test/recipes/80-test_cms.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9
  10 use strict;
  11 use warnings;
  12
  13 use POSIX;
  14 use File::Spec::Functions qw/catfile/;
  15 use File::Compare qw/compare_text compare/;
  16 use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file/;
  17
  18 use OpenSSL::Test::Utils;
  19
  20 BEGIN {
  21     setup("test_cms");
  22 }
  23
  24 use lib srctop_dir('Configurations');
  25 use lib bldtop_dir('.');
  26
  27 my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
  28
  29 plan skip_all => "CMS is not supported by this OpenSSL build"
  30     if disabled("cms");
  31
  32 my $provpath = bldtop_dir("providers");
  33
  34 # Some tests require legacy algorithms to be included.
  35 my @legacyprov = ("-provider-path", $provpath,
  36                   "-provider", "default",
  37                   "-provider", "legacy" );
  38 my @defaultprov = ("-provider-path", $provpath,
  39                    "-provider", "default");
  40
  41 my @config = ( );
  42 my $provname = 'default';
  43
  44 my $datadir = srctop_dir("test", "recipes", "80-test_cms_data");
  45 my $smdir    = srctop_dir("test", "smime-certs");
  46 my $smcont   = srctop_file("test", "smcont.txt");
  47 my $smcont_zero = srctop_file("test", "smcont_zero.txt");
  48 my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib)
  49     = disabled qw/des dh dsa ec ec2m rc2 zlib/;
  50
  51 $no_rc2 = 1 if disabled("legacy");
  52
  53 plan tests => 15;
  54
  55 ok(run(test(["pkcs7_test"])), "test pkcs7");
  56
  57 unless ($no_fips) {
  58     @config = ( "-config", srctop_file("test", "fips-and-base.cnf") );
  59     $provname = 'fips';
  60 }
  61
  62 $ENV{OPENSSL_TEST_LIBCTX} = "1";
  63 my @prov = ("-provider-path", $provpath,
  64             @config,
  65             "-provider", $provname);
  66
  67 my $smrsa1 = catfile($smdir, "smrsa1.pem");
  68 my $smroot = catfile($smdir, "smroot.pem");
  69
  70 my @smime_pkcs7_tests = (
  71
  72     [ "signed content DER format, RSA key",
  73       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
  74         "-certfile", $smroot, "-signer", $smrsa1, "-out", "{output}.cms" ],
  75       [ "{cmd2}",  @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
  76         "-CAfile", $smroot, "-out", "{output}.txt" ],
  77       \&final_compare
  78     ],
  79
  80     [ "signed detached content DER format, RSA key",
  81       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
  82         "-signer", $smrsa1, "-out", "{output}.cms" ],
  83       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
  84         "-CAfile", $smroot, "-out", "{output}.txt",
  85         "-content", $smcont ],
  86       \&final_compare
  87     ],
  88
  89     [ "signed content test streaming BER format, RSA",
  90       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
  91         "-stream",
  92         "-signer", $smrsa1, "-out", "{output}.cms" ],
  93       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
  94         "-CAfile", $smroot, "-out", "{output}.txt" ],
  95       \&final_compare
  96     ],
  97
  98     [ "signed content DER format, DSA key",
  99       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
 100         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
 101       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 102         "-CAfile", $smroot, "-out", "{output}.txt" ],
 103       \&final_compare
 104     ],
 105
 106     [ "signed detached content DER format, DSA key",
 107       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 108         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
 109       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 110         "-CAfile", $smroot, "-out", "{output}.txt",
 111         "-content", $smcont ],
 112       \&final_compare
 113     ],
 114
 115     [ "signed detached content DER format, add RSA signer (with DSA existing)",
 116       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 117         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
 118       [ "{cmd1}", @prov, "-resign", "-in", "{output}.cms", "-inform", "DER", "-outform", "DER",
 119         "-signer", $smrsa1, "-out", "{output}2.cms" ],
 120       [ "{cmd2}", @prov, "-verify", "-in", "{output}2.cms", "-inform", "DER",
 121         "-CAfile", $smroot, "-out", "{output}.txt",
 122         "-content", $smcont ],
 123       \&final_compare
 124     ],
 125
 126     [ "signed content test streaming BER format, DSA key",
 127       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 128         "-nodetach", "-stream",
 129         "-signer", catfile($smdir, "smdsa1.pem"), "-out", "{output}.cms" ],
 130       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 131         "-CAfile", $smroot, "-out", "{output}.txt" ],
 132       \&final_compare
 133     ],
 134
 135     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys",
 136       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 137         "-nodetach", "-stream",
 138         "-signer", $smrsa1,
 139         "-signer", catfile($smdir, "smrsa2.pem"),
 140         "-signer", catfile($smdir, "smdsa1.pem"),
 141         "-signer", catfile($smdir, "smdsa2.pem"),
 142         "-out", "{output}.cms" ],
 143       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 144         "-CAfile", $smroot, "-out", "{output}.txt" ],
 145       \&final_compare
 146     ],
 147
 148     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, no attributes",
 149       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 150         "-noattr", "-nodetach", "-stream",
 151         "-signer", $smrsa1,
 152         "-signer", catfile($smdir, "smrsa2.pem"),
 153         "-signer", catfile($smdir, "smdsa1.pem"),
 154         "-signer", catfile($smdir, "smdsa2.pem"),
 155         "-out", "{output}.cms" ],
 156       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 157         "-CAfile", $smroot, "-out", "{output}.txt" ],
 158       \&final_compare
 159     ],
 160
 161     [ "signed content S/MIME format, RSA key SHA1",
 162       [ "{cmd1}", @defaultprov, "-sign", "-in", $smcont, "-md", "sha1",
 163         "-certfile", $smroot,
 164         "-signer", $smrsa1, "-out", "{output}.cms" ],
 165       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 166         "-CAfile", $smroot, "-out", "{output}.txt" ],
 167       \&final_compare
 168     ],
 169
 170     [ "signed zero-length content S/MIME format, RSA key SHA1",
 171       [ "{cmd1}", @defaultprov, "-sign", "-in", $smcont_zero, "-md", "sha1",
 172         "-certfile", $smroot, "-signer", $smrsa1, "-out", "{output}.cms" ],
 173       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 174         "-CAfile", $smroot, "-out", "{output}.txt" ],
 175       \&zero_compare
 176     ],
 177
 178     [ "signed content test streaming S/MIME format, 2 DSA and 2 RSA keys",
 179       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-nodetach",
 180         "-signer", $smrsa1,
 181         "-signer", catfile($smdir, "smrsa2.pem"),
 182         "-signer", catfile($smdir, "smdsa1.pem"),
 183         "-signer", catfile($smdir, "smdsa2.pem"),
 184         "-stream", "-out", "{output}.cms" ],
 185       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 186         "-CAfile", $smroot, "-out", "{output}.txt" ],
 187       \&final_compare
 188     ],
 189
 190     [ "signed content test streaming multipart S/MIME format, 2 DSA and 2 RSA keys",
 191       [ "{cmd1}", @prov, "-sign", "-in", $smcont,
 192         "-signer", $smrsa1,
 193         "-signer", catfile($smdir, "smrsa2.pem"),
 194         "-signer", catfile($smdir, "smdsa1.pem"),
 195         "-signer", catfile($smdir, "smdsa2.pem"),
 196         "-stream", "-out", "{output}.cms" ],
 197       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 198         "-CAfile", $smroot, "-out", "{output}.txt" ],
 199       \&final_compare
 200     ],
 201
 202     [ "enveloped content test streaming S/MIME format, DES, 3 recipients",
 203       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 204         "-stream", "-out", "{output}.cms",
 205         $smrsa1,
 206         catfile($smdir, "smrsa2.pem"),
 207         catfile($smdir, "smrsa3.pem") ],
 208       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", $smrsa1,
 209         "-in", "{output}.cms", "-out", "{output}.txt" ],
 210       \&final_compare
 211     ],
 212
 213     [ "enveloped content test streaming S/MIME format, DES, 3 recipients, 3rd used",
 214       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 215         "-stream", "-out", "{output}.cms",
 216         $smrsa1,
 217         catfile($smdir, "smrsa2.pem"),
 218         catfile($smdir, "smrsa3.pem") ],
 219       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smrsa3.pem"),
 220         "-in", "{output}.cms", "-out", "{output}.txt" ],
 221       \&final_compare
 222     ],
 223
 224     [ "enveloped content test streaming S/MIME format, DES, 3 recipients, key only used",
 225       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 226         "-stream", "-out", "{output}.cms",
 227         $smrsa1,
 228         catfile($smdir, "smrsa2.pem"),
 229         catfile($smdir, "smrsa3.pem") ],
 230       [ "{cmd2}", @defaultprov, "-decrypt", "-inkey", catfile($smdir, "smrsa3.pem"),
 231         "-in", "{output}.cms", "-out", "{output}.txt" ],
 232       \&final_compare
 233     ],
 234
 235     [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients",
 236       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 237         "-aes256", "-stream", "-out", "{output}.cms",
 238         $smrsa1,
 239         catfile($smdir, "smrsa2.pem"),
 240         catfile($smdir, "smrsa3.pem") ],
 241       [ "{cmd2}", @prov, "-decrypt", "-recip", $smrsa1,
 242         "-in", "{output}.cms", "-out", "{output}.txt" ],
 243       \&final_compare
 244     ],
 245
 246 );
 247
 248 my @smime_cms_tests = (
 249
 250     [ "signed content test streaming BER format, 2 DSA and 2 RSA keys, keyid",
 251       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER",
 252         "-nodetach", "-keyid",
 253         "-signer", $smrsa1,
 254         "-signer", catfile($smdir, "smrsa2.pem"),
 255         "-signer", catfile($smdir, "smdsa1.pem"),
 256         "-signer", catfile($smdir, "smdsa2.pem"),
 257         "-stream", "-out", "{output}.cms" ],
 258       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "DER",
 259         "-CAfile", $smroot, "-out", "{output}.txt" ],
 260       \&final_compare
 261     ],
 262
 263     [ "signed content test streaming PEM format, 2 DSA and 2 RSA keys",
 264       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 265         "-signer", $smrsa1,
 266         "-signer", catfile($smdir, "smrsa2.pem"),
 267         "-signer", catfile($smdir, "smdsa1.pem"),
 268         "-signer", catfile($smdir, "smdsa2.pem"),
 269         "-stream", "-out", "{output}.cms" ],
 270       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 271         "-CAfile", $smroot, "-out", "{output}.txt" ],
 272       \&final_compare
 273     ],
 274
 275     [ "signed content MIME format, RSA key, signed receipt request",
 276       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-nodetach",
 277         "-signer", $smrsa1,
 278         "-receipt_request_to", "test\@openssl.org", "-receipt_request_all",
 279         "-out", "{output}.cms" ],
 280       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms",
 281         "-CAfile", $smroot, "-out", "{output}.txt" ],
 282       \&final_compare
 283     ],
 284
 285     [ "signed receipt MIME format, RSA key",
 286       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-nodetach",
 287         "-signer", $smrsa1,
 288         "-receipt_request_to", "test\@openssl.org", "-receipt_request_all",
 289         "-out", "{output}.cms" ],
 290       [ "{cmd1}", @prov, "-sign_receipt", "-in", "{output}.cms",
 291         "-signer", catfile($smdir, "smrsa2.pem"), "-out", "{output}2.cms" ],
 292       [ "{cmd2}", @prov, "-verify_receipt", "{output}2.cms", "-in", "{output}.cms",
 293         "-CAfile", $smroot ]
 294     ],
 295
 296     [ "enveloped content test streaming S/MIME format, DES, 3 recipients, keyid",
 297       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 298         "-stream", "-out", "{output}.cms", "-keyid",
 299         $smrsa1,
 300         catfile($smdir, "smrsa2.pem"),
 301         catfile($smdir, "smrsa3.pem") ],
 302       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", $smrsa1,
 303         "-in", "{output}.cms", "-out", "{output}.txt" ],
 304       \&final_compare
 305     ],
 306
 307     [ "enveloped content test streaming PEM format, AES-256-CBC cipher, KEK",
 308       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, "-outform", "PEM", "-aes128",
 309         "-stream", "-out", "{output}.cms",
 310         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 311         "-secretkeyid", "C0FEE0" ],
 312       [ "{cmd2}", @prov, "-decrypt", "-in", "{output}.cms", "-out", "{output}.txt",
 313         "-inform", "PEM",
 314         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 315         "-secretkeyid", "C0FEE0" ],
 316       \&final_compare
 317     ],
 318
 319     [ "enveloped content test streaming PEM format, AES-256-GCM cipher, KEK",
 320       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, "-outform", "PEM", "-aes-128-gcm",
 321         "-stream", "-out", "{output}.cms",
 322         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 323         "-secretkeyid", "C0FEE0" ],
 324       [ "{cmd2}", "-decrypt", "-in", "{output}.cms", "-out", "{output}.txt",
 325         "-inform", "PEM",
 326         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 327         "-secretkeyid", "C0FEE0" ],
 328       \&final_compare
 329     ],
 330
 331     [ "enveloped content test streaming PEM format, KEK, key only",
 332       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, "-outform", "PEM", "-aes128",
 333         "-stream", "-out", "{output}.cms",
 334         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 335         "-secretkeyid", "C0FEE0" ],
 336       [ "{cmd2}", @prov, "-decrypt", "-in", "{output}.cms", "-out", "{output}.txt",
 337         "-inform", "PEM",
 338         "-secretkey", "000102030405060708090A0B0C0D0E0F" ],
 339       \&final_compare
 340     ],
 341
 342     [ "data content test streaming PEM format",
 343       [ "{cmd1}", @prov, "-data_create", "-in", $smcont, "-outform", "PEM",
 344         "-nodetach", "-stream", "-out", "{output}.cms" ],
 345       [ "{cmd2}", @prov, "-data_out", "-in", "{output}.cms", "-inform", "PEM",
 346         "-out", "{output}.txt" ],
 347       \&final_compare
 348     ],
 349
 350     [ "encrypted content test streaming PEM format, 128 bit RC2 key",
 351       [ "{cmd1}", @legacyprov, "-EncryptedData_encrypt",
 352         "-in", $smcont, "-outform", "PEM",
 353         "-rc2", "-secretkey", "000102030405060708090A0B0C0D0E0F",
 354         "-stream", "-out", "{output}.cms" ],
 355       [ "{cmd2}", @legacyprov, "-EncryptedData_decrypt", "-in", "{output}.cms",
 356         "-inform", "PEM",
 357         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 358         "-out", "{output}.txt" ],
 359       \&final_compare
 360     ],
 361
 362     [ "encrypted content test streaming PEM format, 40 bit RC2 key",
 363       [ "{cmd1}", @legacyprov, "-EncryptedData_encrypt",
 364         "-in", $smcont, "-outform", "PEM",
 365         "-rc2", "-secretkey", "0001020304",
 366         "-stream", "-out", "{output}.cms" ],
 367       [ "{cmd2}", @legacyprov, "-EncryptedData_decrypt", "-in", "{output}.cms",
 368         "-inform", "PEM",
 369         "-secretkey", "0001020304", "-out", "{output}.txt" ],
 370       \&final_compare
 371     ],
 372
 373     [ "encrypted content test streaming PEM format, 128 bit AES key",
 374       [ "{cmd1}", @prov, "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
 375         "-aes128", "-secretkey", "000102030405060708090A0B0C0D0E0F",
 376         "-stream", "-out", "{output}.cms" ],
 377       [ "{cmd2}", @prov, "-EncryptedData_decrypt", "-in", "{output}.cms",
 378         "-inform", "PEM",
 379         "-secretkey", "000102030405060708090A0B0C0D0E0F",
 380         "-out", "{output}.txt" ],
 381       \&final_compare
 382     ],
 383 );
 384
 385 # FIPS 140-3: DES is unavailable
 386 push @smime_cms_tests, (
 387     [ "encrypted content test streaming PEM format, triple DES key",
 388       [ "{cmd1}", @prov, "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
 389         "-des3", "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
 390         "-stream", "-out", "{output}.cms" ],
 391       [ "{cmd2}", @prov, "-EncryptedData_decrypt", "-in", "{output}.cms",
 392         "-inform", "PEM",
 393         "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
 394         "-out", "{output}.txt" ],
 395       \&final_compare
 396     ],
 397 ) if $no_fips;
 398
 399 my @smime_cms_cades_tests = (
 400
 401     [ "signed content DER format, RSA key, CAdES-BES compatible",
 402       [ "{cmd1}", @prov, "-sign", "-cades", "-in", $smcont, "-outform", "DER",
 403          "-nodetach",
 404         "-certfile", $smroot, "-signer", $smrsa1, "-out", "{output}.cms" ],
 405       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 406         "-CAfile", $smroot, "-out", "{output}.txt" ],
 407       \&final_compare
 408     ],
 409
 410     [ "signed content DER format, RSA key, SHA256 md, CAdES-BES compatible",
 411       [ "{cmd1}", @prov, "-sign", "-cades", "-md", "sha256", "-in", $smcont, "-outform",
 412         "DER", "-nodetach", "-certfile", $smroot,
 413         "-signer", $smrsa1, "-out", "{output}.cms" ],
 414       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 415         "-CAfile", $smroot, "-out", "{output}.txt" ],
 416       \&final_compare
 417     ],
 418
 419     [ "signed content DER format, RSA key, SHA512 md, CAdES-BES compatible",
 420       [ "{cmd1}", @prov, "-sign", "-cades", "-md", "sha512", "-in", $smcont, "-outform",
 421         "DER", "-nodetach", "-certfile", $smroot,
 422         "-signer", $smrsa1, "-out", "{output}.cms" ],
 423       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 424         "-CAfile", $smroot, "-out", "{output}.txt" ],
 425       \&final_compare
 426     ],
 427
 428     [ "signed content DER format, RSA key, SHA256 md, CAdES-BES compatible",
 429       [ "{cmd1}", @prov, "-sign", "-cades", "-binary",  "-nodetach", "-nosmimecap", "-md", "sha256",
 430         "-in", $smcont, "-outform", "DER",
 431         "-certfile", $smroot, "-signer", $smrsa1,
 432         "-outform", "DER", "-out", "{output}.cms"  ],
 433       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 434         "-CAfile", $smroot, "-out", "{output}.txt" ],
 435       \&final_compare
 436     ],
 437
 438     [ "resigned content DER format, RSA key, SHA256 md, CAdES-BES compatible",
 439       [ "{cmd1}", @prov, "-sign", "-cades", "-binary",  "-nodetach", "-nosmimecap", "-md", "sha256",
 440         "-in", $smcont, "-outform", "DER",
 441         "-certfile", $smroot, "-signer", $smrsa1,
 442         "-outform", "DER", "-out", "{output}.cms"  ],
 443       [ "{cmd1}", @prov, "-resign", "-cades", "-binary", "-nodetach", "-nosmimecap", "-md", "sha256",
 444         "-inform", "DER", "-in", "{output}.cms",
 445         "-certfile", $smroot, "-signer", catfile($smdir, "smrsa2.pem"),
 446         "-outform", "DER", "-out", "{output}2.cms" ],
 447
 448       [ "{cmd2}", @prov, "-verify", "-cades", "-in", "{output}2.cms", "-inform", "DER",
 449         "-CAfile", $smroot, "-out", "{output}.txt" ],
 450       \&final_compare
 451     ],
 452 );
 453
 454 my @smime_cms_cades_ko_tests = (
 455     [ "sign content DER format, RSA key, not CAdES-BES compatible",
 456       [ @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
 457         "-certfile", $smroot, "-signer", $smrsa1, "-out", "{output}.cms" ],
 458       "fail to verify token since requiring CAdES-BES compatibility",
 459       [ @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
 460         "-CAfile", $smroot, "-out", "{output}.txt" ],
 461       \&final_compare
 462     ]
 463 );
 464
 465 # cades options test - check that some combinations are rejected
 466 my @smime_cms_cades_invalid_option_tests = (
 467     [
 468         [ "-cades", "-noattr" ],
 469     ],[
 470         [ "-verify", "-cades", "-noattr" ],
 471     ],[
 472         [ "-verify", "-cades", "-noverify" ],
 473     ],
 474 );
 475
 476 my @smime_cms_comp_tests = (
 477
 478     [ "compressed content test streaming PEM format",
 479       [ "{cmd1}", @prov, "-compress", "-in", $smcont, "-outform", "PEM", "-nodetach",
 480         "-stream", "-out", "{output}.cms" ],
 481       [ "{cmd2}", @prov, "-uncompress", "-in", "{output}.cms", "-inform", "PEM",
 482         "-out", "{output}.txt" ],
 483       \&final_compare
 484     ]
 485
 486 );
 487
 488 my @smime_cms_param_tests = (
 489     [ "signed content test streaming PEM format, RSA keys, PSS signature",
 490       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 491         "-signer", $smrsa1,
 492         "-keyopt", "rsa_padding_mode:pss",
 493         "-out", "{output}.cms" ],
 494       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 495         "-CAfile", $smroot, "-out", "{output}.txt" ],
 496       \&final_compare
 497     ],
 498
 499     [ "signed content test streaming PEM format, RSA keys, PSS signature, saltlen=max",
 500       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 501         "-signer", $smrsa1,
 502         "-keyopt", "rsa_padding_mode:pss", "-keyopt", "rsa_pss_saltlen:max",
 503         "-out", "{output}.cms" ],
 504       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 505         "-CAfile", $smroot, "-out", "{output}.txt" ],
 506       \&final_compare
 507     ],
 508
 509     [ "signed content test streaming PEM format, RSA keys, PSS signature, no attributes",
 510       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 511         "-noattr", "-signer", $smrsa1,
 512         "-keyopt", "rsa_padding_mode:pss",
 513         "-out", "{output}.cms" ],
 514       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 515         "-CAfile", $smroot, "-out", "{output}.txt" ],
 516       \&final_compare
 517     ],
 518
 519     [ "signed content test streaming PEM format, RSA keys, PSS signature, SHA384 MGF1",
 520       [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach",
 521         "-signer", $smrsa1,
 522         "-keyopt", "rsa_padding_mode:pss", "-keyopt", "rsa_mgf1_md:sha384",
 523         "-out", "{output}.cms" ],
 524       [ "{cmd2}", @prov, "-verify", "-in", "{output}.cms", "-inform", "PEM",
 525         "-CAfile", $smroot, "-out", "{output}.txt" ],
 526       \&final_compare
 527     ],
 528
 529     [ "enveloped content test streaming S/MIME format, DES, OAEP default parameters",
 530       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 531         "-stream", "-out", "{output}.cms",
 532         "-recip", $smrsa1,
 533         "-keyopt", "rsa_padding_mode:oaep" ],
 534       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", $smrsa1,
 535         "-in", "{output}.cms", "-out", "{output}.txt" ],
 536       \&final_compare
 537     ],
 538
 539     [ "enveloped content test streaming S/MIME format, DES, OAEP SHA256",
 540       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 541         "-stream", "-out", "{output}.cms",
 542         "-recip", $smrsa1,
 543         "-keyopt", "rsa_padding_mode:oaep",
 544         "-keyopt", "rsa_oaep_md:sha256" ],
 545       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", $smrsa1,
 546         "-in", "{output}.cms", "-out", "{output}.txt" ],
 547       \&final_compare
 548     ],
 549
 550     [ "enveloped content test streaming S/MIME format, DES, ECDH",
 551       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 552         "-stream", "-out", "{output}.cms",
 553         "-recip", catfile($smdir, "smec1.pem") ],
 554       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
 555         "-in", "{output}.cms", "-out", "{output}.txt" ],
 556       \&final_compare
 557     ],
 558
 559     [ "enveloped content test streaming S/MIME format, DES, ECDH, 2 recipients, key only used",
 560       [ "{cmd1}", @defaultprov, "-encrypt", "-in", $smcont,
 561         "-stream", "-out", "{output}.cms",
 562         catfile($smdir, "smec1.pem"),
 563         catfile($smdir, "smec3.pem") ],
 564       [ "{cmd2}", @defaultprov, "-decrypt", "-inkey", catfile($smdir, "smec3.pem"),
 565         "-in", "{output}.cms", "-out", "{output}.txt" ],
 566       \&final_compare
 567     ],
 568
 569     [ "enveloped content test streaming S/MIME format, ECDH, DES, key identifier",
 570       [ "{cmd1}", @defaultprov, "-encrypt", "-keyid", "-in", $smcont,
 571         "-stream", "-out", "{output}.cms",
 572         "-recip", catfile($smdir, "smec1.pem") ],
 573       [ "{cmd2}", @defaultprov, "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
 574         "-in", "{output}.cms", "-out", "{output}.txt" ],
 575       \&final_compare
 576     ],
 577
 578     [ "enveloped content test streaming S/MIME format, ECDH, AES-128-CBC, SHA256 KDF",
 579       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 580         "-stream", "-out", "{output}.cms",
 581         "-recip", catfile($smdir, "smec1.pem"), "-aes128",
 582         "-keyopt", "ecdh_kdf_md:sha256" ],
 583       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
 584         "-in", "{output}.cms", "-out", "{output}.txt" ],
 585       \&final_compare
 586     ],
 587
 588     [ "enveloped content test streaming S/MIME format, ECDH, AES-128-GCM cipher, SHA256 KDF",
 589       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 590         "-stream", "-out", "{output}.cms",
 591         "-recip", catfile($smdir, "smec1.pem"), "-aes-128-gcm", "-keyopt", "ecdh_kdf_md:sha256" ],
 592       [ "{cmd2}", "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
 593         "-in", "{output}.cms", "-out", "{output}.txt" ],
 594       \&final_compare
 595     ],
 596
 597     [ "enveloped content test streaming S/MIME format, ECDH, K-283, cofactor DH",
 598       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 599         "-stream", "-out", "{output}.cms",
 600         "-recip", catfile($smdir, "smec2.pem"), "-aes128",
 601         "-keyopt", "ecdh_kdf_md:sha256", "-keyopt", "ecdh_cofactor_mode:1" ],
 602       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smec2.pem"),
 603         "-in", "{output}.cms", "-out", "{output}.txt" ],
 604       \&final_compare
 605     ],
 606
 607     [ "enveloped content test streaming S/MIME format, X9.42 DH",
 608       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
 609         "-stream", "-out", "{output}.cms",
 610         "-recip", catfile($smdir, "smdh.pem"), "-aes128" ],
 611       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smdh.pem"),
 612         "-in", "{output}.cms", "-out", "{output}.txt" ],
 613       \&final_compare
 614     ]
 615 );
 616
 617 my @contenttype_cms_test = (
 618     [ "signed content test - check that content type is added to additional signerinfo, RSA keys",
 619       [ "{cmd1}", @prov, "-sign", "-binary", "-nodetach", "-stream", "-in", $smcont,
 620         "-outform", "DER", "-signer", $smrsa1, "-md", "SHA256",
 621         "-out", "{output}.cms" ],
 622       [ "{cmd1}", @prov, "-resign", "-binary", "-nodetach", "-in", "{output}.cms",
 623         "-inform", "DER", "-outform", "DER",
 624         "-signer", catfile($smdir, "smrsa2.pem"), "-md", "SHA256",
 625         "-out", "{output}2.cms" ],
 626       sub { my %opts = @_; contentType_matches("$opts{output}2.cms") == 2; },
 627       [ "{cmd2}", @prov, "-verify", "-in", "{output}2.cms", "-inform", "DER",
 628         "-CAfile", $smroot, "-out", "{output}.txt" ]
 629     ],
 630 );
 631
 632 my @incorrect_attribute_cms_test = (
 633     "bad_signtime_attr.cms",
 634     "no_ct_attr.cms",
 635     "no_md_attr.cms",
 636     "ct_multiple_attr.cms"
 637 );
 638
 639 # Runs a standard loop on the input array
 640 sub runner_loop {
 641     my %opts = ( @_ );
 642     my $cnt1 = 0;
 643
 644     foreach (@{$opts{tests}}) {
 645         $cnt1++;
 646         $opts{output} = "$opts{prefix}-$cnt1";
 647       SKIP: {
 648           my $skip_reason = check_availability($$_[0]);
 649           skip $skip_reason, 1 if $skip_reason;
 650           my $ok = 1;
 651           1 while unlink "$opts{output}.txt";
 652
 653           foreach (@$_[1..$#$_]) {
 654               if (ref $_ eq 'CODE') {
 655                   $ok &&= $_->(%opts);
 656               } else {
 657                   my @cmd = map {
 658                       my $x = $_;
 659                       while ($x =~ /\{([^\}]+)\}/) {
 660                           $x = $`.$opts{$1}.$' if exists $opts{$1};
 661                       }
 662                       $x;
 663                   } @$_;
 664
 665                   diag "CMD: openssl ", join(" ", @cmd);
 666                   $ok &&= run(app(["openssl", @cmd]));
 667                   $opts{input} = $opts{output};
 668               }
 669           }
 670
 671           ok($ok, $$_[0]);
 672         }
 673     }
 674 }
 675
 676 sub final_compare {
 677     my %opts = @_;
 678
 679     diag "Comparing $smcont with $opts{output}.txt";
 680     return compare_text($smcont, "$opts{output}.txt") == 0;
 681 }
 682
 683 sub zero_compare {
 684     my %opts = @_;
 685
 686     diag "Checking for zero-length file";
 687     return (-e "$opts{output}.txt" && -z "$opts{output}.txt");
 688 }
 689
 690 subtest "CMS => PKCS#7 compatibility tests\n" => sub {
 691     plan tests => scalar @smime_pkcs7_tests;
 692
 693     runner_loop(prefix => 'cms2pkcs7', cmd1 => 'cms', cmd2 => 'smime',
 694                 tests => [ @smime_pkcs7_tests ]);
 695 };
 696 subtest "CMS <= PKCS#7 compatibility tests\n" => sub {
 697     plan tests => scalar @smime_pkcs7_tests;
 698
 699     runner_loop(prefix => 'pkcs72cms', cmd1 => 'smime', cmd2 => 'cms',
 700                 tests => [ @smime_pkcs7_tests ]);
 701 };
 702
 703 subtest "CMS <=> CMS consistency tests\n" => sub {
 704     plan tests => (scalar @smime_pkcs7_tests) + (scalar @smime_cms_tests);
 705
 706     runner_loop(prefix => 'cms2cms-1', cmd1 => 'cms', cmd2 => 'cms',
 707                 tests => [ @smime_pkcs7_tests ]);
 708     runner_loop(prefix => 'cms2cms-2', cmd1 => 'cms', cmd2 => 'cms',
 709                 tests => [ @smime_cms_tests ]);
 710 };
 711
 712 subtest "CMS <=> CMS consistency tests, modified key parameters\n" => sub {
 713     plan tests =>
 714         (scalar @smime_cms_param_tests) + (scalar @smime_cms_comp_tests);
 715
 716     runner_loop(prefix => 'cms2cms-mod', cmd1 => 'cms', cmd2 => 'cms',
 717                 tests => [ @smime_cms_param_tests ]);
 718   SKIP: {
 719       skip("Zlib not supported: compression tests skipped",
 720            scalar @smime_cms_comp_tests)
 721           if $no_zlib;
 722
 723       runner_loop(prefix => 'cms2cms-comp', cmd1 => 'cms', cmd2 => 'cms',
 724                   tests => [ @smime_cms_comp_tests ]);
 725     }
 726 };
 727
 728 # Returns the number of matches of a Content Type Attribute in a binary file.
 729 sub contentType_matches {
 730   # Read in a binary file
 731   my ($in) = @_;
 732   open (HEX_IN, "$in") or die("open failed for $in : $!");
 733   binmode(HEX_IN);
 734   local $/;
 735   my $str = <HEX_IN>;
 736
 737   # Find ASN1 data for a Content Type Attribute (with a OID of PKCS7 data)
 738   my @c = $str =~ /\x30\x18\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x09\x03\x31\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x01/gs;
 739
 740   close(HEX_IN);
 741   return scalar(@c);
 742 }
 743
 744 subtest "CMS Check the content type attribute is added for additional signers\n" => sub {
 745     plan tests => (scalar @contenttype_cms_test);
 746
 747     runner_loop(prefix => 'cms2cms-added', cmd1 => 'cms', cmd2 => 'cms',
 748                 tests => [ @contenttype_cms_test ]);
 749 };
 750
 751 subtest "CMS Check that bad attributes fail when verifying signers\n" => sub {
 752     plan tests =>
 753         (scalar @incorrect_attribute_cms_test);
 754
 755     my $cnt = 0;
 756     foreach my $name (@incorrect_attribute_cms_test) {
 757         my $out = "incorrect-$cnt.txt";
 758
 759         ok(!run(app(["openssl", "cms", @prov, "-verify", "-in",
 760                      catfile($datadir, $name), "-inform", "DER", "-CAfile",
 761                      $smroot, "-out", $out ])),
 762             $name);
 763     }
 764 };
 765
 766 subtest "CMS Decrypt message encrypted with OpenSSL 1.1.1\n" => sub {
 767     plan tests => 1;
 768
 769     SKIP: {
 770         skip "EC or DES isn't supported in this build", 1
 771             if disabled("ec") || disabled("des");
 772
 773         my $out = "smtst.txt";
 774
 775         ok(run(app(["openssl", "cms", @defaultprov, "-decrypt",
 776                     "-inkey", catfile($smdir, "smec3.pem"),
 777                     "-in", catfile($datadir, "ciphertext_from_1_1_1.cms"),
 778                     "-out", $out ]))
 779            && compare_text($smcont, $out) == 0,
 780            "Decrypt message from OpenSSL 1.1.1");
 781     }
 782 };
 783
 784 subtest "CAdES <=> CAdES consistency tests\n" => sub {
 785     plan tests => (scalar @smime_cms_cades_tests);
 786
 787     runner_loop(prefix => 'cms-cades', cmd1 => 'cms', cmd2 => 'cms',
 788                 tests => [ @smime_cms_cades_tests ]);
 789 };
 790
 791 subtest "CAdES; cms incompatible arguments tests\n" => sub {
 792     plan tests => (scalar @smime_cms_cades_invalid_option_tests);
 793
 794     foreach (@smime_cms_cades_invalid_option_tests) {
 795         ok(!run(app(["openssl", "cms", @{$$_[0]} ] )));
 796     }
 797 };
 798
 799 subtest "CAdES ko tests\n" => sub {
 800     plan tests => 2 * scalar @smime_cms_cades_ko_tests;
 801
 802     foreach (@smime_cms_cades_ko_tests) {
 803       SKIP: {
 804         my $skip_reason = check_availability($$_[0]);
 805         skip $skip_reason, 1 if $skip_reason;
 806
 807         ok(run(app(["openssl", "cms", @{$$_[1]}])), $$_[0]);
 808         ok(!run(app(["openssl", "cms", @{$$_[3]}])), $$_[2]);
 809         }
 810     }
 811 };
 812
 813 subtest "CMS binary input tests\n" => sub {
 814     my $input = srctop_file("test", "smcont.bin");
 815     my $signed = "smcont.signed";
 816     my $verified = "smcont.verified";
 817
 818     plan tests => 11;
 819
 820     ok(run(app(["openssl", "cms", "-sign", "-md", "sha256", "-signer", $smrsa1,
 821                 "-binary", "-in", $input, "-out", $signed])),
 822        "sign binary input with -binary");
 823     ok(run(app(["openssl", "cms", "-verify", "-CAfile", $smroot,
 824                 "-binary", "-in", $signed, "-out", $verified])),
 825        "verify binary input with -binary");
 826     is(compare($input, $verified), 0, "binary input retained with -binary");
 827
 828     ok(run(app(["openssl", "cms", "-sign", "-md", "sha256", "-signer", $smrsa1,
 829                 "-in", $input, "-out", $signed.".nobin"])),
 830        "sign binary input without -binary");
 831     ok(run(app(["openssl", "cms", "-verify", "-CAfile", $smroot,
 832                 "-in", $signed.".nobin", "-out", $verified.".nobin"])),
 833        "verify binary input without -binary");
 834     is(compare($input, $verified.".nobin"), 1, "binary input not retained without -binary");
 835     ok(!run(app(["openssl", "cms", "-verify", "-CAfile", $smroot, "-crlfeol",
 836                 "-binary", "-in", $signed, "-out", $verified.".crlfeol"])),
 837        "verify binary input wrong crlfeol");
 838
 839     ok(run(app(["openssl", "cms", "-sign", "-md", "sha256", "-signer", $smrsa1,
 840                 "-crlfeol",
 841                 "-binary", "-in", $input, "-out", $signed.".crlf"])),
 842        "sign binary input with -binary -crlfeol");
 843     ok(run(app(["openssl", "cms", "-verify", "-CAfile", $smroot, "-crlfeol",
 844                 "-binary", "-in", $signed.".crlf", "-out", $verified.".crlf"])),
 845        "verify binary input with -binary -crlfeol");
 846     is(compare($input, $verified.".crlf"), 0,
 847        "binary input retained with -binary -crlfeol");
 848     ok(!run(app(["openssl", "cms", "-verify", "-CAfile", $smroot,
 849                 "-binary", "-in", $signed.".crlf", "-out", $verified.".crlf2"])),
 850        "verify binary input with -binary missing -crlfeol");
 851 };
 852
 853 subtest "CMS signed digest, DER format" => sub {
 854     plan tests => 2;
 855
 856     # Pre-computed SHA256 digest of $smcont in hexadecimal form
 857     my $digest = "ff236ef61b396355f75a4cc6e1c306d4c309084ae271a9e2ad6888f10a101b32";
 858
 859     my $sig_file = "signature.der";
 860     ok(run(app(["openssl", "cms", @prov, "-sign", "-digest", $digest,
 861                     "-outform", "DER",
 862                     "-certfile", catfile($smdir, "smroot.pem"),
 863                     "-signer", catfile($smdir, "smrsa1.pem"),
 864                     "-out", $sig_file])),
 865         "CMS sign pre-computed digest, DER format");
 866
 867     ok(run(app(["openssl", "cms", @prov, "-verify", "-in", $sig_file,
 868                     "-inform", "DER",
 869                     "-CAfile", catfile($smdir, "smroot.pem"),
 870                     "-content", $smcont])),
 871        "Verify CMS signed digest, DER format");
 872 };
 873
 874 subtest "CMS signed digest, S/MIME format" => sub {
 875     plan tests => 2;
 876
 877     # Pre-computed SHA256 digest of $smcont in hexadecimal form
 878     my $digest = "ff236ef61b396355f75a4cc6e1c306d4c309084ae271a9e2ad6888f10a101b32";
 879
 880     my $sig_file = "signature.smime";
 881     ok(run(app(["openssl", "cms", @prov, "-sign", "-digest", $digest,
 882                     "-outform", "SMIME",
 883                     "-certfile", catfile($smdir, "smroot.pem"),
 884                     "-signer", catfile($smdir, "smrsa1.pem"),
 885                     "-out", $sig_file])),
 886         "CMS sign pre-computed digest, S/MIME format");
 887
 888     ok(run(app(["openssl", "cms", @prov, "-verify", "-in", $sig_file,
 889                     "-inform", "SMIME",
 890                     "-CAfile", catfile($smdir, "smroot.pem"),
 891                     "-content", $smcont])),
 892        "Verify CMS signed digest, S/MIME format");
 893 };
 894
 895 subtest "CMS code signing test" => sub {
 896     plan tests => 7;
 897     my $sig_file = "signature.p7s";
 898     ok(run(app(["openssl", "cms", @prov, "-sign", "-in", $smcont,
 899                    "-certfile", catfile($smdir, "smroot.pem"),
 900                    "-signer", catfile($smdir, "smrsa1.pem"),
 901                    "-out", $sig_file])),
 902        "accept perform CMS signature with smime certificate");
 903
 904     ok(run(app(["openssl", "cms", @prov, "-verify", "-in", $sig_file,
 905                     "-CAfile", catfile($smdir, "smroot.pem"),
 906                     "-content", $smcont])),
 907        "accept verify CMS signature with smime certificate");
 908
 909     ok(!run(app(["openssl", "cms", @prov, "-verify", "-in", $sig_file,
 910                     "-CAfile", catfile($smdir, "smroot.pem"),
 911                     "-purpose", "codesign",
 912                     "-content", $smcont])),
 913        "fail verify CMS signature with smime certificate for purpose code signing");
 914
 915     ok(!run(app(["openssl", "cms", @prov, "-verify", "-in", $sig_file,
 916                     "-CAfile", catfile($smdir, "smroot.pem"),
 917                     "-purpose", "football",
 918                     "-content", $smcont])),
 919        "fail verify CMS signature with invalid purpose argument");
 920
 921     ok(run(app(["openssl", "cms", @prov, "-sign", "-in", $smcont,
 922                    "-certfile", catfile($smdir, "smroot.pem"),
 923                    "-signer", catfile($smdir, "csrsa1.pem"),
 924                    "-out", $sig_file])),
 925         "accept perform CMS signature with code signing certificate");
 926
 927     ok(run(app(["openssl", "cms", @prov, "-verify", "-in", $sig_file,
 928                     "-CAfile", catfile($smdir, "smroot.pem"),
 929                     "-purpose", "codesign",
 930                     "-content", $smcont])),
 931        "accept verify CMS signature with code signing certificate for purpose code signing");
 932
 933     ok(!run(app(["openssl", "cms", @prov, "-verify", "-in", $sig_file,
 934                     "-CAfile", catfile($smdir, "smroot.pem"),
 935                     "-content", $smcont])),
 936        "fail verify CMS signature with code signing certificate for purpose smime_sign");
 937 };
 938
 939 sub check_availability {
 940     my $tnam = shift;
 941
 942     return "$tnam: skipped, EC disabled\n"
 943         if ($no_ec && $tnam =~ /ECDH/);
 944     return "$tnam: skipped, ECDH disabled\n"
 945         if ($no_ec && $tnam =~ /ECDH/);
 946     return "$tnam: skipped, EC2M disabled\n"
 947         if ($no_ec2m && $tnam =~ /K-283/);
 948     return "$tnam: skipped, DH disabled\n"
 949         if ($no_dh && $tnam =~ /X9\.42/);
 950     return "$tnam: skipped, RC2 disabled\n"
 951         if ($no_rc2 && $tnam =~ /RC2/);
 952     return "$tnam: skipped, DES disabled\n"
 953         if ($no_des && $tnam =~ /DES/);
 954     return "$tnam: skipped, DSA disabled\n"
 955         if ($no_dsa && $tnam =~ / DSA/);
 956
 957     return "";
 958 }