libp11 PKCS#11 provider tests

Author: olszomal

tests/Makefile.am

@@ -15,10 +15,14 @@ check_PROGRAMS = \
 	fork-change-slot \
 	list-tokens \
 	rsa-pss-sign \
+	rsa-pss-sign-prov \
 	rsa-oaep \
+	rsa-oaep-prov \
 	check-privkey \
+	check-privkey-prov \
 	store-cert \
-	dup-key
+	dup-key \
+	dup-key-prov
 dist_check_SCRIPTS = \
 	rsa-testpkcs11.softhsm \
 	rsa-testfork.softhsm \
@@ -36,7 +40,14 @@ dist_check_SCRIPTS = \
 	fork-change-slot.softhsm \
 	case-insensitive.softhsm \
 	pkcs11-uri-without-token.softhsm \
-	search-all-matching-tokens.softhsm
+	search-all-matching-tokens.softhsm \
+	provider-ec-check-privkey.softhsm \
+	provider-ec-copy.softhsm \
+	provider-rsa-check-privkey.softhsm \
+	provider-rsa-oaep.softhsm \
+	provider-rsa-pss-sign.softhsm \
+	provider-pkcs11-uri-without-token.softhsm \
+	provider-search-all-matching-tokens.softhsm
 dist_check_DATA = \
 	rsa-cert.der rsa-privkey.der rsa-pubkey.der \
 	ec-cert.der ec-privkey.der ec-pubkey.der

tests/check-privkey-prov.c

@@ -0,0 +1,212 @@
+/*
+ * Copyright © 2025 Mobi - Com Polska Sp. z o.o.
+ * Author: Małgorzata Olszówka <Malgorzata.Olszowka@stunnel.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <openssl/opensslv.h>
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/err.h>
+#include <openssl/store.h>
+#include <openssl/provider.h>
+#include <openssl/rand.h>
+#include <openssl/ui.h>
+
+DEFINE_STACK_OF(OSSL_PROVIDER)
+static STACK_OF(OSSL_PROVIDER) *providers;
+
+static void display_openssl_errors(void) {
+	unsigned long e;
+	const char *file = NULL, *func = NULL, *reason = NULL;
+	int line = 0, flags = 0;
+	char err_buf[256];
+
+	while ((e = ERR_get_error_all(&file, &line, &func, &reason, &flags))) {
+		ERR_error_string_n(e, err_buf, sizeof(err_buf));
+		fprintf(stderr, "%s:%d: %s: %s: %s\n", file ? file : "unknown file",
+			line, func ? func : "unknown function",
+			err_buf, reason ? reason : "unknown reason");
+	}
+}
+
+static EVP_PKEY *load_pkey(const char *uri)
+{
+	EVP_PKEY *pkey = NULL;
+	OSSL_STORE_INFO *info;
+	OSSL_STORE_CTX *store_ctx;
+
+	store_ctx = OSSL_STORE_open(uri, NULL, NULL, NULL, NULL);
+	if (!store_ctx) {
+		return NULL;
+	}
+	if (!OSSL_STORE_expect(store_ctx, OSSL_STORE_INFO_PKEY)) {
+		OSSL_STORE_close(store_ctx);
+		return NULL;
+	}
+	info = OSSL_STORE_load(store_ctx);
+	if (info == NULL) {
+		OSSL_STORE_close(store_ctx);
+		return NULL;
+	}
+	if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
+		pkey = OSSL_STORE_INFO_get1_PKEY(info);
+	}
+	OSSL_STORE_INFO_free(info);
+	OSSL_STORE_close(store_ctx);
+	return pkey;
+}
+
+static X509 *load_cert(const char *uri)
+{
+	X509 *cert = NULL;
+	OSSL_STORE_INFO *info;
+	OSSL_STORE_CTX *store_ctx;
+
+	store_ctx = OSSL_STORE_open(uri, NULL, NULL, NULL, NULL);
+	if (!store_ctx) {
+		return NULL;
+	}
+	if (!OSSL_STORE_expect(store_ctx, OSSL_STORE_INFO_CERT)) {
+		OSSL_STORE_close(store_ctx);
+		return NULL;
+	}
+	info = OSSL_STORE_load(store_ctx);
+	if (info == NULL) {
+		OSSL_STORE_close(store_ctx);
+		return NULL;
+	}
+	if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_CERT) {
+		cert = OSSL_STORE_INFO_get1_CERT(info);
+	}
+	OSSL_STORE_INFO_free(info);
+	OSSL_STORE_close(store_ctx);
+	return cert;
+}
+
+static void provider_free(OSSL_PROVIDER *prov)
+{
+        printf("Provider \"%s\" unloaded.\n", OSSL_PROVIDER_get0_name(prov));
+        OSSL_PROVIDER_unload(prov);
+}
+
+static void providers_cleanup(void)
+{
+        sk_OSSL_PROVIDER_pop_free(providers, provider_free);
+        providers = NULL;
+}
+
+static int provider_load(const char *pname)
+{
+        OSSL_PROVIDER *prov = OSSL_PROVIDER_load(NULL, pname);
+        if (prov == NULL) {
+                fprintf(stderr, "Unable to load provider: %s\n", pname);
+                return 0; /* FAILED */
+        }
+        if (providers == NULL) {
+                providers = sk_OSSL_PROVIDER_new_null();
+        }
+        if (providers == NULL || !sk_OSSL_PROVIDER_push(providers, prov)) {
+                providers_cleanup();
+                return 0; /* FAILED */
+        }
+        printf("Provider \"%s\" set.\n", OSSL_PROVIDER_get0_name(prov));
+        return 1; /* OK */
+}
+
+int main(int argc, char *argv[])
+{
+	EVP_PKEY *private_key = NULL;
+	X509 *cert = NULL;
+	int ret = EXIT_FAILURE;
+
+	if (argc < 2) {
+		fprintf(stderr, "usage: %s [certificate (PEM or URL)] [private key URL]n", argv[0]);
+		return ret;
+	}
+
+	/* Load PKCS#11 provider */
+        if (!OSSL_PROVIDER_available(NULL, "pkcs11prov")) {
+		if (!provider_load("pkcs11prov")) {
+			fprintf(stderr, "Failed to load \"pkcs11prov\" provider\n");
+			display_openssl_errors();
+			goto cleanup;
+		}
+		/* load the default provider explicitly */
+		if (!provider_load("default")) {
+			fprintf(stderr, "Failed to load \"default\" provider\n");
+			display_openssl_errors();
+			goto cleanup;
+		}
+	}
+
+	/* Load certificate */
+	cert = load_cert(argv[1]);
+	if (!cert) {
+		fprintf(stderr, "Cannot load certificate: %s\n", argv[1]);
+		display_openssl_errors();
+		goto cleanup;
+	}
+	printf("Certificate found: %s\n", argv[1]);
+
+	/* Load private key */
+	private_key = load_pkey(argv[2]);
+	if (!private_key) {
+		fprintf(stderr, "Cannot load private key: %s\n", argv[1]);
+		display_openssl_errors();
+		goto cleanup;
+	}
+	printf("Private key found.\n");
+
+	ret = X509_check_private_key(cert, private_key);
+	if (!ret) {
+		printf("Could not check private key.\n");
+		display_openssl_errors();
+		goto cleanup;
+	}
+
+	printf("Key and certificate matched.\n");
+	ret = EXIT_SUCCESS;
+
+cleanup:
+	X509_free(cert);
+	EVP_PKEY_free(private_key);
+	providers_cleanup();
+	return ret;
+}
+
+#else
+
+int main() {
+	return 0;
+}
+
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+
+/* vim: set noexpandtab: */