECDH, AES-128-GCM cipher, SHA256 KDF",
 589       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 590         "-stream", "-out", "{output}.cms",
 591         "-recip", catfile($smdir, "smec1.pem"), "-aes-128-gcm", "-keyopt", "ecdh_kdf_md:sha256" ],
 592       [ "{cmd2}", "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
 593         "-in", "{output}.cms", "-out", "{output}.txt" ],
 594       \&final_compare
 595     ],
 596
 597     [ "enveloped content test streaming S/MIME format, ECDH, K-283, cofactor DH",
 598       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 599         "-stream", "-out", "{output}.cms",
 600         "-recip", catfile($smdir, "smec2.pem"), "-aes128",
 601         "-keyopt", "ecdh_kdf_md:sha256", "-keyopt", "ecdh_cofactor_mode:1" ],
 602       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smec2.pem"),
 603         "-in", "{output}.cms", "-out", "{output}.txt" ],
 604       \&final_compare
 605     ],
 606
 607     [ "enveloped content test streaming S/MIME format, X9.42 DH",
 608       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 609         "-stream", "-out", "{output}.cms",
 610         "-recip", catfile($smdir, "smdh.pem"), "-aes128" ],
 611       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smdh.pem"),
 612         "-in", "{output}.cms", "-out", "{output}.txt" ],
 613       \&final_compare
 614     ]
 615 );
 616
 617 my @contenttype_cms_test = (
 618     [ "signed content test - check that content type is added to additional signerinfo, RSA keys",
 619       [ "{cmd1}", @prov, "-sign", "-binary", "-nodetach", "-stream", "-in", $smcont,
 620         "-outform", "DER",
 621         "-signer", catfile($smdir, "smrsa1.pem"), "-md", "SHA256",
 622         "-out", "{output}.cms" ],
 623       [ "{cmd1}", @prov, "-resign", "-binary", "-nodetach", "-in", "{output}.cms",
 624         "-inform", "DER", "-outform", "DER",
 625         "-signer", catfile($smdir, "smrsa2.pem"), "-md", "SHA256",
 626         "-out", "{output}2.cms" ],
 627       sub { my %opts = @_; contentType_matches("$opts{output}2.cms") == 2; },
 628       [ "{cmd2}", @prov, "-verify", "-in", "{output}2.cms", "-inform", "DER",
 629         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ]
 630     ],
 631 );
 632
 633 my @incorrect_attribute_cms_test = (
 634     "bad_signtime_attr.cms",
 635     "no_ct_attr.cms",
 636     "no_md_attr.cms",
 637     "ct_multiple_attr.cms"
 638 );
 639
 640 # Runs a standard loop on the input array
 641 sub runner_loop {
 642     my %opts = ( @_ );
 643     my $cnt1 = 0;
 644
 645     foreach (@{$opts{tests}}) {
 646         $cnt1++;
 647         $opts{output} = "$opts{prefix}-$cnt1";
 648       SKIP: {
 649           my $skip_reason = check_availability($$_[0]);
 650           skip $skip_reason, 1 if $skip_reason;
 651           my $ok = 1;
 652           1 while unlink "$opts{output}.txt";
 653
 654           foreach (@$_[1..$#$_]) {
 655               if (ref $_ eq 'CODE') {
 656                   $ok &&= $_->(%opts);
 657               } else {
 658                   my @cmd = map {
 659                       my $x = $_;
 660                       while ($x =~ /\{([^\}]+)\}/) {
 661                           $x = $`.$opts{$1}.$' if exists $opts{$1};
 662                       }
 663                       $x;
 664                   } @$_;
 665
 666                   diag "CMD: openssl ", join(" ", @cmd);
 667                   $ok &&= run(app(["openssl", @cmd]));
 668                   $opts{input} = $opts{output};
 669               }
 670           }
 671
 672           ok($ok, $$_[0]);
 673         }
 674     }
 675 }
 676
 677 sub final_compare {
 678     my %opts = @_;
 679
 680     diag "Comparing $smcont with $opts{output}.txt";
 681     return compare_text($smcont, "$opts{output}.txt") == 0;
 682 }
 683
 684 sub zero_compare {
 685     my %opts = @_;
 686
 687     diag "Checking for zero-length file";
 688     return (-e "$opts{output}.txt" && -z "$opts{output}.txt");
 689 }
 690
 691 subtest "CMS => PKCS#7 compatibility tests\n" => sub {
 692     plan tests => scalar @smime_pkcs7_tests;
 693
 694     runner_loop(prefix => 'cms2pkcs7', cmd1 => 'cms', cmd2 => 'smime',
 695                 tests => [ @smime_pkcs7_tests ]);
 696 };
 697 subtest "CMS <= PKCS#7 compatibility tests\n" => sub {
 698     plan tests => scalar @smime_pkcs7_tests;
 699
 700     runner_loop(prefix => 'pkcs72cms', cmd1 => 'smime', cmd2 => 'cms',
 701                 tests => [ @smime_pkcs7_tests ]);
 702 };
 703
 704 subtest "CMS <=> CMS consistency tests\n" => sub {
 705     plan tests => (scalar @smime_pkcs7_tests) + (scalar @smime_cms_tests);
 706
 707     runner_loop(prefix => 'cms2cms-1', cmd1 => 'cms', cmd2 => 'cms',
 708                 tests => [ @smime_pkcs7_tests ]);
 709     runner_loop(prefix => 'cms2cms-2', cmd1 => 'cms', cmd2 => 'cms',
 710                 tests => [ @smime_cms_tests ]);
 711 };
 712
 713 subtest "CMS <=> CMS consistency tests, modified key parameters\n" => sub {
 714     plan tests =>
 715         (scalar @smime_cms_param_tests) + (scalar @smime_cms_comp_tests);
 716
 717     runner_loop(prefix => 'cms2cms-mod', cmd1 => 'cms', cmd2 => 'cms',
 718                 tests => [ @smime_cms_param_tests ]);
 719   SKIP: {
 720       skip("Zlib not supported: compression tests skipped",
 721            scalar @smime_cms_comp_tests)
 722           if $no_zlib;
 723
 724       runner_loop(prefix => 'cms2cms-comp', cmd1 => 'cms', cmd2 => 'cms',
 725                   tests => [ @smime_cms_comp_tests ]);
 726     }
 727 };
 728
 729 # Returns the number of matches of a Content Type Attribute in a binary file.
 730 sub contentType_matches {
 731   # Read in a binary file
 732   my ($in) = @_;
 733   open (HEX_IN, "$in") or die("open failed for $in : $!");
 734   binmode(HEX_IN);
 735   local $/;
 736   my $str = <HEX_IN>;
 737
 738   # Find ASN1 data for a Content Type Attribute (with a OID of PKCS7 data)
 739   my @c = $str =~ /\x30\x18\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x09\x03\x31\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x01/gs;
 740
 741   close(HEX_IN);
 742   return scalar(@c);
 743 }
 744
 745 subtest "CMS Check the content type attribute is added for additional signers\n" => sub {
 746     plan tests => (scalar @contenttype_cms_test);
 747
 748     runner_loop(prefix => 'cms2cms-added', cmd1 => 'cms', cmd2 => 'cms',
 749                 tests => [ @contenttype_cms_test ]);
 750 };
 751
 752 subtest "CMS Check that bad attributes fail when verifying signers\n" => sub {
 753     plan tests =>
 754         (scalar @incorrect_attribute_cms_test);
 755
 756     my $cnt = 0;
 757     foreach my $name (@incorrect_attribute_cms_test) {
 758         my $out = "incorrect-$cnt.txt";
 759
 760         ok(!run(app(["openssl", "cms", @prov, "-verify", "-in",
 761                      catfile($datadir, $name), "-inform", "DER", "-CAfile",
 762                      catfile($smdir, "smroot.pem"), "-out", $out ])),
 763             $name);
 764     }
 765 };
 766
 767 subtest "CMS Decrypt message encrypted with OpenSSL 1.1.1\n" => sub {
 768     plan tests => 1;
 769
 770     SKIP: {
 771         skip "EC or DES isn't supported in this build", 1
 772             if disabled("ec") || disabled("des");
 773
 774         my $out = "smtst.txt";
 775
 776         ok(run(app(["openssl", "cms", @defaultprov, "-decrypt",
 777                     "-inkey", catfile($smdir, "smec3.pem"),
 778                     "-in", catfile($datadir, "ciphertext_from_1_1_1.cms"),
 779                     "-out", $out ]))
 780            && compare_text($smcont, $out) == 0,
 781            "Decrypt message from OpenSSL 1.1.1");
 782     }
 783 };
 784
 785 subtest "CAdES <=> CAdES consistency tests\n" => sub {
 786     plan tests => (scalar @smime_cms_cades_tests);
 787
 788     runner_loop(prefix => 'cms-cades', cmd1 => 'cms', cmd2 => 'cms',
 789                 tests => [ @smime_cms_cades_tests ]);
 790 };
 791
 792 subtest "CAdES; cms incompatible arguments tests\n" => sub {
 793     plan tests => (scalar @smime_cms_cades_invalid_option_tests);
 794
 795     foreach (@smime_cms_cades_invalid_option_tests) {
 796         ok(!run(app(["openssl", "cms", @{$$_[0]} ] )));
 797     }
 798 };
 799
 800 subtest "CAdES ko tests\n" => sub {
 801     plan tests => 2 * scalar @smime_cms_cades_ko_tests;
 802
 803     foreach (@smime_cms_cades_ko_tests) {
 804       SKIP: {
 805         my $skip_reason = check_availability($$_[0]);
 806         skip $skip_reason, 1 if $skip_reason;
 807
 808         ok(run(app(["openssl", "cms", @{$$_[1]}])), $$_[0]);
 809         ok(!run(app(["openssl", "cms", @{$$_[3]}])), $$_[2]);
 810         }
 811     }
 812 };
 813
 814 subtest "CMS binary input tests\n" => sub {
 815     my $input = srctop_file("test", "smcont.bin");
 816     my $signed = "smcont.signed";
 817     my $verified = "smcont.verified";
 818     my $cert = srctop_file("test", "certs", "ee-self-signed.pem");
 819     my $key = srctop_file("test", "certs", "ee-key.pem");
 820
 821     plan tests => 11;
 822
 823     ok(run(app(["openssl", "cms", "-sign", "-md", "sha256",
 824                 "-signer", $cert, "-inkey", $key,
 825                 "-binary", "-in", $input, "-out", $signed])),
 826        "sign binary input with -binary");
 827     ok(run(app(["openssl", "cms", "-verify", "-CAfile", $cert,
 828                 "-binary", "-in", $signed, "-out", $verified])),
 829        "verify binary input with -binary");
 830     is(compare($input, $verified), 0, "binary input retained with -binary");
 831
 832     ok(run(app(["openssl", "cms", "-sign", "-md", "sha256",
 833                 "-signer", $cert, "-inkey", $key,
 834                 "-in", $input, "-out", $signed.".nobin"])),
 835        "sign binary input without -binary");
 836     ok(run(app(["openssl", "cms", "-verify", "-CAfile", $cert,
 837                 "-in", $signed.".nobin", "-out", $verified.".nobin"])),
 838        "verify binary input without -binary");
 839     is(compare($input, $verified.".nobin"), 1, "binary input not retained without -binary");
 840     ok(!run(app(["openssl", "cms", "-verify", "-CAfile", $cert, "-crlfeol",
 841                 "-binary", "-in", $signed, "-out", $verified.".crlfeol"])),
 842        "verify binary input wrong crlfeol");
 843
 844     ok(run(app(["openssl", "cms", "-sign", "-md", "sha256", "-crlfeol",
 845                 "-signer", $cert, "-inkey", $key,
 846                 "-binary", "-in", $input, "-out", $signed.".crlf"])),
 847        "sign binary input with -binary -crlfeol");
 848     ok(run(app(["openssl", "cms", "-verify", "-CAfile", $cert, "-crlfeol",
 849                 "-binary", "-in", $signed.".crlf", "-out", $verified.".crlf"])),
 850        "verify binary input with -binary -crlfeol");
 851     is(compare($input, $verified.".crlf"), 0,
 852        "binary input retained with -binary -crlfeol");
 853     ok(!run(app(["openssl", "cms", "-verify", "-CAfile", $cert,
 854                 "-binary", "-in", $signed.".crlf", "-out", $verified.".crlf2"])),
 855        "verify binary input with -binary missing -crlfeol");
 856 };
 857
 858 sub check_availability {
 859     my $tnam = shift;
 860
 861     return "$tnam: skipped, EC disabled\n"
 862         if ($no_ec && $tnam =~ /ECDH/);
 863     return "$tnam: skipped, ECDH disabled\n"
 864         if ($no_ec && $tnam =~ /ECDH/);
 865     return "$tnam: skipped, EC2M disabled\n"
 866         if ($no_ec2m && $tnam =~ /K-283/);
 867     return "$tnam: skipped, DH disabled\n"
 868         if ($no_dh && $tnam =~ /X9\.42/);
 869     return "$tnam: skipped, RC2 disabled\n"
 870         if ($no_rc2 && $tnam =~ /RC2/);
 871     return "$tnam: skipped, DES disabled\n"
 872         if ($no_des && $tnam =~ /DES/);
 873     return "$tnam: skipped, DSA disabled\n"
 874         if ($no_dsa && $tnam =~ / DSA/);
 875
 876     return "";
 877 }