#include <stdlib.h>
#include <ctype.h>
#include <openssl/evp.h>
+#include <openssl/pem.h>
#include <openssl/err.h>
#include <openssl/x509v3.h>
*buflen = 0;
return 1;
}
+ /* Check for string literal */
+ if (value[0] == '"') {
+ size_t vlen;
+ value++;
+ vlen = strlen(value);
+ if (value[vlen - 1] != '"')
+ return 0;
+ vlen--;
+ *buf = BUF_memdup(value, vlen);
+ *buflen = vlen;
+ return 1;
+ }
*buf = string_to_hex(value, &len);
if (!*buf) {
fprintf(stderr, "Value=%s\n", value);
/* Structure holding test information */
struct evp_test {
+ /* file being read */
+ FILE *in;
+ /* List of public and private keys */
+ struct key_list *private;
+ struct key_list *public;
/* method for this test */
const struct evp_test_method *meth;
/* current line being processed */
int ntests;
/* Error count */
int errors;
+ /* Number of tests skipped */
+ int nskip;
+ /* If output mismatch expected and got value */
+ unsigned char *out_got;
+ unsigned char *out_expected;
+ size_t out_len;
/* test specific data */
void *data;
+ /* Current test should be skipped */
+ int skip;
};
+
+struct key_list {
+ char *name;
+ EVP_PKEY *key;
+ struct key_list *next;
+};
+
/* Test method structure */
struct evp_test_method {
/* Name of test as it appears in file */
};
static const struct evp_test_method digest_test_method, cipher_test_method;
-static const struct evp_test_method aead_test_method;
+static const struct evp_test_method mac_test_method;
+static const struct evp_test_method psign_test_method, pverify_test_method;
+static const struct evp_test_method pdecrypt_test_method;
+static const struct evp_test_method pverify_recover_test_method;
static const struct evp_test_method *evp_test_list[] = {
&digest_test_method,
&cipher_test_method,
- NULL,
+ &mac_test_method,
+ &psign_test_method,
+ &pverify_test_method,
+ &pdecrypt_test_method,
+ &pverify_recover_test_method,
+ NULL
};
static const struct evp_test_method *evp_find_test(const char *name)
return NULL;
}
+static void hex_print(const char *name, const unsigned char *buf, size_t len)
+{
+ size_t i;
+ fprintf(stderr, "%s ", name);
+ for (i = 0; i < len; i++)
+ fprintf(stderr, "%02X", buf[i]);
+ fputs("\n", stderr);
+}
+
+static void print_expected(struct evp_test *t)
+{
+ if (t->out_expected == NULL)
+ return;
+ hex_print("Expected:", t->out_expected, t->out_len);
+ hex_print("Got: ", t->out_got, t->out_len);
+ OPENSSL_free(t->out_expected);
+ OPENSSL_free(t->out_got);
+ t->out_expected = NULL;
+ t->out_got = NULL;
+}
+
static int check_test_error(struct evp_test *t)
{
if (!t->err && !t->expected_err)
if (t->err && !t->expected_err) {
fprintf(stderr, "Test line %d: unexpected error %s\n",
t->start_line, t->err);
+ print_expected(t);
return 0;
}
if (!t->err && t->expected_err) {
/* If we already have a test set up run it */
if (t->meth) {
t->ntests++;
+ if (t->skip) {
+ t->meth = tmeth;
+ t->nskip++;
+ return 1;
+ }
t->err = NULL;
if (t->meth->run_test(t) != 1) {
fprintf(stderr, "%s test error line %d\n",
}
ERR_clear_error();
t->meth->cleanup(t);
- /* If new test type free old data */
- if (tmeth != t->meth && t->data) {
- OPENSSL_free(t->data);
- t->data = NULL;
- }
+ OPENSSL_free(t->data);
+ t->data = NULL;
if (t->expected_err) {
OPENSSL_free(t->expected_err);
t->expected_err = NULL;
return 1;
}
+static int find_key(EVP_PKEY **ppk, const char *name, struct key_list *lst)
+{
+ for (; lst; lst = lst->next) {
+ if (!strcmp(lst->name, name)) {
+ if (ppk)
+ *ppk = lst->key;
+ return 1;
+ }
+ }
+ return 0;
+}
+
+static void free_key_list(struct key_list *lst)
+{
+ while (lst != NULL) {
+ struct key_list *ltmp;
+ EVP_PKEY_free(lst->key);
+ OPENSSL_free(lst->name);
+ ltmp = lst->next;
+ OPENSSL_free(lst);
+ lst = ltmp;
+ }
+}
+
+static int check_unsupported()
+{
+ long err = ERR_peek_error();
+ if (ERR_GET_LIB(err) == ERR_LIB_EVP
+ && ERR_GET_REASON(err) == EVP_R_UNSUPPORTED_ALGORITHM) {
+ ERR_clear_error();
+ return 1;
+ }
+ return 0;
+}
+
static int process_test(struct evp_test *t, char *buf, int verbose)
{
char *keyword, *value;
- int rv = 0;
+ int rv = 0, add_key = 0;
+ long save_pos;
+ struct key_list **lst, *key;
+ EVP_PKEY *pk = NULL;
const struct evp_test_method *tmeth;
if (verbose)
fputs(buf, stdout);
if (!parse_line(&keyword, &value, buf))
return 1;
+ if (!strcmp(keyword, "PrivateKey")) {
+ save_pos = ftell(t->in);
+ pk = PEM_read_PrivateKey(t->in, NULL, 0, NULL);
+ if (pk == NULL && !check_unsupported()) {
+ fprintf(stderr, "Error reading private key %s\n", value);
+ ERR_print_errors_fp(stderr);
+ return 0;
+ }
+ lst = &t->private;
+ add_key = 1;
+ }
+ if (!strcmp(keyword, "PublicKey")) {
+ save_pos = ftell(t->in);
+ pk = PEM_read_PUBKEY(t->in, NULL, 0, NULL);
+ if (pk == NULL && !check_unsupported()) {
+ fprintf(stderr, "Error reading public key %s\n", value);
+ ERR_print_errors_fp(stderr);
+ return 0;
+ }
+ lst = &t->public;
+ add_key = 1;
+ }
+ /* If we have a key add to list */
+ if (add_key) {
+ char tmpbuf[80];
+ if (find_key(NULL, value, *lst)) {
+ fprintf(stderr, "Duplicate key %s\n", value);
+ return 0;
+ }
+ key = OPENSSL_malloc(sizeof(struct key_list));
+ if (!key)
+ return 0;
+ key->name = BUF_strdup(value);
+ key->key = pk;
+ key->next = *lst;
+ *lst = key;
+ /* Rewind input, read to end and update line numbers */
+ fseek(t->in, save_pos, SEEK_SET);
+ while (fgets(tmpbuf, sizeof(tmpbuf), t->in)) {
+ t->line++;
+ if (!strncmp(tmpbuf, "-----END", 8))
+ return 1;
+ }
+ fprintf(stderr, "Can't find key end\n");
+ return 0;
+ }
+
/* See if keyword corresponds to a test start */
tmeth = evp_find_test(keyword);
if (tmeth) {
if (!setup_test(t, tmeth))
return 0;
t->start_line = t->line;
+ t->skip = 0;
if (!tmeth->init(t, value)) {
fprintf(stderr, "Unknown %s: %s\n", keyword, value);
return 0;
}
return 1;
+ } else if (t->skip) {
+ return 1;
} else if (!strcmp(keyword, "Result")) {
if (t->expected_err) {
fprintf(stderr, "Line %d: multiple result lines\n", t->line);
return 1;
}
+static int check_output(struct evp_test *t, const unsigned char *expected,
+ const unsigned char *got, size_t len)
+{
+ if (!memcmp(expected, got, len))
+ return 0;
+ t->out_expected = BUF_memdup(expected, len);
+ t->out_got = BUF_memdup(got, len);
+ t->out_len = len;
+ if (t->out_expected == NULL || t->out_got == NULL) {
+ fprintf(stderr, "Memory allocation error!\n");
+ exit(1);
+ }
+ return 1;
+}
+
int main(int argc, char **argv)
{
FILE *in = NULL;
char buf[10240];
struct evp_test t;
+ if (argc != 2) {
+ fprintf(stderr, "usage: evp_test testfile.txt\n");
+ return 1;
+ }
+
+ CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+
ERR_load_crypto_strings();
OpenSSL_add_all_algorithms();
+
+ memset(&t,0,sizeof(t));
t.meth = NULL;
+ t.public = NULL;
+ t.private = NULL;
t.err = NULL;
t.line = 0;
t.start_line = -1;
t.errors = 0;
t.ntests = 0;
+ t.out_expected = NULL;
+ t.out_got = NULL;
+ t.out_len = 0;
in = fopen(argv[1], "r");
+ t.in = in;
while (fgets(buf, sizeof(buf), in)) {
t.line++;
if (!process_test(&t, buf, 0))
/* Run any final test we have */
if (!setup_test(&t, NULL))
exit(1);
- fprintf(stderr, "%d tests completed with %d errors\n",
- t.ntests, t.errors);
+ fprintf(stderr, "%d tests completed with %d errors, %d skipped\n",
+ t.ntests, t.errors, t.nskip);
+ free_key_list(t.public);
+ free_key_list(t.private);
fclose(in);
+ EVP_cleanup();
+ CRYPTO_cleanup_all_ex_data();
+ ERR_remove_thread_state(NULL);
+ ERR_free_strings();
+ CRYPTO_mem_leaks_fp(stderr);
+ if (t.errors)
+ return 1;
return 0;
}
const EVP_MD *digest;
struct digest_data *mdat = t->data;
digest = EVP_get_digestbyname(alg);
- if (!digest)
+ if (!digest) {
+ /* If alg has an OID assume disabled algorithm */
+ if (OBJ_sn2nid(alg) != NID_undef || OBJ_ln2nid(alg) != NID_undef) {
+ t->skip = 1;
+ return 1;
+ }
return 0;
+ }
mdat = OPENSSL_malloc(sizeof(struct digest_data));
mdat->digest = digest;
mdat->input = NULL;
if (md_len != mdata->output_len)
goto err;
err = "DIGEST_MISMATCH";
- if (memcmp(mdata->output, md, md_len))
+ if (check_output(t, mdata->output, md, md_len))
goto err;
err = NULL;
err:
if (mctx)
EVP_MD_CTX_destroy(mctx);
t->err = err;
- return err ? 0 : 1;
+ return 1;
}
static const struct evp_test_method digest_test_method = {
const EVP_CIPHER *cipher;
struct cipher_data *cdat = t->data;
cipher = EVP_get_cipherbyname(alg);
- if (!cipher)
+ if (!cipher) {
+ /* If alg has an OID assume disabled algorithm */
+ if (OBJ_sn2nid(alg) != NID_undef || OBJ_ln2nid(alg) != NID_undef) {
+ t->skip = 1;
+ return 1;
+ }
return 0;
+ }
cdat = OPENSSL_malloc(sizeof(struct cipher_data));
cdat->cipher = cipher;
cdat->enc = -1;
if (out_len != (size_t)(tmplen + tmpflen))
goto err;
err = "VALUE_MISMATCH";
- if (memcmp(out, tmp, out_len))
+ if (check_output(t, out, tmp, out_len))
goto err;
if (enc && cdat->aead) {
unsigned char rtag[16];
err = "TAG_RETRIEVE_ERROR";
goto err;
}
- if (memcmp(cdat->tag, rtag, cdat->tag_len)) {
+ if (check_output(t, cdat->tag, rtag, cdat->tag_len)) {
err = "TAG_VALUE_MISMATCH";
goto err;
}
cipher_test_parse,
cipher_test_run
};
+
+struct mac_data {
+ /* MAC type */
+ int type;
+ /* Algorithm string for this MAC */
+ char *alg;
+ /* MAC key */
+ unsigned char *key;
+ size_t key_len;
+ /* Input to MAC */
+ unsigned char *input;
+ size_t input_len;
+ /* Expected output */
+ unsigned char *output;
+ size_t output_len;
+};
+
+static int mac_test_init(struct evp_test *t, const char *alg)
+{
+ int type;
+ struct mac_data *mdat;
+ if (!strcmp(alg, "HMAC"))
+ type = EVP_PKEY_HMAC;
+ else if (!strcmp(alg, "CMAC"))
+ type = EVP_PKEY_CMAC;
+ else
+ return 0;
+
+ mdat = OPENSSL_malloc(sizeof(struct mac_data));
+ mdat->type = type;
+ mdat->alg = NULL;
+ mdat->key = NULL;
+ mdat->input = NULL;
+ mdat->output = NULL;
+ t->data = mdat;
+ return 1;
+}
+
+static void mac_test_cleanup(struct evp_test *t)
+{
+ struct mac_data *mdat = t->data;
+ test_free(mdat->alg);
+ test_free(mdat->key);
+ test_free(mdat->input);
+ test_free(mdat->output);
+}
+
+static int mac_test_parse(struct evp_test *t,
+ const char *keyword, const char *value)
+{
+ struct mac_data *mdata = t->data;
+ if (!strcmp(keyword, "Key"))
+ return test_bin(value, &mdata->key, &mdata->key_len);
+ if (!strcmp(keyword, "Algorithm")) {
+ mdata->alg = BUF_strdup(value);
+ if (!mdata->alg)
+ return 0;
+ return 1;
+ }
+ if (!strcmp(keyword, "Input"))
+ return test_bin(value, &mdata->input, &mdata->input_len);
+ if (!strcmp(keyword, "Output"))
+ return test_bin(value, &mdata->output, &mdata->output_len);
+ return 0;
+}
+
+static int mac_test_run(struct evp_test *t)
+{
+ struct mac_data *mdata = t->data;
+ const char *err = "INTERNAL_ERROR";
+ EVP_MD_CTX *mctx = NULL;
+ EVP_PKEY_CTX *pctx = NULL, *genctx = NULL;
+ EVP_PKEY *key = NULL;
+ const EVP_MD *md = NULL;
+ unsigned char *mac = NULL;
+ size_t mac_len;
+
+ err = "MAC_PKEY_CTX_ERROR";
+ genctx = EVP_PKEY_CTX_new_id(mdata->type, NULL);
+ if (!genctx)
+ goto err;
+
+ err = "MAC_KEYGEN_INIT_ERROR";
+ if (EVP_PKEY_keygen_init(genctx) <= 0)
+ goto err;
+ if (mdata->type == EVP_PKEY_CMAC) {
+ err = "MAC_ALGORITHM_SET_ERROR";
+ if (EVP_PKEY_CTX_ctrl_str(genctx, "cipher", mdata->alg) <= 0)
+ goto err;
+ }
+
+ err = "MAC_KEY_SET_ERROR";
+ if (EVP_PKEY_CTX_set_mac_key(genctx, mdata->key, mdata->key_len) <= 0)
+ goto err;
+
+ err = "MAC_KEY_GENERATE_ERROR";
+ if (EVP_PKEY_keygen(genctx, &key) <= 0)
+ goto err;
+ if (mdata->type == EVP_PKEY_HMAC) {
+ err = "MAC_ALGORITHM_SET_ERROR";
+ md = EVP_get_digestbyname(mdata->alg);
+ if (!md)
+ goto err;
+ }
+ mctx = EVP_MD_CTX_create();
+ if (!mctx)
+ goto err;
+ err = "DIGESTSIGNINIT_ERROR";
+ if (!EVP_DigestSignInit(mctx, &pctx, md, NULL, key))
+ goto err;
+
+ err = "DIGESTSIGNUPDATE_ERROR";
+ if (!EVP_DigestSignUpdate(mctx, mdata->input, mdata->input_len))
+ goto err;
+ err = "DIGESTSIGNFINAL_LENGTH_ERROR";
+ if (!EVP_DigestSignFinal(mctx, NULL, &mac_len))
+ goto err;
+ mac = OPENSSL_malloc(mac_len);
+ if (!mac) {
+ fprintf(stderr, "Error allocating mac buffer!\n");
+ exit(1);
+ }
+ if (!EVP_DigestSignFinal(mctx, mac, &mac_len))
+ goto err;
+ err = "MAC_LENGTH_MISMATCH";
+ if (mac_len != mdata->output_len)
+ goto err;
+ err = "MAC_MISMATCH";
+ if (check_output(t, mdata->output, mac, mac_len))
+ goto err;
+ err = NULL;
+ err:
+ if (mctx)
+ EVP_MD_CTX_destroy(mctx);
+ if (mac)
+ OPENSSL_free(mac);
+ if (genctx)
+ EVP_PKEY_CTX_free(genctx);
+ if (key)
+ EVP_PKEY_free(key);
+ t->err = err;
+ return 1;
+}
+
+static const struct evp_test_method mac_test_method = {
+ "MAC",
+ mac_test_init,
+ mac_test_cleanup,
+ mac_test_parse,
+ mac_test_run
+};
+
+/*
+ * Public key operations. These are all very similar and can share
+ * a lot of common code.
+ */
+
+struct pkey_data {
+ /* Context for this operation */
+ EVP_PKEY_CTX *ctx;
+ /* Key operation to perform */
+ int (*keyop) (EVP_PKEY_CTX *ctx,
+ unsigned char *sig, size_t *siglen,
+ const unsigned char *tbs, size_t tbslen);
+ /* Input to MAC */
+ unsigned char *input;
+ size_t input_len;
+ /* Expected output */
+ unsigned char *output;
+ size_t output_len;
+};
+
+/*
+ * Perform public key operation setup: lookup key, allocated ctx and call
+ * the appropriate initialisation function
+ */
+static int pkey_test_init(struct evp_test *t, const char *name,
+ int use_public,
+ int (*keyopinit) (EVP_PKEY_CTX *ctx),
+ int (*keyop) (EVP_PKEY_CTX *ctx,
+ unsigned char *sig, size_t *siglen,
+ const unsigned char *tbs,
+ size_t tbslen)
+ )
+{
+ struct pkey_data *kdata;
+ EVP_PKEY *pkey = NULL;
+ int rv = 0;
+ if (use_public)
+ rv = find_key(&pkey, name, t->public);
+ if (!rv)
+ rv = find_key(&pkey, name, t->private);
+ if (!rv)
+ return 0;
+ if (!pkey) {
+ t->skip = 1;
+ return 1;
+ }
+
+ kdata = OPENSSL_malloc(sizeof(struct pkey_data));
+ if (!kdata) {
+ EVP_PKEY_free(pkey);
+ return 0;
+ }
+ kdata->ctx = NULL;
+ kdata->input = NULL;
+ kdata->output = NULL;
+ kdata->keyop = keyop;
+ t->data = kdata;
+ kdata->ctx = EVP_PKEY_CTX_new(pkey, NULL);
+ if (!kdata->ctx)
+ return 0;
+ if (keyopinit(kdata->ctx) <= 0)
+ return 0;
+ return 1;
+}
+
+static void pkey_test_cleanup(struct evp_test *t)
+{
+ struct pkey_data *kdata = t->data;
+ if (kdata->input)
+ OPENSSL_free(kdata->input);
+ if (kdata->output)
+ OPENSSL_free(kdata->output);
+ if (kdata->ctx)
+ EVP_PKEY_CTX_free(kdata->ctx);
+}
+
+static int pkey_test_parse(struct evp_test *t,
+ const char *keyword, const char *value)
+{
+ struct pkey_data *kdata = t->data;
+ if (!strcmp(keyword, "Input"))
+ return test_bin(value, &kdata->input, &kdata->input_len);
+ if (!strcmp(keyword, "Output"))
+ return test_bin(value, &kdata->output, &kdata->output_len);
+ if (!strcmp(keyword, "Ctrl")) {
+ char *p = strchr(value, ':');
+ if (p)
+ *p++ = 0;
+ if (EVP_PKEY_CTX_ctrl_str(kdata->ctx, value, p) <= 0)
+ return 0;
+ return 1;
+ }
+ return 0;
+}
+
+static int pkey_test_run(struct evp_test *t)
+{
+ struct pkey_data *kdata = t->data;
+ unsigned char *out = NULL;
+ size_t out_len;
+ const char *err = "KEYOP_LENGTH_ERROR";
+ if (kdata->keyop(kdata->ctx, NULL, &out_len, kdata->input,
+ kdata->input_len) <= 0)
+ goto err;
+ out = OPENSSL_malloc(out_len);
+ if (!out) {
+ fprintf(stderr, "Error allocating output buffer!\n");
+ exit(1);
+ }
+ err = "KEYOP_ERROR";
+ if (kdata->keyop
+ (kdata->ctx, out, &out_len, kdata->input, kdata->input_len) <= 0)
+ goto err;
+ err = "KEYOP_LENGTH_MISMATCH";
+ if (out_len != kdata->output_len)
+ goto err;
+ err = "KEYOP_MISMATCH";
+ if (check_output(t, kdata->output, out, out_len))
+ goto err;
+ err = NULL;
+ err:
+ if (out)
+ OPENSSL_free(out);
+ t->err = err;
+ return 1;
+}
+
+static int sign_test_init(struct evp_test *t, const char *name)
+{
+ return pkey_test_init(t, name, 0, EVP_PKEY_sign_init, EVP_PKEY_sign);
+}
+
+static const struct evp_test_method psign_test_method = {
+ "Sign",
+ sign_test_init,
+ pkey_test_cleanup,
+ pkey_test_parse,
+ pkey_test_run
+};
+
+static int verify_recover_test_init(struct evp_test *t, const char *name)
+{
+ return pkey_test_init(t, name, 1, EVP_PKEY_verify_recover_init,
+ EVP_PKEY_verify_recover);
+}
+
+static const struct evp_test_method pverify_recover_test_method = {
+ "VerifyRecover",
+ verify_recover_test_init,
+ pkey_test_cleanup,
+ pkey_test_parse,
+ pkey_test_run
+};
+
+static int decrypt_test_init(struct evp_test *t, const char *name)
+{
+ return pkey_test_init(t, name, 0, EVP_PKEY_decrypt_init,
+ EVP_PKEY_decrypt);
+}
+
+static const struct evp_test_method pdecrypt_test_method = {
+ "Decrypt",
+ decrypt_test_init,
+ pkey_test_cleanup,
+ pkey_test_parse,
+ pkey_test_run
+};
+
+static int verify_test_init(struct evp_test *t, const char *name)
+{
+ return pkey_test_init(t, name, 1, EVP_PKEY_verify_init, 0);
+}
+
+static int verify_test_run(struct evp_test *t)
+{
+ struct pkey_data *kdata = t->data;
+ if (EVP_PKEY_verify(kdata->ctx, kdata->output, kdata->output_len,
+ kdata->input, kdata->input_len) <= 0)
+ t->err = "VERIFY_ERROR";
+ return 1;
+}
+
+static const struct evp_test_method pverify_test_method = {
+ "Verify",
+ verify_test_init,
+ pkey_test_cleanup,
+ pkey_test_parse,
+ verify_test_run
+};
projects / openssl.git / blobdiff