blob: 30e95c95edd08132cc038474418a78b91d827999 [file] [log] [blame]
Paul Bakker4593aea2009-02-09 22:32:35 +00001/*
2 * SSL certificate functionality tests
3 *
Manuel Pégourié-Gonnarda658a402015-01-23 09:45:19 +00004 * Copyright (C) 2006-2011, ARM Limited, All Rights Reserved
Paul Bakkerb96f1542010-07-18 20:36:00 +00005 *
Manuel Pégourié-Gonnard085ab042015-01-23 11:06:27 +00006 * This file is part of mbed TLS (https://www.polarssl.org)
Paul Bakkerb96f1542010-07-18 20:36:00 +00007 *
Paul Bakker4593aea2009-02-09 22:32:35 +00008 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020023#if !defined(POLARSSL_CONFIG_FILE)
Manuel Pégourié-Gonnardabd6e022013-09-20 13:30:43 +020024#include "polarssl/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020025#else
26#include POLARSSL_CONFIG_FILE
27#endif
Paul Bakker4593aea2009-02-09 22:32:35 +000028
Rich Evansf90016a2015-01-19 14:26:37 +000029#if defined(POLARSSL_PLATFORM_C)
30#include "polarssl/platform.h"
31#else
32#define polarssl_printf printf
33#define polarssl_fprintf fprintf
34#define polarssl_malloc malloc
35#define polarssl_free free
36#endif
37
Paul Bakker4593aea2009-02-09 22:32:35 +000038#include <string.h>
39#include <stdio.h>
40
Manuel Pégourié-Gonnard7831b0c2013-09-20 12:29:56 +020041#if !defined(POLARSSL_RSA_C) || !defined(POLARSSL_X509_CRT_PARSE_C) || \
Manuel Pégourié-Gonnardcbf3ef32013-09-23 12:20:02 +020042 !defined(POLARSSL_FS_IO) || !defined(POLARSSL_X509_CRL_PARSE_C)
Manuel Pégourié-Gonnard7831b0c2013-09-20 12:29:56 +020043int main( int argc, char *argv[] )
44{
45 ((void) argc);
46 ((void) argv);
47
Rich Evansf90016a2015-01-19 14:26:37 +000048 polarssl_printf("POLARSSL_RSA_C and/or POLARSSL_X509_CRT_PARSE_C "
Manuel Pégourié-Gonnardcbf3ef32013-09-23 12:20:02 +020049 "POLARSSL_FS_IO and/or POLARSSL_X509_CRL_PARSE_C "
Manuel Pégourié-Gonnard7831b0c2013-09-20 12:29:56 +020050 "not defined.\n");
51 return( 0 );
52}
53#else
54
Paul Bakker4593aea2009-02-09 22:32:35 +000055#include "polarssl/certs.h"
Paul Bakker36713e82013-09-17 13:25:29 +020056#include "polarssl/x509_crt.h"
Paul Bakker4593aea2009-02-09 22:32:35 +000057
Paul Bakkerd98030e2009-05-02 15:13:40 +000058#if defined _MSC_VER && !defined snprintf
59#define snprintf _snprintf
60#endif
61
Manuel Pégourié-Gonnard7831b0c2013-09-20 12:29:56 +020062
Paul Bakker40ea7de2009-05-03 10:18:48 +000063#define MAX_CLIENT_CERTS 8
Paul Bakker4593aea2009-02-09 22:32:35 +000064
Paul Bakkeref3f8c72013-06-24 13:01:08 +020065const char *client_certificates[MAX_CLIENT_CERTS] =
Paul Bakker4593aea2009-02-09 22:32:35 +000066{
Paul Bakkerd98030e2009-05-02 15:13:40 +000067 "client1.crt",
68 "client2.crt",
Paul Bakker40ea7de2009-05-03 10:18:48 +000069 "server1.crt",
70 "server2.crt",
Paul Bakkerd98030e2009-05-02 15:13:40 +000071 "cert_sha224.crt",
72 "cert_sha256.crt",
73 "cert_sha384.crt",
74 "cert_sha512.crt"
Paul Bakker4593aea2009-02-09 22:32:35 +000075};
76
Paul Bakkeref3f8c72013-06-24 13:01:08 +020077const char *client_private_keys[MAX_CLIENT_CERTS] =
Paul Bakkera1d3e5f2009-03-28 17:30:26 +000078{
Paul Bakkerd98030e2009-05-02 15:13:40 +000079 "client1.key",
80 "client2.key",
Paul Bakker40ea7de2009-05-03 10:18:48 +000081 "server1.key",
82 "server2.key",
Paul Bakkerf17ed282011-02-09 17:10:48 +000083 "cert_digest.key",
84 "cert_digest.key",
85 "cert_digest.key",
86 "cert_digest.key"
Paul Bakkera1d3e5f2009-03-28 17:30:26 +000087};
88
Paul Bakkercce9d772011-11-18 14:26:47 +000089int main( int argc, char *argv[] )
Paul Bakker4593aea2009-02-09 22:32:35 +000090{
91 int ret, i;
Paul Bakkerc559c7a2013-09-18 14:13:26 +020092 x509_crt cacert;
Paul Bakkerd98030e2009-05-02 15:13:40 +000093 x509_crl crl;
94 char buf[10240];
95
Paul Bakkercce9d772011-11-18 14:26:47 +000096 ((void) argc);
97 ((void) argv);
98
Paul Bakker369d2eb2013-09-18 11:58:25 +020099 x509_crt_init( &cacert );
100 x509_crl_init( &crl );
Paul Bakker4593aea2009-02-09 22:32:35 +0000101
102 /*
103 * 1.1. Load the trusted CA
104 */
Rich Evansf90016a2015-01-19 14:26:37 +0000105 polarssl_printf( "\n . Loading the CA root certificate ..." );
Paul Bakker4593aea2009-02-09 22:32:35 +0000106 fflush( stdout );
107
Paul Bakker4593aea2009-02-09 22:32:35 +0000108 /*
109 * Alternatively, you may load the CA certificates from a .pem or
Paul Bakkerddf26b42013-09-18 13:46:23 +0200110 * .crt file by calling x509_crt_parse_file( &cacert, "myca.crt" ).
Paul Bakker4593aea2009-02-09 22:32:35 +0000111 */
Paul Bakkerddf26b42013-09-18 13:46:23 +0200112 ret = x509_crt_parse_file( &cacert, "ssl/test-ca/test-ca.crt" );
Paul Bakker4593aea2009-02-09 22:32:35 +0000113 if( ret != 0 )
114 {
Rich Evansf90016a2015-01-19 14:26:37 +0000115 polarssl_printf( " failed\n ! x509_crt_parse_file returned %d\n\n", ret );
Paul Bakker4593aea2009-02-09 22:32:35 +0000116 goto exit;
117 }
118
Rich Evansf90016a2015-01-19 14:26:37 +0000119 polarssl_printf( " ok\n" );
Paul Bakker4593aea2009-02-09 22:32:35 +0000120
Paul Bakkerddf26b42013-09-18 13:46:23 +0200121 x509_crt_info( buf, 1024, "CRT: ", &cacert );
Rich Evansf90016a2015-01-19 14:26:37 +0000122 polarssl_printf("%s\n", buf );
Paul Bakker40ea7de2009-05-03 10:18:48 +0000123
Paul Bakkerd98030e2009-05-02 15:13:40 +0000124 /*
125 * 1.2. Load the CRL
126 */
Rich Evansf90016a2015-01-19 14:26:37 +0000127 polarssl_printf( " . Loading the CRL ..." );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000128 fflush( stdout );
129
Paul Bakkerddf26b42013-09-18 13:46:23 +0200130 ret = x509_crl_parse_file( &crl, "ssl/test-ca/crl.pem" );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000131 if( ret != 0 )
132 {
Rich Evansf90016a2015-01-19 14:26:37 +0000133 polarssl_printf( " failed\n ! x509_crl_parse_file returned %d\n\n", ret );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000134 goto exit;
135 }
136
Rich Evansf90016a2015-01-19 14:26:37 +0000137 polarssl_printf( " ok\n" );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000138
Paul Bakkerddf26b42013-09-18 13:46:23 +0200139 x509_crl_info( buf, 1024, "CRL: ", &crl );
Rich Evansf90016a2015-01-19 14:26:37 +0000140 polarssl_printf("%s\n", buf );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000141
Paul Bakker4593aea2009-02-09 22:32:35 +0000142 for( i = 0; i < MAX_CLIENT_CERTS; i++ )
143 {
144 /*
Paul Bakkerd98030e2009-05-02 15:13:40 +0000145 * 1.3. Load own certificate
Paul Bakker4593aea2009-02-09 22:32:35 +0000146 */
Paul Bakkerd98030e2009-05-02 15:13:40 +0000147 char name[512];
148 int flags;
Paul Bakkerc559c7a2013-09-18 14:13:26 +0200149 x509_crt clicert;
Paul Bakker36713e82013-09-17 13:25:29 +0200150 pk_context pk;
Paul Bakker4593aea2009-02-09 22:32:35 +0000151
Paul Bakker369d2eb2013-09-18 11:58:25 +0200152 x509_crt_init( &clicert );
Paul Bakker36713e82013-09-17 13:25:29 +0200153 pk_init( &pk );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000154
155 snprintf(name, 512, "ssl/test-ca/%s", client_certificates[i]);
156
Rich Evansf90016a2015-01-19 14:26:37 +0000157 polarssl_printf( " . Loading the client certificate %s...", name );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000158 fflush( stdout );
Paul Bakker4593aea2009-02-09 22:32:35 +0000159
Paul Bakkerddf26b42013-09-18 13:46:23 +0200160 ret = x509_crt_parse_file( &clicert, name );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000161 if( ret != 0 )
162 {
Rich Evansf90016a2015-01-19 14:26:37 +0000163 polarssl_printf( " failed\n ! x509_crt_parse_file returned %d\n\n", ret );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000164 goto exit;
165 }
Paul Bakker4593aea2009-02-09 22:32:35 +0000166
Rich Evansf90016a2015-01-19 14:26:37 +0000167 polarssl_printf( " ok\n" );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000168
169 /*
Paul Bakkerd98030e2009-05-02 15:13:40 +0000170 * 1.4. Verify certificate validity with CA certificate
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000171 */
Rich Evansf90016a2015-01-19 14:26:37 +0000172 polarssl_printf( " . Verify the client certificate with CA certificate..." );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000173 fflush( stdout );
174
Paul Bakkerddf26b42013-09-18 13:46:23 +0200175 ret = x509_crt_verify( &clicert, &cacert, &crl, NULL, &flags, NULL,
176 NULL );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000177 if( ret != 0 )
178 {
Paul Bakker40ea7de2009-05-03 10:18:48 +0000179 if( ret == POLARSSL_ERR_X509_CERT_VERIFY_FAILED )
180 {
Paul Bakker860d36b2009-05-03 17:29:56 +0000181 if( flags & BADCERT_CN_MISMATCH )
Rich Evansf90016a2015-01-19 14:26:37 +0000182 polarssl_printf( " CN_MISMATCH " );
Paul Bakker860d36b2009-05-03 17:29:56 +0000183 if( flags & BADCERT_EXPIRED )
Rich Evansf90016a2015-01-19 14:26:37 +0000184 polarssl_printf( " EXPIRED " );
Paul Bakker860d36b2009-05-03 17:29:56 +0000185 if( flags & BADCERT_REVOKED )
Rich Evansf90016a2015-01-19 14:26:37 +0000186 polarssl_printf( " REVOKED " );
Paul Bakker860d36b2009-05-03 17:29:56 +0000187 if( flags & BADCERT_NOT_TRUSTED )
Rich Evansf90016a2015-01-19 14:26:37 +0000188 polarssl_printf( " NOT_TRUSTED " );
Paul Bakker860d36b2009-05-03 17:29:56 +0000189 if( flags & BADCRL_NOT_TRUSTED )
Rich Evansf90016a2015-01-19 14:26:37 +0000190 polarssl_printf( " CRL_NOT_TRUSTED " );
Paul Bakker860d36b2009-05-03 17:29:56 +0000191 if( flags & BADCRL_EXPIRED )
Rich Evansf90016a2015-01-19 14:26:37 +0000192 polarssl_printf( " CRL_EXPIRED " );
Paul Bakker40ea7de2009-05-03 10:18:48 +0000193 } else {
Rich Evansf90016a2015-01-19 14:26:37 +0000194 polarssl_printf( " failed\n ! x509_crt_verify returned %d\n\n", ret );
Paul Bakker40ea7de2009-05-03 10:18:48 +0000195 goto exit;
196 }
Paul Bakkerd98030e2009-05-02 15:13:40 +0000197 }
198
Rich Evansf90016a2015-01-19 14:26:37 +0000199 polarssl_printf( " ok\n" );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000200
201 /*
202 * 1.5. Load own private key
203 */
204 snprintf(name, 512, "ssl/test-ca/%s", client_private_keys[i]);
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000205
Rich Evansf90016a2015-01-19 14:26:37 +0000206 polarssl_printf( " . Loading the client private key %s...", name );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000207 fflush( stdout );
208
Paul Bakker36713e82013-09-17 13:25:29 +0200209 ret = pk_parse_keyfile( &pk, name, NULL );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000210 if( ret != 0 )
211 {
Rich Evansf90016a2015-01-19 14:26:37 +0000212 polarssl_printf( " failed\n ! pk_parse_keyfile returned %d\n\n", ret );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000213 goto exit;
214 }
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000215
Rich Evansf90016a2015-01-19 14:26:37 +0000216 polarssl_printf( " ok\n" );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000217
Paul Bakkerd98030e2009-05-02 15:13:40 +0000218 /*
Manuel Pégourié-Gonnardbe506802013-07-11 13:17:21 +0200219 * 1.6. Verify certificate validity with private key
Paul Bakkerd98030e2009-05-02 15:13:40 +0000220 */
Rich Evansf90016a2015-01-19 14:26:37 +0000221 polarssl_printf( " . Verify the client certificate with private key..." );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000222 fflush( stdout );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000223
Manuel Pégourié-Gonnardbe506802013-07-11 13:17:21 +0200224
225 /* EC NOT IMPLEMENTED YET */
Manuel Pégourié-Gonnard7e56de12013-08-14 21:15:53 +0200226 if( ! pk_can_do( &clicert.pk, POLARSSL_PK_RSA ) )
Manuel Pégourié-Gonnardbe506802013-07-11 13:17:21 +0200227 {
Rich Evansf90016a2015-01-19 14:26:37 +0000228 polarssl_printf( " failed\n ! certificate's key is not RSA\n\n" );
Manuel Pégourié-Gonnardbe506802013-07-11 13:17:21 +0200229 ret = POLARSSL_ERR_X509_FEATURE_UNAVAILABLE;
230 goto exit;
231 }
232
Paul Bakker36713e82013-09-17 13:25:29 +0200233 ret = mpi_cmp_mpi(&pk_rsa( pk )->N, &pk_rsa( clicert.pk )->N);
Paul Bakkerd98030e2009-05-02 15:13:40 +0000234 if( ret != 0 )
235 {
Rich Evansf90016a2015-01-19 14:26:37 +0000236 polarssl_printf( " failed\n ! mpi_cmp_mpi for N returned %d\n\n", ret );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000237 goto exit;
238 }
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000239
Paul Bakker36713e82013-09-17 13:25:29 +0200240 ret = mpi_cmp_mpi(&pk_rsa( pk )->E, &pk_rsa( clicert.pk )->E);
Paul Bakkerd98030e2009-05-02 15:13:40 +0000241 if( ret != 0 )
242 {
Rich Evansf90016a2015-01-19 14:26:37 +0000243 polarssl_printf( " failed\n ! mpi_cmp_mpi for E returned %d\n\n", ret );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000244 goto exit;
245 }
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000246
Paul Bakker36713e82013-09-17 13:25:29 +0200247 ret = rsa_check_privkey( pk_rsa( pk ) );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000248 if( ret != 0 )
249 {
Rich Evansf90016a2015-01-19 14:26:37 +0000250 polarssl_printf( " failed\n ! rsa_check_privkey returned %d\n\n", ret );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000251 goto exit;
252 }
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000253
Rich Evansf90016a2015-01-19 14:26:37 +0000254 polarssl_printf( " ok\n" );
Paul Bakkera1d3e5f2009-03-28 17:30:26 +0000255
Paul Bakker36713e82013-09-17 13:25:29 +0200256 x509_crt_free( &clicert );
257 pk_free( &pk );
Paul Bakker4593aea2009-02-09 22:32:35 +0000258 }
259
260exit:
Paul Bakker36713e82013-09-17 13:25:29 +0200261 x509_crt_free( &cacert );
Paul Bakkerd98030e2009-05-02 15:13:40 +0000262 x509_crl_free( &crl );
Paul Bakker4593aea2009-02-09 22:32:35 +0000263
Paul Bakkercce9d772011-11-18 14:26:47 +0000264#if defined(_WIN32)
Rich Evansf90016a2015-01-19 14:26:37 +0000265 polarssl_printf( " + Press Enter to exit this program.\n" );
Paul Bakker4593aea2009-02-09 22:32:35 +0000266 fflush( stdout ); getchar();
267#endif
268
269 return( ret );
270}
Manuel Pégourié-Gonnardcbf3ef32013-09-23 12:20:02 +0200271#endif /* POLARSSL_RSA_C && POLARSSL_X509_CRT_PARSE_C && POLARSSL_FS_IO &&
272 POLARSSL_X509_CRL_PARSE_C */