luna - wolfssl/tests/api/test_evp

   1/* test_evp_cipher.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#ifdef NO_INLINE
  25    #include <wolfssl/wolfcrypt/misc.h>
  26#else
  27    #define WOLFSSL_MISC_INCLUDED
  28    #include <wolfcrypt/src/misc.c>
  29#endif
  30
  31#include <wolfssl/openssl/evp.h>
  32#include <tests/api/api.h>
  33#include <tests/api/test_evp_cipher.h>
  34#if defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 2)
  35    #include <wolfssl/wolfcrypt/wc_encrypt.h>
  36#endif
  37
  38
  39int test_wolfSSL_EVP_CIPHER_CTX(void)
  40{
  41    EXPECT_DECLS;
  42#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_128) && \
  43    defined(OPENSSL_EXTRA)
  44    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
  45    const EVP_CIPHER *init = EVP_aes_128_cbc();
  46    const EVP_CIPHER *test;
  47    byte key[AES_BLOCK_SIZE] = {0};
  48    byte iv[AES_BLOCK_SIZE] = {0};
  49
  50    ExpectNotNull(ctx);
  51    wolfSSL_EVP_CIPHER_CTX_init(ctx);
  52    ExpectIntEQ(EVP_CipherInit(ctx, init, key, iv, 1), WOLFSSL_SUCCESS);
  53    test = EVP_CIPHER_CTX_cipher(ctx);
  54    ExpectTrue(init == test);
  55    ExpectIntEQ(EVP_CIPHER_nid(test), NID_aes_128_cbc);
  56
  57    ExpectIntEQ(EVP_CIPHER_CTX_reset(ctx), WOLFSSL_SUCCESS);
  58    ExpectIntEQ(EVP_CIPHER_CTX_reset(NULL), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
  59
  60    EVP_CIPHER_CTX_free(ctx);
  61    /* test EVP_CIPHER_CTX_cleanup with NULL */
  62    ExpectIntEQ(EVP_CIPHER_CTX_cleanup(NULL), WOLFSSL_SUCCESS);
  63#endif /* !NO_AES && HAVE_AES_CBC && WOLFSSL_AES_128 && OPENSSL_EXTRA */
  64    return EXPECT_RESULT();
  65}
  66
  67int test_wolfSSL_EVP_CIPHER_CTX_iv_length(void)
  68{
  69    EXPECT_DECLS;
  70#ifdef OPENSSL_ALL
  71    /* This is large enough to be used for all key sizes */
  72    byte key[AES_256_KEY_SIZE] = {0};
  73    byte iv[AES_BLOCK_SIZE] = {0};
  74    int i;
  75    int nids[] = {
  76    #ifdef HAVE_AES_CBC
  77         NID_aes_128_cbc,
  78    #endif
  79    #if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
  80        (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2))
  81    #ifdef HAVE_AESGCM
  82         NID_aes_128_gcm,
  83    #endif
  84    #endif /* (HAVE_FIPS && !HAVE_SELFTEST) || HAVE_FIPS_VERSION > 2 */
  85    #ifdef WOLFSSL_AES_COUNTER
  86         NID_aes_128_ctr,
  87    #endif
  88    #ifndef NO_DES3
  89         NID_des_cbc,
  90         NID_des_ede3_cbc,
  91    #endif
  92    };
  93    int iv_lengths[] = {
  94    #ifdef HAVE_AES_CBC
  95         AES_BLOCK_SIZE,
  96    #endif
  97    #if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
  98        (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2))
  99    #ifdef HAVE_AESGCM
 100         GCM_NONCE_MID_SZ,
 101    #endif
 102    #endif /* (HAVE_FIPS && !HAVE_SELFTEST) || HAVE_FIPS_VERSION > 2 */
 103    #ifdef WOLFSSL_AES_COUNTER
 104         AES_BLOCK_SIZE,
 105    #endif
 106    #ifndef NO_DES3
 107         DES_BLOCK_SIZE,
 108         DES_BLOCK_SIZE,
 109    #endif
 110    };
 111    int nidsLen = (sizeof(nids)/sizeof(int));
 112
 113    for (i = 0; i < nidsLen; i++) {
 114        const EVP_CIPHER* init = wolfSSL_EVP_get_cipherbynid(nids[i]);
 115        EVP_CIPHER_CTX* ctx = EVP_CIPHER_CTX_new();
 116        wolfSSL_EVP_CIPHER_CTX_init(ctx);
 117
 118        ExpectIntEQ(EVP_CipherInit(ctx, init, key, iv, 1), WOLFSSL_SUCCESS);
 119        ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_iv_length(ctx), iv_lengths[i]);
 120
 121        EVP_CIPHER_CTX_free(ctx);
 122    }
 123#endif
 124    return EXPECT_RESULT();
 125}
 126
 127int test_wolfSSL_EVP_CIPHER_CTX_key_length(void)
 128{
 129    EXPECT_DECLS;
 130#ifdef OPENSSL_ALL
 131    byte key[AES_256_KEY_SIZE] = {0};
 132    byte iv[AES_BLOCK_SIZE] = {0};
 133    int i;
 134    int nids[] = {
 135    #ifdef HAVE_AES_CBC
 136        NID_aes_128_cbc,
 137        #ifdef WOLFSSL_AES_256
 138        NID_aes_256_cbc,
 139        #endif
 140    #endif
 141    #if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
 142        (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2))
 143    #ifdef HAVE_AESGCM
 144        NID_aes_128_gcm,
 145        #ifdef WOLFSSL_AES_256
 146        NID_aes_256_gcm,
 147        #endif
 148    #endif
 149    #endif /* (HAVE_FIPS && !HAVE_SELFTEST) || HAVE_FIPS_VERSION > 2 */
 150    #ifdef WOLFSSL_AES_COUNTER
 151        NID_aes_128_ctr,
 152        #ifdef WOLFSSL_AES_256
 153        NID_aes_256_ctr,
 154        #endif
 155    #endif
 156    #ifndef NO_DES3
 157         NID_des_cbc,
 158         NID_des_ede3_cbc,
 159    #endif
 160    };
 161    int key_lengths[] = {
 162    #ifdef HAVE_AES_CBC
 163        AES_128_KEY_SIZE,
 164        #ifdef WOLFSSL_AES_256
 165        AES_256_KEY_SIZE,
 166        #endif
 167    #endif
 168    #if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
 169        (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2))
 170    #ifdef HAVE_AESGCM
 171        AES_128_KEY_SIZE,
 172        #ifdef WOLFSSL_AES_256
 173        AES_256_KEY_SIZE,
 174        #endif
 175    #endif
 176    #endif /* (HAVE_FIPS && !HAVE_SELFTEST) || HAVE_FIPS_VERSION > 2 */
 177    #ifdef WOLFSSL_AES_COUNTER
 178        AES_128_KEY_SIZE,
 179        #ifdef WOLFSSL_AES_256
 180        AES_256_KEY_SIZE,
 181        #endif
 182    #endif
 183    #ifndef NO_DES3
 184         DES_KEY_SIZE,
 185         DES3_KEY_SIZE,
 186    #endif
 187    };
 188    int nidsLen = (sizeof(nids)/sizeof(int));
 189
 190    for (i = 0; i < nidsLen; i++) {
 191        const EVP_CIPHER *init = wolfSSL_EVP_get_cipherbynid(nids[i]);
 192        EVP_CIPHER_CTX* ctx = EVP_CIPHER_CTX_new();
 193        wolfSSL_EVP_CIPHER_CTX_init(ctx);
 194
 195        ExpectIntEQ(EVP_CipherInit(ctx, init, key, iv, 1), WOLFSSL_SUCCESS);
 196        ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_key_length(ctx), key_lengths[i]);
 197
 198        ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_set_key_length(ctx, key_lengths[i]),
 199            WOLFSSL_SUCCESS);
 200
 201        EVP_CIPHER_CTX_free(ctx);
 202    }
 203#endif
 204    return EXPECT_RESULT();
 205}
 206
 207int test_wolfSSL_EVP_CIPHER_CTX_set_iv(void)
 208{
 209    EXPECT_DECLS;
 210#if defined(HAVE_AESGCM) && !defined(NO_DES3) && defined(OPENSSL_ALL)
 211    int ivLen, keyLen;
 212    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
 213#ifdef HAVE_AESGCM
 214    byte key[AES_128_KEY_SIZE] = {0};
 215    byte iv[AES_BLOCK_SIZE] = {0};
 216    const EVP_CIPHER *init = EVP_aes_128_gcm();
 217#else
 218    byte key[DES3_KEY_SIZE] = {0};
 219    byte iv[DES_BLOCK_SIZE] = {0};
 220    const EVP_CIPHER *init = EVP_des_ede3_cbc();
 221#endif
 222
 223    wolfSSL_EVP_CIPHER_CTX_init(ctx);
 224    ExpectIntEQ(EVP_CipherInit(ctx, init, key, iv, 1), WOLFSSL_SUCCESS);
 225
 226    ivLen = wolfSSL_EVP_CIPHER_CTX_iv_length(ctx);
 227    keyLen = wolfSSL_EVP_CIPHER_CTX_key_length(ctx);
 228
 229    /* Bad cases */
 230    ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_set_iv(NULL, iv, ivLen),
 231        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 232    ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_set_iv(ctx, NULL, ivLen),
 233        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 234    ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_set_iv(ctx, iv, 0),
 235        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 236    ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_set_iv(NULL, NULL, 0),
 237        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 238    ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_set_iv(ctx, iv, keyLen),
 239        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 240
 241    /* Good case */
 242    ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_set_iv(ctx, iv, ivLen), 1);
 243
 244    EVP_CIPHER_CTX_free(ctx);
 245#endif
 246    return EXPECT_RESULT();
 247}
 248
 249int test_wolfSSL_EVP_get_cipherbynid(void)
 250{
 251    EXPECT_DECLS;
 252#ifdef OPENSSL_EXTRA
 253#ifndef NO_AES
 254    const WOLFSSL_EVP_CIPHER* c;
 255
 256    c = wolfSSL_EVP_get_cipherbynid(419);
 257    #if (defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT)) && \
 258         defined(WOLFSSL_AES_128)
 259        ExpectNotNull(c);
 260        ExpectNotNull(XSTRCMP("EVP_AES_128_CBC", c));
 261    #else
 262        ExpectNull(c);
 263    #endif
 264
 265    c = wolfSSL_EVP_get_cipherbynid(423);
 266    #if (defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT)) && \
 267         defined(WOLFSSL_AES_192)
 268        ExpectNotNull(c);
 269        ExpectNotNull(XSTRCMP("EVP_AES_192_CBC", c));
 270    #else
 271        ExpectNull(c);
 272    #endif
 273
 274    c = wolfSSL_EVP_get_cipherbynid(427);
 275    #if (defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT)) && \
 276         defined(WOLFSSL_AES_256)
 277        ExpectNotNull(c);
 278        ExpectNotNull(XSTRCMP("EVP_AES_256_CBC", c));
 279    #else
 280        ExpectNull(c);
 281    #endif
 282
 283    c = wolfSSL_EVP_get_cipherbynid(904);
 284    #if defined(WOLFSSL_AES_COUNTER) && defined(WOLFSSL_AES_128)
 285        ExpectNotNull(c);
 286        ExpectNotNull(XSTRCMP("EVP_AES_128_CTR", c));
 287    #else
 288        ExpectNull(c);
 289    #endif
 290
 291    c = wolfSSL_EVP_get_cipherbynid(905);
 292    #if defined(WOLFSSL_AES_COUNTER) && defined(WOLFSSL_AES_192)
 293        ExpectNotNull(c);
 294        ExpectNotNull(XSTRCMP("EVP_AES_192_CTR", c));
 295    #else
 296        ExpectNull(c);
 297    #endif
 298
 299    c = wolfSSL_EVP_get_cipherbynid(906);
 300    #if defined(WOLFSSL_AES_COUNTER) && defined(WOLFSSL_AES_256)
 301        ExpectNotNull(c);
 302        ExpectNotNull(XSTRCMP("EVP_AES_256_CTR", c));
 303    #else
 304        ExpectNull(c);
 305    #endif
 306
 307    c = wolfSSL_EVP_get_cipherbynid(418);
 308    #if defined(HAVE_AES_ECB) && defined(WOLFSSL_AES_128)
 309        ExpectNotNull(c);
 310        ExpectNotNull(XSTRCMP("EVP_AES_128_ECB", c));
 311    #else
 312        ExpectNull(c);
 313    #endif
 314
 315    c = wolfSSL_EVP_get_cipherbynid(422);
 316    #if defined(HAVE_AES_ECB) && defined(WOLFSSL_AES_192)
 317        ExpectNotNull(c);
 318        ExpectNotNull(XSTRCMP("EVP_AES_192_ECB", c));
 319    #else
 320        ExpectNull(c);
 321    #endif
 322
 323    c = wolfSSL_EVP_get_cipherbynid(426);
 324    #if defined(HAVE_AES_ECB) && defined(WOLFSSL_AES_256)
 325        ExpectNotNull(c);
 326        ExpectNotNull(XSTRCMP("EVP_AES_256_ECB", c));
 327    #else
 328        ExpectNull(c);
 329    #endif
 330#endif /* !NO_AES */
 331
 332#ifndef NO_DES3
 333    ExpectNotNull(XSTRCMP("EVP_DES_CBC", wolfSSL_EVP_get_cipherbynid(31)));
 334#ifdef WOLFSSL_DES_ECB
 335    ExpectNotNull(XSTRCMP("EVP_DES_ECB", wolfSSL_EVP_get_cipherbynid(29)));
 336#endif
 337    ExpectNotNull(XSTRCMP("EVP_DES_EDE3_CBC", wolfSSL_EVP_get_cipherbynid(44)));
 338#ifdef WOLFSSL_DES_ECB
 339    ExpectNotNull(XSTRCMP("EVP_DES_EDE3_ECB", wolfSSL_EVP_get_cipherbynid(33)));
 340#endif
 341#endif /* !NO_DES3 */
 342
 343#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
 344    ExpectNotNull(XSTRCMP("EVP_CHACHA20_POLY13O5", EVP_get_cipherbynid(1018)));
 345#endif
 346
 347    /* test for nid is out of range */
 348    ExpectNull(wolfSSL_EVP_get_cipherbynid(1));
 349#endif
 350    return EXPECT_RESULT();
 351}
 352
 353int test_wolfSSL_EVP_CIPHER_block_size(void)
 354{
 355    EXPECT_DECLS;
 356#ifdef OPENSSL_ALL
 357#ifdef HAVE_AES_CBC
 358    #ifdef WOLFSSL_AES_128
 359    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_128_cbc()), AES_BLOCK_SIZE);
 360    #endif
 361    #ifdef WOLFSSL_AES_192
 362    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_192_cbc()), AES_BLOCK_SIZE);
 363    #endif
 364    #ifdef WOLFSSL_AES_256
 365    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_256_cbc()), AES_BLOCK_SIZE);
 366    #endif
 367#endif
 368
 369#ifdef HAVE_AESGCM
 370    #ifdef WOLFSSL_AES_128
 371    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_128_gcm()), 1);
 372    #endif
 373    #ifdef WOLFSSL_AES_192
 374    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_192_gcm()), 1);
 375    #endif
 376    #ifdef WOLFSSL_AES_256
 377    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_256_gcm()), 1);
 378    #endif
 379#endif
 380
 381#ifdef HAVE_AESCCM
 382    #ifdef WOLFSSL_AES_128
 383    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_128_ccm()), 1);
 384    #endif
 385    #ifdef WOLFSSL_AES_192
 386    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_192_ccm()), 1);
 387    #endif
 388    #ifdef WOLFSSL_AES_256
 389    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_256_ccm()), 1);
 390    #endif
 391#endif
 392
 393#ifdef WOLFSSL_AES_COUNTER
 394    #ifdef WOLFSSL_AES_128
 395    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_128_ctr()), 1);
 396    #endif
 397    #ifdef WOLFSSL_AES_192
 398    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_192_ctr()), 1);
 399    #endif
 400    #ifdef WOLFSSL_AES_256
 401    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_256_ctr()), 1);
 402    #endif
 403#endif
 404
 405#ifdef HAVE_AES_ECB
 406    #ifdef WOLFSSL_AES_128
 407    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_128_ecb()), AES_BLOCK_SIZE);
 408    #endif
 409    #ifdef WOLFSSL_AES_192
 410    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_192_ecb()), AES_BLOCK_SIZE);
 411    #endif
 412    #ifdef WOLFSSL_AES_256
 413    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_256_ecb()), AES_BLOCK_SIZE);
 414    #endif
 415#endif
 416
 417#ifdef WOLFSSL_AES_OFB
 418    #ifdef WOLFSSL_AES_128
 419    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_128_ofb()), 1);
 420    #endif
 421    #ifdef WOLFSSL_AES_192
 422    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_192_ofb()), 1);
 423    #endif
 424    #ifdef WOLFSSL_AES_256
 425    ExpectIntEQ(EVP_CIPHER_block_size(EVP_aes_256_ofb()), 1);
 426    #endif
 427#endif
 428
 429#ifndef NO_RC4
 430    ExpectIntEQ(EVP_CIPHER_block_size(wolfSSL_EVP_rc4()), 1);
 431#endif
 432
 433#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
 434    ExpectIntEQ(EVP_CIPHER_block_size(wolfSSL_EVP_chacha20_poly1305()), 1);
 435#endif
 436
 437#ifdef WOLFSSL_SM4_ECB
 438    ExpectIntEQ(EVP_CIPHER_block_size(EVP_sm4_ecb()), SM4_BLOCK_SIZE);
 439#endif
 440#ifdef WOLFSSL_SM4_CBC
 441    ExpectIntEQ(EVP_CIPHER_block_size(EVP_sm4_cbc()), SM4_BLOCK_SIZE);
 442#endif
 443#ifdef WOLFSSL_SM4_CTR
 444    ExpectIntEQ(EVP_CIPHER_block_size(EVP_sm4_ctr()), 1);
 445#endif
 446#ifdef WOLFSSL_SM4_GCM
 447    ExpectIntEQ(EVP_CIPHER_block_size(EVP_sm4_gcm()), 1);
 448#endif
 449#ifdef WOLFSSL_SM4_CCM
 450    ExpectIntEQ(EVP_CIPHER_block_size(EVP_sm4_ccm()), 1);
 451#endif
 452#endif
 453    return EXPECT_RESULT();
 454}
 455
 456int test_wolfSSL_EVP_CIPHER_iv_length(void)
 457{
 458    EXPECT_DECLS;
 459#ifdef OPENSSL_ALL
 460    int nids[] = {
 461    #if defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT)
 462    #ifdef WOLFSSL_AES_128
 463        NID_aes_128_cbc,
 464    #endif
 465    #ifdef WOLFSSL_AES_192
 466        NID_aes_192_cbc,
 467    #endif
 468    #ifdef WOLFSSL_AES_256
 469        NID_aes_256_cbc,
 470    #endif
 471    #endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT */
 472    #if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
 473        (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2))
 474    #ifdef HAVE_AESGCM
 475        #ifdef WOLFSSL_AES_128
 476            NID_aes_128_gcm,
 477        #endif
 478        #ifdef WOLFSSL_AES_192
 479            NID_aes_192_gcm,
 480        #endif
 481        #ifdef WOLFSSL_AES_256
 482            NID_aes_256_gcm,
 483        #endif
 484    #endif /* HAVE_AESGCM */
 485    #endif /* (HAVE_FIPS && !HAVE_SELFTEST) || HAVE_FIPS_VERSION > 2 */
 486    #ifdef WOLFSSL_AES_COUNTER
 487    #ifdef WOLFSSL_AES_128
 488         NID_aes_128_ctr,
 489    #endif
 490    #ifdef WOLFSSL_AES_192
 491        NID_aes_192_ctr,
 492    #endif
 493    #ifdef WOLFSSL_AES_256
 494        NID_aes_256_ctr,
 495    #endif
 496    #endif
 497    #ifndef NO_DES3
 498         NID_des_cbc,
 499         NID_des_ede3_cbc,
 500    #endif
 501    #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
 502         NID_chacha20_poly1305,
 503    #endif
 504    };
 505    int iv_lengths[] = {
 506    #if defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT)
 507    #ifdef WOLFSSL_AES_128
 508            AES_BLOCK_SIZE,
 509    #endif
 510    #ifdef WOLFSSL_AES_192
 511            AES_BLOCK_SIZE,
 512    #endif
 513    #ifdef WOLFSSL_AES_256
 514            AES_BLOCK_SIZE,
 515    #endif
 516    #endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT */
 517    #if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
 518        (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2))
 519    #ifdef HAVE_AESGCM
 520        #ifdef WOLFSSL_AES_128
 521            GCM_NONCE_MID_SZ,
 522        #endif
 523        #ifdef WOLFSSL_AES_192
 524            GCM_NONCE_MID_SZ,
 525        #endif
 526        #ifdef WOLFSSL_AES_256
 527            GCM_NONCE_MID_SZ,
 528        #endif
 529    #endif /* HAVE_AESGCM */
 530    #endif /* (HAVE_FIPS && !HAVE_SELFTEST) || HAVE_FIPS_VERSION > 2 */
 531    #ifdef WOLFSSL_AES_COUNTER
 532    #ifdef WOLFSSL_AES_128
 533            AES_BLOCK_SIZE,
 534    #endif
 535    #ifdef WOLFSSL_AES_192
 536            AES_BLOCK_SIZE,
 537    #endif
 538    #ifdef WOLFSSL_AES_256
 539            AES_BLOCK_SIZE,
 540    #endif
 541    #endif
 542    #ifndef NO_DES3
 543            DES_BLOCK_SIZE,
 544            DES_BLOCK_SIZE,
 545    #endif
 546    #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
 547            CHACHA20_POLY1305_AEAD_IV_SIZE,
 548    #endif
 549    };
 550    int i;
 551    int nidsLen = (sizeof(nids)/sizeof(int));
 552
 553    for (i = 0; i < nidsLen; i++) {
 554        const EVP_CIPHER *c = EVP_get_cipherbynid(nids[i]);
 555        ExpectIntEQ(EVP_CIPHER_iv_length(c), iv_lengths[i]);
 556    }
 557#endif
 558    return EXPECT_RESULT();
 559}
 560
 561/* Test for NULL_CIPHER_TYPE in wolfSSL_EVP_CipherUpdate() */
 562int test_wolfSSL_EVP_CipherUpdate_Null(void)
 563{
 564    EXPECT_DECLS;
 565#ifdef OPENSSL_EXTRA
 566    WOLFSSL_EVP_CIPHER_CTX* ctx;
 567    const char* testData = "Test NULL cipher data";
 568    unsigned char output[100];
 569    int outputLen = 0;
 570    int testDataLen = (int)XSTRLEN(testData);
 571
 572    /* Create and initialize the cipher context */
 573    ctx = wolfSSL_EVP_CIPHER_CTX_new();
 574    ExpectNotNull(ctx);
 575
 576    /* Initialize with NULL cipher */
 577    ExpectIntEQ(wolfSSL_EVP_CipherInit_ex(ctx, wolfSSL_EVP_enc_null(),
 578                                         NULL, NULL, NULL, 1), WOLFSSL_SUCCESS);
 579
 580    /* Test encryption (which should just copy the data) */
 581    ExpectIntEQ(wolfSSL_EVP_CipherUpdate(ctx, output, &outputLen,
 582                                        (const unsigned char*)testData,
 583                                        testDataLen), WOLFSSL_SUCCESS);
 584
 585    /* Verify output length matches input length */
 586    ExpectIntEQ(outputLen, testDataLen);
 587
 588    /* Verify output data matches input data (no encryption occurred) */
 589    ExpectIntEQ(XMEMCMP(output, testData, testDataLen), 0);
 590
 591    /* Clean up */
 592    wolfSSL_EVP_CIPHER_CTX_free(ctx);
 593#endif /* OPENSSL_EXTRA */
 594
 595    return EXPECT_RESULT();
 596}
 597
 598/* Test for wolfSSL_EVP_CIPHER_type_string() */
 599int test_wolfSSL_EVP_CIPHER_type_string(void)
 600{
 601    EXPECT_DECLS;
 602#ifdef OPENSSL_EXTRA
 603    const char* cipherStr;
 604
 605    /* Test with valid cipher types */
 606#ifdef HAVE_AES_CBC
 607    #ifdef WOLFSSL_AES_128
 608    cipherStr = wolfSSL_EVP_CIPHER_type_string(WC_AES_128_CBC_TYPE);
 609    ExpectNotNull(cipherStr);
 610    ExpectStrEQ(cipherStr, "AES-128-CBC");
 611    #endif
 612#endif
 613
 614#ifndef NO_DES3
 615    cipherStr = wolfSSL_EVP_CIPHER_type_string(WC_DES_CBC_TYPE);
 616    ExpectNotNull(cipherStr);
 617    ExpectStrEQ(cipherStr, "DES-CBC");
 618#endif
 619
 620    /* Test with NULL cipher type */
 621    cipherStr = wolfSSL_EVP_CIPHER_type_string(WC_NULL_CIPHER_TYPE);
 622    ExpectNotNull(cipherStr);
 623    ExpectStrEQ(cipherStr, "NULL");
 624
 625    /* Test with invalid cipher type */
 626    cipherStr = wolfSSL_EVP_CIPHER_type_string(0xFFFF);
 627    ExpectNull(cipherStr);
 628#endif /* OPENSSL_EXTRA */
 629
 630    return EXPECT_RESULT();
 631}
 632
 633int test_wolfSSL_EVP_BytesToKey(void)
 634{
 635    EXPECT_DECLS;
 636#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(OPENSSL_ALL)
 637    byte                key[AES_BLOCK_SIZE] = {0};
 638    byte                iv[AES_BLOCK_SIZE] = {0};
 639    int                 count = 0;
 640    const               EVP_MD* md = EVP_sha256();
 641    const EVP_CIPHER    *type;
 642    const unsigned char *salt = (unsigned char *)"salt1234";
 643    int                 sz = 5;
 644    const byte data[] = {
 645        0x48,0x65,0x6c,0x6c,0x6f,0x20,0x57,0x6f,
 646        0x72,0x6c,0x64
 647    };
 648
 649    type = wolfSSL_EVP_get_cipherbynid(NID_aes_128_cbc);
 650
 651    /* Bad cases */
 652    ExpectIntEQ(EVP_BytesToKey(NULL, md, salt, data, sz, count, key, iv),
 653                 0);
 654    ExpectIntEQ(EVP_BytesToKey(type, md, salt, NULL, sz, count, key, iv),
 655                16);
 656    md = "2";
 657    ExpectIntEQ(EVP_BytesToKey(type, md, salt, data, sz, count, key, iv),
 658                 WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 659
 660    /* Good case */
 661    md = EVP_sha256();
 662    ExpectIntEQ(EVP_BytesToKey(type, md, salt, data, sz, count, key, iv),
 663                 16);
 664#endif
 665    return EXPECT_RESULT();
 666}
 667
 668#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) &&\
 669    (!defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_128))
 670static void binary_dump(void *ptr, int size)
 671{
 672    #ifdef WOLFSSL_EVP_PRINT
 673    int i = 0;
 674    unsigned char *p = (unsigned char *) ptr;
 675
 676    fprintf(stderr, "{");
 677    while ((p != NULL) && (i < size)) {
 678        if ((i % 8) == 0) {
 679            fprintf(stderr, "\n");
 680            fprintf(stderr, "    ");
 681        }
 682        fprintf(stderr, "0x%02x, ", p[i]);
 683        i++;
 684    }
 685    fprintf(stderr, "\n};\n");
 686    #else
 687    (void) ptr;
 688    (void) size;
 689    #endif
 690}
 691
 692static int last_val = 0x0f;
 693
 694static int check_result(unsigned char *data, int len)
 695{
 696    int i;
 697
 698    for ( ; len; ) {
 699            last_val = (last_val + 1) % 16;
 700            for (i = 0; i < 16; len--, i++, data++)
 701                    if (*data != last_val) {
 702                            return -1;
 703                    }
 704    }
 705    return 0;
 706}
 707
 708static int r_offset;
 709static int w_offset;
 710
 711static void init_offset(void)
 712{
 713    r_offset = 0;
 714    w_offset = 0;
 715}
 716
 717static void get_record(unsigned char *data, unsigned char *buf, int len)
 718{
 719    XMEMCPY(buf, data+r_offset, len);
 720    r_offset += len;
 721}
 722
 723static void set_record(unsigned char *data, unsigned char *buf, int len)
 724{
 725    XMEMCPY(data+w_offset, buf, len);
 726    w_offset += len;
 727}
 728
 729static void set_plain(unsigned char *plain, int rec)
 730{
 731    int i, j;
 732    unsigned char *p = plain;
 733
 734    #define BLOCKSZ 16
 735
 736    for (i=0; i<(rec/BLOCKSZ); i++) {
 737        for (j=0; j<BLOCKSZ; j++)
 738            *p++ = (i % 16);
 739    }
 740}
 741#endif
 742
 743int test_wolfSSL_EVP_Cipher_extra(void)
 744{
 745    EXPECT_DECLS;
 746#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) &&\
 747    (!defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_128))
 748    /* aes128-cbc, keylen=16, ivlen=16 */
 749    byte aes128_cbc_key[] = {
 750        0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, 0xef,
 751        0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, 0xef,
 752    };
 753
 754    byte aes128_cbc_iv[] = {
 755        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
 756        0x99, 0x00, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
 757    };
 758
 759    /* teset data size table */
 760    static const int test_drive1[] = {8, 3, 5, 512, 8, 3, 8, 512, 0};
 761    static const int test_drive2[] = {8, 3, 8, 512, 0};
 762    static const int test_drive3[] = {512, 512, 504, 512, 512, 8, 512, 0};
 763
 764    static const int *test_drive[] = { test_drive1, test_drive2, test_drive3,
 765                                       NULL };
 766
 767    int test_drive_len[100];
 768
 769    int ret = 0;
 770    EVP_CIPHER_CTX *evp = NULL;
 771
 772    int ilen = 0;
 773    int klen = 0;
 774    int i, j;
 775
 776    const EVP_CIPHER *type;
 777    byte *iv;
 778    byte *key;
 779    int ivlen;
 780    int keylen;
 781
 782    #define RECORDS 16
 783    #define BUFFSZ  512
 784    byte plain [BUFFSZ * RECORDS];
 785    byte cipher[BUFFSZ * RECORDS];
 786
 787    byte inb[BUFFSZ];
 788    byte outb[BUFFSZ+16];
 789    int outl = 0;
 790    int inl;
 791
 792    iv = aes128_cbc_iv;
 793    ivlen = sizeof(aes128_cbc_iv);
 794    key = aes128_cbc_key;
 795    keylen = sizeof(aes128_cbc_key);
 796    type = EVP_aes_128_cbc();
 797
 798    set_plain(plain, BUFFSZ * RECORDS);
 799
 800    ExpectNotNull(evp = EVP_CIPHER_CTX_new());
 801    ExpectIntNE((ret = EVP_CipherInit(evp, type, NULL, iv, 0)), 0);
 802
 803    ExpectIntEQ(EVP_CIPHER_CTX_nid(evp), NID_aes_128_cbc);
 804
 805    klen = EVP_CIPHER_CTX_key_length(evp);
 806    if (klen > 0 && keylen != klen) {
 807        ExpectIntNE(EVP_CIPHER_CTX_set_key_length(evp, keylen), 0);
 808    }
 809    ilen = EVP_CIPHER_CTX_iv_length(evp);
 810    if (ilen > 0 && ivlen != ilen) {
 811        ExpectIntNE(EVP_CIPHER_CTX_set_iv_length(evp, ivlen), 0);
 812    }
 813
 814    ExpectIntNE((ret = EVP_CipherInit(evp, NULL, key, iv, 1)), 0);
 815
 816    for (j = 0; j<RECORDS; j++)
 817    {
 818        inl = BUFFSZ;
 819        get_record(plain, inb, inl);
 820        ExpectIntNE((ret = EVP_CipherUpdate(evp, outb, &outl, inb, inl)), 0);
 821        set_record(cipher, outb, outl);
 822    }
 823
 824    for (i = 0; test_drive[i]; i++) {
 825
 826        ExpectIntNE((ret = EVP_CipherInit(evp, NULL, key, iv, 1)), 0);
 827
 828        init_offset();
 829        test_drive_len[i] = 0;
 830        for (j = 0; test_drive[i][j]; j++)
 831        {
 832            inl = test_drive[i][j];
 833            test_drive_len[i] += inl;
 834
 835            get_record(plain, inb, inl);
 836            ExpectIntNE((ret = EVP_EncryptUpdate(evp, outb, &outl, inb, inl)),
 837                0);
 838            /* output to cipher buffer, so that following Dec test can detect
 839               if any error */
 840            set_record(cipher, outb, outl);
 841        }
 842
 843        EVP_CipherFinal(evp, outb, &outl);
 844
 845        if (outl > 0)
 846            set_record(cipher, outb, outl);
 847    }
 848
 849    for (i = 0; test_drive[i]; i++) {
 850        last_val = 0x0f;
 851
 852        ExpectIntNE((ret = EVP_CipherInit(evp, NULL, key, iv, 0)), 0);
 853
 854        init_offset();
 855
 856        for (j = 0; test_drive[i][j]; j++) {
 857            inl = test_drive[i][j];
 858            get_record(cipher, inb, inl);
 859
 860            ExpectIntNE((ret = EVP_DecryptUpdate(evp, outb, &outl, inb, inl)),
 861                0);
 862
 863            binary_dump(outb, outl);
 864            ExpectIntEQ((ret = check_result(outb, outl)), 0);
 865            ExpectFalse(outl > ((inl/16+1)*16) && outl > 16);
 866        }
 867
 868        ret = EVP_CipherFinal(evp, outb, &outl);
 869
 870        binary_dump(outb, outl);
 871
 872        ret = (((test_drive_len[i] % 16) != 0) && (ret == 0)) ||
 873                 (((test_drive_len[i] % 16) == 0) && (ret == 1));
 874        ExpectTrue(ret);
 875    }
 876
 877    ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_cleanup(evp), WOLFSSL_SUCCESS);
 878
 879    EVP_CIPHER_CTX_free(evp);
 880    evp = NULL;
 881
 882    /* Do an extra test to verify correct behavior with empty input. */
 883
 884    ExpectNotNull(evp = EVP_CIPHER_CTX_new());
 885    ExpectIntNE((ret = EVP_CipherInit(evp, type, NULL, iv, 0)), 0);
 886
 887    ExpectIntEQ(EVP_CIPHER_CTX_nid(evp), NID_aes_128_cbc);
 888
 889    klen = EVP_CIPHER_CTX_key_length(evp);
 890    if (klen > 0 && keylen != klen) {
 891        ExpectIntNE(EVP_CIPHER_CTX_set_key_length(evp, keylen), 0);
 892    }
 893    ilen = EVP_CIPHER_CTX_iv_length(evp);
 894    if (ilen > 0 && ivlen != ilen) {
 895        ExpectIntNE(EVP_CIPHER_CTX_set_iv_length(evp, ivlen), 0);
 896    }
 897
 898    ExpectIntNE((ret = EVP_CipherInit(evp, NULL, key, iv, 1)), 0);
 899
 900    /* outl should be set to 0 after passing NULL, 0 for input args. */
 901    outl = -1;
 902    ExpectIntNE((ret = EVP_CipherUpdate(evp, outb, &outl, NULL, 0)), 0);
 903    ExpectIntEQ(outl, 0);
 904
 905    EVP_CIPHER_CTX_free(evp);
 906#endif /* test_EVP_Cipher */
 907    return EXPECT_RESULT();
 908}
 909
 910int test_wolfSSL_EVP_X_STATE(void)
 911{
 912    EXPECT_DECLS;
 913#if !defined(NO_DES3) && !defined(NO_RC4) && defined(OPENSSL_ALL)
 914    byte key[DES3_KEY_SIZE] = {0};
 915    byte iv[DES_IV_SIZE] = {0};
 916    EVP_CIPHER_CTX *ctx = NULL;
 917    const EVP_CIPHER *init = NULL;
 918
 919    /* Bad test cases */
 920    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
 921    ExpectNotNull(init = EVP_des_ede3_cbc());
 922
 923    wolfSSL_EVP_CIPHER_CTX_init(ctx);
 924    ExpectIntEQ(EVP_CipherInit(ctx, init, key, iv, 1), WOLFSSL_SUCCESS);
 925
 926    ExpectNull(wolfSSL_EVP_X_STATE(NULL));
 927    ExpectNull(wolfSSL_EVP_X_STATE(ctx));
 928    EVP_CIPHER_CTX_free(ctx);
 929    ctx = NULL;
 930
 931    /* Good test case */
 932    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
 933    ExpectNotNull(init = wolfSSL_EVP_rc4());
 934
 935    wolfSSL_EVP_CIPHER_CTX_init(ctx);
 936    ExpectIntEQ(EVP_CipherInit(ctx, init, key, iv, 1), WOLFSSL_SUCCESS);
 937
 938    ExpectNotNull(wolfSSL_EVP_X_STATE(ctx));
 939    EVP_CIPHER_CTX_free(ctx);
 940#endif
 941    return EXPECT_RESULT();
 942}
 943int test_wolfSSL_EVP_X_STATE_LEN(void)
 944{
 945    EXPECT_DECLS;
 946#if !defined(NO_DES3) && !defined(NO_RC4) && defined(OPENSSL_ALL)
 947    byte key[DES3_KEY_SIZE] = {0};
 948    byte iv[DES_IV_SIZE] = {0};
 949    EVP_CIPHER_CTX *ctx = NULL;
 950    const EVP_CIPHER *init = NULL;
 951
 952    /* Bad test cases */
 953    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
 954    ExpectNotNull(init = EVP_des_ede3_cbc());
 955
 956    wolfSSL_EVP_CIPHER_CTX_init(ctx);
 957    ExpectIntEQ(EVP_CipherInit(ctx, init, key, iv, 1), WOLFSSL_SUCCESS);
 958
 959    ExpectIntEQ(wolfSSL_EVP_X_STATE_LEN(NULL), 0);
 960    ExpectIntEQ(wolfSSL_EVP_X_STATE_LEN(ctx), 0);
 961    EVP_CIPHER_CTX_free(ctx);
 962    ctx = NULL;
 963
 964    /* Good test case */
 965    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
 966    ExpectNotNull(init = wolfSSL_EVP_rc4());
 967
 968    wolfSSL_EVP_CIPHER_CTX_init(ctx);
 969    ExpectIntEQ(EVP_CipherInit(ctx, init, key, iv, 1), WOLFSSL_SUCCESS);
 970
 971    ExpectIntEQ(wolfSSL_EVP_X_STATE_LEN(ctx), sizeof(Arc4));
 972    EVP_CIPHER_CTX_free(ctx);
 973#endif
 974    return EXPECT_RESULT();
 975}
 976
 977
 978int test_wolfSSL_EVP_aes_256_gcm(void)
 979{
 980    EXPECT_DECLS;
 981#if defined(HAVE_AESGCM) && defined(WOLFSSL_AES_256) && defined(OPENSSL_ALL)
 982    ExpectNotNull(wolfSSL_EVP_aes_256_gcm());
 983#endif
 984    return EXPECT_RESULT();
 985}
 986
 987int test_wolfSSL_EVP_aes_192_gcm(void)
 988{
 989    EXPECT_DECLS;
 990#if defined(HAVE_AESGCM) && defined(WOLFSSL_AES_192) && defined(OPENSSL_ALL)
 991    ExpectNotNull(wolfSSL_EVP_aes_192_gcm());
 992#endif
 993    return EXPECT_RESULT();
 994}
 995
 996int test_wolfSSL_EVP_aes_128_gcm(void)
 997{
 998    EXPECT_DECLS;
 999#if defined(HAVE_AESGCM) && defined(WOLFSSL_AES_128) && defined(OPENSSL_ALL)
1000    ExpectNotNull(wolfSSL_EVP_aes_128_gcm());
1001#endif
1002    return EXPECT_RESULT();
1003}
1004
1005int test_evp_cipher_aes_gcm(void)
1006{
1007    EXPECT_DECLS;
1008#if defined(HAVE_AESGCM) && defined(OPENSSL_ALL) && ((!defined(HAVE_FIPS) && \
1009    !defined(HAVE_SELFTEST)) || (defined(HAVE_FIPS_VERSION) && \
1010    (HAVE_FIPS_VERSION >= 2))) && defined(WOLFSSL_AES_256)
1011    /*
1012     * This test checks data at various points in the encrypt/decrypt process
1013     * against known values produced using the same test with OpenSSL. This
1014     * interop testing is critical for verifying the correctness of our
1015     * EVP_Cipher implementation with AES-GCM. Specifically, this test exercises
1016     * a flow supported by OpenSSL that uses the control command
1017     * EVP_CTRL_GCM_IV_GEN to increment the IV between cipher operations without
1018     * the need to call EVP_CipherInit. OpenSSH uses this flow, for example. We
1019     * had a bug with OpenSSH where wolfSSL OpenSSH servers could only talk to
1020     * wolfSSL OpenSSH clients because there was a bug in this flow that
1021     * happened to "cancel out" if both sides of the connection had the bug.
1022     */
1023    enum {
1024        NUM_ENCRYPTIONS = 3,
1025        AAD_SIZE = 4
1026    };
1027    static const byte plainText1[] = {
1028        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
1029        0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1030        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
1031    };
1032    static const byte plainText2[] = {
1033        0x42, 0x49, 0x3b, 0x27, 0x03, 0x35, 0x59, 0x14, 0x41, 0x47, 0x37, 0x14,
1034        0x0e, 0x34, 0x0d, 0x28, 0x63, 0x09, 0x0a, 0x5b, 0x22, 0x57, 0x42, 0x22,
1035        0x0f, 0x5c, 0x1e, 0x53, 0x45, 0x15, 0x62, 0x08, 0x60, 0x43, 0x50, 0x2c
1036    };
1037    static const byte plainText3[] = {
1038        0x36, 0x0d, 0x2b, 0x09, 0x4a, 0x56, 0x3b, 0x4c, 0x21, 0x22, 0x58, 0x0e,
1039        0x5b, 0x57, 0x10
1040    };
1041    static const byte* plainTexts[NUM_ENCRYPTIONS] = {
1042        plainText1,
1043        plainText2,
1044        plainText3
1045    };
1046    static const int plainTextSzs[NUM_ENCRYPTIONS] = {
1047        sizeof(plainText1),
1048        sizeof(plainText2),
1049        sizeof(plainText3)
1050    };
1051    static const byte aad1[AAD_SIZE] = {
1052        0x00, 0x00, 0x00, 0x01
1053    };
1054    static const byte aad2[AAD_SIZE] = {
1055        0x00, 0x00, 0x00, 0x10
1056    };
1057    static const byte aad3[AAD_SIZE] = {
1058        0x00, 0x00, 0x01, 0x00
1059    };
1060    static const byte* aads[NUM_ENCRYPTIONS] = {
1061        aad1,
1062        aad2,
1063        aad3
1064    };
1065    const byte iv[GCM_NONCE_MID_SZ] = {
1066        0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF
1067    };
1068    byte currentIv[GCM_NONCE_MID_SZ];
1069    const byte key[] = {
1070        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
1071        0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
1072        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f
1073    };
1074    const byte expIvs[NUM_ENCRYPTIONS][GCM_NONCE_MID_SZ] = {
1075        {
1076            0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE,
1077            0xEF
1078        },
1079        {
1080            0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE,
1081            0xF0
1082        },
1083        {
1084            0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE,
1085            0xF1
1086        }
1087    };
1088    const byte expTags[NUM_ENCRYPTIONS][AES_BLOCK_SIZE] = {
1089        {
1090            0x65, 0x4F, 0xF7, 0xA0, 0xBB, 0x7B, 0x90, 0xB7, 0x9C, 0xC8, 0x14,
1091            0x3D, 0x32, 0x18, 0x34, 0xA9
1092        },
1093        {
1094            0x50, 0x3A, 0x13, 0x8D, 0x91, 0x1D, 0xEC, 0xBB, 0xBA, 0x5B, 0x57,
1095            0xA2, 0xFD, 0x2D, 0x6B, 0x7F
1096        },
1097        {
1098            0x3B, 0xED, 0x18, 0x9C, 0xB3, 0xE3, 0x61, 0x1E, 0x11, 0xEB, 0x13,
1099            0x5B, 0xEC, 0x52, 0x49, 0x32,
1100        }
1101    };
1102    static const byte expCipherText1[] = {
1103        0xCB, 0x93, 0x4F, 0xC8, 0x22, 0xE2, 0xC0, 0x35, 0xAA, 0x6B, 0x41, 0x15,
1104        0x17, 0x30, 0x2F, 0x97, 0x20, 0x74, 0x39, 0x28, 0xF8, 0xEB, 0xC5, 0x51,
1105        0x7B, 0xD9, 0x8A, 0x36, 0xB8, 0xDA, 0x24, 0x80, 0xE7, 0x9E, 0x09, 0xDE
1106    };
1107    static const byte expCipherText2[] = {
1108        0xF9, 0x32, 0xE1, 0x87, 0x37, 0x0F, 0x04, 0xC1, 0xB5, 0x59, 0xF0, 0x45,
1109        0x3A, 0x0D, 0xA0, 0x26, 0xFF, 0xA6, 0x8D, 0x38, 0xFE, 0xB8, 0xE5, 0xC2,
1110        0x2A, 0x98, 0x4A, 0x54, 0x8F, 0x1F, 0xD6, 0x13, 0x03, 0xB2, 0x1B, 0xC0
1111    };
1112    static const byte expCipherText3[] = {
1113        0xD0, 0x37, 0x59, 0x1C, 0x2F, 0x85, 0x39, 0x4D, 0xED, 0xC2, 0x32, 0x5B,
1114        0x80, 0x5E, 0x6B,
1115    };
1116    static const byte* expCipherTexts[NUM_ENCRYPTIONS] = {
1117        expCipherText1,
1118        expCipherText2,
1119        expCipherText3
1120    };
1121    byte* cipherText = NULL;
1122    byte* calcPlainText = NULL;
1123    byte tag[AES_BLOCK_SIZE];
1124    EVP_CIPHER_CTX* encCtx = NULL;
1125    EVP_CIPHER_CTX* decCtx = NULL;
1126    int i, j, outl;
1127
1128    /****************************************************/
1129    for (i = 0; i < 3; ++i) {
1130        ExpectNotNull(encCtx = EVP_CIPHER_CTX_new());
1131        ExpectNotNull(decCtx = EVP_CIPHER_CTX_new());
1132
1133        /* First iteration, set key before IV. */
1134        if (i == 0) {
1135            ExpectIntEQ(EVP_CipherInit(encCtx, EVP_aes_256_gcm(), key, NULL, 1),
1136                        SSL_SUCCESS);
1137
1138            /*
1139             * The call to EVP_CipherInit below (with NULL key) should clear the
1140             * authIvGenEnable flag set by EVP_CTRL_GCM_SET_IV_FIXED. As such, a
1141             * subsequent EVP_CTRL_GCM_IV_GEN should fail. This matches OpenSSL
1142             * behavior.
1143             */
1144            ExpectIntEQ(EVP_CIPHER_CTX_ctrl(encCtx, EVP_CTRL_GCM_SET_IV_FIXED,
1145                        -1, (void*)iv), SSL_SUCCESS);
1146            ExpectIntEQ(EVP_CipherInit(encCtx, NULL, NULL, iv, 1),
1147                        SSL_SUCCESS);
1148            ExpectIntEQ(EVP_CIPHER_CTX_ctrl(encCtx, EVP_CTRL_GCM_IV_GEN, -1,
1149                        currentIv), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1150
1151            ExpectIntEQ(EVP_CipherInit(decCtx, EVP_aes_256_gcm(), key, NULL, 0),
1152                        SSL_SUCCESS);
1153            ExpectIntEQ(EVP_CipherInit(decCtx, NULL, NULL, iv, 0),
1154                        SSL_SUCCESS);
1155        }
1156        /* Second iteration, IV before key. */
1157        else {
1158            ExpectIntEQ(EVP_CipherInit(encCtx, EVP_aes_256_gcm(), NULL, iv, 1),
1159                        SSL_SUCCESS);
1160            ExpectIntEQ(EVP_CipherInit(encCtx, NULL, key, NULL, 1),
1161                        SSL_SUCCESS);
1162            ExpectIntEQ(EVP_CipherInit(decCtx, EVP_aes_256_gcm(), NULL, iv, 0),
1163                        SSL_SUCCESS);
1164            ExpectIntEQ(EVP_CipherInit(decCtx, NULL, key, NULL, 0),
1165                        SSL_SUCCESS);
1166        }
1167
1168        /*
1169         * EVP_CTRL_GCM_IV_GEN should fail if EVP_CTRL_GCM_SET_IV_FIXED hasn't
1170         * been issued first.
1171         */
1172        ExpectIntEQ(EVP_CIPHER_CTX_ctrl(encCtx, EVP_CTRL_GCM_IV_GEN, -1,
1173                        currentIv), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1174
1175        ExpectIntEQ(EVP_CIPHER_CTX_ctrl(encCtx, EVP_CTRL_GCM_SET_IV_FIXED, -1,
1176                    (void*)iv), SSL_SUCCESS);
1177        ExpectIntEQ(EVP_CIPHER_CTX_ctrl(decCtx, EVP_CTRL_GCM_SET_IV_FIXED, -1,
1178                    (void*)iv), SSL_SUCCESS);
1179
1180        for (j = 0; j < NUM_ENCRYPTIONS; ++j) {
1181            /*************** Encrypt ***************/
1182            ExpectIntEQ(EVP_CIPHER_CTX_ctrl(encCtx, EVP_CTRL_GCM_IV_GEN, -1,
1183                        currentIv), SSL_SUCCESS);
1184            /* Check current IV against expected. */
1185            ExpectIntEQ(XMEMCMP(currentIv, expIvs[j], GCM_NONCE_MID_SZ), 0);
1186
1187            /* Add AAD. */
1188            if (i == 2) {
1189                /* Test streaming API. */
1190                ExpectIntEQ(EVP_CipherUpdate(encCtx, NULL, &outl, aads[j],
1191                                             AAD_SIZE), SSL_SUCCESS);
1192            }
1193            else {
1194                ExpectIntEQ(EVP_Cipher(encCtx, NULL, (byte *)aads[j], AAD_SIZE),
1195                                       AAD_SIZE);
1196            }
1197
1198            ExpectNotNull(cipherText = (byte*)XMALLOC(plainTextSzs[j], NULL,
1199                          DYNAMIC_TYPE_TMP_BUFFER));
1200
1201            /* Encrypt plaintext. */
1202            if (i == 2) {
1203                ExpectIntEQ(EVP_CipherUpdate(encCtx, cipherText, &outl,
1204                                             plainTexts[j], plainTextSzs[j]),
1205                            SSL_SUCCESS);
1206            }
1207            else {
1208                ExpectIntEQ(EVP_Cipher(encCtx, cipherText,
1209                            (byte *)plainTexts[j], plainTextSzs[j]),
1210                            plainTextSzs[j]);
1211            }
1212
1213            if (i == 2) {
1214                ExpectIntEQ(EVP_CipherFinal(encCtx, cipherText, &outl),
1215                            SSL_SUCCESS);
1216            }
1217            else {
1218                /*
1219                 * Calling EVP_Cipher with NULL input and output for AES-GCM is
1220                 * akin to calling EVP_CipherFinal.
1221                 */
1222                ExpectIntGE(EVP_Cipher(encCtx, NULL, NULL, 0), 0);
1223            }
1224
1225            /* Check ciphertext against expected. */
1226            ExpectIntEQ(XMEMCMP(cipherText, expCipherTexts[j], plainTextSzs[j]),
1227                        0);
1228
1229            /* Get and check tag against expected. */
1230            ExpectIntEQ(EVP_CIPHER_CTX_ctrl(encCtx, EVP_CTRL_GCM_GET_TAG,
1231                        sizeof(tag), tag), SSL_SUCCESS);
1232            ExpectIntEQ(XMEMCMP(tag, expTags[j], sizeof(tag)), 0);
1233
1234            /*************** Decrypt ***************/
1235            ExpectIntEQ(EVP_CIPHER_CTX_ctrl(decCtx, EVP_CTRL_GCM_IV_GEN, -1,
1236                        currentIv), SSL_SUCCESS);
1237            /* Check current IV against expected. */
1238            ExpectIntEQ(XMEMCMP(currentIv, expIvs[j], GCM_NONCE_MID_SZ), 0);
1239
1240            /* Add AAD. */
1241            if (i == 2) {
1242                /* Test streaming API. */
1243                ExpectIntEQ(EVP_CipherUpdate(decCtx, NULL, &outl, aads[j],
1244                                             AAD_SIZE), SSL_SUCCESS);
1245            }
1246            else {
1247                ExpectIntEQ(EVP_Cipher(decCtx, NULL, (byte *)aads[j], AAD_SIZE),
1248                            AAD_SIZE);
1249            }
1250
1251            /* Set expected tag. */
1252            ExpectIntEQ(EVP_CIPHER_CTX_ctrl(decCtx, EVP_CTRL_GCM_SET_TAG,
1253                        sizeof(tag), tag), SSL_SUCCESS);
1254
1255            /* Decrypt ciphertext. */
1256            ExpectNotNull(calcPlainText = (byte*)XMALLOC(plainTextSzs[j], NULL,
1257                          DYNAMIC_TYPE_TMP_BUFFER));
1258            if (i == 2) {
1259                ExpectIntEQ(EVP_CipherUpdate(decCtx, calcPlainText, &outl,
1260                                             cipherText, plainTextSzs[j]),
1261                            SSL_SUCCESS);
1262            }
1263            else {
1264                /* This first EVP_Cipher call will check the tag, too. */
1265                ExpectIntEQ(EVP_Cipher(decCtx, calcPlainText, cipherText,
1266                        plainTextSzs[j]), plainTextSzs[j]);
1267            }
1268
1269            if (i == 2) {
1270                ExpectIntEQ(EVP_CipherFinal(decCtx, calcPlainText, &outl),
1271                            SSL_SUCCESS);
1272            }
1273            else {
1274                ExpectIntGE(EVP_Cipher(decCtx, NULL, NULL, 0), 0);
1275            }
1276
1277            /* Check plaintext against expected. */
1278            ExpectIntEQ(XMEMCMP(calcPlainText, plainTexts[j], plainTextSzs[j]),
1279                        0);
1280
1281            XFREE(cipherText, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1282            cipherText = NULL;
1283            XFREE(calcPlainText, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1284            calcPlainText = NULL;
1285        }
1286
1287        EVP_CIPHER_CTX_free(encCtx);
1288        encCtx = NULL;
1289        EVP_CIPHER_CTX_free(decCtx);
1290        decCtx = NULL;
1291    }
1292#endif
1293    return EXPECT_RESULT();
1294}
1295
1296int test_wolfssl_EVP_aes_gcm(void)
1297{
1298    EXPECT_DECLS;
1299#if defined(OPENSSL_EXTRA) && !defined(NO_AES) && defined(HAVE_AESGCM) && \
1300    !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
1301    /* A 256 bit key, AES_128 will use the first 128 bit*/
1302    byte *key = (byte*)"01234567890123456789012345678901";
1303    /* A 128 bit IV */
1304    byte *iv = (byte*)"0123456789012345";
1305    int ivSz = AES_BLOCK_SIZE;
1306    /* Message to be encrypted */
1307    byte *plaintxt = (byte*)"for things to change you have to change";
1308    /* Additional non-confidential data */
1309    byte *aad = (byte*)"Don't spend major time on minor things.";
1310
1311    unsigned char tag[AES_BLOCK_SIZE] = {0};
1312    int plaintxtSz = (int)XSTRLEN((char*)plaintxt);
1313    int aadSz = (int)XSTRLEN((char*)aad);
1314    byte ciphertxt[AES_BLOCK_SIZE * 4] = {0};
1315    byte decryptedtxt[AES_BLOCK_SIZE * 4] = {0};
1316    int ciphertxtSz = 0;
1317    int decryptedtxtSz = 0;
1318    int len = 0;
1319    int i = 0;
1320    EVP_CIPHER_CTX en[2];
1321    EVP_CIPHER_CTX de[2];
1322
1323    for (i = 0; i < 2; i++) {
1324        EVP_CIPHER_CTX_init(&en[i]);
1325        if (i == 0) {
1326            /* Default uses 96-bits IV length */
1327#ifdef WOLFSSL_AES_128
1328            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_128_gcm(), NULL,
1329                key, iv));
1330#elif defined(WOLFSSL_AES_192)
1331            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_192_gcm(), NULL,
1332                key, iv));
1333#elif defined(WOLFSSL_AES_256)
1334            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_256_gcm(), NULL,
1335                key, iv));
1336#endif
1337        }
1338        else {
1339#ifdef WOLFSSL_AES_128
1340            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_128_gcm(), NULL,
1341                NULL, NULL));
1342#elif defined(WOLFSSL_AES_192)
1343            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_192_gcm(), NULL,
1344                NULL, NULL));
1345#elif defined(WOLFSSL_AES_256)
1346            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_256_gcm(), NULL,
1347                NULL, NULL));
1348#endif
1349             /* non-default must to set the IV length first */
1350            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_GCM_SET_IVLEN,
1351                ivSz, NULL));
1352            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], NULL, NULL, key, iv));
1353        }
1354        ExpectIntEQ(1, EVP_EncryptUpdate(&en[i], NULL, &len, aad, aadSz));
1355        ExpectIntEQ(1, EVP_EncryptUpdate(&en[i], ciphertxt, &len, plaintxt,
1356            plaintxtSz));
1357        ciphertxtSz = len;
1358        ExpectIntEQ(1, EVP_EncryptFinal_ex(&en[i], ciphertxt, &len));
1359        ciphertxtSz += len;
1360        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_GCM_GET_TAG,
1361            AES_BLOCK_SIZE, tag));
1362        wolfSSL_EVP_CIPHER_CTX_cleanup(&en[i]);
1363
1364        EVP_CIPHER_CTX_init(&de[i]);
1365        if (i == 0) {
1366            /* Default uses 96-bits IV length */
1367#ifdef WOLFSSL_AES_128
1368            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_128_gcm(), NULL,
1369                key, iv));
1370#elif defined(WOLFSSL_AES_192)
1371            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_192_gcm(), NULL,
1372                key, iv));
1373#elif defined(WOLFSSL_AES_256)
1374            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_256_gcm(), NULL,
1375                key, iv));
1376#endif
1377        }
1378        else {
1379#ifdef WOLFSSL_AES_128
1380            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_128_gcm(), NULL,
1381                NULL, NULL));
1382#elif defined(WOLFSSL_AES_192)
1383            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_192_gcm(), NULL,
1384                NULL, NULL));
1385#elif defined(WOLFSSL_AES_256)
1386            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_256_gcm(), NULL,
1387                NULL, NULL));
1388#endif
1389            /* non-default must to set the IV length first */
1390            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_IVLEN,
1391                ivSz, NULL));
1392            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], NULL, NULL, key, iv));
1393
1394        }
1395        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
1396        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
1397            ciphertxtSz));
1398        decryptedtxtSz = len;
1399        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_TAG,
1400            AES_BLOCK_SIZE, tag));
1401        ExpectIntEQ(1, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
1402        decryptedtxtSz += len;
1403        ExpectIntEQ(ciphertxtSz, decryptedtxtSz);
1404        ExpectIntEQ(0, XMEMCMP(plaintxt, decryptedtxt, decryptedtxtSz));
1405
1406        /* modify tag*/
1407        if (i == 0) {
1408            /* Default uses 96-bits IV length */
1409#ifdef WOLFSSL_AES_128
1410            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_128_gcm(), NULL,
1411                key, iv));
1412#elif defined(WOLFSSL_AES_192)
1413            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_192_gcm(), NULL,
1414                key, iv));
1415#elif defined(WOLFSSL_AES_256)
1416            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_256_gcm(), NULL,
1417                key, iv));
1418#endif
1419        }
1420        else {
1421#ifdef WOLFSSL_AES_128
1422            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_128_gcm(), NULL,
1423                NULL, NULL));
1424#elif defined(WOLFSSL_AES_192)
1425            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_192_gcm(), NULL,
1426                NULL, NULL));
1427#elif defined(WOLFSSL_AES_256)
1428            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_256_gcm(), NULL,
1429                NULL, NULL));
1430#endif
1431            /* non-default must to set the IV length first */
1432            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_IVLEN,
1433                ivSz, NULL));
1434            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], NULL, NULL, key, iv));
1435
1436        }
1437        tag[AES_BLOCK_SIZE-1]+=0xBB;
1438        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
1439        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_TAG,
1440            AES_BLOCK_SIZE, tag));
1441        /* fail due to wrong tag */
1442        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
1443            ciphertxtSz));
1444        ExpectIntEQ(0, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
1445        ExpectIntEQ(0, len);
1446
1447        wolfSSL_EVP_CIPHER_CTX_cleanup(&de[i]);
1448    }
1449#endif /* OPENSSL_EXTRA && !NO_AES && HAVE_AESGCM */
1450    return EXPECT_RESULT();
1451}
1452
1453int test_wolfssl_EVP_aes_gcm_AAD_2_parts(void)
1454{
1455    EXPECT_DECLS;
1456#if defined(OPENSSL_EXTRA) && !defined(NO_AES) && defined(HAVE_AESGCM) && \
1457    !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
1458    const byte iv[12] = { 0 };
1459    const byte key[16] = { 0 };
1460    const byte cleartext[16] = { 0 };
1461    const byte aad[] = {
1462        0x01, 0x10, 0x00, 0x2a, 0x08, 0x00, 0x04, 0x00,
1463        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08,
1464        0x00, 0x00, 0xdc, 0x4d, 0xad, 0x6b, 0x06, 0x93,
1465        0x4f
1466    };
1467    byte out1Part[16];
1468    byte outTag1Part[16];
1469    byte out2Part[16];
1470    byte outTag2Part[16];
1471    byte decryptBuf[16];
1472    int len = 0;
1473    int tlen;
1474    EVP_CIPHER_CTX* ctx = NULL;
1475
1476    /* ENCRYPT */
1477    /* Send AAD and data in 1 part */
1478    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
1479    tlen = 0;
1480    ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL),
1481                1);
1482    ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv), 1);
1483    ExpectIntEQ(EVP_EncryptUpdate(ctx, NULL, &len, aad, sizeof(aad)), 1);
1484    ExpectIntEQ(EVP_EncryptUpdate(ctx, out1Part, &len, cleartext,
1485                                  sizeof(cleartext)), 1);
1486    tlen += len;
1487    ExpectIntEQ(EVP_EncryptFinal_ex(ctx, out1Part, &len), 1);
1488    tlen += len;
1489    ExpectIntEQ(tlen, sizeof(cleartext));
1490    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16,
1491                                    outTag1Part), 1);
1492    EVP_CIPHER_CTX_free(ctx);
1493    ctx = NULL;
1494
1495    /* DECRYPT */
1496    /* Send AAD and data in 1 part */
1497    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
1498    tlen = 0;
1499    ExpectIntEQ(EVP_DecryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL),
1500                1);
1501    ExpectIntEQ(EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv), 1);
1502    ExpectIntEQ(EVP_DecryptUpdate(ctx, NULL, &len, aad, sizeof(aad)), 1);
1503    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptBuf, &len, out1Part,
1504                                  sizeof(cleartext)), 1);
1505    tlen += len;
1506    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16,
1507                                    outTag1Part), 1);
1508    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptBuf, &len), 1);
1509    tlen += len;
1510    ExpectIntEQ(tlen, sizeof(cleartext));
1511    EVP_CIPHER_CTX_free(ctx);
1512    ctx = NULL;
1513
1514    ExpectIntEQ(XMEMCMP(decryptBuf, cleartext, len), 0);
1515
1516    /* ENCRYPT */
1517    /* Send AAD and data in 2 parts */
1518    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
1519    tlen = 0;
1520    ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL),
1521                1);
1522    ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv), 1);
1523    ExpectIntEQ(EVP_EncryptUpdate(ctx, NULL, &len, aad, 1), 1);
1524    ExpectIntEQ(EVP_EncryptUpdate(ctx, NULL, &len, aad + 1, sizeof(aad) - 1),
1525                1);
1526    ExpectIntEQ(EVP_EncryptUpdate(ctx, out2Part, &len, cleartext, 1), 1);
1527    tlen += len;
1528    ExpectIntEQ(EVP_EncryptUpdate(ctx, out2Part + tlen, &len, cleartext + 1,
1529                                  sizeof(cleartext) - 1), 1);
1530    tlen += len;
1531    ExpectIntEQ(EVP_EncryptFinal_ex(ctx, out2Part + tlen, &len), 1);
1532    tlen += len;
1533    ExpectIntEQ(tlen, sizeof(cleartext));
1534    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16,
1535                                    outTag2Part), 1);
1536
1537    ExpectIntEQ(XMEMCMP(out1Part, out2Part, sizeof(out1Part)), 0);
1538    ExpectIntEQ(XMEMCMP(outTag1Part, outTag2Part, sizeof(outTag1Part)), 0);
1539    EVP_CIPHER_CTX_free(ctx);
1540    ctx = NULL;
1541
1542    /* DECRYPT */
1543    /* Send AAD and data in 2 parts */
1544    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
1545    tlen = 0;
1546    ExpectIntEQ(EVP_DecryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL),
1547                1);
1548    ExpectIntEQ(EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv), 1);
1549    ExpectIntEQ(EVP_DecryptUpdate(ctx, NULL, &len, aad, 1), 1);
1550    ExpectIntEQ(EVP_DecryptUpdate(ctx, NULL, &len, aad + 1, sizeof(aad) - 1),
1551                1);
1552    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptBuf, &len, out1Part, 1), 1);
1553    tlen += len;
1554    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptBuf + tlen, &len, out1Part + 1,
1555                                  sizeof(cleartext) - 1), 1);
1556    tlen += len;
1557    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16,
1558                                    outTag1Part), 1);
1559    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptBuf + tlen, &len), 1);
1560    tlen += len;
1561    ExpectIntEQ(tlen, sizeof(cleartext));
1562
1563    ExpectIntEQ(XMEMCMP(decryptBuf, cleartext, len), 0);
1564
1565    /* Test AAD reuse */
1566    EVP_CIPHER_CTX_free(ctx);
1567#endif
1568    return EXPECT_RESULT();
1569}
1570
1571int test_wolfssl_EVP_aes_gcm_zeroLen(void)
1572{
1573    EXPECT_DECLS;
1574#if defined(OPENSSL_EXTRA) && !defined(NO_AES) && defined(HAVE_AESGCM) && \
1575    !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) && defined(WOLFSSL_AES_256)
1576    /* Zero length plain text */
1577    byte key[] = {
1578        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1579        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1580        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1581        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
1582    }; /* align */
1583    byte iv[]  = {
1584        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
1585    }; /* align */
1586    byte plaintxt[1];
1587    int ivSz  = 12;
1588    int plaintxtSz = 0;
1589    unsigned char tag[16];
1590    unsigned char tag_kat[] = {
1591        0x53,0x0f,0x8a,0xfb,0xc7,0x45,0x36,0xb9,
1592        0xa9,0x63,0xb4,0xf1,0xc4,0xcb,0x73,0x8b
1593    };
1594
1595    byte ciphertxt[AES_BLOCK_SIZE * 4] = {0};
1596    byte decryptedtxt[AES_BLOCK_SIZE * 4] = {0};
1597    int ciphertxtSz = 0;
1598    int decryptedtxtSz = 0;
1599    int len = 0;
1600
1601    EVP_CIPHER_CTX *en = EVP_CIPHER_CTX_new();
1602    EVP_CIPHER_CTX *de = EVP_CIPHER_CTX_new();
1603
1604    ExpectIntEQ(1, EVP_EncryptInit_ex(en, EVP_aes_256_gcm(), NULL, key, iv));
1605    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(en, EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
1606    ExpectIntEQ(1, EVP_EncryptUpdate(en, ciphertxt, &ciphertxtSz , plaintxt,
1607        plaintxtSz));
1608    ExpectIntEQ(1, EVP_EncryptFinal_ex(en, ciphertxt, &len));
1609    ciphertxtSz += len;
1610    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(en, EVP_CTRL_GCM_GET_TAG, 16, tag));
1611    ExpectIntEQ(1, EVP_CIPHER_CTX_cleanup(en));
1612
1613    ExpectIntEQ(0, ciphertxtSz);
1614    ExpectIntEQ(0, XMEMCMP(tag, tag_kat, sizeof(tag)));
1615
1616    EVP_CIPHER_CTX_init(de);
1617    ExpectIntEQ(1, EVP_DecryptInit_ex(de, EVP_aes_256_gcm(), NULL, key, iv));
1618    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(de, EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
1619    ExpectIntEQ(1, EVP_DecryptUpdate(de, NULL, &len, ciphertxt, len));
1620    decryptedtxtSz = len;
1621    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(de, EVP_CTRL_GCM_SET_TAG, 16, tag));
1622    ExpectIntEQ(1, EVP_DecryptFinal_ex(de, decryptedtxt, &len));
1623    decryptedtxtSz += len;
1624    ExpectIntEQ(0, decryptedtxtSz);
1625
1626    EVP_CIPHER_CTX_free(en);
1627    EVP_CIPHER_CTX_free(de);
1628#endif
1629    return EXPECT_RESULT();
1630}
1631
1632int test_wolfSSL_EVP_aes_256_ccm(void)
1633{
1634    EXPECT_DECLS;
1635#if defined(HAVE_AESCCM) && defined(WOLFSSL_AES_256) && defined(OPENSSL_ALL)
1636    ExpectNotNull(wolfSSL_EVP_aes_256_ccm());
1637#endif
1638    return EXPECT_RESULT();
1639}
1640
1641int test_wolfSSL_EVP_aes_192_ccm(void)
1642{
1643    EXPECT_DECLS;
1644#if defined(HAVE_AESCCM) && defined(WOLFSSL_AES_192) && defined(OPENSSL_ALL)
1645    ExpectNotNull(wolfSSL_EVP_aes_192_ccm());
1646#endif
1647    return EXPECT_RESULT();
1648}
1649
1650int test_wolfSSL_EVP_aes_128_ccm(void)
1651{
1652    EXPECT_DECLS;
1653#if defined(HAVE_AESCCM) && defined(WOLFSSL_AES_128) && defined(OPENSSL_ALL)
1654    ExpectNotNull(wolfSSL_EVP_aes_128_ccm());
1655#endif
1656    return EXPECT_RESULT();
1657}
1658
1659int test_wolfssl_EVP_aes_ccm(void)
1660{
1661    EXPECT_DECLS;
1662#if defined(OPENSSL_EXTRA) && !defined(NO_AES) && defined(HAVE_AESCCM) && \
1663    !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
1664    /* A 256 bit key, AES_128 will use the first 128 bit*/
1665    byte *key = (byte*)"01234567890123456789012345678901";
1666    /* A 128 bit IV */
1667    byte *iv = (byte*)"0123456789012";
1668    int ivSz = (int)XSTRLEN((char*)iv);
1669    /* Message to be encrypted */
1670    byte *plaintxt = (byte*)"for things to change you have to change";
1671    /* Additional non-confidential data */
1672    byte *aad = (byte*)"Don't spend major time on minor things.";
1673
1674    unsigned char tag[AES_BLOCK_SIZE] = {0};
1675    int plaintxtSz = (int)XSTRLEN((char*)plaintxt);
1676    int aadSz = (int)XSTRLEN((char*)aad);
1677    byte ciphertxt[AES_BLOCK_SIZE * 4] = {0};
1678    byte decryptedtxt[AES_BLOCK_SIZE * 4] = {0};
1679    int ciphertxtSz = 0;
1680    int decryptedtxtSz = 0;
1681    int len = 0;
1682    int i = 0;
1683    int ret;
1684    EVP_CIPHER_CTX en[2];
1685    EVP_CIPHER_CTX de[2];
1686
1687    for (i = 0; i < 2; i++) {
1688        EVP_CIPHER_CTX_init(&en[i]);
1689
1690        if (i == 0) {
1691            /* Default uses 96-bits IV length */
1692#ifdef WOLFSSL_AES_128
1693            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_128_ccm(), NULL,
1694                key, iv));
1695#elif defined(WOLFSSL_AES_192)
1696            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_192_ccm(), NULL,
1697                key, iv));
1698#elif defined(WOLFSSL_AES_256)
1699            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_256_ccm(), NULL,
1700                key, iv));
1701#endif
1702        }
1703        else {
1704#ifdef WOLFSSL_AES_128
1705            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_128_ccm(), NULL,
1706                NULL, NULL));
1707#elif defined(WOLFSSL_AES_192)
1708            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_192_ccm(), NULL,
1709                NULL, NULL));
1710#elif defined(WOLFSSL_AES_256)
1711            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aes_256_ccm(), NULL,
1712                NULL, NULL));
1713#endif
1714             /* non-default must to set the IV length first */
1715            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_CCM_SET_IVLEN,
1716                ivSz, NULL));
1717            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], NULL, NULL, key, iv));
1718        }
1719        ExpectIntEQ(1, EVP_EncryptUpdate(&en[i], NULL, &len, aad, aadSz));
1720        ExpectIntEQ(1, EVP_EncryptUpdate(&en[i], ciphertxt, &len, plaintxt,
1721              plaintxtSz));
1722        ciphertxtSz = len;
1723        ExpectIntEQ(1, EVP_EncryptFinal_ex(&en[i], ciphertxt, &len));
1724        ciphertxtSz += len;
1725        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_CCM_GET_TAG,
1726            AES_BLOCK_SIZE, tag));
1727        ret = wolfSSL_EVP_CIPHER_CTX_cleanup(&en[i]);
1728        ExpectIntEQ(ret, 1);
1729
1730        EVP_CIPHER_CTX_init(&de[i]);
1731        if (i == 0) {
1732            /* Default uses 96-bits IV length */
1733#ifdef WOLFSSL_AES_128
1734            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_128_ccm(), NULL,
1735                key, iv));
1736#elif defined(WOLFSSL_AES_192)
1737            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_192_ccm(), NULL,
1738                key, iv));
1739#elif defined(WOLFSSL_AES_256)
1740            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_256_ccm(), NULL,
1741                key, iv));
1742#endif
1743        }
1744        else {
1745#ifdef WOLFSSL_AES_128
1746            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_128_ccm(), NULL,
1747                NULL, NULL));
1748#elif defined(WOLFSSL_AES_192)
1749            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_192_ccm(), NULL,
1750                NULL, NULL));
1751#elif defined(WOLFSSL_AES_256)
1752            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aes_256_ccm(), NULL,
1753                NULL, NULL));
1754#endif
1755            /* non-default must to set the IV length first */
1756            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_CCM_SET_IVLEN,
1757                ivSz, NULL));
1758            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], NULL, NULL, key, iv));
1759
1760        }
1761        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
1762        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
1763            ciphertxtSz));
1764        decryptedtxtSz = len;
1765        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_CCM_SET_TAG,
1766            AES_BLOCK_SIZE, tag));
1767        ExpectIntEQ(1, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
1768        decryptedtxtSz += len;
1769        ExpectIntEQ(ciphertxtSz, decryptedtxtSz);
1770        ExpectIntEQ(0, XMEMCMP(plaintxt, decryptedtxt, decryptedtxtSz));
1771
1772        /* modify tag*/
1773        tag[AES_BLOCK_SIZE-1]+=0xBB;
1774        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
1775        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_CCM_SET_TAG,
1776            AES_BLOCK_SIZE, tag));
1777        /* fail due to wrong tag */
1778        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
1779            ciphertxtSz));
1780        ExpectIntEQ(0, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
1781        ExpectIntEQ(0, len);
1782        ret = wolfSSL_EVP_CIPHER_CTX_cleanup(&de[i]);
1783        ExpectIntEQ(ret, 1);
1784    }
1785#endif /* OPENSSL_EXTRA && !NO_AES && HAVE_AESCCM */
1786    return EXPECT_RESULT();
1787}
1788
1789int test_wolfssl_EVP_aes_ccm_zeroLen(void)
1790{
1791    EXPECT_DECLS;
1792#if defined(OPENSSL_EXTRA) && !defined(NO_AES) && defined(HAVE_AESCCM) && \
1793    !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) && defined(WOLFSSL_AES_256)
1794    /* Zero length plain text */
1795    byte key[] = {
1796        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1797        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1798        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1799        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
1800    }; /* align */
1801    byte iv[]  = {
1802        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
1803    }; /* align */
1804    byte plaintxt[1];
1805    int ivSz  = 12;
1806    int plaintxtSz = 0;
1807    unsigned char tag[16];
1808
1809    byte ciphertxt[AES_BLOCK_SIZE * 4] = {0};
1810    byte decryptedtxt[AES_BLOCK_SIZE * 4] = {0};
1811    int ciphertxtSz = 0;
1812    int decryptedtxtSz = 0;
1813    int len = 0;
1814
1815    EVP_CIPHER_CTX *en = EVP_CIPHER_CTX_new();
1816    EVP_CIPHER_CTX *de = EVP_CIPHER_CTX_new();
1817
1818    ExpectIntEQ(1, EVP_EncryptInit_ex(en, EVP_aes_256_ccm(), NULL, key, iv));
1819    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(en, EVP_CTRL_CCM_SET_IVLEN, ivSz, NULL));
1820    ExpectIntEQ(1, EVP_EncryptUpdate(en, ciphertxt, &ciphertxtSz , plaintxt,
1821                                     plaintxtSz));
1822    ExpectIntEQ(1, EVP_EncryptFinal_ex(en, ciphertxt, &len));
1823    ciphertxtSz += len;
1824    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(en, EVP_CTRL_CCM_GET_TAG, 16, tag));
1825    ExpectIntEQ(1, EVP_CIPHER_CTX_cleanup(en));
1826
1827    ExpectIntEQ(0, ciphertxtSz);
1828
1829    EVP_CIPHER_CTX_init(de);
1830    ExpectIntEQ(1, EVP_DecryptInit_ex(de, EVP_aes_256_ccm(), NULL, key, iv));
1831    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(de, EVP_CTRL_CCM_SET_IVLEN, ivSz, NULL));
1832    ExpectIntEQ(1, EVP_DecryptUpdate(de, NULL, &len, ciphertxt, len));
1833    decryptedtxtSz = len;
1834    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(de, EVP_CTRL_CCM_SET_TAG, 16, tag));
1835    ExpectIntEQ(1, EVP_DecryptFinal_ex(de, decryptedtxt, &len));
1836    decryptedtxtSz += len;
1837    ExpectIntEQ(0, decryptedtxtSz);
1838
1839    EVP_CIPHER_CTX_free(en);
1840    EVP_CIPHER_CTX_free(de);
1841#endif
1842    return EXPECT_RESULT();
1843}
1844
1845int test_wolfssl_EVP_chacha20(void)
1846{
1847    EXPECT_DECLS;
1848#if defined(OPENSSL_EXTRA) && defined(HAVE_CHACHA)
1849    byte key[CHACHA_MAX_KEY_SZ];
1850    byte iv [WOLFSSL_EVP_CHACHA_IV_BYTES];
1851    byte plainText[] = {0xDE, 0xAD, 0xBE, 0xEF};
1852    byte cipherText[sizeof(plainText)];
1853    byte decryptedText[sizeof(plainText)];
1854    EVP_CIPHER_CTX* ctx = NULL;
1855    int outSz;
1856
1857    XMEMSET(key, 0, sizeof(key));
1858    XMEMSET(iv, 0, sizeof(iv));
1859    /* Encrypt. */
1860    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
1861    ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_chacha20(), NULL, NULL,
1862                NULL), WOLFSSL_SUCCESS);
1863    /* Any tag length must fail - not an AEAD cipher. */
1864    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
1865                16, NULL), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1866    ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv), WOLFSSL_SUCCESS);
1867    ExpectIntEQ(EVP_EncryptUpdate(ctx, cipherText, &outSz, plainText,
1868                sizeof(plainText)), WOLFSSL_SUCCESS);
1869    ExpectIntEQ(outSz, sizeof(plainText));
1870    ExpectIntEQ(EVP_EncryptFinal_ex(ctx, cipherText, &outSz), WOLFSSL_SUCCESS);
1871    ExpectIntEQ(outSz, 0);
1872    EVP_CIPHER_CTX_free(ctx);
1873    ctx = NULL;
1874
1875    /* Decrypt. */
1876    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
1877    ExpectIntEQ(EVP_DecryptInit_ex(ctx, EVP_chacha20(), NULL, NULL,
1878                NULL), WOLFSSL_SUCCESS);
1879    ExpectIntEQ(EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv), WOLFSSL_SUCCESS);
1880    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
1881                sizeof(cipherText)), WOLFSSL_SUCCESS);
1882    ExpectIntEQ(outSz, sizeof(cipherText));
1883    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText, &outSz),
1884                WOLFSSL_SUCCESS);
1885    ExpectIntEQ(outSz, 0);
1886    EVP_CIPHER_CTX_free(ctx);
1887    ctx = NULL;
1888
1889    /* Test partial Inits. CipherInit() allow setting of key and iv
1890     * in separate calls. */
1891    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
1892    ExpectIntEQ(wolfSSL_EVP_CipherInit(ctx, EVP_chacha20(),
1893                key, NULL, 1), WOLFSSL_SUCCESS);
1894    ExpectIntEQ(wolfSSL_EVP_CipherInit(ctx, NULL, NULL, iv, 1),
1895                WOLFSSL_SUCCESS);
1896    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
1897                sizeof(cipherText)), WOLFSSL_SUCCESS);
1898    ExpectIntEQ(outSz, sizeof(cipherText));
1899    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText, &outSz),
1900            WOLFSSL_SUCCESS);
1901    ExpectIntEQ(outSz, 0);
1902    EVP_CIPHER_CTX_free(ctx);
1903#endif
1904    return EXPECT_RESULT();
1905}
1906
1907int test_wolfssl_EVP_chacha20_poly1305(void)
1908{
1909    EXPECT_DECLS;
1910#if defined(OPENSSL_EXTRA) && defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
1911    byte key[CHACHA20_POLY1305_AEAD_KEYSIZE];
1912    byte iv [CHACHA20_POLY1305_AEAD_IV_SIZE];
1913    byte plainText[] = {0xDE, 0xAD, 0xBE, 0xEF};
1914    byte aad[] = {0xAA, 0XBB, 0xCC, 0xDD, 0xEE, 0xFF};
1915    byte cipherText[sizeof(plainText)];
1916    byte decryptedText[sizeof(plainText)];
1917    byte tag[CHACHA20_POLY1305_AEAD_AUTHTAG_SIZE];
1918    byte badTag[CHACHA20_POLY1305_AEAD_AUTHTAG_SIZE];
1919    EVP_CIPHER_CTX* ctx = NULL;
1920    int outSz;
1921
1922    XMEMSET(key, 0, sizeof(key));
1923    XMEMSET(iv, 0, sizeof(iv));
1924
1925    /* Encrypt. */
1926    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
1927    ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_chacha20_poly1305(), NULL, NULL,
1928                NULL), WOLFSSL_SUCCESS);
1929    /* Invalid IV length. */
1930    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
1931                CHACHA20_POLY1305_AEAD_IV_SIZE-1, NULL),
1932                WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1933    /* Valid IV length. */
1934    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
1935                CHACHA20_POLY1305_AEAD_IV_SIZE, NULL), WOLFSSL_SUCCESS);
1936    /* Invalid tag length. */
1937    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
1938                CHACHA20_POLY1305_AEAD_AUTHTAG_SIZE-1, NULL),
1939                WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1940    /* Valid tag length. */
1941    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
1942                CHACHA20_POLY1305_AEAD_AUTHTAG_SIZE, NULL), WOLFSSL_SUCCESS);
1943    ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv), WOLFSSL_SUCCESS);
1944    ExpectIntEQ(EVP_EncryptUpdate(ctx, NULL, &outSz, aad, sizeof(aad)),
1945               WOLFSSL_SUCCESS);
1946    ExpectIntEQ(outSz, sizeof(aad));
1947    ExpectIntEQ(EVP_EncryptUpdate(ctx, cipherText, &outSz, plainText,
1948                sizeof(plainText)), WOLFSSL_SUCCESS);
1949    ExpectIntEQ(outSz, sizeof(plainText));
1950    ExpectIntEQ(EVP_EncryptFinal_ex(ctx, cipherText, &outSz), WOLFSSL_SUCCESS);
1951    ExpectIntEQ(outSz, 0);
1952    /* Invalid tag length. */
1953    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG,
1954                CHACHA20_POLY1305_AEAD_AUTHTAG_SIZE-1, tag),
1955                WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1956    /* Valid tag length. */
1957    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG,
1958                CHACHA20_POLY1305_AEAD_AUTHTAG_SIZE, tag), WOLFSSL_SUCCESS);
1959    EVP_CIPHER_CTX_free(ctx);
1960    ctx = NULL;
1961
1962    /* Decrypt. */
1963    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
1964    ExpectIntEQ(EVP_DecryptInit_ex(ctx, EVP_chacha20_poly1305(), NULL, NULL,
1965                NULL), WOLFSSL_SUCCESS);
1966    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
1967                CHACHA20_POLY1305_AEAD_IV_SIZE, NULL), WOLFSSL_SUCCESS);
1968    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
1969                CHACHA20_POLY1305_AEAD_AUTHTAG_SIZE, tag), WOLFSSL_SUCCESS);
1970    ExpectIntEQ(EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv), WOLFSSL_SUCCESS);
1971    ExpectIntEQ(EVP_DecryptUpdate(ctx, NULL, &outSz, aad, sizeof(aad)),
1972               WOLFSSL_SUCCESS);
1973    ExpectIntEQ(outSz, sizeof(aad));
1974    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
1975                sizeof(cipherText)), WOLFSSL_SUCCESS);
1976    ExpectIntEQ(outSz, sizeof(cipherText));
1977    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText, &outSz),
1978                WOLFSSL_SUCCESS);
1979    ExpectIntEQ(outSz, 0);
1980    EVP_CIPHER_CTX_free(ctx);
1981    ctx = NULL;
1982
1983    /* Negative test: forged (all-zero) tag must be rejected. */
1984    XMEMSET(badTag, 0, sizeof(badTag));
1985    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
1986    ExpectIntEQ(EVP_DecryptInit_ex(ctx, EVP_chacha20_poly1305(), NULL,
1987                NULL, NULL), WOLFSSL_SUCCESS);
1988    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
1989                CHACHA20_POLY1305_AEAD_IV_SIZE, NULL), WOLFSSL_SUCCESS);
1990    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
1991                CHACHA20_POLY1305_AEAD_AUTHTAG_SIZE, badTag),
1992                WOLFSSL_SUCCESS);
1993    ExpectIntEQ(EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv),
1994                WOLFSSL_SUCCESS);
1995    ExpectIntEQ(EVP_DecryptUpdate(ctx, NULL, &outSz, aad, sizeof(aad)),
1996                WOLFSSL_SUCCESS);
1997    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
1998                sizeof(cipherText)), WOLFSSL_SUCCESS);
1999    /* EVP_DecryptFinal_ex MUST return failure on tag mismatch */
2000    ExpectIntNE(EVP_DecryptFinal_ex(ctx, decryptedText, &outSz),
2001                WOLFSSL_SUCCESS);
2002    EVP_CIPHER_CTX_free(ctx);
2003    ctx = NULL;
2004
2005    /* Test partial Inits. CipherInit() allow setting of key and iv
2006     * in separate calls. */
2007    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2008    ExpectIntEQ(wolfSSL_EVP_CipherInit(ctx, EVP_chacha20_poly1305(),
2009                key, NULL, 1), WOLFSSL_SUCCESS);
2010    ExpectIntEQ(wolfSSL_EVP_CipherInit(ctx, NULL, NULL, iv, 1),
2011                WOLFSSL_SUCCESS);
2012    ExpectIntEQ(wolfSSL_EVP_CipherUpdate(ctx, NULL, &outSz,
2013                aad, sizeof(aad)), WOLFSSL_SUCCESS);
2014    ExpectIntEQ(outSz, sizeof(aad));
2015    ExpectIntEQ(outSz, sizeof(aad));
2016    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
2017                sizeof(cipherText)), WOLFSSL_SUCCESS);
2018    ExpectIntEQ(outSz, sizeof(cipherText));
2019    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText, &outSz),
2020            WOLFSSL_SUCCESS);
2021    ExpectIntEQ(outSz, 0);
2022    EVP_CIPHER_CTX_free(ctx);
2023#endif
2024    return EXPECT_RESULT();
2025}
2026
2027int test_wolfssl_EVP_aria_gcm(void)
2028{
2029    int res = TEST_SKIPPED;
2030#if defined(OPENSSL_EXTRA) && defined(HAVE_ARIA) && \
2031    !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
2032
2033    /* A 256 bit key, AES_128 will use the first 128 bit*/
2034    byte *key = (byte*)"01234567890123456789012345678901";
2035    /* A 128 bit IV */
2036    byte *iv = (byte*)"0123456789012345";
2037    int ivSz = ARIA_BLOCK_SIZE;
2038    /* Message to be encrypted */
2039    const int plaintxtSz = 40;
2040    byte plaintxt[WC_ARIA_GCM_GET_CIPHERTEXT_SIZE(plaintxtSz)];
2041    XMEMCPY(plaintxt,"for things to change you have to change",plaintxtSz);
2042    /* Additional non-confidential data */
2043    byte *aad = (byte*)"Don't spend major time on minor things.";
2044
2045    unsigned char tag[ARIA_BLOCK_SIZE] = {0};
2046    int aadSz = (int)XSTRLEN((char*)aad);
2047    byte ciphertxt[WC_ARIA_GCM_GET_CIPHERTEXT_SIZE(plaintxtSz)];
2048    byte decryptedtxt[plaintxtSz];
2049    int ciphertxtSz = 0;
2050    int decryptedtxtSz = 0;
2051    int len = 0;
2052    int i = 0;
2053    #define TEST_ARIA_GCM_COUNT 6
2054    EVP_CIPHER_CTX en[TEST_ARIA_GCM_COUNT];
2055    EVP_CIPHER_CTX de[TEST_ARIA_GCM_COUNT];
2056
2057    for (i = 0; i < TEST_ARIA_GCM_COUNT; i++) {
2058
2059        EVP_CIPHER_CTX_init(&en[i]);
2060        switch (i) {
2061            case 0:
2062                /* Default uses 96-bits IV length */
2063                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aria_128_gcm(),
2064                    NULL, key, iv));
2065                break;
2066            case 1:
2067                /* Default uses 96-bits IV length */
2068                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aria_192_gcm(),
2069                    NULL, key, iv));
2070                break;
2071            case 2:
2072                /* Default uses 96-bits IV length */
2073                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aria_256_gcm(),
2074                    NULL, key, iv));
2075                break;
2076            case 3:
2077                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aria_128_gcm(),
2078                    NULL, NULL, NULL));
2079                /* non-default must to set the IV length first */
2080                AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i],
2081                    EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
2082                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], NULL, NULL, key, iv));
2083                break;
2084            case 4:
2085                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aria_192_gcm(),
2086                    NULL, NULL, NULL));
2087                /* non-default must to set the IV length first */
2088                AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i],
2089                    EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
2090                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], NULL, NULL, key, iv));
2091                break;
2092            case 5:
2093                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_aria_256_gcm(),
2094                    NULL, NULL, NULL));
2095                /* non-default must to set the IV length first */
2096                AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i],
2097                    EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
2098                AssertIntEQ(1, EVP_EncryptInit_ex(&en[i], NULL, NULL, key, iv));
2099                break;
2100        }
2101        XMEMSET(ciphertxt,0,sizeof(ciphertxt));
2102        AssertIntEQ(1, EVP_EncryptUpdate(&en[i], NULL, &len, aad, aadSz));
2103        AssertIntEQ(1, EVP_EncryptUpdate(&en[i], ciphertxt, &len, plaintxt,
2104            plaintxtSz));
2105        ciphertxtSz = len;
2106        AssertIntEQ(1, EVP_EncryptFinal_ex(&en[i], ciphertxt, &len));
2107        AssertIntNE(0, XMEMCMP(plaintxt, ciphertxt, plaintxtSz));
2108        ciphertxtSz += len;
2109        AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_GCM_GET_TAG,
2110            ARIA_BLOCK_SIZE, tag));
2111        AssertIntEQ(wolfSSL_EVP_CIPHER_CTX_cleanup(&en[i]), 1);
2112
2113        EVP_CIPHER_CTX_init(&de[i]);
2114        switch (i) {
2115            case 0:
2116                /* Default uses 96-bits IV length */
2117                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aria_128_gcm(),
2118                    NULL, key, iv));
2119                break;
2120            case 1:
2121                /* Default uses 96-bits IV length */
2122                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aria_192_gcm(),
2123                    NULL, key, iv));
2124                break;
2125            case 2:
2126                /* Default uses 96-bits IV length */
2127                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aria_256_gcm(),
2128                    NULL, key, iv));
2129                break;
2130            case 3:
2131                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aria_128_gcm(),
2132                    NULL, NULL, NULL));
2133                /* non-default must to set the IV length first */
2134                AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i],
2135                    EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
2136                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], NULL, NULL, key, iv));
2137                break;
2138            case 4:
2139                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aria_192_gcm(),
2140                    NULL, NULL, NULL));
2141                /* non-default must to set the IV length first */
2142                AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i],
2143                    EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
2144                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], NULL, NULL, key, iv));
2145                break;
2146            case 5:
2147                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_aria_256_gcm(),
2148                    NULL, NULL, NULL));
2149                /* non-default must to set the IV length first */
2150                AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i],
2151                    EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
2152                AssertIntEQ(1, EVP_DecryptInit_ex(&de[i], NULL, NULL, key, iv));
2153                break;
2154        }
2155        XMEMSET(decryptedtxt,0,sizeof(decryptedtxt));
2156        AssertIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
2157        AssertIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
2158            ciphertxtSz));
2159        decryptedtxtSz = len;
2160        AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_TAG,
2161            ARIA_BLOCK_SIZE, tag));
2162        AssertIntEQ(1, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
2163        decryptedtxtSz += len;
2164        AssertIntEQ(plaintxtSz, decryptedtxtSz);
2165        AssertIntEQ(0, XMEMCMP(plaintxt, decryptedtxt, decryptedtxtSz));
2166
2167        XMEMSET(decryptedtxt,0,sizeof(decryptedtxt));
2168        /* modify tag*/
2169        tag[AES_BLOCK_SIZE-1]+=0xBB;
2170        AssertIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
2171        AssertIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_TAG,
2172            ARIA_BLOCK_SIZE, tag));
2173        /* fail due to wrong tag */
2174        AssertIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
2175            ciphertxtSz));
2176        AssertIntEQ(0, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
2177        AssertIntEQ(0, len);
2178        AssertIntEQ(wolfSSL_EVP_CIPHER_CTX_cleanup(&de[i]), 1);
2179    }
2180
2181    res = TEST_RES_CHECK(1);
2182#endif /* OPENSSL_EXTRA && !NO_AES && HAVE_AESGCM */
2183    return res;
2184}
2185
2186int test_wolfssl_EVP_sm4_ecb(void)
2187{
2188    int res = TEST_SKIPPED;
2189#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_SM4_ECB)
2190    EXPECT_DECLS;
2191    byte key[SM4_KEY_SIZE];
2192    byte plainText[SM4_BLOCK_SIZE] = {
2193        0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF,
2194        0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF
2195    };
2196    byte cipherText[sizeof(plainText) + SM4_BLOCK_SIZE];
2197    byte decryptedText[sizeof(plainText) + SM4_BLOCK_SIZE];
2198    EVP_CIPHER_CTX* ctx = NULL;
2199    int outSz;
2200
2201    XMEMSET(key, 0, sizeof(key));
2202
2203    /* Encrypt. */
2204    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2205    ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_sm4_ecb(), NULL, NULL, NULL),
2206        WOLFSSL_SUCCESS);
2207    /* Any tag length must fail - not an AEAD cipher. */
2208    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, NULL),
2209        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
2210    ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, NULL),
2211        WOLFSSL_SUCCESS);
2212    ExpectIntEQ(EVP_EncryptUpdate(ctx, cipherText, &outSz, plainText,
2213        sizeof(plainText)), WOLFSSL_SUCCESS);
2214    ExpectIntEQ(outSz, sizeof(plainText));
2215    ExpectIntEQ(EVP_EncryptFinal_ex(ctx, cipherText + outSz, &outSz),
2216        WOLFSSL_SUCCESS);
2217    ExpectIntEQ(outSz, SM4_BLOCK_SIZE);
2218    ExpectBufNE(cipherText, plainText, sizeof(plainText));
2219    EVP_CIPHER_CTX_free(ctx);
2220
2221    /* Decrypt. */
2222    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2223    ExpectIntEQ(EVP_DecryptInit_ex(ctx, EVP_sm4_ecb(), NULL, NULL, NULL),
2224        WOLFSSL_SUCCESS);
2225    ExpectIntEQ(EVP_DecryptInit_ex(ctx, NULL, NULL, key, NULL),
2226        WOLFSSL_SUCCESS);
2227    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
2228        sizeof(cipherText)), WOLFSSL_SUCCESS);
2229    ExpectIntEQ(outSz, sizeof(plainText));
2230    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText + outSz, &outSz),
2231        WOLFSSL_SUCCESS);
2232    ExpectIntEQ(outSz, 0);
2233    ExpectBufEQ(decryptedText, plainText, sizeof(plainText));
2234    EVP_CIPHER_CTX_free(ctx);
2235
2236    res = EXPECT_RESULT();
2237#endif
2238    return res;
2239}
2240
2241int test_wolfssl_EVP_sm4_cbc(void)
2242{
2243    int res = TEST_SKIPPED;
2244#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_SM4_CBC)
2245    EXPECT_DECLS;
2246    byte key[SM4_KEY_SIZE];
2247    byte iv[SM4_BLOCK_SIZE];
2248    byte plainText[SM4_BLOCK_SIZE] = {
2249        0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF,
2250        0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF
2251    };
2252    byte cipherText[sizeof(plainText) + SM4_BLOCK_SIZE];
2253    byte decryptedText[sizeof(plainText) + SM4_BLOCK_SIZE];
2254    EVP_CIPHER_CTX* ctx = NULL;
2255    int outSz;
2256
2257    XMEMSET(key, 0, sizeof(key));
2258    XMEMSET(iv, 0, sizeof(iv));
2259
2260    /* Encrypt. */
2261    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2262    ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_sm4_cbc(), NULL, NULL, NULL),
2263        WOLFSSL_SUCCESS);
2264    /* Any tag length must fail - not an AEAD cipher. */
2265    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, NULL),
2266        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
2267    ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv), WOLFSSL_SUCCESS);
2268    ExpectIntEQ(EVP_EncryptUpdate(ctx, cipherText, &outSz, plainText,
2269        sizeof(plainText)), WOLFSSL_SUCCESS);
2270    ExpectIntEQ(outSz, sizeof(plainText));
2271    ExpectIntEQ(EVP_EncryptFinal_ex(ctx, cipherText + outSz, &outSz),
2272        WOLFSSL_SUCCESS);
2273    ExpectIntEQ(outSz, SM4_BLOCK_SIZE);
2274    ExpectBufNE(cipherText, plainText, sizeof(plainText));
2275    EVP_CIPHER_CTX_free(ctx);
2276
2277    /* Decrypt. */
2278    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2279    ExpectIntEQ(EVP_DecryptInit_ex(ctx, EVP_sm4_cbc(), NULL, NULL, NULL),
2280        WOLFSSL_SUCCESS);
2281    ExpectIntEQ(EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv), WOLFSSL_SUCCESS);
2282    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
2283        sizeof(cipherText)), WOLFSSL_SUCCESS);
2284    ExpectIntEQ(outSz, sizeof(plainText));
2285    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText + outSz, &outSz),
2286        WOLFSSL_SUCCESS);
2287    ExpectIntEQ(outSz, 0);
2288    ExpectBufEQ(decryptedText, plainText, sizeof(plainText));
2289    EVP_CIPHER_CTX_free(ctx);
2290
2291    /* Test partial Inits. CipherInit() allow setting of key and iv
2292     * in separate calls. */
2293    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2294    ExpectIntEQ(wolfSSL_EVP_CipherInit(ctx, EVP_sm4_cbc(), key, NULL, 0),
2295        WOLFSSL_SUCCESS);
2296    ExpectIntEQ(wolfSSL_EVP_CipherInit(ctx, NULL, NULL, iv, 0),
2297        WOLFSSL_SUCCESS);
2298    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
2299         sizeof(cipherText)), WOLFSSL_SUCCESS);
2300    ExpectIntEQ(outSz, sizeof(plainText));
2301    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText + outSz, &outSz),
2302        WOLFSSL_SUCCESS);
2303    ExpectIntEQ(outSz, 0);
2304    ExpectBufEQ(decryptedText, plainText, sizeof(plainText));
2305    EVP_CIPHER_CTX_free(ctx);
2306
2307    res = EXPECT_RESULT();
2308#endif
2309    return res;
2310}
2311
2312int test_wolfssl_EVP_sm4_ctr(void)
2313{
2314    int res = TEST_SKIPPED;
2315#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_SM4_CTR)
2316    EXPECT_DECLS;
2317    byte key[SM4_KEY_SIZE];
2318    byte iv[SM4_BLOCK_SIZE];
2319    byte plainText[] = {0xDE, 0xAD, 0xBE, 0xEF};
2320    byte cipherText[sizeof(plainText)];
2321    byte decryptedText[sizeof(plainText)];
2322    EVP_CIPHER_CTX* ctx = NULL;
2323    int outSz;
2324
2325    XMEMSET(key, 0, sizeof(key));
2326    XMEMSET(iv, 0, sizeof(iv));
2327
2328    /* Encrypt. */
2329    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2330    ExpectIntEQ(EVP_EncryptInit_ex(ctx, EVP_sm4_ctr(), NULL, NULL, NULL),
2331        WOLFSSL_SUCCESS);
2332    /* Any tag length must fail - not an AEAD cipher. */
2333    ExpectIntEQ(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, NULL),
2334        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
2335    ExpectIntEQ(EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv), WOLFSSL_SUCCESS);
2336    ExpectIntEQ(EVP_EncryptUpdate(ctx, cipherText, &outSz, plainText,
2337        sizeof(plainText)), WOLFSSL_SUCCESS);
2338    ExpectIntEQ(outSz, sizeof(plainText));
2339    ExpectIntEQ(EVP_EncryptFinal_ex(ctx, cipherText, &outSz), WOLFSSL_SUCCESS);
2340    ExpectIntEQ(outSz, 0);
2341    ExpectBufNE(cipherText, plainText, sizeof(plainText));
2342    EVP_CIPHER_CTX_free(ctx);
2343
2344    /* Decrypt. */
2345    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2346    ExpectIntEQ(EVP_DecryptInit_ex(ctx, EVP_sm4_ctr(), NULL, NULL, NULL),
2347        WOLFSSL_SUCCESS);
2348    ExpectIntEQ(EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv), WOLFSSL_SUCCESS);
2349    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
2350        sizeof(cipherText)), WOLFSSL_SUCCESS);
2351    ExpectIntEQ(outSz, sizeof(cipherText));
2352    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText, &outSz),
2353        WOLFSSL_SUCCESS);
2354    ExpectIntEQ(outSz, 0);
2355    ExpectBufEQ(decryptedText, plainText, sizeof(plainText));
2356    EVP_CIPHER_CTX_free(ctx);
2357
2358    /* Test partial Inits. CipherInit() allow setting of key and iv
2359     * in separate calls. */
2360    ExpectNotNull((ctx = EVP_CIPHER_CTX_new()));
2361    ExpectIntEQ(wolfSSL_EVP_CipherInit(ctx, EVP_sm4_ctr(), key, NULL, 1),
2362        WOLFSSL_SUCCESS);
2363    ExpectIntEQ(wolfSSL_EVP_CipherInit(ctx, NULL, NULL, iv, 1),
2364        WOLFSSL_SUCCESS);
2365    ExpectIntEQ(EVP_DecryptUpdate(ctx, decryptedText, &outSz, cipherText,
2366         sizeof(cipherText)), WOLFSSL_SUCCESS);
2367    ExpectIntEQ(outSz, sizeof(cipherText));
2368    ExpectIntEQ(EVP_DecryptFinal_ex(ctx, decryptedText, &outSz),
2369        WOLFSSL_SUCCESS);
2370    ExpectIntEQ(outSz, 0);
2371    ExpectBufEQ(decryptedText, plainText, sizeof(plainText));
2372    EVP_CIPHER_CTX_free(ctx);
2373
2374    res = EXPECT_RESULT();
2375#endif
2376    return res;
2377}
2378
2379int test_wolfssl_EVP_sm4_gcm_zeroLen(void)
2380{
2381    int res = TEST_SKIPPED;
2382#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_SM4_GCM)
2383    /* Zero length plain text */
2384    EXPECT_DECLS;
2385    byte key[] = {
2386        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
2387        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
2388        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
2389        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
2390    }; /* align */
2391    byte iv[]  = {
2392        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
2393    }; /* align */
2394    byte plaintxt[1];
2395    int ivSz  = 12;
2396    int plaintxtSz = 0;
2397    unsigned char tag[16];
2398    unsigned char tag_kat[16] = {
2399        0x23,0x2f,0x0c,0xfe,0x30,0x8b,0x49,0xea,
2400        0x6f,0xc8,0x82,0x29,0xb5,0xdc,0x85,0x8d
2401    };
2402
2403    byte ciphertxt[SM4_BLOCK_SIZE * 4] = {0};
2404    byte decryptedtxt[SM4_BLOCK_SIZE * 4] = {0};
2405    int ciphertxtSz = 0;
2406    int decryptedtxtSz = 0;
2407    int len = 0;
2408
2409    EVP_CIPHER_CTX *en = EVP_CIPHER_CTX_new();
2410    EVP_CIPHER_CTX *de = EVP_CIPHER_CTX_new();
2411
2412    ExpectIntEQ(1, EVP_EncryptInit_ex(en, EVP_sm4_gcm(), NULL, key, iv));
2413    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(en, EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
2414    ExpectIntEQ(1, EVP_EncryptUpdate(en, ciphertxt, &ciphertxtSz , plaintxt,
2415        plaintxtSz));
2416    ExpectIntEQ(1, EVP_EncryptFinal_ex(en, ciphertxt, &len));
2417    ciphertxtSz += len;
2418    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(en, EVP_CTRL_GCM_GET_TAG, 16, tag));
2419    ExpectIntEQ(1, EVP_CIPHER_CTX_cleanup(en));
2420
2421    ExpectIntEQ(0, ciphertxtSz);
2422    ExpectIntEQ(0, XMEMCMP(tag, tag_kat, sizeof(tag)));
2423
2424    EVP_CIPHER_CTX_init(de);
2425    ExpectIntEQ(1, EVP_DecryptInit_ex(de, EVP_sm4_gcm(), NULL, key, iv));
2426    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(de, EVP_CTRL_GCM_SET_IVLEN, ivSz, NULL));
2427    ExpectIntEQ(1, EVP_DecryptUpdate(de, NULL, &len, ciphertxt, len));
2428    decryptedtxtSz = len;
2429    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(de, EVP_CTRL_GCM_SET_TAG, 16, tag));
2430    ExpectIntEQ(1, EVP_DecryptFinal_ex(de, decryptedtxt, &len));
2431    decryptedtxtSz += len;
2432    ExpectIntEQ(0, decryptedtxtSz);
2433
2434    EVP_CIPHER_CTX_free(en);
2435    EVP_CIPHER_CTX_free(de);
2436
2437    res = EXPECT_RESULT();
2438#endif /* OPENSSL_EXTRA && WOLFSSL_SM4_GCM */
2439    return res;
2440}
2441
2442int test_wolfssl_EVP_sm4_gcm(void)
2443{
2444    int res = TEST_SKIPPED;
2445#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_SM4_GCM)
2446    EXPECT_DECLS;
2447    byte *key = (byte*)"0123456789012345";
2448    /* A 128 bit IV */
2449    byte *iv = (byte*)"0123456789012345";
2450    int ivSz = SM4_BLOCK_SIZE;
2451    /* Message to be encrypted */
2452    byte *plaintxt = (byte*)"for things to change you have to change";
2453    /* Additional non-confidential data */
2454    byte *aad = (byte*)"Don't spend major time on minor things.";
2455
2456    unsigned char tag[SM4_BLOCK_SIZE] = {0};
2457    int plaintxtSz = (int)XSTRLEN((char*)plaintxt);
2458    int aadSz = (int)XSTRLEN((char*)aad);
2459    byte ciphertxt[SM4_BLOCK_SIZE * 4] = {0};
2460    byte decryptedtxt[SM4_BLOCK_SIZE * 4] = {0};
2461    int ciphertxtSz = 0;
2462    int decryptedtxtSz = 0;
2463    int len = 0;
2464    int i = 0;
2465    EVP_CIPHER_CTX en[2];
2466    EVP_CIPHER_CTX de[2];
2467
2468    for (i = 0; i < 2; i++) {
2469        EVP_CIPHER_CTX_init(&en[i]);
2470
2471        if (i == 0) {
2472            /* Default uses 96-bits IV length */
2473            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_sm4_gcm(), NULL, key,
2474                iv));
2475        }
2476        else {
2477            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_sm4_gcm(), NULL, NULL,
2478                NULL));
2479             /* non-default must to set the IV length first */
2480            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_GCM_SET_IVLEN,
2481                ivSz, NULL));
2482            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], NULL, NULL, key, iv));
2483        }
2484        ExpectIntEQ(1, EVP_EncryptUpdate(&en[i], NULL, &len, aad, aadSz));
2485        ExpectIntEQ(1, EVP_EncryptUpdate(&en[i], ciphertxt, &len, plaintxt,
2486            plaintxtSz));
2487        ciphertxtSz = len;
2488        ExpectIntEQ(1, EVP_EncryptFinal_ex(&en[i], ciphertxt, &len));
2489        ciphertxtSz += len;
2490        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_GCM_GET_TAG,
2491            SM4_BLOCK_SIZE, tag));
2492        ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_cleanup(&en[i]), 1);
2493
2494        EVP_CIPHER_CTX_init(&de[i]);
2495        if (i == 0) {
2496            /* Default uses 96-bits IV length */
2497            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_sm4_gcm(), NULL, key,
2498                iv));
2499        }
2500        else {
2501            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_sm4_gcm(), NULL, NULL,
2502                NULL));
2503            /* non-default must to set the IV length first */
2504            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_IVLEN,
2505                ivSz, NULL));
2506            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], NULL, NULL, key, iv));
2507
2508        }
2509        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
2510        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
2511            ciphertxtSz));
2512        decryptedtxtSz = len;
2513        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_TAG,
2514            SM4_BLOCK_SIZE, tag));
2515        ExpectIntEQ(1, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
2516        decryptedtxtSz += len;
2517        ExpectIntEQ(ciphertxtSz, decryptedtxtSz);
2518        ExpectIntEQ(0, XMEMCMP(plaintxt, decryptedtxt, decryptedtxtSz));
2519
2520        /* modify tag*/
2521        tag[SM4_BLOCK_SIZE-1]+=0xBB;
2522        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
2523        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_GCM_SET_TAG,
2524            SM4_BLOCK_SIZE, tag));
2525        /* fail due to wrong tag */
2526        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
2527            ciphertxtSz));
2528        ExpectIntEQ(0, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
2529        ExpectIntEQ(0, len);
2530        ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_cleanup(&de[i]), 1);
2531    }
2532
2533    res = EXPECT_RESULT();
2534#endif /* OPENSSL_EXTRA && WOLFSSL_SM4_GCM */
2535    return res;
2536}
2537
2538int test_wolfssl_EVP_sm4_ccm_zeroLen(void)
2539{
2540    int res = TEST_SKIPPED;
2541#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_SM4_CCM)
2542    /* Zero length plain text */
2543    EXPECT_DECLS;
2544    byte key[] = {
2545        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
2546        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
2547        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
2548        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
2549    }; /* align */
2550    byte iv[]  = {
2551        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
2552    }; /* align */
2553    byte plaintxt[1];
2554    int ivSz  = 12;
2555    int plaintxtSz = 0;
2556    unsigned char tag[16];
2557
2558    byte ciphertxt[SM4_BLOCK_SIZE * 4] = {0};
2559    byte decryptedtxt[SM4_BLOCK_SIZE * 4] = {0};
2560    int ciphertxtSz = 0;
2561    int decryptedtxtSz = 0;
2562    int len = 0;
2563
2564    EVP_CIPHER_CTX *en = EVP_CIPHER_CTX_new();
2565    EVP_CIPHER_CTX *de = EVP_CIPHER_CTX_new();
2566
2567    ExpectIntEQ(1, EVP_EncryptInit_ex(en, EVP_sm4_ccm(), NULL, key, iv));
2568    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(en, EVP_CTRL_CCM_SET_IVLEN, ivSz, NULL));
2569    ExpectIntEQ(1, EVP_EncryptUpdate(en, ciphertxt, &ciphertxtSz , plaintxt,
2570                                     plaintxtSz));
2571    ExpectIntEQ(1, EVP_EncryptFinal_ex(en, ciphertxt, &len));
2572    ciphertxtSz += len;
2573    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(en, EVP_CTRL_CCM_GET_TAG, 16, tag));
2574    ExpectIntEQ(1, EVP_CIPHER_CTX_cleanup(en));
2575
2576    ExpectIntEQ(0, ciphertxtSz);
2577
2578    EVP_CIPHER_CTX_init(de);
2579    ExpectIntEQ(1, EVP_DecryptInit_ex(de, EVP_sm4_ccm(), NULL, key, iv));
2580    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(de, EVP_CTRL_CCM_SET_IVLEN, ivSz, NULL));
2581    ExpectIntEQ(1, EVP_DecryptUpdate(de, NULL, &len, ciphertxt, len));
2582    decryptedtxtSz = len;
2583    ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(de, EVP_CTRL_CCM_SET_TAG, 16, tag));
2584    ExpectIntEQ(1, EVP_DecryptFinal_ex(de, decryptedtxt, &len));
2585    decryptedtxtSz += len;
2586    ExpectIntEQ(0, decryptedtxtSz);
2587
2588    EVP_CIPHER_CTX_free(en);
2589    EVP_CIPHER_CTX_free(de);
2590
2591    res = EXPECT_RESULT();
2592#endif /* OPENSSL_EXTRA && WOLFSSL_SM4_CCM */
2593    return res;
2594}
2595
2596int test_wolfssl_EVP_sm4_ccm(void)
2597{
2598    int res = TEST_SKIPPED;
2599#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_SM4_CCM)
2600    EXPECT_DECLS;
2601    byte *key = (byte*)"0123456789012345";
2602    byte *iv = (byte*)"0123456789012";
2603    int ivSz = (int)XSTRLEN((char*)iv);
2604    /* Message to be encrypted */
2605    byte *plaintxt = (byte*)"for things to change you have to change";
2606    /* Additional non-confidential data */
2607    byte *aad = (byte*)"Don't spend major time on minor things.";
2608
2609    unsigned char tag[SM4_BLOCK_SIZE] = {0};
2610    int plaintxtSz = (int)XSTRLEN((char*)plaintxt);
2611    int aadSz = (int)XSTRLEN((char*)aad);
2612    byte ciphertxt[SM4_BLOCK_SIZE * 4] = {0};
2613    byte decryptedtxt[SM4_BLOCK_SIZE * 4] = {0};
2614    int ciphertxtSz = 0;
2615    int decryptedtxtSz = 0;
2616    int len = 0;
2617    int i = 0;
2618    EVP_CIPHER_CTX en[2];
2619    EVP_CIPHER_CTX de[2];
2620
2621    for (i = 0; i < 2; i++) {
2622        EVP_CIPHER_CTX_init(&en[i]);
2623
2624        if (i == 0) {
2625            /* Default uses 96-bits IV length */
2626            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_sm4_ccm(), NULL, key,
2627                iv));
2628        }
2629        else {
2630            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], EVP_sm4_ccm(), NULL, NULL,
2631                NULL));
2632             /* non-default must to set the IV length first */
2633            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_CCM_SET_IVLEN,
2634                ivSz, NULL));
2635            ExpectIntEQ(1, EVP_EncryptInit_ex(&en[i], NULL, NULL, key, iv));
2636        }
2637        ExpectIntEQ(1, EVP_EncryptUpdate(&en[i], NULL, &len, aad, aadSz));
2638        ExpectIntEQ(1, EVP_EncryptUpdate(&en[i], ciphertxt, &len, plaintxt,
2639            plaintxtSz));
2640        ciphertxtSz = len;
2641        ExpectIntEQ(1, EVP_EncryptFinal_ex(&en[i], ciphertxt, &len));
2642        ciphertxtSz += len;
2643        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&en[i], EVP_CTRL_CCM_GET_TAG,
2644            SM4_BLOCK_SIZE, tag));
2645        ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_cleanup(&en[i]), 1);
2646
2647        EVP_CIPHER_CTX_init(&de[i]);
2648        if (i == 0) {
2649            /* Default uses 96-bits IV length */
2650            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_sm4_ccm(), NULL, key,
2651                iv));
2652        }
2653        else {
2654            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], EVP_sm4_ccm(), NULL, NULL,
2655                NULL));
2656            /* non-default must to set the IV length first */
2657            ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_CCM_SET_IVLEN,
2658                ivSz, NULL));
2659            ExpectIntEQ(1, EVP_DecryptInit_ex(&de[i], NULL, NULL, key, iv));
2660
2661        }
2662        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
2663        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
2664            ciphertxtSz));
2665        decryptedtxtSz = len;
2666        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_CCM_SET_TAG,
2667            SM4_BLOCK_SIZE, tag));
2668        ExpectIntEQ(1, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
2669        decryptedtxtSz += len;
2670        ExpectIntEQ(ciphertxtSz, decryptedtxtSz);
2671        ExpectIntEQ(0, XMEMCMP(plaintxt, decryptedtxt, decryptedtxtSz));
2672
2673        /* modify tag*/
2674        tag[SM4_BLOCK_SIZE-1]+=0xBB;
2675        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], NULL, &len, aad, aadSz));
2676        ExpectIntEQ(1, EVP_CIPHER_CTX_ctrl(&de[i], EVP_CTRL_CCM_SET_TAG,
2677            SM4_BLOCK_SIZE, tag));
2678        /* fail due to wrong tag */
2679        ExpectIntEQ(1, EVP_DecryptUpdate(&de[i], decryptedtxt, &len, ciphertxt,
2680            ciphertxtSz));
2681        ExpectIntEQ(0, EVP_DecryptFinal_ex(&de[i], decryptedtxt, &len));
2682        ExpectIntEQ(0, len);
2683        ExpectIntEQ(wolfSSL_EVP_CIPHER_CTX_cleanup(&de[i]), 1);
2684    }
2685
2686    res = EXPECT_RESULT();
2687#endif /* OPENSSL_EXTRA && WOLFSSL_SM4_CCM */
2688    return res;
2689}
2690
2691
2692int test_wolfSSL_EVP_rc4(void)
2693{
2694    EXPECT_DECLS;
2695#if !defined(NO_RC4) && defined(OPENSSL_ALL)
2696    ExpectNotNull(wolfSSL_EVP_rc4());
2697#endif
2698    return EXPECT_RESULT();
2699}
2700
2701int test_wolfSSL_EVP_enc_null(void)
2702{
2703    EXPECT_DECLS;
2704#ifdef OPENSSL_ALL
2705    ExpectNotNull(wolfSSL_EVP_enc_null());
2706#endif
2707    return EXPECT_RESULT();
2708}
2709int test_wolfSSL_EVP_rc2_cbc(void)
2710
2711{
2712    EXPECT_DECLS;
2713#if defined(WOLFSSL_QT) && !defined(NO_WOLFSSL_STUB)
2714    ExpectNull(wolfSSL_EVP_rc2_cbc());
2715#endif
2716    return EXPECT_RESULT();
2717}
2718
2719int test_wolfSSL_EVP_mdc2(void)
2720{
2721    EXPECT_DECLS;
2722#if !defined(NO_WOLFSSL_STUB) && defined(OPENSSL_ALL)
2723    ExpectNull(wolfSSL_EVP_mdc2());
2724#endif
2725    return EXPECT_RESULT();
2726}
2727
2728/* Test for integer overflow in EVP AEAD AAD accumulation.
2729 *
2730 * wolfSSL_EVP_CipherUpdate_GCM_AAD (and the CCM/ARIA variants) compute
2731 * allocation sizes as (ctx->authInSz + inl) where both operands are int.
2732 * Repeated AAD calls can accumulate authInSz to a value where adding inl
2733 * overflows the signed int sum. The overflowed value is then cast to size_t
2734 * for XMALLOC/XREALLOC, producing either:
2735 *   - A huge allocation on 64-bit (masking the bug as MEMORY_E), or
2736 *   - A potential heap buffer overflow on 32-bit if the wrapped size is small
2737 *     enough to succeed but the subsequent XMEMCPY uses the original large
2738 *     authInSz offset.
2739 *
2740 * This test simulates the overflow condition by directly setting authInSz near
2741 * INT_MAX after legitimate initialization, then calling EVP_EncryptUpdate with
2742 * AAD that triggers the overflow. A properly-fixed implementation should detect
2743 * the overflow and return WOLFSSL_FAILURE before attempting the allocation.
2744 */
2745int test_evp_cipher_pkcs7_pad_zero(void)
2746{
2747    EXPECT_DECLS;
2748#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_128) && \
2749    defined(OPENSSL_EXTRA)
2750    EVP_CIPHER_CTX *ctx = NULL;
2751    /* AES-128-CBC key and IV */
2752    byte key[AES_BLOCK_SIZE] = {
2753        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
2754        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
2755    };
2756    byte iv[AES_BLOCK_SIZE] = {0};
2757    /* Two plaintext blocks, with the last byte set to 0x00. When decrypted
2758     * with padding enabled, the last byte (0x00) will be interpreted as the
2759     * PKCS#7 padding length, which is invalid (valid range is 1..block_size).
2760     * Using two blocks ensures CipherUpdate outputs the first block and
2761     * CipherFinal processes the second (last) block through checkPad. */
2762    byte plain[AES_BLOCK_SIZE * 2] = {
2763        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2764        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2765        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
2766        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x00
2767    };
2768    byte cipher[AES_BLOCK_SIZE * 3];
2769    byte decrypted[AES_BLOCK_SIZE * 3];
2770    int outl = 0;
2771    int total = 0;
2772
2773    /* Encrypt two plaintext blocks with padding disabled so the ciphertext
2774     * is exactly two blocks. */
2775    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
2776    ExpectIntEQ(EVP_CipherInit(ctx, EVP_aes_128_cbc(), key, iv, 1),
2777        WOLFSSL_SUCCESS);
2778    ExpectIntEQ(EVP_CIPHER_CTX_set_padding(ctx, 0), WOLFSSL_SUCCESS);
2779    ExpectIntEQ(EVP_CipherUpdate(ctx, cipher, &outl, plain,
2780        AES_BLOCK_SIZE * 2), WOLFSSL_SUCCESS);
2781    total = outl;
2782    ExpectIntEQ(EVP_CipherFinal(ctx, cipher + total, &outl), WOLFSSL_SUCCESS);
2783    total += outl;
2784    ExpectIntEQ(total, AES_BLOCK_SIZE * 2);
2785    EVP_CIPHER_CTX_free(ctx);
2786    ctx = NULL;
2787
2788    /* Decrypt the ciphertext with padding enabled (the default).
2789     * CipherUpdate should output the first block. CipherFinal processes
2790     * the last block through checkPad, which should reject padding value 0. */
2791    ExpectNotNull(ctx = EVP_CIPHER_CTX_new());
2792    ExpectIntEQ(EVP_CipherInit(ctx, EVP_aes_128_cbc(), key, iv, 0),
2793        WOLFSSL_SUCCESS);
2794    ExpectIntEQ(EVP_CipherUpdate(ctx, decrypted, &outl, cipher, total),
2795        WOLFSSL_SUCCESS);
2796    ExpectIntEQ(outl, AES_BLOCK_SIZE);
2797    ExpectIntNE(EVP_CipherFinal(ctx, decrypted + outl, &outl),
2798        WOLFSSL_SUCCESS);
2799    EVP_CIPHER_CTX_free(ctx);
2800
2801#endif /* !NO_AES && HAVE_AES_CBC && WOLFSSL_AES_128 && OPENSSL_EXTRA */
2802    return EXPECT_RESULT();
2803}
2804
2805int test_evp_cipher_aead_aad_overflow(void)
2806{
2807    EXPECT_DECLS;
2808#if defined(OPENSSL_EXTRA) && !defined(NO_AES) && defined(HAVE_AESGCM) && \
2809    defined(WOLFSSL_AES_256) && !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) && \
2810    !defined(WOLFSSL_AESGCM_STREAM)
2811
2812    WOLFSSL_EVP_CIPHER_CTX *ctx = NULL;
2813    byte key[32] = {0};
2814    byte iv[12] = {0};
2815    byte aad[32] = {0};
2816    int outl = 0;
2817    int savedAuthInSz;
2818
2819    /* Initialize AES-256-GCM encryption context */
2820    ctx = EVP_CIPHER_CTX_new();
2821    ExpectNotNull(ctx);
2822    ExpectIntEQ(WOLFSSL_SUCCESS, EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(),
2823        NULL, key, iv));
2824
2825    /* Feed a small legitimate AAD to allocate authIn */
2826    ExpectIntEQ(WOLFSSL_SUCCESS, EVP_EncryptUpdate(ctx, NULL, &outl, aad, 16));
2827
2828    if (EXPECT_SUCCESS()) {
2829        ExpectIntEQ(ctx->authInSz, 16);
2830
2831        /* Simulate accumulated AAD near INT_MAX.
2832         * In a real attack scenario, an attacker controlling AAD input to a
2833         * server could accumulate authInSz toward INT_MAX through many calls.
2834         * We set it directly to avoid needing ~2GB of actual allocations.
2835         */
2836        savedAuthInSz = ctx->authInSz;
2837        ctx->authInSz = INT_MAX - 16;
2838
2839        /* Attempt AAD update that causes overflow:
2840         *   (INT_MAX - 16) + 32 = INT_MAX + 16
2841         * This overflows signed int (undefined behavior in C). The result:
2842         *   - As signed int: wraps to INT_MIN + 15 (on 2's complement)
2843         *   - Cast to size_t on 64-bit: ~0xFFFFFFFF8000000F (huge)
2844         *   - Cast to size_t on 32-bit: ~0x8000000F (~2GB)
2845         *
2846         * With no overflow check, the code proceeds to XREALLOC with the
2847         * wrapped size. On 64-bit this fails (MEMORY_E), accidentally
2848         * preventing corruption. On 32-bit, if the allocation succeeds,
2849         * XMEMCPY writes at offset (INT_MAX - 16) into the buffer, causing
2850         * heap corruption.
2851         */
2852        ExpectIntNE(WOLFSSL_SUCCESS,
2853            EVP_EncryptUpdate(ctx, NULL, &outl, aad, 32));
2854
2855        /* Restore authInSz so cleanup doesn't operate on corrupted state */
2856        if (ctx != NULL)
2857            ctx->authInSz = savedAuthInSz;
2858    }
2859
2860    EVP_CIPHER_CTX_free(ctx);
2861
2862#endif /* OPENSSL_EXTRA && HAVE_AESGCM && WOLFSSL_AES_256 */
2863    return EXPECT_RESULT();
2864}
2865
2866