evp_libctx_test.c 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766
  1. /*
  2. * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * These tests are setup to load null into the default library context.
  11. * Any tests are expected to use the created 'libctx' to find algorithms.
  12. * The framework runs the tests twice using the 'default' provider or
  13. * 'fips' provider as inputs.
  14. */
  15. /*
  16. * DSA/DH low level APIs are deprecated for public use, but still ok for
  17. * internal use.
  18. */
  19. #include "internal/deprecated.h"
  20. #include <assert.h>
  21. #include <openssl/evp.h>
  22. #include <openssl/provider.h>
  23. #include <openssl/dsa.h>
  24. #include <openssl/dh.h>
  25. #include <openssl/safestack.h>
  26. #include <openssl/core_dispatch.h>
  27. #include <openssl/core_names.h>
  28. #include <openssl/x509.h>
  29. #include <openssl/encoder.h>
  30. #include "testutil.h"
  31. #include "internal/nelem.h"
  32. #include "crypto/bn_dh.h" /* _bignum_ffdhe2048_p */
  33. static OSSL_LIB_CTX *libctx = NULL;
  34. static OSSL_PROVIDER *nullprov = NULL;
  35. static OSSL_PROVIDER *libprov = NULL;
  36. static STACK_OF(OPENSSL_STRING) *cipher_names = NULL;
  37. typedef enum OPTION_choice {
  38. OPT_ERR = -1,
  39. OPT_EOF = 0,
  40. OPT_CONFIG_FILE,
  41. OPT_PROVIDER_NAME,
  42. OPT_TEST_ENUM
  43. } OPTION_CHOICE;
  44. const OPTIONS *test_get_options(void)
  45. {
  46. static const OPTIONS test_options[] = {
  47. OPT_TEST_OPTIONS_DEFAULT_USAGE,
  48. { "config", OPT_CONFIG_FILE, '<',
  49. "The configuration file to use for the libctx" },
  50. { "provider", OPT_PROVIDER_NAME, 's',
  51. "The provider to load (The default value is 'default')" },
  52. { NULL }
  53. };
  54. return test_options;
  55. }
  56. #ifndef OPENSSL_NO_DH
  57. static const char *getname(int id)
  58. {
  59. const char *name[] = {"p", "q", "g" };
  60. if (id >= 0 && id < 3)
  61. return name[id];
  62. return "?";
  63. }
  64. #endif
  65. /*
  66. * We're using some DH specific values in this test, so we skip compilation if
  67. * we're in a no-dh build.
  68. */
  69. #if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DH)
  70. static int test_dsa_param_keygen(int tstid)
  71. {
  72. int ret = 0;
  73. int expected;
  74. EVP_PKEY_CTX *gen_ctx = NULL;
  75. EVP_PKEY *pkey_parm = NULL;
  76. EVP_PKEY *pkey = NULL, *dup_pk = NULL;
  77. DSA *dsa = NULL;
  78. int pind, qind, gind;
  79. BIGNUM *p = NULL, *q = NULL, *g = NULL;
  80. /*
  81. * Just grab some fixed dh p, q, g values for testing,
  82. * these 'safe primes' should not be used normally for dsa *.
  83. */
  84. static const BIGNUM *bn[] = {
  85. &ossl_bignum_dh2048_256_p, &ossl_bignum_dh2048_256_q,
  86. &ossl_bignum_dh2048_256_g
  87. };
  88. /*
  89. * These tests are using bad values for p, q, g by reusing the values.
  90. * A value of 0 uses p, 1 uses q and 2 uses g.
  91. * There are 27 different combinations, with only the 1 valid combination.
  92. */
  93. pind = tstid / 9;
  94. qind = (tstid / 3) % 3;
  95. gind = tstid % 3;
  96. expected = (pind == 0 && qind == 1 && gind == 2);
  97. TEST_note("Testing with (p, q, g) = (%s, %s, %s)\n", getname(pind),
  98. getname(qind), getname(gind));
  99. if (!TEST_ptr(pkey_parm = EVP_PKEY_new())
  100. || !TEST_ptr(dsa = DSA_new())
  101. || !TEST_ptr(p = BN_dup(bn[pind]))
  102. || !TEST_ptr(q = BN_dup(bn[qind]))
  103. || !TEST_ptr(g = BN_dup(bn[gind]))
  104. || !TEST_true(DSA_set0_pqg(dsa, p, q, g)))
  105. goto err;
  106. p = q = g = NULL;
  107. if (!TEST_true(EVP_PKEY_assign_DSA(pkey_parm, dsa)))
  108. goto err;
  109. dsa = NULL;
  110. if (!TEST_ptr(gen_ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey_parm, NULL))
  111. || !TEST_int_gt(EVP_PKEY_keygen_init(gen_ctx), 0)
  112. || !TEST_int_eq(EVP_PKEY_keygen(gen_ctx, &pkey), expected))
  113. goto err;
  114. if (expected) {
  115. if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pkey))
  116. || !TEST_int_eq(EVP_PKEY_eq(pkey, dup_pk), 1))
  117. goto err;
  118. }
  119. ret = 1;
  120. err:
  121. EVP_PKEY_free(pkey);
  122. EVP_PKEY_free(dup_pk);
  123. EVP_PKEY_CTX_free(gen_ctx);
  124. EVP_PKEY_free(pkey_parm);
  125. DSA_free(dsa);
  126. BN_free(g);
  127. BN_free(q);
  128. BN_free(p);
  129. return ret;
  130. }
  131. #endif /* OPENSSL_NO_DSA */
  132. #ifndef OPENSSL_NO_DH
  133. static int do_dh_param_keygen(int tstid, const BIGNUM **bn)
  134. {
  135. int ret = 0;
  136. int expected;
  137. EVP_PKEY_CTX *gen_ctx = NULL;
  138. EVP_PKEY *pkey_parm = NULL;
  139. EVP_PKEY *pkey = NULL, *dup_pk = NULL;
  140. DH *dh = NULL;
  141. int pind, qind, gind;
  142. BIGNUM *p = NULL, *q = NULL, *g = NULL;
  143. /*
  144. * These tests are using bad values for p, q, g by reusing the values.
  145. * A value of 0 uses p, 1 uses q and 2 uses g.
  146. * There are 27 different combinations, with only the 1 valid combination.
  147. */
  148. pind = tstid / 9;
  149. qind = (tstid / 3) % 3;
  150. gind = tstid % 3;
  151. expected = (pind == 0 && qind == 1 && gind == 2);
  152. TEST_note("Testing with (p, q, g) = (%s, %s, %s)", getname(pind),
  153. getname(qind), getname(gind));
  154. if (!TEST_ptr(pkey_parm = EVP_PKEY_new())
  155. || !TEST_ptr(dh = DH_new())
  156. || !TEST_ptr(p = BN_dup(bn[pind]))
  157. || !TEST_ptr(q = BN_dup(bn[qind]))
  158. || !TEST_ptr(g = BN_dup(bn[gind]))
  159. || !TEST_true(DH_set0_pqg(dh, p, q, g)))
  160. goto err;
  161. p = q = g = NULL;
  162. if (!TEST_true(EVP_PKEY_assign_DH(pkey_parm, dh)))
  163. goto err;
  164. dh = NULL;
  165. if (!TEST_ptr(gen_ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey_parm, NULL))
  166. || !TEST_int_gt(EVP_PKEY_keygen_init(gen_ctx), 0)
  167. || !TEST_int_eq(EVP_PKEY_keygen(gen_ctx, &pkey), expected))
  168. goto err;
  169. if (expected) {
  170. if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pkey))
  171. || !TEST_int_eq(EVP_PKEY_eq(pkey, dup_pk), 1))
  172. goto err;
  173. }
  174. ret = 1;
  175. err:
  176. EVP_PKEY_free(pkey);
  177. EVP_PKEY_free(dup_pk);
  178. EVP_PKEY_CTX_free(gen_ctx);
  179. EVP_PKEY_free(pkey_parm);
  180. DH_free(dh);
  181. BN_free(g);
  182. BN_free(q);
  183. BN_free(p);
  184. return ret;
  185. }
  186. /*
  187. * Note that we get the fips186-4 path being run for most of these cases since
  188. * the internal code will detect that the p, q, g does not match a safe prime
  189. * group (Except for when tstid = 5, which sets the correct p, q, g)
  190. */
  191. static int test_dh_safeprime_param_keygen(int tstid)
  192. {
  193. static const BIGNUM *bn[] = {
  194. &ossl_bignum_ffdhe2048_p, &ossl_bignum_ffdhe2048_q,
  195. &ossl_bignum_const_2
  196. };
  197. return do_dh_param_keygen(tstid, bn);
  198. }
  199. static int dhx_cert_load(void)
  200. {
  201. int ret = 0;
  202. X509 *cert = NULL;
  203. BIO *bio = NULL;
  204. static const unsigned char dhx_cert[] = {
  205. 0x30,0x82,0x03,0xff,0x30,0x82,0x02,0xe7,0xa0,0x03,0x02,0x01,0x02,0x02,0x09,0x00,
  206. 0xdb,0xf5,0x4d,0x22,0xa0,0x7a,0x67,0xa6,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,
  207. 0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x30,0x44,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,
  208. 0x04,0x06,0x13,0x02,0x55,0x4b,0x31,0x16,0x30,0x14,0x06,0x03,0x55,0x04,0x0a,0x0c,
  209. 0x0d,0x4f,0x70,0x65,0x6e,0x53,0x53,0x4c,0x20,0x47,0x72,0x6f,0x75,0x70,0x31,0x1d,
  210. 0x30,0x1b,0x06,0x03,0x55,0x04,0x03,0x0c,0x14,0x54,0x65,0x73,0x74,0x20,0x53,0x2f,
  211. 0x4d,0x49,0x4d,0x45,0x20,0x52,0x53,0x41,0x20,0x52,0x6f,0x6f,0x74,0x30,0x1e,0x17,
  212. 0x0d,0x31,0x33,0x30,0x38,0x30,0x32,0x31,0x34,0x34,0x39,0x32,0x39,0x5a,0x17,0x0d,
  213. 0x32,0x33,0x30,0x36,0x31,0x31,0x31,0x34,0x34,0x39,0x32,0x39,0x5a,0x30,0x44,0x31,
  214. 0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x4b,0x31,0x16,0x30,0x14,
  215. 0x06,0x03,0x55,0x04,0x0a,0x0c,0x0d,0x4f,0x70,0x65,0x6e,0x53,0x53,0x4c,0x20,0x47,
  216. 0x72,0x6f,0x75,0x70,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,0x04,0x03,0x0c,0x14,0x54,
  217. 0x65,0x73,0x74,0x20,0x53,0x2f,0x4d,0x49,0x4d,0x45,0x20,0x45,0x45,0x20,0x44,0x48,
  218. 0x20,0x23,0x31,0x30,0x82,0x01,0xb6,0x30,0x82,0x01,0x2b,0x06,0x07,0x2a,0x86,0x48,
  219. 0xce,0x3e,0x02,0x01,0x30,0x82,0x01,0x1e,0x02,0x81,0x81,0x00,0xd4,0x0c,0x4a,0x0c,
  220. 0x04,0x72,0x71,0x19,0xdf,0x59,0x19,0xc5,0xaf,0x44,0x7f,0xca,0x8e,0x2b,0xf0,0x09,
  221. 0xf5,0xd3,0x25,0xb1,0x73,0x16,0x55,0x89,0xdf,0xfd,0x07,0xaf,0x19,0xd3,0x7f,0xd0,
  222. 0x07,0xa2,0xfe,0x3f,0x5a,0xf1,0x01,0xc6,0xf8,0x2b,0xef,0x4e,0x6d,0x03,0x38,0x42,
  223. 0xa1,0x37,0xd4,0x14,0xb4,0x00,0x4a,0xb1,0x86,0x5a,0x83,0xce,0xb9,0x08,0x0e,0xc1,
  224. 0x99,0x27,0x47,0x8d,0x0b,0x85,0xa8,0x82,0xed,0xcc,0x0d,0xb9,0xb0,0x32,0x7e,0xdf,
  225. 0xe8,0xe4,0xf6,0xf6,0xec,0xb3,0xee,0x7a,0x11,0x34,0x65,0x97,0xfc,0x1a,0xb0,0x95,
  226. 0x4b,0x19,0xb9,0xa6,0x1c,0xd9,0x01,0x32,0xf7,0x35,0x7c,0x2d,0x5d,0xfe,0xc1,0x85,
  227. 0x70,0x49,0xf8,0xcc,0x99,0xd0,0xbe,0xf1,0x5a,0x78,0xc8,0x03,0x02,0x81,0x80,0x69,
  228. 0x00,0xfd,0x66,0xf2,0xfc,0x15,0x8b,0x09,0xb8,0xdc,0x4d,0xea,0xaa,0x79,0x55,0xf9,
  229. 0xdf,0x46,0xa6,0x2f,0xca,0x2d,0x8f,0x59,0x2a,0xad,0x44,0xa3,0xc6,0x18,0x2f,0x95,
  230. 0xb6,0x16,0x20,0xe3,0xd3,0xd1,0x8f,0x03,0xce,0x71,0x7c,0xef,0x3a,0xc7,0x44,0x39,
  231. 0x0e,0xe2,0x1f,0xd8,0xd3,0x89,0x2b,0xe7,0x51,0xdc,0x12,0x48,0x4c,0x18,0x4d,0x99,
  232. 0x12,0x06,0xe4,0x17,0x02,0x03,0x8c,0x24,0x05,0x8e,0xa6,0x85,0xf2,0x69,0x1b,0xe1,
  233. 0x6a,0xdc,0xe2,0x04,0x3a,0x01,0x9d,0x64,0xbe,0xfe,0x45,0xf9,0x44,0x18,0x71,0xbd,
  234. 0x2d,0x3e,0x7a,0x6f,0x72,0x7d,0x1a,0x80,0x42,0x57,0xae,0x18,0x6f,0x91,0xd6,0x61,
  235. 0x03,0x8a,0x1c,0x89,0x73,0xc7,0x56,0x41,0x03,0xd3,0xf8,0xed,0x65,0xe2,0x85,0x02,
  236. 0x15,0x00,0x89,0x94,0xab,0x10,0x67,0x45,0x41,0xad,0x63,0xc6,0x71,0x40,0x8d,0x6b,
  237. 0x9e,0x19,0x5b,0xa4,0xc7,0xf5,0x03,0x81,0x84,0x00,0x02,0x81,0x80,0x2f,0x5b,0xde,
  238. 0x72,0x02,0x36,0x6b,0x00,0x5e,0x24,0x7f,0x14,0x2c,0x18,0x52,0x42,0x97,0x4b,0xdb,
  239. 0x6e,0x15,0x50,0x3c,0x45,0x3e,0x25,0xf3,0xb7,0xc5,0x6e,0xe5,0x52,0xe7,0xc4,0xfb,
  240. 0xf4,0xa5,0xf0,0x39,0x12,0x7f,0xbc,0x54,0x1c,0x93,0xb9,0x5e,0xee,0xe9,0x14,0xb0,
  241. 0xdf,0xfe,0xfc,0x36,0xe4,0xf2,0xaf,0xfb,0x13,0xc8,0xdf,0x18,0x94,0x1d,0x40,0xb9,
  242. 0x71,0xdd,0x4c,0x9c,0xa7,0x03,0x52,0x02,0xb5,0xed,0x71,0x80,0x3e,0x23,0xda,0x28,
  243. 0xe5,0xab,0xe7,0x6f,0xf2,0x0a,0x0e,0x00,0x5b,0x7d,0xc6,0x4b,0xd7,0xc7,0xb2,0xc3,
  244. 0xba,0x62,0x7f,0x70,0x28,0xa0,0x9d,0x71,0x13,0x70,0xd1,0x9f,0x32,0x2f,0x3e,0xd2,
  245. 0xcd,0x1b,0xa4,0xc6,0x72,0xa0,0x74,0x5d,0x71,0xef,0x03,0x43,0x6e,0xa3,0x60,0x30,
  246. 0x5e,0x30,0x0c,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x02,0x30,0x00,0x30,
  247. 0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,0xff,0x04,0x04,0x03,0x02,0x05,0xe0,0x30,
  248. 0x1d,0x06,0x03,0x55,0x1d,0x0e,0x04,0x16,0x04,0x14,0x0b,0x5a,0x4d,0x5f,0x7d,0x25,
  249. 0xc7,0xf2,0x9d,0xc1,0xaa,0xb7,0x63,0x82,0x2f,0xfa,0x8f,0x32,0xe7,0xc0,0x30,0x1f,
  250. 0x06,0x03,0x55,0x1d,0x23,0x04,0x18,0x30,0x16,0x80,0x14,0xdf,0x7e,0x5e,0x88,0x05,
  251. 0x24,0x33,0x08,0xdd,0x22,0x81,0x02,0x97,0xcc,0x9a,0xb7,0xb1,0x33,0x27,0x30,0x30,
  252. 0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x82,
  253. 0x01,0x01,0x00,0x5a,0xf2,0x63,0xef,0xd3,0x16,0xd7,0xf5,0xaa,0xdd,0x12,0x00,0x36,
  254. 0x00,0x21,0xa2,0x7b,0x08,0xd6,0x3b,0x9f,0x62,0xac,0x53,0x1f,0xed,0x4c,0xd1,0x15,
  255. 0x34,0x65,0x71,0xee,0x96,0x07,0xa6,0xef,0xb2,0xde,0xd8,0xbb,0x35,0x6e,0x2c,0xe2,
  256. 0xd1,0x26,0xef,0x7e,0x94,0xe2,0x88,0x51,0xa4,0x6c,0xaa,0x27,0x2a,0xd3,0xb6,0xc2,
  257. 0xf7,0xea,0xc3,0x0b,0xa9,0xb5,0x28,0x37,0xa2,0x63,0x08,0xe4,0x88,0xc0,0x1b,0x16,
  258. 0x1b,0xca,0xfd,0x8a,0x07,0x32,0x29,0xa7,0x53,0xb5,0x2d,0x30,0xe4,0xf5,0x16,0xc3,
  259. 0xe3,0xc2,0x4c,0x30,0x5d,0x35,0x80,0x1c,0xa2,0xdb,0xe3,0x4b,0x51,0x0d,0x4c,0x60,
  260. 0x5f,0xb9,0x46,0xac,0xa8,0x46,0xa7,0x32,0xa7,0x9c,0x76,0xf8,0xe9,0xb5,0x19,0xe2,
  261. 0x0c,0xe1,0x0f,0xc6,0x46,0xe2,0x38,0xa7,0x87,0x72,0x6d,0x6c,0xbc,0x88,0x2f,0x9d,
  262. 0x2d,0xe5,0xd0,0x7d,0x1e,0xc7,0x5d,0xf8,0x7e,0xb4,0x0b,0xa6,0xf9,0x6c,0xe3,0x7c,
  263. 0xb2,0x70,0x6e,0x75,0x9b,0x1e,0x63,0xe1,0x4d,0xb2,0x81,0xd3,0x55,0x38,0x94,0x1a,
  264. 0x7a,0xfa,0xbf,0x01,0x18,0x70,0x2d,0x35,0xd3,0xe3,0x10,0x7a,0x9a,0xa7,0x8f,0xf3,
  265. 0xbd,0x56,0x55,0x5e,0xd8,0xbd,0x4e,0x16,0x76,0xd0,0x48,0x4c,0xf9,0x51,0x54,0xdf,
  266. 0x2d,0xb0,0xc9,0xaa,0x5e,0x42,0x38,0x50,0xbf,0x0f,0xc0,0xd9,0x84,0x44,0x4b,0x42,
  267. 0x24,0xec,0x14,0xa3,0xde,0x11,0xdf,0x58,0x7f,0xc2,0x4d,0xb2,0xd5,0x42,0x78,0x6e,
  268. 0x52,0x3e,0xad,0xc3,0x5f,0x04,0xc4,0xe6,0x31,0xaa,0x81,0x06,0x8b,0x13,0x4b,0x3c,
  269. 0x0e,0x6a,0xb1
  270. };
  271. if (!TEST_ptr(bio = BIO_new_mem_buf(dhx_cert, sizeof(dhx_cert)))
  272. || !TEST_ptr(cert = X509_new_ex(libctx, NULL))
  273. || !TEST_ptr(d2i_X509_bio(bio, &cert)))
  274. goto err;
  275. ret = 1;
  276. err:
  277. X509_free(cert);
  278. BIO_free(bio);
  279. return ret;
  280. }
  281. #endif /* OPENSSL_NO_DH */
  282. static int test_cipher_reinit(int test_id)
  283. {
  284. int ret = 0, diff, ccm, siv, no_null_key;
  285. int out1_len = 0, out2_len = 0, out3_len = 0;
  286. EVP_CIPHER *cipher = NULL;
  287. EVP_CIPHER_CTX *ctx = NULL;
  288. unsigned char out1[256];
  289. unsigned char out2[256];
  290. unsigned char out3[256];
  291. unsigned char in[16] = {
  292. 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
  293. 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10
  294. };
  295. unsigned char key[64] = {
  296. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  297. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  298. 0x01, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  299. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  300. 0x02, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  301. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  302. 0x03, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  303. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  304. };
  305. unsigned char iv[16] = {
  306. 0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
  307. 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00
  308. };
  309. const char *name = sk_OPENSSL_STRING_value(cipher_names, test_id);
  310. if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()))
  311. goto err;
  312. TEST_note("Fetching %s\n", name);
  313. if (!TEST_ptr(cipher = EVP_CIPHER_fetch(libctx, name, NULL)))
  314. goto err;
  315. /* ccm fails on the second update - this matches OpenSSL 1_1_1 behaviour */
  316. ccm = (EVP_CIPHER_get_mode(cipher) == EVP_CIPH_CCM_MODE);
  317. /* siv cannot be called with NULL key as the iv is irrelevant */
  318. siv = (EVP_CIPHER_get_mode(cipher) == EVP_CIPH_SIV_MODE);
  319. /*
  320. * Skip init call with a null key for RC4 as the stream cipher does not
  321. * handle reinit (1.1.1 behaviour).
  322. */
  323. no_null_key = EVP_CIPHER_is_a(cipher, "RC4")
  324. || EVP_CIPHER_is_a(cipher, "RC4-40")
  325. || EVP_CIPHER_is_a(cipher, "RC4-HMAC-MD5");
  326. /* DES3-WRAP uses random every update - so it will give a different value */
  327. diff = EVP_CIPHER_is_a(cipher, "DES3-WRAP");
  328. if (!TEST_true(EVP_EncryptInit_ex(ctx, cipher, NULL, key, iv))
  329. || !TEST_true(EVP_EncryptUpdate(ctx, out1, &out1_len, in, sizeof(in)))
  330. || !TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv))
  331. || !TEST_int_eq(EVP_EncryptUpdate(ctx, out2, &out2_len, in, sizeof(in)),
  332. ccm ? 0 : 1)
  333. || (!no_null_key
  334. && (!TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, iv))
  335. || !TEST_int_eq(EVP_EncryptUpdate(ctx, out3, &out3_len, in, sizeof(in)),
  336. ccm || siv ? 0 : 1))))
  337. goto err;
  338. if (ccm == 0) {
  339. if (diff) {
  340. if (!TEST_mem_ne(out1, out1_len, out2, out2_len)
  341. || !TEST_mem_ne(out1, out1_len, out3, out3_len)
  342. || !TEST_mem_ne(out2, out2_len, out3, out3_len))
  343. goto err;
  344. } else {
  345. if (!TEST_mem_eq(out1, out1_len, out2, out2_len)
  346. || (!siv && !no_null_key && !TEST_mem_eq(out1, out1_len, out3, out3_len)))
  347. goto err;
  348. }
  349. }
  350. ret = 1;
  351. err:
  352. EVP_CIPHER_free(cipher);
  353. EVP_CIPHER_CTX_free(ctx);
  354. return ret;
  355. }
  356. /*
  357. * This test only uses a partial block (half the block size) of input for each
  358. * EVP_EncryptUpdate() in order to test that the second init/update is not using
  359. * a leftover buffer from the first init/update.
  360. * Note: some ciphers don't need a full block to produce output.
  361. */
  362. static int test_cipher_reinit_partialupdate(int test_id)
  363. {
  364. int ret = 0, in_len;
  365. int out1_len = 0, out2_len = 0, out3_len = 0;
  366. EVP_CIPHER *cipher = NULL;
  367. EVP_CIPHER_CTX *ctx = NULL;
  368. unsigned char out1[256];
  369. unsigned char out2[256];
  370. unsigned char out3[256];
  371. static const unsigned char in[32] = {
  372. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  373. 0xba, 0xbe, 0xba, 0xbe, 0x00, 0x00, 0xba, 0xbe,
  374. 0x01, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  375. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  376. };
  377. static const unsigned char key[64] = {
  378. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  379. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  380. 0x01, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  381. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  382. 0x02, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  383. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  384. 0x03, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  385. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  386. };
  387. static const unsigned char iv[16] = {
  388. 0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
  389. 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00
  390. };
  391. const char *name = sk_OPENSSL_STRING_value(cipher_names, test_id);
  392. if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()))
  393. goto err;
  394. TEST_note("Fetching %s\n", name);
  395. if (!TEST_ptr(cipher = EVP_CIPHER_fetch(libctx, name, NULL)))
  396. goto err;
  397. in_len = EVP_CIPHER_get_block_size(cipher) / 2;
  398. /* skip any ciphers that don't allow partial updates */
  399. if (((EVP_CIPHER_get_flags(cipher)
  400. & (EVP_CIPH_FLAG_CTS | EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) != 0)
  401. || EVP_CIPHER_get_mode(cipher) == EVP_CIPH_CCM_MODE
  402. || EVP_CIPHER_get_mode(cipher) == EVP_CIPH_XTS_MODE
  403. || EVP_CIPHER_get_mode(cipher) == EVP_CIPH_WRAP_MODE) {
  404. ret = 1;
  405. goto err;
  406. }
  407. if (!TEST_true(EVP_EncryptInit_ex(ctx, cipher, NULL, key, iv))
  408. || !TEST_true(EVP_EncryptUpdate(ctx, out1, &out1_len, in, in_len))
  409. || !TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv))
  410. || !TEST_true(EVP_EncryptUpdate(ctx, out2, &out2_len, in, in_len)))
  411. goto err;
  412. if (!TEST_mem_eq(out1, out1_len, out2, out2_len))
  413. goto err;
  414. if (EVP_CIPHER_get_mode(cipher) != EVP_CIPH_SIV_MODE) {
  415. if (!TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, iv))
  416. || !TEST_true(EVP_EncryptUpdate(ctx, out3, &out3_len, in, in_len)))
  417. goto err;
  418. if (!TEST_mem_eq(out1, out1_len, out3, out3_len))
  419. goto err;
  420. }
  421. ret = 1;
  422. err:
  423. EVP_CIPHER_free(cipher);
  424. EVP_CIPHER_CTX_free(ctx);
  425. return ret;
  426. }
  427. static int name_cmp(const char * const *a, const char * const *b)
  428. {
  429. return OPENSSL_strcasecmp(*a, *b);
  430. }
  431. static void collect_cipher_names(EVP_CIPHER *cipher, void *cipher_names_list)
  432. {
  433. STACK_OF(OPENSSL_STRING) *names = cipher_names_list;
  434. const char *name = EVP_CIPHER_get0_name(cipher);
  435. char *namedup = NULL;
  436. assert(name != NULL);
  437. /* the cipher will be freed after returning, strdup is needed */
  438. if ((namedup = OPENSSL_strdup(name)) != NULL
  439. && !sk_OPENSSL_STRING_push(names, namedup))
  440. OPENSSL_free(namedup);
  441. }
  442. static int rsa_keygen(int bits, EVP_PKEY **pub, EVP_PKEY **priv)
  443. {
  444. int ret = 0;
  445. unsigned char *pub_der = NULL;
  446. const unsigned char *pp = NULL;
  447. size_t len = 0;
  448. OSSL_ENCODER_CTX *ectx = NULL;
  449. if (!TEST_ptr(*priv = EVP_PKEY_Q_keygen(libctx, NULL, "RSA", bits))
  450. || !TEST_ptr(ectx =
  451. OSSL_ENCODER_CTX_new_for_pkey(*priv,
  452. EVP_PKEY_PUBLIC_KEY,
  453. "DER", "type-specific",
  454. NULL))
  455. || !TEST_true(OSSL_ENCODER_to_data(ectx, &pub_der, &len)))
  456. goto err;
  457. pp = pub_der;
  458. if (!TEST_ptr(d2i_PublicKey(EVP_PKEY_RSA, pub, &pp, len)))
  459. goto err;
  460. ret = 1;
  461. err:
  462. OSSL_ENCODER_CTX_free(ectx);
  463. OPENSSL_free(pub_der);
  464. return ret;
  465. }
  466. static int kem_rsa_gen_recover(void)
  467. {
  468. int ret = 0;
  469. EVP_PKEY *pub = NULL;
  470. EVP_PKEY *priv = NULL;
  471. EVP_PKEY_CTX *sctx = NULL, *rctx = NULL, *dctx = NULL;
  472. unsigned char secret[256] = { 0, };
  473. unsigned char ct[256] = { 0, };
  474. unsigned char unwrap[256] = { 0, };
  475. size_t ctlen = 0, unwraplen = 0, secretlen = 0;
  476. int bits = 2048;
  477. ret = TEST_true(rsa_keygen(bits, &pub, &priv))
  478. && TEST_ptr(sctx = EVP_PKEY_CTX_new_from_pkey(libctx, pub, NULL))
  479. && TEST_int_eq(EVP_PKEY_encapsulate_init(sctx, NULL), 1)
  480. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(sctx, "RSASVE"), 1)
  481. && TEST_ptr(dctx = EVP_PKEY_CTX_dup(sctx))
  482. && TEST_int_eq(EVP_PKEY_encapsulate(dctx, NULL, &ctlen, NULL,
  483. &secretlen), 1)
  484. && TEST_int_eq(ctlen, secretlen)
  485. && TEST_int_eq(ctlen, bits / 8)
  486. && TEST_int_eq(EVP_PKEY_encapsulate(dctx, ct, &ctlen, secret,
  487. &secretlen), 1)
  488. && TEST_ptr(rctx = EVP_PKEY_CTX_new_from_pkey(libctx, priv, NULL))
  489. && TEST_int_eq(EVP_PKEY_decapsulate_init(rctx, NULL), 1)
  490. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(rctx, "RSASVE"), 1)
  491. && TEST_int_eq(EVP_PKEY_decapsulate(rctx, NULL, &unwraplen,
  492. ct, ctlen), 1)
  493. && TEST_int_eq(EVP_PKEY_decapsulate(rctx, unwrap, &unwraplen,
  494. ct, ctlen), 1)
  495. && TEST_mem_eq(unwrap, unwraplen, secret, secretlen);
  496. EVP_PKEY_free(pub);
  497. EVP_PKEY_free(priv);
  498. EVP_PKEY_CTX_free(rctx);
  499. EVP_PKEY_CTX_free(dctx);
  500. EVP_PKEY_CTX_free(sctx);
  501. return ret;
  502. }
  503. #ifndef OPENSSL_NO_DES
  504. /*
  505. * This test makes sure that EVP_CIPHER_CTX_rand_key() works correctly
  506. * For fips mode this code would produce an error if the flag is not set.
  507. */
  508. static int test_cipher_tdes_randkey(void)
  509. {
  510. int ret;
  511. EVP_CIPHER_CTX *ctx = NULL;
  512. EVP_CIPHER *tdes_cipher = NULL, *aes_cipher = NULL;
  513. unsigned char key[24] = { 0 };
  514. ret = TEST_ptr(aes_cipher = EVP_CIPHER_fetch(libctx, "AES-256-CBC", NULL))
  515. && TEST_int_eq(EVP_CIPHER_get_flags(aes_cipher) & EVP_CIPH_RAND_KEY, 0)
  516. && TEST_ptr(tdes_cipher = EVP_CIPHER_fetch(libctx, "DES-EDE3-CBC", NULL))
  517. && TEST_int_ne(EVP_CIPHER_get_flags(tdes_cipher) & EVP_CIPH_RAND_KEY, 0)
  518. && TEST_ptr(ctx = EVP_CIPHER_CTX_new())
  519. && TEST_true(EVP_CipherInit_ex(ctx, tdes_cipher, NULL, NULL, NULL, 1))
  520. && TEST_int_gt(EVP_CIPHER_CTX_rand_key(ctx, key), 0);
  521. EVP_CIPHER_CTX_free(ctx);
  522. EVP_CIPHER_free(tdes_cipher);
  523. EVP_CIPHER_free(aes_cipher);
  524. return ret;
  525. }
  526. #endif /* OPENSSL_NO_DES */
  527. static int kem_rsa_params(void)
  528. {
  529. int ret = 0;
  530. EVP_PKEY *pub = NULL;
  531. EVP_PKEY *priv = NULL;
  532. EVP_PKEY_CTX *pubctx = NULL, *privctx = NULL;
  533. unsigned char secret[256] = { 0, };
  534. unsigned char ct[256] = { 0, };
  535. size_t ctlen = 0, secretlen = 0;
  536. ret = TEST_true(rsa_keygen(2048, &pub, &priv))
  537. && TEST_ptr(pubctx = EVP_PKEY_CTX_new_from_pkey(libctx, pub, NULL))
  538. && TEST_ptr(privctx = EVP_PKEY_CTX_new_from_pkey(libctx, priv, NULL))
  539. /* Test setting kem op before the init fails */
  540. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), -2)
  541. /* Test NULL ctx passed */
  542. && TEST_int_eq(EVP_PKEY_encapsulate_init(NULL, NULL), 0)
  543. && TEST_int_eq(EVP_PKEY_encapsulate(NULL, NULL, NULL, NULL, NULL), 0)
  544. && TEST_int_eq(EVP_PKEY_decapsulate_init(NULL, NULL), 0)
  545. && TEST_int_eq(EVP_PKEY_decapsulate(NULL, NULL, NULL, NULL, 0), 0)
  546. /* Test Invalid operation */
  547. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, NULL), -1)
  548. && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, NULL, NULL, 0), 0)
  549. /* Wrong key component - no secret should be returned on failure */
  550. && TEST_int_eq(EVP_PKEY_decapsulate_init(pubctx, NULL), 1)
  551. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), 1)
  552. && TEST_int_eq(EVP_PKEY_decapsulate(pubctx, secret, &secretlen, ct,
  553. sizeof(ct)), 0)
  554. && TEST_uchar_eq(secret[0], 0)
  555. /* Test encapsulate fails if the mode is not set */
  556. && TEST_int_eq(EVP_PKEY_encapsulate_init(pubctx, NULL), 1)
  557. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, secret, &secretlen), -2)
  558. /* Test setting a bad kem ops fail */
  559. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSA"), 0)
  560. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, NULL), 0)
  561. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(NULL, "RSASVE"), 0)
  562. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(NULL, NULL), 0)
  563. /* Test secretlen is optional */
  564. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), 1)
  565. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, secret, NULL), 1)
  566. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, NULL), 1)
  567. /* Test outlen is optional */
  568. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, &secretlen), 1)
  569. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, NULL, secret, &secretlen), 1)
  570. /* test that either len must be set if out is NULL */
  571. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, NULL), 0)
  572. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, NULL), 1)
  573. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, &secretlen), 1)
  574. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, &secretlen), 1)
  575. /* Secret buffer should be set if there is an output buffer */
  576. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, NULL, NULL), 0)
  577. /* Test that lengths are optional if ct is not NULL */
  578. && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, NULL, secret, NULL), 1)
  579. /* Pass if secret or secret length are not NULL */
  580. && TEST_int_eq(EVP_PKEY_decapsulate_init(privctx, NULL), 1)
  581. && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(privctx, "RSASVE"), 1)
  582. && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, NULL, ct, sizeof(ct)), 1)
  583. && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, &secretlen, ct, sizeof(ct)), 1)
  584. && TEST_int_eq(secretlen, 256)
  585. /* Fail if passed NULL arguments */
  586. && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, NULL, ct, sizeof(ct)), 0)
  587. && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, NULL, 0), 0)
  588. && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, NULL, sizeof(ct)), 0)
  589. && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, ct, 0), 0);
  590. EVP_PKEY_free(pub);
  591. EVP_PKEY_free(priv);
  592. EVP_PKEY_CTX_free(pubctx);
  593. EVP_PKEY_CTX_free(privctx);
  594. return ret;
  595. }
  596. #ifndef OPENSSL_NO_DH
  597. static EVP_PKEY *gen_dh_key(void)
  598. {
  599. EVP_PKEY_CTX *gctx = NULL;
  600. EVP_PKEY *pkey = NULL;
  601. OSSL_PARAM params[2];
  602. params[0] = OSSL_PARAM_construct_utf8_string("group", "ffdhe2048", 0);
  603. params[1] = OSSL_PARAM_construct_end();
  604. if (!TEST_ptr(gctx = EVP_PKEY_CTX_new_from_name(libctx, "DH", NULL))
  605. || !TEST_int_gt(EVP_PKEY_keygen_init(gctx), 0)
  606. || !TEST_true(EVP_PKEY_CTX_set_params(gctx, params))
  607. || !TEST_true(EVP_PKEY_keygen(gctx, &pkey)))
  608. goto err;
  609. err:
  610. EVP_PKEY_CTX_free(gctx);
  611. return pkey;
  612. }
  613. /* Fail if we try to use a dh key */
  614. static int kem_invalid_keytype(void)
  615. {
  616. int ret = 0;
  617. EVP_PKEY *key = NULL;
  618. EVP_PKEY_CTX *sctx = NULL;
  619. if (!TEST_ptr(key = gen_dh_key()))
  620. goto done;
  621. if (!TEST_ptr(sctx = EVP_PKEY_CTX_new_from_pkey(libctx, key, NULL)))
  622. goto done;
  623. if (!TEST_int_eq(EVP_PKEY_encapsulate_init(sctx, NULL), -2))
  624. goto done;
  625. ret = 1;
  626. done:
  627. EVP_PKEY_free(key);
  628. EVP_PKEY_CTX_free(sctx);
  629. return ret;
  630. }
  631. #endif /* OPENSSL_NO_DH */
  632. int setup_tests(void)
  633. {
  634. const char *prov_name = "default";
  635. char *config_file = NULL;
  636. OPTION_CHOICE o;
  637. while ((o = opt_next()) != OPT_EOF) {
  638. switch (o) {
  639. case OPT_PROVIDER_NAME:
  640. prov_name = opt_arg();
  641. break;
  642. case OPT_CONFIG_FILE:
  643. config_file = opt_arg();
  644. break;
  645. case OPT_TEST_CASES:
  646. break;
  647. default:
  648. case OPT_ERR:
  649. return 0;
  650. }
  651. }
  652. if (!test_get_libctx(&libctx, &nullprov, config_file, &libprov, prov_name))
  653. return 0;
  654. #if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DH)
  655. ADD_ALL_TESTS(test_dsa_param_keygen, 3 * 3 * 3);
  656. #endif
  657. #ifndef OPENSSL_NO_DH
  658. ADD_ALL_TESTS(test_dh_safeprime_param_keygen, 3 * 3 * 3);
  659. ADD_TEST(dhx_cert_load);
  660. #endif
  661. if (!TEST_ptr(cipher_names = sk_OPENSSL_STRING_new(name_cmp)))
  662. return 0;
  663. EVP_CIPHER_do_all_provided(libctx, collect_cipher_names, cipher_names);
  664. ADD_ALL_TESTS(test_cipher_reinit, sk_OPENSSL_STRING_num(cipher_names));
  665. ADD_ALL_TESTS(test_cipher_reinit_partialupdate,
  666. sk_OPENSSL_STRING_num(cipher_names));
  667. ADD_TEST(kem_rsa_gen_recover);
  668. ADD_TEST(kem_rsa_params);
  669. #ifndef OPENSSL_NO_DH
  670. ADD_TEST(kem_invalid_keytype);
  671. #endif
  672. #ifndef OPENSSL_NO_DES
  673. ADD_TEST(test_cipher_tdes_randkey);
  674. #endif
  675. return 1;
  676. }
  677. /* Because OPENSSL_free is a macro, it can't be passed as a function pointer */
  678. static void string_free(char *m)
  679. {
  680. OPENSSL_free(m);
  681. }
  682. void cleanup_tests(void)
  683. {
  684. sk_OPENSSL_STRING_pop_free(cipher_names, string_free);
  685. OSSL_PROVIDER_unload(libprov);
  686. OSSL_LIB_CTX_free(libctx);
  687. OSSL_PROVIDER_unload(nullprov);
  688. }