path: root/test/algorithmid_test.c

/*
 * Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/asn1.h>
#include <openssl/pem.h>
#include "internal/sizes.h"
#include "crypto/evp.h"
#include "testutil.h"

/* Collected arguments */
static const char *eecert_filename = NULL;  /* For test_x509_file() */
static const char *cacert_filename = NULL;  /* For test_x509_file() */
static const char *pubkey_filename = NULL;  /* For test_spki_file() */

#define ALGORITHMID_NAME "algorithm-id"

static int test_spki_aid(X509_PUBKEY *pubkey, const char *filename)
{
    const ASN1_OBJECT *oid;
    X509_ALGOR *alg = NULL;
    EVP_PKEY *pkey = NULL;
    EVP_KEYMGMT *keymgmt = NULL;
    void *keydata = NULL;
    char name[OSSL_MAX_NAME_SIZE] = "";
    unsigned char *algid_legacy = NULL;
    int algid_legacy_len = 0;
    static unsigned char algid_prov[OSSL_MAX_ALGORITHM_ID_SIZE];
    size_t algid_prov_len = 0;
    const OSSL_PARAM *gettable_params = NULL;
    OSSL_PARAM params[] = {
        OSSL_PARAM_octet_string(ALGORITHMID_NAME,
                                &algid_prov, sizeof(algid_prov)),
        OSSL_PARAM_END
    };
    int ret = 0;

    if (!TEST_true(X509_PUBKEY_get0_param(NULL, NULL, NULL, &alg, pubkey))
        || !TEST_ptr(pkey = X509_PUBKEY_get0(pubkey)))
        goto end;

    if (!TEST_int_ge(algid_legacy_len = i2d_X509_ALGOR(alg, &algid_legacy), 0))
        goto end;

    X509_ALGOR_get0(&oid, NULL, NULL, alg);
    if (!TEST_int_gt(OBJ_obj2txt(name, sizeof(name), oid, 0), 0))
        goto end;

    /*
     * We use an internal functions to ensure we have a provided key.
     * Note that |keydata| should not be freed, as it's cached in |pkey|.
     * The |keymgmt|, however, should, as its reference count is incremented
     * in this function.
     */
    if ((keydata = evp_pkey_export_to_provider(pkey, NULL,
                                               &keymgmt, NULL)) == NULL) {
        TEST_info("The public key found in '%s' doesn't have provider support."
                  "  Skipping...",
                  filename);
        ret = 1;
        goto end;
    }

    if (!TEST_true(EVP_KEYMGMT_is_a(keymgmt, name))) {
        TEST_info("The AlgorithmID key type (%s) for the public key found in"
                  " '%s' doesn't match the key type of the extracted public"
                  " key.",
                  name, filename);
        ret = 1;
        goto end;
    }

    if (!TEST_ptr(gettable_params = EVP_KEYMGMT_gettable_params(keymgmt))
        || !TEST_ptr(OSSL_PARAM_locate_const(gettable_params, ALGORITHMID_NAME))) {
        TEST_info("The %s provider keymgmt appears to lack support for algorithm-id."
                  "  Skipping...",
                  name);
        ret = 1;
        goto end;
    }

    algid_prov[0] = '\0';
    if (!TEST_true(evp_keymgmt_get_params(keymgmt, keydata, params)))
        goto end;
    algid_prov_len = params[0].return_size;

    /* We now have all the algorithm IDs we need, let's compare them */
    if (TEST_mem_eq(algid_legacy, algid_legacy_len,
                    algid_prov, algid_prov_len))
        ret = 1;

 end:
    EVP_KEYMGMT_free(keymgmt);
    OPENSSL_free(algid_legacy);
    return ret;
}

static int test_x509_spki_aid(X509 *cert, const char *filename)
{
    X509_PUBKEY *pubkey = X509_get_X509_PUBKEY(cert);

    return test_spki_aid(pubkey, filename);
}

static int test_x509_sig_aid(X509 *eecert, const char *ee_filename,
                             X509 *cacert, const char *ca_filename)
{
    const ASN1_OBJECT *sig_oid = NULL;
    const X509_ALGOR *alg = NULL;
    int sig_nid = NID_undef, dig_nid = NID_undef, pkey_nid = NID_undef;
    EVP_MD_CTX *mdctx = NULL;
    EVP_PKEY_CTX *pctx = NULL;
    EVP_PKEY *pkey = NULL;
    unsigned char *algid_legacy = NULL;
    int algid_legacy_len = 0;
    static unsigned char algid_prov[OSSL_MAX_ALGORITHM_ID_SIZE];
    size_t algid_prov_len = 0;
    const OSSL_PARAM *gettable_params = NULL;
    OSSL_PARAM params[] = {
        OSSL_PARAM_octet_string("algorithm-id",
                                &algid_prov, sizeof(algid_prov)),
        OSSL_PARAM_END
    };
    int ret = 0;

    X509_get0_signature(NULL, &alg, eecert);
    X509_ALGOR_get0(&sig_oid, NULL, NULL, alg);
    if (!TEST_int_eq(X509_ALGOR_cmp(alg, X509_get0_tbs_sigalg(eecert)), 0))
        goto end;
    if (!TEST_int_ne(sig_nid = OBJ_obj2nid(sig_oid), NID_undef)
        || !TEST_true(OBJ_find_sigid_algs(sig_nid, &dig_nid, &pkey_nid))
        || !TEST_ptr(pkey = X509_get0_pubkey(cacert)))
        goto end;

    if (!TEST_true(EVP_PKEY_is_a(pkey, OBJ_nid2sn(pkey_nid)))) {
        TEST_info("The '%s' pubkey can't be used to verify the '%s' signature",
                  ca_filename, ee_filename);
        TEST_info("Signature algorithm is %s (pkey type %s, hash type %s)",
                  OBJ_nid2sn(sig_nid), OBJ_nid2sn(pkey_nid), OBJ_nid2sn(dig_nid));
        TEST_info("Pkey key type is %s", EVP_PKEY_get0_type_name(pkey));
        goto end;
    }

    if (!TEST_int_ge(algid_legacy_len = i2d_X509_ALGOR(alg, &algid_legacy), 0))
        goto end;

    if (!TEST_ptr(mdctx = EVP_MD_CTX_new())
        || !TEST_true(EVP_DigestVerifyInit_ex(mdctx, &pctx,
                                              OBJ_nid2sn(dig_nid),
                                              NULL, NULL, pkey, NULL))) {
        TEST_info("Couldn't initialize a DigestVerify operation with "
                  "pkey type %s and hash type %s",
                  OBJ_nid2sn(pkey_nid), OBJ_nid2sn(dig_nid));
        goto end;
    }

    if (!TEST_ptr(gettable_params = EVP_PKEY_CTX_gettable_params(pctx))
        || !TEST_ptr(OSSL_PARAM_locate_const(gettable_params, ALGORITHMID_NAME))) {
        TEST_info("The %s provider keymgmt appears to lack support for algorithm-id"
                  "  Skipping...",
                  OBJ_nid2sn(pkey_nid));
        ret = 1;
        goto end;
    }

    algid_prov[0] = '\0';
    if (!TEST_true(EVP_PKEY_CTX_get_params(pctx, params)))
        goto end;
    algid_prov_len = params[0].return_size;

    /* We now have all the algorithm IDs we need, let's compare them */
    if (TEST_mem_eq(algid_legacy, algid_legacy_len,
                    algid_prov, algid_prov_len))
        ret = 1;

 end:
    EVP_MD_CTX_free(mdctx);
    /* pctx is free by EVP_MD_CTX_free() */
    OPENSSL_free(algid_legacy);
    return ret;
}

static int test_spki_file(void)
{
    X509_PUBKEY *pubkey = NULL;
    BIO *b = BIO_new_file(pubkey_filename, "r");
    int ret = 0;

    if (b == NULL) {
        TEST_error("Couldn't open '%s' for reading\n", pubkey_filename);
        TEST_openssl_errors();
        goto end;
    }

    if ((pubkey = PEM_read_bio_X509_PUBKEY(b, NULL, NULL, NULL)) == NULL) {
        TEST_error("'%s' doesn't appear to be a SubjectPublicKeyInfo in PEM format\n",
                   pubkey_filename);
        TEST_openssl_errors();
        goto end;
    }

    ret = test_spki_aid(pubkey, pubkey_filename);
 end:
    BIO_free(b);
    X509_PUBKEY_free(pubkey);
    return ret;
}

static int test_x509_files(void)
{
    X509 *eecert = NULL, *cacert = NULL;
    BIO *bee = NULL, *bca = NULL;
    int ret = 0;

    if ((bee = BIO_new_file(eecert_filename, "r")) == NULL) {
        TEST_error("Couldn't open '%s' for reading\n", eecert_filename);
        TEST_openssl_errors();
        goto end;
    }
    if ((bca = BIO_new_file(cacert_filename, "r")) == NULL) {
        TEST_error("Couldn't open '%s' for reading\n", cacert_filename);
        TEST_openssl_e