From d47114df83e88f1b5ae65747001fc13d5dae525b Mon Sep 17 00:00:00 2001 From: Brett Grandbois Date: Tue, 15 May 2018 10:55:52 +1000 Subject: [PATCH] test/lib: Add OpenSSL verify and decrypt tests Signed-off-by: Brett Grandbois Signed-off-by: Samuel Mendoza-Jonas --- test/lib/Makefile.am | 7 ++ test/lib/data/security/cert.p12 | Bin 0 -> 2469 bytes test/lib/data/security/cert.pem | 21 ++++ test/lib/data/security/key.pem | 28 +++++ test/lib/data/security/pubkey.pem | 9 ++ test/lib/data/security/rootdata.cmsenc | 17 +++ test/lib/data/security/rootdata.cmsencver | 41 +++++++ test/lib/data/security/rootdata.cmsver | 31 ++++++ test/lib/data/security/rootdata.txt | 2 + test/lib/data/security/rootdata_different.txt | 2 + test/lib/data/security/rootdatasha256.sig | Bin 0 -> 256 bytes test/lib/data/security/rootdatasha512.sig | Bin 0 -> 256 bytes test/lib/data/security/wrong_cert.pem | 21 ++++ test/lib/data/security/wrong_key.pem | 28 +++++ test/lib/test-security-openssl-decrypt.c | 82 ++++++++++++++ test/lib/test-security-openssl-verify.c | 103 ++++++++++++++++++ 16 files changed, 392 insertions(+) create mode 100644 test/lib/data/security/cert.p12 create mode 100644 test/lib/data/security/cert.pem create mode 100644 test/lib/data/security/key.pem create mode 100644 test/lib/data/security/pubkey.pem create mode 100644 test/lib/data/security/rootdata.cmsenc create mode 100644 test/lib/data/security/rootdata.cmsencver create mode 100644 test/lib/data/security/rootdata.cmsver create mode 100644 test/lib/data/security/rootdata.txt create mode 100644 test/lib/data/security/rootdata_different.txt create mode 100644 test/lib/data/security/rootdatasha256.sig create mode 100644 test/lib/data/security/rootdatasha512.sig create mode 100644 test/lib/data/security/wrong_cert.pem create mode 100644 test/lib/data/security/wrong_key.pem create mode 100644 test/lib/test-security-openssl-decrypt.c create mode 100644 test/lib/test-security-openssl-verify.c diff --git a/test/lib/Makefile.am b/test/lib/Makefile.am index 9636b08..047fcb2 100644 --- a/test/lib/Makefile.am +++ b/test/lib/Makefile.am @@ -25,7 +25,14 @@ lib_TESTS = \ test/lib/test-process-stdout-eintr \ test/lib/test-fold +if WITH_OPENSSL +lib_TESTS += \ + test/lib/test-security-openssl-verify \ + test/lib/test-security-openssl-decrypt +endif + $(lib_TESTS): LIBS += $(core_lib) +$(lib_TESTS): AM_CPPFLAGS += -DTEST_LIB_DATA_BASE='"$(abs_top_srcdir)/test/lib/data"' check_PROGRAMS += $(lib_TESTS) TESTS += $(lib_TESTS) diff --git a/test/lib/data/security/cert.p12 b/test/lib/data/security/cert.p12 new file mode 100644 index 0000000000000000000000000000000000000000..f5ab0739240e9dc45b14b956514c3210dd390b0e GIT binary patch literal 2469 zcmV;W30n3rf(fAl0Ru3C31@y={IM282wLQS$dW66 zKI=2N$mWvjs|PQpVhgX)Cltcjbs5;8;vcRwA>G62F5=hVJb%mWFMp!;F_>e60AGn9 zQspL>k46~KFomMqSKhE*uy$L$`+q12O zk5a>?r_Zf?lcD8vFzPE?LrNMagqo|kSv2HiyrBtQqs>Wz>n}AeSL`EAWB-m4ijD$^ zFhEioyh8($?+>;rYlp;6yo-YsDZ!t!5sdp$@fDykR`hnahjDG+7Fe-GUI1LpGk_y- z{oI)xLrvW~@0a^!527XQ=&BRXpFw zN8bR?^1^Zc+A!doY;45x&0ZTbYhE#HYMZsPO=S?mpU<#+>7opnS-zmK0kuv9jI^M- z`f9$Oe)M=AF;nbANIjPsqOFL9YZ7qO=Xy{_$SuiqCTcwJxe18NeMd^$a+*%*=X6K4zUT0rLrgJevVhko}U|oSxMq z%vK&52dchC=<3W=tK7=Mx0jm5qWM2rfd7%tbvgz05$2dnenEKyL~L(%;`}#qaNaG` z`Bc(mw!eEbk1V2b*QSF<^22sEBCTrKPWoa>2JKpc4JbvqoE=5(e^}g_r}0pJoLtlb z%?AeR2diQ6QrxHjC92ZzT;^vV5g0+{zMl$n-+%?qAE<9Mby7Ot)by&pC*j7h*2P{y zDx9vDWUnk`m^gj=d-!4)P)+z$H==+=ze~$)?xtUz^fM;)B8u)0xWBMt76)Gr-0F6n)FvLluvGsJ z=@h3~kb2Z8yW7>H@+TfUPrtOeYt9Nx9iS)w@~PDTuJmNVFoFd^1_>&LNQU-W38DVG>j zad2j=44TIccmm}qTggWo0IcTmX;goS|N6c6x9k~eRA#MqWb4$UJIZt>5MJVRYw(V47SM6M;ryaP8&GvR_c(?1!;$R>JW@J17 zHG+w`?KdWRyxba}v;VL$X{cC8p1{~ng(FIL7&_Ehw`XjKN)Lhsf>2PY60G70$0e{g zo7rcUscQSGgpt@g_!TqLYik1%kstPfr%LKj(+!LL3VYRacZtsxD=lGd1#y1KfJh+iE`> zc>*prk_997>RYOo`b1ubH?L4!hvwZHt(TN4gpH1=&a5m>vWfv?2xh;j$l^K8!)bd2 zMHb2Jrl5v==Gvf(3_2jFffbt4sKMrW#36!gMuZu7*t9R2*LB-*G6cnWf(Pr^jkj z?#D+sO(MpKDoH!c@|E+VUZu}DRe~0AA?NfFfsAKB6h1NLQxVPb_ez0IA)0LA6#eDj z3#V#H#sPC@4koMfb0GKu=)_0h@USWmT$edh{mYfv_@3q^_9{?h!H z#f%?#$5)c!c`#~wkBHW_7QPoVyBCJw%4blOwDJw}4qCLo62yoZ6!Kf2yka@W_i=XQ zdktru;H~pEU76cHD*e$B)fl*(p@xbEFfBt6!vBRVkxdyreCIiR3^L8m1qfeR-hZC3SzD$sQAZllTPqn9nAMH-dzglwGjvCP$=Qzi`%08Kj# z``~lGME9?Djw8v3J-#h!`6?m1zTL!>wlY@6*qgE9olU4wEmZ2#Pf&$wz&}`>0QRao zazL_;`N`#hx4JwWQ%bI-442}!uSNDLCK?Ng4L3E}*kjnFac=IFT*Mkn&r$dd>o;Oy zxLU00B!9hcO9fln-)K8k^i*7!?$3p8B+MC@9#wa)8RoI3S<&_Yv~IU3y)n{lUU0TQ z;{|480^Z!tQC*7Q=ooSQUS!RfE!U29@l!d{h9Qvi5CdD|(|n=qFzleUnG8V;a`d>+ z2JRy|L)W`7z)#S(@duzwu7MA37-pIzqI?c1>Wyr$1qYc6wrj~Z-D|cu;iuyZ4{^g% zDFeda;Pzp(PS$EBsXDDl?!UJX+5e2C=lFA+vhk1WXG0c_n0I|$8Mp2A#KL!2Hk!{| zAoW#Ez8fuL;{|t@0$nWa#bFL*m=l~sTA^;FBme?2h{*-xi`GL_ATifXUexm&S#OYf zHk4~4xHNRCZRf0hGcd0ND{NlPd@C=s4+&*<;vPv|sr}G@QMz|C8CKm_k`SV!>5t|C zx3D$p6hv09qabd0R-~E)FzVbhl&DlB7Cfev&Q>irNxY%8fK~$RIDl6e`cZ-fB?H?b z^wi3gN^YL_QlRQ5(d_V8EX(X*ARh&Rkl|progJpO>m-f`0u_`nX(}0NK-!#CGb>}KPOCnsI;8l!jk^DlssX~@JCx!sb_ldPG=Tb$GyW}h=yfax5!3~rZgG7@Nzi7NkbS^y90?I0ltEMNCf#(D*`D$vrOW`&$(^h&9Y@u zLQiE6^cZbB#Wng~y$OXAPZ^|=^vS{y_<5;#{c!o`r3JfpxU~F!56?N6Hm|Y#PfS+i zeAEt_FG7$Rx=;k}AiEiZ;|Y6X$6KW14*P)TOtg$#{I4X5I^>VHT>VF|{GfU5Kiv`i zMNM|JWjEsE;d;WUDjr99&sQOmY_3xdECGDYoW_XQc@&}l0b4st Gg+}v?p@ZH4 literal 0 HcmV?d00001 diff --git a/test/lib/data/security/wrong_cert.pem b/test/lib/data/security/wrong_cert.pem new file mode 100644 index 0000000..f33a586 --- /dev/null +++ b/test/lib/data/security/wrong_cert.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDXzCCAkegAwIBAgIJAODEiSno23BvMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV +BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX +aWRnaXRzIFB0eSBMdGQwIBcNMTgwNDI2MjM0ODIwWhgPMjExODA0MDIyMzQ4MjBa +MEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJ +bnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw +ggEKAoIBAQDRZOnMMFLyDGePJlUFMhywLTbhen8Rc2JQC2v26QPGAa7n8QH/YsGy +WPmJcZEBDv022qnluk3ciskyzgC6COKEiSiDSHA96KY6jir3FN0dimPdMkNMKC/+ +RWchOckKWh4/OsS3hFZzoWQTy9El2U78KfWUaDLNpl+KcGRWl++iHIIJZ/6SDur+ +WjLuzxXnvOA6naReVnJnAtXkp8Wd6Nc9gqLw8qT9pKdDb0IEQPYz7Dq2LQSjN0ys +U0gbv3UN2Q9wyxK3rIPVFhFWELX0rJ51Js7TkSWZXWw7nSGIGrctR7W3sl3XFc4t +0HZao63X6ik8Md7+z9iONNq1xLwtuXWPAgMBAAGjUDBOMB0GA1UdDgQWBBSMwUJt +EbdE7xr2KlW9cXfVOTfIADAfBgNVHSMEGDAWgBSMwUJtEbdE7xr2KlW9cXfVOTfI +ADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBPHj82Tu8eeVmGUY+F +2dYZ67+T/7tdMsmNx1li4tSp0Al074+Yo1qRfWl9BVb/k2q70BUmsdLm0ZT7Ua0t +xluPc51DPW78KdLa1N+QOaYkyBA1Cc14W0nc1cE8FHe79O48lmw2Z1jWzEdZVL+Y +4XUl6bKm2I/H7bADyMT7nlpkmkDZ2jHWZNf8FGbI2LZK/E7ndXSnmLWn/OQd6H/5 +yJ8SpwtayBi3vg+o3rGULQ5OvnMUxVEz8n+Psl5I3OHRy5048ThP6cjz79HbUtQA +5Q13ja4bDiQ1CVAAS+tYddERBvK3ApmD+QYtPIHERQsJK42bCQicbayahyxei+4/ +hYU4 +-----END CERTIFICATE----- diff --git a/test/lib/data/security/wrong_key.pem b/test/lib/data/security/wrong_key.pem new file mode 100644 index 0000000..d8bc6c7 --- /dev/null +++ b/test/lib/data/security/wrong_key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDRZOnMMFLyDGeP +JlUFMhywLTbhen8Rc2JQC2v26QPGAa7n8QH/YsGyWPmJcZEBDv022qnluk3cisky +zgC6COKEiSiDSHA96KY6jir3FN0dimPdMkNMKC/+RWchOckKWh4/OsS3hFZzoWQT +y9El2U78KfWUaDLNpl+KcGRWl++iHIIJZ/6SDur+WjLuzxXnvOA6naReVnJnAtXk +p8Wd6Nc9gqLw8qT9pKdDb0IEQPYz7Dq2LQSjN0ysU0gbv3UN2Q9wyxK3rIPVFhFW +ELX0rJ51Js7TkSWZXWw7nSGIGrctR7W3sl3XFc4t0HZao63X6ik8Md7+z9iONNq1 +xLwtuXWPAgMBAAECggEAWHfDU9LC6KMXCeMPHr/aYRDpVAB2OUA/tEPvHIW8Y2cI +p9QqnOTzo092Nny13/WeRBPEnlvFU72LXhytL+xbD9YHONhdG7r0qF6yhmvZNAbp +RGZdCoscI9jcxqvsZaRHjT1eKY8PG5F/f+Gn/s6+UUnFCSuw8zQsv4fWzMMqqpmO +jB+2y8jva7uwavKKlblcWHapgO2pgVOsaqkIWBRRKOwH55bjze7SglKblnmt5LMN +NH0wSTAVQS3cte4UPhAYkQy5xYiVo/0MjzBWlpgmWK/oHd1ZWkRFDEDArKgE3Io9 +3UwOUu94GlxZs6r9F6R0Rl9lsc+AOArGMaXIG7t/QQKBgQD6+mrgBgYHqbLKmRcO +z4ParRS6DU50nWl8N6gSOk8um7NCV2wyTg7OZkEdq8lsjHQgklrDyuCBpPNz1feI +EqbhFw1B2t1EEr+IfnU/HZ5j4iTB9uQx/gaMHxdwWBYKnkqDwnzZhgIbyf4NSn/P +kSb+ihqKnsSiG0n5TQS4+cmR7wKBgQDVlX2WQ1SIfwjV9BO1/X6Oi7j+EZ1NjuW6 +6tjvIfzaHK6AdEIep5whSHSMMzbTIANcBMojRjpsdCNMsqF4zOQkjuQ0fXwTEfHw +GoJPI+qPXd8amAEtMQ5XWK9TVQytCL4jAxZc5M3iIrEsDS80nWD9My42Mh6N2e50 +01ea0zt2YQKBgQCOQMW2+HMOgNcAEkmJcYFQvu2Sjtw7KMWTTJCM1FPxHPs7zQVc +dfXacwbRZH8kcW+Yzpt3glRB51a9/zbv/3Jq/n/bJcxoOyAoo1SdU5JlFtaywdeR +pmPbo/vLB4JmvlWJ3QCa4mPrkE/ZBLLw2Vr6xxhIHbliEImbLlZQ6fOgLQKBgQCl +W4aOtnQU9V0u4Df+d1LrI4vG0HZb3J1JuJbZlRPA/eGwO9IRD60WK5VoEiKJFEjl +jiO9aZrD6qqFr+rJrr+W+jX92YUc8pDAVpW6ldD8zC111mdayJcU0ulyd+9Ha/Rh +APvoUZCAWmGW/GImtw2nGl/Vv7neEvLF6fXyPUXVIQKBgQDGxr/VNXQIarrwt1fk +dzqs1JzaRkAwlJ3PYGKW1fqUwxl3BGtkFcK71XFXmN78snwoHNZxEPM/khtoKCZ0 +Oj0pEvUO6+BYlXkgWM7RZAgJxds87q4/9y8qNYEBeaB0p6zqMY652Tr6j9hNFk/o ++G6xXoQYGyrAzQB5EJgSNAWDQg== +-----END PRIVATE KEY----- diff --git a/test/lib/test-security-openssl-decrypt.c b/test/lib/test-security-openssl-decrypt.c new file mode 100644 index 0000000..07faf26 --- /dev/null +++ b/test/lib/test-security-openssl-decrypt.c @@ -0,0 +1,82 @@ +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include + +#define SECURITY_TEST_DATA_DIR TEST_LIB_DATA_BASE "/security/" + +int main(void) +{ + char *verify_data = NULL; + char *compare_data = NULL; + char *filename = NULL; + FILE *keyfile = NULL; + int ret = EXIT_FAILURE; + int verify_len; + int compare_len; + + pb_log_init(stdout); + + keyfile = fopen(SECURITY_TEST_DATA_DIR "cert.p12", "r"); + if (!keyfile) + return EXIT_FAILURE; + + if (read_file(NULL, SECURITY_TEST_DATA_DIR "rootdata.txt", &verify_data, &verify_len)) + goto out; + + /* first basic CMS decrypt case */ + + /* + * these calls overwrite so need a temp file + * copy_file_secure_dest is having some permission issues + */ + if (copy_file_secure_dest(NULL, + SECURITY_TEST_DATA_DIR "rootdata.cmsencver", + &filename)) + goto out; + + if (decrypt_file(filename, keyfile, NULL)) + goto out; + + if (read_file(verify_data, filename, &compare_data, &compare_len)) + goto out; + + if (verify_len != compare_len) + goto out; + + if (memcmp(verify_data, compare_data, verify_len)) + goto out; + + /* check an encrypted but unverified message fails */ + unlink(filename); + talloc_free(filename); + + if (copy_file_secure_dest(NULL, + SECURITY_TEST_DATA_DIR "rootdata.cmsenc", + &filename)) + goto out; + + + if (!decrypt_file(filename, keyfile, NULL)) + goto out; + + /* got here, all fine */ + ret = EXIT_SUCCESS; + +out: + if (keyfile) + fclose(keyfile); + if (filename) { + unlink(filename); + talloc_free(filename); + } + talloc_free(verify_data); + return ret; +} diff --git a/test/lib/test-security-openssl-verify.c b/test/lib/test-security-openssl-verify.c new file mode 100644 index 0000000..4cbf160 --- /dev/null +++ b/test/lib/test-security-openssl-verify.c @@ -0,0 +1,103 @@ +#include +#include +#include +#include +#include + +#include +#include + +#define SECURITY_TEST_DATA_DIR TEST_LIB_DATA_BASE "/security/" +#define SECURITY_TEST_DATA_CERT SECURITY_TEST_DATA_DIR "/cert.pem" + +int main(void) +{ + FILE *keyfile; + + pb_log_init(stdout); + + /* start with basic pubkey extraction */ + keyfile = fopen(SECURITY_TEST_DATA_DIR "cert.pem", "r"); + if (!keyfile) + return EXIT_FAILURE; + + /* first basic verify case */ + /* assuming the default sha256 mode */ + + if (verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdatasha256.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + /* now check different file */ + + if (!verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata_different.txt", + SECURITY_TEST_DATA_DIR "rootdatasha256.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + /* now check different signature */ + + if (!verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdatasha512.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + /* check CMS verify */ + if (verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdata.cmsver", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + fclose(keyfile); + + /* now check basic pubkey fallback */ + keyfile = fopen(SECURITY_TEST_DATA_DIR "pubkey.pem", "r"); + if (!keyfile) + return EXIT_FAILURE; + + if (verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdatasha256.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + fclose(keyfile); + + /* finally check different key */ + keyfile = fopen(SECURITY_TEST_DATA_DIR "wrong_cert.pem", "r"); + if (!keyfile) + return EXIT_FAILURE; + + if (!verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdatasha256.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + + fclose(keyfile); + return EXIT_SUCCESS; +} -- 2.39.2