tests: modified tests with obsolete APIs with their replacement API
[gnutls:gnutls.git] / tests / x509sign-verify.c
1 /*
2  * Copyright (C) 2004-2012 Free Software Foundation, Inc.
3  *
4  * Author: Nikos Mavrogiannopoulos, Simon Josefsson
5  *
6  * This file is part of GnuTLS.
7  *
8  * GnuTLS is free software; you can redistribute it and/or modify it
9  * under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 3 of the License, or
11  * (at your option) any later version.
12  *
13  * GnuTLS is distributed in the hope that it will be useful, but
14  * WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with GnuTLS; if not, write to the Free Software Foundation,
20  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
21  */
22
23 /* Parts copied from GnuTLS example programs. */
24
25 #ifdef HAVE_CONFIG_H
26 #include <config.h>
27 #endif
28
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <sys/types.h>
33 #include <netinet/in.h>
34 #include <sys/socket.h>
35 #ifndef _WIN32
36 # include <arpa/inet.h>
37 #endif
38 #include <unistd.h>
39 #include <gnutls/gnutls.h>
40 #include <gnutls/x509.h>
41 #include <gnutls/abstract.h>
42
43 #include "utils.h"
44
45 static void tls_log_func(int level, const char *str)
46 {
47         fprintf(stderr, "<%d> %s", level, str);
48 }
49
50 /* sha1 hash of "hello" string */
51 const gnutls_datum_t hash_data = {
52         (void *)
53             "\xaa\xf4\xc6\x1d\xdc\xc5\xe8\xa2\xda\xbe"
54             "\xde\x0f\x3b\x48\x2c\xd9\xae\xa9\x43\x4d",
55         20
56 };
57
58 const gnutls_datum_t invalid_hash_data = {
59         (void *)
60             "\xaa\xf4\xc6\x1d\xdc\xca\xe8\xa2\xda\xbe"
61             "\xde\x0f\x3b\x48\x2c\xb9\xae\xa9\x43\x4d",
62         20
63 };
64
65 const gnutls_datum_t raw_data = {
66         (void *) "hello",
67         5
68 };
69
70 static char pem1_cert[] =
71     "-----BEGIN CERTIFICATE-----\n"
72     "MIICHjCCAYmgAwIBAgIERiYdNzALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
73     "VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTI3WhcNMDgwNDE3MTMyOTI3WjAdMRsw\n"
74     "GQYDVQQDExJHbnVUTFMgdGVzdCBjbGllbnQwgZwwCwYJKoZIhvcNAQEBA4GMADCB\n"
75     "iAKBgLtmQ/Xyxde2jMzF3/WIO7HJS2oOoa0gUEAIgKFPXKPQ+GzP5jz37AR2ExeL\n"
76     "ZIkiW8DdU3w77XwEu4C5KL6Om8aOoKUSy/VXHqLnu7czSZ/ju0quak1o/8kR4jKN\n"
77     "zj2AC41179gAgY8oBAOgIo1hBAf6tjd9IQdJ0glhaZiQo1ipAgMBAAGjdjB0MAwG\n"
78     "A1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDwYDVR0PAQH/BAUDAweg\n"
79     "ADAdBgNVHQ4EFgQUTLkKm/odNON+3svSBxX+odrLaJEwHwYDVR0jBBgwFoAU6Twc\n"
80     "+62SbuYGpFYsouHAUyfI8pUwCwYJKoZIhvcNAQEFA4GBALujmBJVZnvaTXr9cFRJ\n"
81     "jpfc/3X7sLUsMvumcDE01ls/cG5mIatmiyEU9qI3jbgUf82z23ON/acwJf875D3/\n"
82     "U7jyOsBJ44SEQITbin2yUeJMIm1tievvdNXBDfW95AM507ShzP12sfiJkJfjjdhy\n"
83     "dc8Siq5JojruiMizAf0pA7in\n" "-----END CERTIFICATE-----\n";
84
85 static char pem1_key[] =
86     "-----BEGIN RSA PRIVATE KEY-----\n"
87     "MIICXAIBAAKBgQC7ZkP18sXXtozMxd/1iDuxyUtqDqGtIFBACIChT1yj0Phsz+Y8\n"
88     "9+wEdhMXi2SJIlvA3VN8O+18BLuAuSi+jpvGjqClEsv1Vx6i57u3M0mf47tKrmpN\n"
89     "aP/JEeIyjc49gAuNde/YAIGPKAQDoCKNYQQH+rY3fSEHSdIJYWmYkKNYqQIDAQAB\n"
90     "AoGADpmARG5CQxS+AesNkGmpauepiCz1JBF/JwnyiX6vEzUh0Ypd39SZztwrDxvF\n"
91     "PJjQaKVljml1zkJpIDVsqvHdyVdse8M+Qn6hw4x2p5rogdvhhIL1mdWo7jWeVJTF\n"
92     "RKB7zLdMPs3ySdtcIQaF9nUAQ2KJEvldkO3m/bRJFEp54k0CQQDYy+RlTmwRD6hy\n"
93     "7UtMjR0H3CSZJeQ8svMCxHLmOluG9H1UKk55ZBYfRTsXniqUkJBZ5wuV1L+pR9EK\n"
94     "ca89a+1VAkEA3UmBelwEv2u9cAU1QjKjmwju1JgXbrjEohK+3B5y0ESEXPAwNQT9\n"
95     "TrDM1m9AyxYTWLxX93dI5QwNFJtmbtjeBQJARSCWXhsoaDRG8QZrCSjBxfzTCqZD\n"
96     "ZXtl807ymCipgJm60LiAt0JLr4LiucAsMZz6+j+quQbSakbFCACB8SLV1QJBAKZQ\n"
97     "YKf+EPNtnmta/rRKKvySsi3GQZZN+Dt3q0r094XgeTsAqrqujVNfPhTMeP4qEVBX\n"
98     "/iVX2cmMTSh3w3z8MaECQEp0XJWDVKOwcTW6Ajp9SowtmiZ3YDYo1LF9igb4iaLv\n"
99     "sWZGfbnU3ryjvkb6YuFjgtzbZDZHWQCo8/cOtOBmPdk=\n"
100     "-----END RSA PRIVATE KEY-----\n";
101
102 static char pem2_cert[] =
103     "-----BEGIN CERTIFICATE-----\n"
104     "MIIDbzCCAtqgAwIBAgIERiYdRTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
105     "VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTQxWhcNMDgwNDE3MTMyOTQxWjA3MRsw\n"
106     "GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
107     "Lm9yZzCCAbQwggEpBgcqhkjOOAQBMIIBHAKBgLmE9VqBvhoNxYpzjwybL5u2DkvD\n"
108     "dBp/ZK2d8yjFoEe8m1dW8ZfVfjcD6fJM9OOLfzCjXS+7oaI3wuo1jx+xX6aiXwHx\n"
109     "IzYr5E8vLd2d1TqmOa96UXzSJY6XdM8exXtLdkOBBx8GFLhuWBLhkOI3b9Ib7GjF\n"
110     "WOLmMOBqXixjeOwHAhSfVoxIZC/+jap6bZbbBF0W7wilcQKBgGIGfuRcdgi3Rhpd\n"
111     "15fUKiH7HzHJ0vT6Odgn0Zv8J12nCqca/FPBL0PCN8iFfz1Mq12BMvsdXh5UERYg\n"
112     "xoBa2YybQ/Dda6D0w/KKnDnSHHsP7/ook4/SoSLr3OCKi60oDs/vCYXpNr2LelDV\n"
113     "e/clDWxgEcTvcJDP1hvru47GPjqXA4GEAAKBgA+Kh1fy0cLcrN9Liw+Luin34QPk\n"
114     "VfqymAfW/RKxgLz1urRQ1H+gDkPnn8l4EV/l5Awsa2qkNdy9VOVgNpox0YpZbmsc\n"
115     "ur0uuut8h+/ayN2h66SD5out+vqOW9c3yDI+lsI+9EPafZECD7e8+O+P90EAXpbf\n"
116     "DwiW3Oqy6QaCr9Ivo4GTMIGQMAwGA1UdEwEB/wQCMAAwGgYDVR0RBBMwEYIPdGVz\n"
117     "dC5nbnV0bHMub3JnMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdDwEB/wQFAwMH\n"
118     "gAAwHQYDVR0OBBYEFL/su87Y6HtwVuzz0SuS1tSZClvzMB8GA1UdIwQYMBaAFOk8\n"
119     "HPutkm7mBqRWLKLhwFMnyPKVMAsGCSqGSIb3DQEBBQOBgQBCsrnfD1xzh8/Eih1f\n"
120     "x+M0lPoX1Re5L2ElHI6DJpHYOBPwf9glwxnet2+avzgUQDUFwUSxOhodpyeaACXD\n"
121     "o0gGVpcH8sOBTQ+aTdM37hGkPxoXjtIkR/LgG5nP2H2JRd5TkW8l13JdM4MJFB4W\n"
122     "QcDzQ8REwidsfh9uKAluk1c/KQ==\n" "-----END CERTIFICATE-----\n";
123
124 static char pem2_key[] =
125     "-----BEGIN DSA PRIVATE KEY-----\n"
126     "MIIBugIBAAKBgQC5hPVagb4aDcWKc48Mmy+btg5Lw3Qaf2StnfMoxaBHvJtXVvGX\n"
127     "1X43A+nyTPTji38wo10vu6GiN8LqNY8fsV+mol8B8SM2K+RPLy3dndU6pjmvelF8\n"
128     "0iWOl3TPHsV7S3ZDgQcfBhS4blgS4ZDiN2/SG+xoxVji5jDgal4sY3jsBwIVAJ9W\n"
129     "jEhkL/6NqnptltsEXRbvCKVxAoGAYgZ+5Fx2CLdGGl3Xl9QqIfsfMcnS9Po52CfR\n"
130     "m/wnXacKpxr8U8EvQ8I3yIV/PUyrXYEy+x1eHlQRFiDGgFrZjJtD8N1roPTD8oqc\n"
131     "OdIcew/v+iiTj9KhIuvc4IqLrSgOz+8Jhek2vYt6UNV79yUNbGARxO9wkM/WG+u7\n"
132     "jsY+OpcCgYAPiodX8tHC3KzfS4sPi7op9+ED5FX6spgH1v0SsYC89bq0UNR/oA5D\n"
133     "55/JeBFf5eQMLGtqpDXcvVTlYDaaMdGKWW5rHLq9LrrrfIfv2sjdoeukg+aLrfr6\n"
134     "jlvXN8gyPpbCPvRD2n2RAg+3vPjvj/dBAF6W3w8IltzqsukGgq/SLwIUS5/r/2ya\n"
135     "AoNBXjeBjgCGMei2m8E=\n" "-----END DSA PRIVATE KEY-----\n";
136
137 const gnutls_datum_t cert_dat[] = {
138         {(void *) pem1_cert, sizeof(pem1_cert)}
139         ,
140         {(void *) pem2_cert, sizeof(pem2_cert)}
141 };
142
143 const gnutls_datum_t key_dat[] = {
144         {(void *) pem1_key, sizeof(pem1_key)}
145         ,
146         {(void *) pem2_key, sizeof(pem2_key)}
147 };
148
149 void doit(void)
150 {
151         gnutls_x509_privkey_t key;
152         gnutls_x509_crt_t crt;
153         gnutls_pubkey_t pubkey;
154         gnutls_privkey_t privkey;
155         gnutls_sign_algorithm_t sign_algo;
156         gnutls_datum_t signature;
157         gnutls_datum_t signature2;
158         int ret;
159         size_t i;
160
161         global_init();
162
163         gnutls_global_set_log_function(tls_log_func);
164         if (debug)
165                 gnutls_global_set_log_level(6);
166
167         for (i = 0; i < sizeof(key_dat) / sizeof(key_dat[0]); i++) {
168                 if (debug)
169                         success("loop %d\n", (int) i);
170
171                 ret = gnutls_x509_privkey_init(&key);
172                 if (ret < 0)
173                         fail("gnutls_x509_privkey_init\n");
174
175                 ret =
176                     gnutls_x509_privkey_import(key, &key_dat[i],
177                                                GNUTLS_X509_FMT_PEM);
178                 if (ret < 0)
179                         fail("gnutls_x509_privkey_import\n");
180
181                 ret = gnutls_pubkey_init(&pubkey);
182                 if (ret < 0)
183                         fail("gnutls_privkey_init\n");
184
185                 ret = gnutls_privkey_init(&privkey);
186                 if (ret < 0)
187                         fail("gnutls_pubkey_init\n");
188
189                 ret = gnutls_privkey_import_x509(privkey, key, 0);
190                 if (ret < 0)
191                         fail("gnutls_privkey_import_x509\n");
192
193                 ret = gnutls_privkey_sign_hash(privkey, GNUTLS_DIG_SHA1, 0,
194                                                &hash_data, &signature2);
195                 if (ret < 0)
196                         fail("gnutls_privkey_sign_hash\n");
197
198                 ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA1, 0,
199                                                &raw_data, &signature);
200                 if (ret < 0)
201                         fail("gnutls_x509_privkey_sign_hash\n");
202
203                 ret = gnutls_x509_crt_init(&crt);
204                 if (ret < 0)
205                         fail("gnutls_x509_crt_init\n");
206
207                 ret =
208                     gnutls_x509_crt_import(crt, &cert_dat[i],
209                                            GNUTLS_X509_FMT_PEM);
210                 if (ret < 0)
211                         fail("gnutls_x509_crt_import\n");
212
213                 ret = gnutls_pubkey_import_x509(pubkey, crt, 0);
214                 if (ret < 0)
215                         fail("gnutls_x509_pubkey_import\n");
216
217                 ret =
218                     gnutls_x509_crt_get_signature_algorithm(crt);
219                 if (ret != GNUTLS_SIGN_RSA_SHA1)
220                         fail("gnutls_crt_get_signature_algorithm\n");
221
222                 ret =
223                     gnutls_pubkey_verify_hash2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0, &hash_data,
224                                               &signature);
225                 if (ret < 0)
226                         fail("gnutls_x509_pubkey_verify_hash2\n");
227
228                 ret =
229                     gnutls_pubkey_verify_hash2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0, &hash_data,
230                                               &signature2);
231                 if (ret < 0)
232                         fail("gnutls_x509_pubkey_verify_hash-1 (hashed data)\n");
233
234                 /* should fail */
235                 ret =
236                     gnutls_pubkey_verify_hash2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0,
237                                               &invalid_hash_data,
238                                               &signature2);
239                 if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED)
240                         fail("gnutls_x509_pubkey_verify_hash-2 (hashed data)\n");
241
242                 sign_algo =
243                     gnutls_pk_to_sign(gnutls_pubkey_get_pk_algorithm
244                                       (pubkey, NULL), GNUTLS_DIG_SHA1);
245
246                 ret =
247                     gnutls_pubkey_verify_hash2(pubkey, sign_algo, 0,
248                                                &hash_data, &signature2);
249                 if (ret < 0)
250                         fail("gnutls_x509_pubkey_verify_hash2-1 (hashed data)\n");
251
252                 /* should fail */
253                 ret =
254                     gnutls_pubkey_verify_hash2(pubkey, sign_algo, 0,
255                                                &invalid_hash_data,
256                                                &signature2);
257                 if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED)
258                         fail("gnutls_x509_pubkey_verify_hash2-2 (hashed data)\n");
259
260                 /* test the raw interface */
261                 gnutls_free(signature.data);
262                 signature.data = NULL;
263
264                 if (gnutls_pubkey_get_pk_algorithm(pubkey, NULL) ==
265                     GNUTLS_PK_RSA) {
266                         ret =
267                             gnutls_privkey_sign_hash(privkey,
268                                                      GNUTLS_DIG_SHA1,
269                                                      GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA,
270                                                      &hash_data,
271                                                      &signature);
272                         if (ret < 0)
273                                 fail("gnutls_privkey_sign_hash: %s\n",
274                                      gnutls_strerror(ret));
275
276                         sign_algo =
277                             gnutls_pk_to_sign
278                             (gnutls_pubkey_get_pk_algorithm(pubkey, NULL),
279                              GNUTLS_DIG_SHA1);
280
281                         ret =
282                             gnutls_pubkey_verify_hash2(pubkey, sign_algo,
283                                                        GNUTLS_PUBKEY_VERIFY_FLAG_TLS1_RSA,
284                                                        &hash_data,
285                                                        &signature);
286                         if (ret < 0)
287                                 fail("gnutls_pubkey_verify_hash-3 (raw hashed data)\n");
288                 }
289                 gnutls_free(signature.data);
290                 gnutls_free(signature2.data);
291                 gnutls_x509_privkey_deinit(key);
292                 gnutls_x509_crt_deinit(crt);
293                 gnutls_privkey_deinit(privkey);
294                 gnutls_pubkey_deinit(pubkey);
295         }
296
297         gnutls_global_deinit();
298 }