tests/x509sign-verify.c

   1 /*
   2  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software
   3  * Foundation, Inc.
   4  *
   5  * Author: Nikos Mavrogiannopoulos, Simon Josefsson
   6  *
   7  * This file is part of GnuTLS.
   8  *
   9  * GnuTLS is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 3 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * GnuTLS is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with GnuTLS; if not, write to the Free Software Foundation,
  21  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  22  */
  23
  24 /* Parts copied from GnuTLS example programs. */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include <config.h>
  28 #endif
  29
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <string.h>
  33 #include <sys/types.h>
  34 #include <netinet/in.h>
  35 #include <sys/socket.h>
  36 #include <arpa/inet.h>
  37 #include <unistd.h>
  38 #include <gnutls/gnutls.h>
  39 #include <gnutls/x509.h>
  40 #include <gnutls/abstract.h>
  41
  42 #include "utils.h"
  43
  44 /* sha1 hash of "hello" string */
  45 const gnutls_datum_t hash_data = {
  46   (void *)
  47     "\xaa\xf4\xc6\x1d\xdc\xc5\xe8\xa2\xda\xbe"
  48     "\xde\x0f\x3b\x48\x2c\xd9\xae\xa9\x43\x4d",
  49   20
  50 };
  51
  52 const gnutls_datum_t invalid_hash_data = {
  53   (void *)
  54     "\xaa\xf4\xc6\x1d\xdc\xca\xe8\xa2\xda\xbe"
  55     "\xde\x0f\x3b\x48\x2c\xb9\xae\xa9\x43\x4d",
  56   20
  57 };
  58
  59 const gnutls_datum_t raw_data = {
  60   (void *) "hello",
  61   5
  62 };
  63
  64 static char pem1_cert[] =
  65   "-----BEGIN CERTIFICATE-----\n"
  66   "MIICHjCCAYmgAwIBAgIERiYdNzALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
  67   "VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTI3WhcNMDgwNDE3MTMyOTI3WjAdMRsw\n"
  68   "GQYDVQQDExJHbnVUTFMgdGVzdCBjbGllbnQwgZwwCwYJKoZIhvcNAQEBA4GMADCB\n"
  69   "iAKBgLtmQ/Xyxde2jMzF3/WIO7HJS2oOoa0gUEAIgKFPXKPQ+GzP5jz37AR2ExeL\n"
  70   "ZIkiW8DdU3w77XwEu4C5KL6Om8aOoKUSy/VXHqLnu7czSZ/ju0quak1o/8kR4jKN\n"
  71   "zj2AC41179gAgY8oBAOgIo1hBAf6tjd9IQdJ0glhaZiQo1ipAgMBAAGjdjB0MAwG\n"
  72   "A1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDwYDVR0PAQH/BAUDAweg\n"
  73   "ADAdBgNVHQ4EFgQUTLkKm/odNON+3svSBxX+odrLaJEwHwYDVR0jBBgwFoAU6Twc\n"
  74   "+62SbuYGpFYsouHAUyfI8pUwCwYJKoZIhvcNAQEFA4GBALujmBJVZnvaTXr9cFRJ\n"
  75   "jpfc/3X7sLUsMvumcDE01ls/cG5mIatmiyEU9qI3jbgUf82z23ON/acwJf875D3/\n"
  76   "U7jyOsBJ44SEQITbin2yUeJMIm1tievvdNXBDfW95AM507ShzP12sfiJkJfjjdhy\n"
  77   "dc8Siq5JojruiMizAf0pA7in\n" "-----END CERTIFICATE-----\n";
  78
  79 static char pem1_key[] =
  80   "-----BEGIN RSA PRIVATE KEY-----\n"
  81   "MIICXAIBAAKBgQC7ZkP18sXXtozMxd/1iDuxyUtqDqGtIFBACIChT1yj0Phsz+Y8\n"
  82   "9+wEdhMXi2SJIlvA3VN8O+18BLuAuSi+jpvGjqClEsv1Vx6i57u3M0mf47tKrmpN\n"
  83   "aP/JEeIyjc49gAuNde/YAIGPKAQDoCKNYQQH+rY3fSEHSdIJYWmYkKNYqQIDAQAB\n"
  84   "AoGADpmARG5CQxS+AesNkGmpauepiCz1JBF/JwnyiX6vEzUh0Ypd39SZztwrDxvF\n"
  85   "PJjQaKVljml1zkJpIDVsqvHdyVdse8M+Qn6hw4x2p5rogdvhhIL1mdWo7jWeVJTF\n"
  86   "RKB7zLdMPs3ySdtcIQaF9nUAQ2KJEvldkO3m/bRJFEp54k0CQQDYy+RlTmwRD6hy\n"
  87   "7UtMjR0H3CSZJeQ8svMCxHLmOluG9H1UKk55ZBYfRTsXniqUkJBZ5wuV1L+pR9EK\n"
  88   "ca89a+1VAkEA3UmBelwEv2u9cAU1QjKjmwju1JgXbrjEohK+3B5y0ESEXPAwNQT9\n"
  89   "TrDM1m9AyxYTWLxX93dI5QwNFJtmbtjeBQJARSCWXhsoaDRG8QZrCSjBxfzTCqZD\n"
  90   "ZXtl807ymCipgJm60LiAt0JLr4LiucAsMZz6+j+quQbSakbFCACB8SLV1QJBAKZQ\n"
  91   "YKf+EPNtnmta/rRKKvySsi3GQZZN+Dt3q0r094XgeTsAqrqujVNfPhTMeP4qEVBX\n"
  92   "/iVX2cmMTSh3w3z8MaECQEp0XJWDVKOwcTW6Ajp9SowtmiZ3YDYo1LF9igb4iaLv\n"
  93   "sWZGfbnU3ryjvkb6YuFjgtzbZDZHWQCo8/cOtOBmPdk=\n"
  94   "-----END RSA PRIVATE KEY-----\n";
  95
  96 static char pem2_cert[] =
  97   "-----BEGIN CERTIFICATE-----\n"
  98   "MIIDbzCCAtqgAwIBAgIERiYdRTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
  99   "VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTQxWhcNMDgwNDE3MTMyOTQxWjA3MRsw\n"
 100   "GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
 101   "Lm9yZzCCAbQwggEpBgcqhkjOOAQBMIIBHAKBgLmE9VqBvhoNxYpzjwybL5u2DkvD\n"
 102   "dBp/ZK2d8yjFoEe8m1dW8ZfVfjcD6fJM9OOLfzCjXS+7oaI3wuo1jx+xX6aiXwHx\n"
 103   "IzYr5E8vLd2d1TqmOa96UXzSJY6XdM8exXtLdkOBBx8GFLhuWBLhkOI3b9Ib7GjF\n"
 104   "WOLmMOBqXixjeOwHAhSfVoxIZC/+jap6bZbbBF0W7wilcQKBgGIGfuRcdgi3Rhpd\n"
 105   "15fUKiH7HzHJ0vT6Odgn0Zv8J12nCqca/FPBL0PCN8iFfz1Mq12BMvsdXh5UERYg\n"
 106   "xoBa2YybQ/Dda6D0w/KKnDnSHHsP7/ook4/SoSLr3OCKi60oDs/vCYXpNr2LelDV\n"
 107   "e/clDWxgEcTvcJDP1hvru47GPjqXA4GEAAKBgA+Kh1fy0cLcrN9Liw+Luin34QPk\n"
 108   "VfqymAfW/RKxgLz1urRQ1H+gDkPnn8l4EV/l5Awsa2qkNdy9VOVgNpox0YpZbmsc\n"
 109   "ur0uuut8h+/ayN2h66SD5out+vqOW9c3yDI+lsI+9EPafZECD7e8+O+P90EAXpbf\n"
 110   "DwiW3Oqy6QaCr9Ivo4GTMIGQMAwGA1UdEwEB/wQCMAAwGgYDVR0RBBMwEYIPdGVz\n"
 111   "dC5nbnV0bHMub3JnMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdDwEB/wQFAwMH\n"
 112   "gAAwHQYDVR0OBBYEFL/su87Y6HtwVuzz0SuS1tSZClvzMB8GA1UdIwQYMBaAFOk8\n"
 113   "HPutkm7mBqRWLKLhwFMnyPKVMAsGCSqGSIb3DQEBBQOBgQBCsrnfD1xzh8/Eih1f\n"
 114   "x+M0lPoX1Re5L2ElHI6DJpHYOBPwf9glwxnet2+avzgUQDUFwUSxOhodpyeaACXD\n"
 115   "o0gGVpcH8sOBTQ+aTdM37hGkPxoXjtIkR/LgG5nP2H2JRd5TkW8l13JdM4MJFB4W\n"
 116   "QcDzQ8REwidsfh9uKAluk1c/KQ==\n" "-----END CERTIFICATE-----\n";
 117
 118 static char pem2_key[] =
 119   "-----BEGIN DSA PRIVATE KEY-----\n"
 120   "MIIBugIBAAKBgQC5hPVagb4aDcWKc48Mmy+btg5Lw3Qaf2StnfMoxaBHvJtXVvGX\n"
 121   "1X43A+nyTPTji38wo10vu6GiN8LqNY8fsV+mol8B8SM2K+RPLy3dndU6pjmvelF8\n"
 122   "0iWOl3TPHsV7S3ZDgQcfBhS4blgS4ZDiN2/SG+xoxVji5jDgal4sY3jsBwIVAJ9W\n"
 123   "jEhkL/6NqnptltsEXRbvCKVxAoGAYgZ+5Fx2CLdGGl3Xl9QqIfsfMcnS9Po52CfR\n"
 124   "m/wnXacKpxr8U8EvQ8I3yIV/PUyrXYEy+x1eHlQRFiDGgFrZjJtD8N1roPTD8oqc\n"
 125   "OdIcew/v+iiTj9KhIuvc4IqLrSgOz+8Jhek2vYt6UNV79yUNbGARxO9wkM/WG+u7\n"
 126   "jsY+OpcCgYAPiodX8tHC3KzfS4sPi7op9+ED5FX6spgH1v0SsYC89bq0UNR/oA5D\n"
 127   "55/JeBFf5eQMLGtqpDXcvVTlYDaaMdGKWW5rHLq9LrrrfIfv2sjdoeukg+aLrfr6\n"
 128   "jlvXN8gyPpbCPvRD2n2RAg+3vPjvj/dBAF6W3w8IltzqsukGgq/SLwIUS5/r/2ya\n"
 129   "AoNBXjeBjgCGMei2m8E=\n" "-----END DSA PRIVATE KEY-----\n";
 130
 131 const gnutls_datum_t cert_dat[] = {
 132   {pem1_cert, sizeof (pem1_cert)}
 133   ,
 134   {pem2_cert, sizeof (pem2_cert)}
 135 };
 136
 137 const gnutls_datum_t key_dat[] = {
 138   {pem1_key, sizeof (pem1_key)}
 139   ,
 140   {pem2_key, sizeof (pem2_key)}
 141 };
 142
 143 void
 144 doit (void)
 145 {
 146   gnutls_x509_privkey_t key;
 147   gnutls_x509_crt_t crt;
 148   gnutls_pubkey_t pubkey;
 149   gnutls_privkey_t privkey;
 150   gnutls_digest_algorithm_t hash_algo;
 151   gnutls_datum_t signature;
 152   gnutls_datum_t signature2;
 153   int ret;
 154   size_t i;
 155
 156   gnutls_global_init ();
 157
 158   for (i = 0; i < sizeof (key_dat) / sizeof (key_dat[0]); i++)
 159     {
 160       if (debug)
 161         success ("loop %d\n", (int) i);
 162
 163       ret = gnutls_x509_privkey_init (&key);
 164       if (ret < 0)
 165         fail ("gnutls_x509_privkey_init\n");
 166
 167       ret =
 168         gnutls_x509_privkey_import (key, &key_dat[i], GNUTLS_X509_FMT_PEM);
 169       if (ret < 0)
 170         fail ("gnutls_x509_privkey_import\n");
 171
 172       ret = gnutls_pubkey_init (&pubkey);
 173       if (ret < 0)
 174         fail ("gnutls_privkey_init\n");
 175
 176       ret = gnutls_privkey_init (&privkey);
 177       if (ret < 0)
 178         fail ("gnutls_pubkey_init\n");
 179
 180       ret = gnutls_privkey_import_x509 (privkey, key, 0);
 181       if (ret < 0)
 182         fail ("gnutls_privkey_import_x509\n");
 183
 184       ret = gnutls_privkey_sign_hash (privkey, GNUTLS_DIG_SHA1, 0,
 185                                       &hash_data, &signature2);
 186       if (ret < 0)
 187         fail ("gnutls_privkey_sign_hash\n");
 188
 189       ret = gnutls_privkey_sign_data (privkey, GNUTLS_DIG_SHA1, 0,
 190                                       &raw_data, &signature);
 191       if (ret < 0)
 192         fail ("gnutls_x509_privkey_sign_hash\n");
 193
 194       ret = gnutls_x509_crt_init (&crt);
 195       if (ret < 0)
 196         fail ("gnutls_x509_crt_init\n");
 197
 198       ret = gnutls_x509_crt_import (crt, &cert_dat[i], GNUTLS_X509_FMT_PEM);
 199       if (ret < 0)
 200         fail ("gnutls_x509_crt_import\n");
 201
 202       ret =
 203         gnutls_pubkey_import_x509 (pubkey, crt, 0);
 204       if (ret < 0)
 205         fail ("gnutls_x509_pubkey_import\n");
 206
 207       ret =
 208         gnutls_pubkey_get_verify_algorithm (pubkey, &signature, &hash_algo);
 209       if (ret < 0 || hash_algo != GNUTLS_DIG_SHA1)
 210         fail ("gnutls_x509_crt_get_verify_algorithm\n");
 211
 212       ret = gnutls_pubkey_verify_hash (pubkey, 0, &hash_data, &signature);
 213       if (ret < 0)
 214         fail ("gnutls_x509_privkey_verify_hash\n");
 215
 216       ret =
 217         gnutls_pubkey_get_verify_algorithm (pubkey, &signature2, &hash_algo);
 218       if (ret < 0 || hash_algo != GNUTLS_DIG_SHA1)
 219         fail ("gnutls_x509_crt_get_verify_algorithm (hashed data)\n");
 220
 221       ret = gnutls_pubkey_verify_hash (pubkey, 0, &hash_data, &signature2);
 222       if (ret < 0)
 223         fail ("gnutls_x509_privkey_verify_hash (hashed data)\n");
 224
 225       /* should fail */
 226       ret = gnutls_pubkey_verify_hash (pubkey, 0, &invalid_hash_data, &signature2);
 227       if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED)
 228         fail ("gnutls_x509_privkey_verify_hash (hashed data)\n");
 229
 230
 231       gnutls_free(signature.data);
 232       gnutls_free(signature2.data);
 233       gnutls_x509_privkey_deinit (key);
 234       gnutls_x509_crt_deinit (crt);
 235       gnutls_privkey_deinit (privkey);
 236       gnutls_pubkey_deinit (pubkey);
 237     }
 238
 239   gnutls_global_deinit ();
 240 }