summaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
authorschwarze <>2019-08-10 23:41:22 +0000
committerschwarze <>2019-08-10 23:41:22 +0000
commitcc47a3abfdbd325bb89055dfd451213698f0850e (patch)
tree3f70859fec97a5fc0a89365840d52dc9deee7bf9 /src/lib
parenta7f0a908e25ca54df61944e40d7165ba5d79d244 (diff)
downloadopenbsd-cc47a3abfdbd325bb89055dfd451213698f0850e.tar.gz
openbsd-cc47a3abfdbd325bb89055dfd451213698f0850e.tar.bz2
openbsd-cc47a3abfdbd325bb89055dfd451213698f0850e.zip
Re-convert and re-import the CMS manual pages from OpenSSL 1.1.1
(which are still under a free license) with pod2mdoc(1) now that jsing@ has begun work to provide these APIs. Some formatting was improved and some typos were fixed, but apart from that, little was changed, so there is still much to polish.
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/libcrypto/man/BIO_new_CMS.3138
-rw-r--r--src/lib/libcrypto/man/CMS_add0_cert.3177
-rw-r--r--src/lib/libcrypto/man/CMS_add1_recipient_cert.3165
-rw-r--r--src/lib/libcrypto/man/CMS_add1_signer.3203
-rw-r--r--src/lib/libcrypto/man/CMS_compress.3157
-rw-r--r--src/lib/libcrypto/man/CMS_decrypt.3169
-rw-r--r--src/lib/libcrypto/man/CMS_encrypt.3190
-rw-r--r--src/lib/libcrypto/man/CMS_final.398
-rw-r--r--src/lib/libcrypto/man/CMS_get0_RecipientInfos.3323
-rw-r--r--src/lib/libcrypto/man/CMS_get0_SignerInfos.3180
-rw-r--r--src/lib/libcrypto/man/CMS_get0_type.3174
-rw-r--r--src/lib/libcrypto/man/CMS_get1_ReceiptRequest.3175
-rw-r--r--src/lib/libcrypto/man/CMS_sign.3224
-rw-r--r--src/lib/libcrypto/man/CMS_sign_receipt.3110
-rw-r--r--src/lib/libcrypto/man/CMS_uncompress.3111
-rw-r--r--src/lib/libcrypto/man/CMS_verify.3223
-rw-r--r--src/lib/libcrypto/man/CMS_verify_receipt.3104
-rw-r--r--src/lib/libcrypto/man/PEM_write_bio_CMS_stream.393
-rw-r--r--src/lib/libcrypto/man/SMIME_read_CMS.3146
-rw-r--r--src/lib/libcrypto/man/SMIME_write_CMS.3133
-rw-r--r--src/lib/libcrypto/man/i2d_CMS_bio_stream.395
21 files changed, 3388 insertions, 0 deletions
diff --git a/src/lib/libcrypto/man/BIO_new_CMS.3 b/src/lib/libcrypto/man/BIO_new_CMS.3
new file mode 100644
index 0000000000..d35fb0b7bf
--- /dev/null
+++ b/src/lib/libcrypto/man/BIO_new_CMS.3
@@ -0,0 +1,138 @@
1.\" $OpenBSD: BIO_new_CMS.3,v 1.4 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL df75c2bfc Dec 9 01:02:36 2018 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt BIO_NEW_CMS 3
53.Os
54.Sh NAME
55.Nm BIO_new_CMS
56.Nd CMS streaming filter BIO
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft BIO *
60.Fo BIO_new_CMS
61.Fa "BIO *out"
62.Fa "CMS_ContentInfo *cms"
63.Fc
64.Sh DESCRIPTION
65.Fn BIO_new_CMS
66returns a streaming filter
67.Vt BIO
68chain based on
69.Fa cms .
70The output of the filter is written to
71.Fa out .
72Any data written to the chain is automatically translated
73to a BER format CMS structure of the appropriate type.
74.Pp
75The chain returned by this function behaves like a standard filter
76.Vt BIO .
77It supports non blocking I/O.
78Content is processed and streamed on the fly and not all held in memory
79at once: so it is possible to encode very large structures.
80After all content has been written through the chain,
81.Xr BIO_flush 3
82must be called to finalise the structure.
83.Pp
84The
85.Dv CMS_STREAM
86flag must be included in the corresponding
87.Fa flags
88parameter of the
89.Fa cms
90creation function.
91.Pp
92If an application wishes to write additional data to
93.Fa out ,
94BIOs should be removed from the chain using
95.Xr BIO_pop 3
96and freed with
97.Xr BIO_free 3
98until
99.Fa out
100is reached.
101If no additional data needs to be written,
102.Xr BIO_free_all 3
103can be called to free up the whole chain.
104.Pp
105Any content written through the filter is used verbatim:
106no canonical translation is performed.
107.Pp
108It is possible to chain multiple BIOs to, for example,
109create a triple wrapped signed, enveloped, signed structure.
110In this case it is the application's responsibility
111to set the inner content type of any outer
112.Vt CMS_ContentInfo
113structures.
114.Pp
115Large numbers of small writes through the chain should be avoided as this
116will produce an output consisting of lots of OCTET STRING structures.
117Prepending a
118.Xr BIO_f_buffer 3
119buffering BIO will prevent this.
120.Sh RETURN VALUES
121.Fn BIO_new_CMS
122returns a
123.Vt BIO
124chain when successful or
125.Dv NULL
126if an error occurred.
127The error can be obtained from
128.Xr ERR_get_error 3 .
129.Sh SEE ALSO
130.Xr CMS_encrypt 3 ,
131.Xr CMS_sign 3
132.Sh HISTORY
133The
134.Fn BIO_new_CMS
135function was added in OpenSSL 1.0.0.
136.Sh BUGS
137There is currently no corresponding inverse BIO
138which can decode a CMS structure on the fly.
diff --git a/src/lib/libcrypto/man/CMS_add0_cert.3 b/src/lib/libcrypto/man/CMS_add0_cert.3
new file mode 100644
index 0000000000..9f99e2259f
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_add0_cert.3
@@ -0,0 +1,177 @@
1.\" $OpenBSD: CMS_add0_cert.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL e9b77246 Jan 20 19:58:49 2017 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_ADD0_CERT 3
53.Os
54.Sh NAME
55.Nm CMS_add0_cert ,
56.Nm CMS_add1_cert ,
57.Nm CMS_get1_certs ,
58.Nm CMS_add0_crl ,
59.Nm CMS_add1_crl ,
60.Nm CMS_get1_crls
61.Nd CMS certificate and CRL utility functions
62.Sh SYNOPSIS
63.In openssl/cms.h
64.Ft int
65.Fo CMS_add0_cert
66.Fa "CMS_ContentInfo *cms"
67.Fa "X509 *cert"
68.Fc
69.Ft int
70.Fo CMS_add1_cert
71.Fa "CMS_ContentInfo *cms"
72.Fa "X509 *cert"
73.Fc
74.Ft STACK_OF(X509) *
75.Fo CMS_get1_certs
76.Fa "CMS_ContentInfo *cms"
77.Fc
78.Ft int
79.Fo CMS_add0_crl
80.Fa "CMS_ContentInfo *cms"
81.Fa "X509_CRL *crl"
82.Fc
83.Ft int
84.Fo CMS_add1_crl
85.Fa "CMS_ContentInfo *cms"
86.Fa "X509_CRL *crl"
87.Fc
88.Ft STACK_OF(X509_CRL) *
89.Fo CMS_get1_crls
90.Fa "CMS_ContentInfo *cms"
91.Fc
92.Sh DESCRIPTION
93.Fn CMS_add0_cert
94and
95.Fn CMS_add1_cert
96add the certificate
97.Fa cert
98to
99.Fa cms .
100.Fa cms
101must be of type signed data or enveloped data.
102.Pp
103.Fn CMS_get1_certs
104returns all certificates in
105.Fa cms .
106.Pp
107.Fn CMS_add0_crl
108and
109.Fn CMS_add1_crl
110add the CRL
111.Fa crl
112to
113.Fa cms .
114.Fn CMS_get1_crls
115returns any CRLs in
116.Fa cms .
117.Pp
118The
119.Vt CMS_ContentInfo
120structure
121.Fa cms
122must be of type signed data or enveloped data or an error will be
123returned.
124.Pp
125The signed data certificates and CRLs are added to the
126.Sy certificates
127and
128.Sy crls
129fields of the SignedData structure.
130For enveloped data, they are added to
131.Sy OriginatorInfo .
132.Pp
133As the
134.Sq 0
135in the function name implies,
136.Fn CMS_add0_cert
137adds
138.Fa cert
139internally to
140.Fa cms
141and it must not be freed up after the call, as opposed to
142.Fn CMS_add1_cert
143where
144.Fa cert
145must be freed up.
146.Pp
147The same certificate or CRL must not be added to the same cms structure
148more than once.
149.Sh RETURN VALUES
150.Fn CMS_add0_cert ,
151.Fn CMS_add1_cert ,
152.Fn CMS_add0_crl ,
153and
154.Fn CMS_add1_crl
155return 1 for success or 0 for failure.
156.Pp
157.Fn CMS_get1_certs
158and
159.Fn CMS_get1_crls
160return the STACK of certificates or CRLs or
161.Dv NULL
162if there are none or an error occurs.
163The only error which will occur in practice is if the
164.Fa cms
165type is invalid.
166.Sh SEE ALSO
167.Xr CMS_encrypt 3 ,
168.Xr CMS_sign 3 ,
169.Xr ERR_get_error 3
170.Sh HISTORY
171.Fn CMS_add0_cert ,
172.Fn CMS_add1_cert ,
173.Fn CMS_get1_certs ,
174.Fn CMS_add0_crl
175and
176.Fn CMS_get1_crls
177were all first added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_add1_recipient_cert.3 b/src/lib/libcrypto/man/CMS_add1_recipient_cert.3
new file mode 100644
index 0000000000..47307fdaa1
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_add1_recipient_cert.3
@@ -0,0 +1,165 @@
1.\" $OpenBSD: CMS_add1_recipient_cert.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL e9b77246 Jan 20 19:58:49 2017 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_ADD1_RECIPIENT_CERT 3
53.Os
54.Sh NAME
55.Nm CMS_add1_recipient_cert ,
56.Nm CMS_add0_recipient_key
57.Nd add recipients to a CMS enveloped data structure
58.Sh SYNOPSIS
59.In openssl/cms.h
60.Ft CMS_RecipientInfo *
61.Fo CMS_add1_recipient_cert
62.Fa "CMS_ContentInfo *cms"
63.Fa "X509 *recip"
64.Fa "unsigned int flags"
65.Fc
66.Ft CMS_RecipientInfo *
67.Fo CMS_add0_recipient_key
68.Fa "CMS_ContentInfo *cms"
69.Fa "int nid"
70.Fa "unsigned char *key"
71.Fa "size_t keylen"
72.Fa "unsigned char *id"
73.Fa "size_t idlen"
74.Fa "ASN1_GENERALIZEDTIME *date"
75.Fa "ASN1_OBJECT *otherTypeId"
76.Fa "ASN1_TYPE *otherType"
77.Fc
78.Sh DESCRIPTION
79.Fn CMS_add1_recipient_cert
80adds the recipient
81.Fa recip
82to the
83.Vt CMS_ContentInfo
84enveloped data structure
85.Fa cms
86as a KeyTransRecipientInfo structure.
87.Pp
88.Fn CMS_add0_recipient_key
89adds the symmetric key
90.Fa key
91of length
92.Fa keylen
93using the wrapping algorithm
94.Fa nid ,
95the identifier
96.Fa id
97of length
98.Fa idlen ,
99and the optional values
100.Fa date ,
101.Fa otherTypeId
102and
103.Fa otherType
104to the
105.Vt CMS_ContentInfo
106enveloped data structure
107.Fa cms
108as a KEKRecipientInfo structure.
109.Pp
110The
111.Vt CMS_ContentInfo
112structure should be obtained from an initial call to
113.Xr CMS_encrypt 3
114with the flag
115.Dv CMS_PARTIAL
116set.
117.Pp
118The main purpose of this function is to provide finer control over a CMS
119enveloped data structure where the simpler
120.Xr CMS_encrypt 3
121function defaults are not appropriate,
122for example if one or more KEKRecipientInfo structures need to be added.
123New attributes can also be added using the returned
124.Vt CMS_RecipientInfo
125structure and the CMS attribute utility functions.
126.Pp
127By default, recipient certificates are identified using issuer
128name and serial number.
129If the flag
130.Dv CMS_USE_KEYID
131is set, it will use the subject key identifier value instead.
132An error occurs if all recipient certificates do not have a subject key
133identifier extension.
134.Pp
135Currently only AES based key wrapping algorithms are supported for
136.Fa nid ,
137specifically
138.Dv NID_id_aes128_wrap ,
139.Dv NID_id_aes192_wrap ,
140and
141.Dv NID_id_aes256_wrap .
142If
143.Fa nid
144is set to
145.Dv NID_undef ,
146then an AES wrap algorithm will be used consistent with
147.Fa keylen .
148.Sh RETURN VALUES
149.Fn CMS_add1_recipient_cert
150and
151.Fn CMS_add0_recipient_key
152return an internal pointer to the
153.Vt CMS_RecipientInfo
154structure just added or
155.Dv NULL
156if an error occurs.
157.Sh SEE ALSO
158.Xr CMS_decrypt 3 ,
159.Xr CMS_final 3 ,
160.Xr ERR_get_error 3
161.Sh HISTORY
162.Fn CMS_add1_recipient_cert
163and
164.Fn CMS_add0_recipient_key
165were added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_add1_signer.3 b/src/lib/libcrypto/man/CMS_add1_signer.3
new file mode 100644
index 0000000000..065e15c7be
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_add1_signer.3
@@ -0,0 +1,203 @@
1.\" $OpenBSD: CMS_add1_signer.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL e9b77246 Jan 20 19:58:49 2017 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_ADD1_SIGNER 3
53.Os
54.Sh NAME
55.Nm CMS_add1_signer ,
56.Nm CMS_SignerInfo_sign
57.Nd add a signer to a CMS_ContentInfo signed data structure
58.Sh SYNOPSIS
59.In openssl/cms.h
60.Ft CMS_SignerInfo *
61.Fo CMS_add1_signer
62.Fa "CMS_ContentInfo *cms"
63.Fa "X509 *signcert"
64.Fa "EVP_PKEY *pkey"
65.Fa "const EVP_MD *md"
66.Fa "unsigned int flags"
67.Fc
68.Ft int
69.Fo CMS_SignerInfo_sign
70.Fa "CMS_SignerInfo *si"
71.Fc
72.Sh DESCRIPTION
73.Fn CMS_add1_signer
74adds a signer with certificate
75.Fa signcert
76and private key
77.Fa pkey
78using message digest
79.Fa md
80to the
81.Vt CMS_ContentInfo
82SignedData structure
83.Fa cms .
84.Pp
85The
86.Vt CMS_ContentInfo
87structure should be obtained from an initial call to
88.Xr CMS_sign 3
89with the flag
90.Dv CMS_PARTIAL
91set or in the case or re-signing a valid
92.Vt CMS_ContentInfo
93SignedData structure.
94.Pp
95If the
96.Fa md
97parameter is
98.Dv NULL ,
99then the default digest for the public key algorithm will be used.
100.Pp
101Unless the
102.Dv CMS_REUSE_DIGEST
103flag is set, the returned
104.Vt CMS_ContentInfo
105structure is not complete and must be finalized either by streaming
106(if applicable) or a call to
107.Xr CMS_final 3 .
108.Pp
109The
110.Fn CMS_SignerInfo_sign
111function will explicitly sign a
112.Vt CMS_SignerInfo
113structure.
114Its main use is when the
115.Dv CMS_REUSE_DIGEST
116and
117.Dv CMS_PARTIAL
118flags are both set.
119.Pp
120The main purpose of
121.Fn CMS_add1_signer
122is to provide finer control over a CMS signed data structure where the
123simpler
124.Xr CMS_sign 3
125function defaults are not appropriate, for example if multiple signers
126or non default digest algorithms are needed.
127New attributes can also be added using the returned
128.Vt CMS_SignerInfo
129structure and the CMS attribute utility functions or the CMS signed
130receipt request functions.
131.Pp
132Any of the following flags (OR'ed together) can be passed in the
133.Fa flags
134parameter:
135.Bl -tag -width Ds
136.It Dv CMS_REUSE_DIGEST
137Attempt to copy the content digest value from the
138.Vt CMS_ContentInfo
139structure to add a signer to an existing structure.
140An error occurs if a matching digest value cannot be found to copy.
141The returned
142.Vt CMS_ContentInfo
143structure will be valid and finalized when this flag is set.
144.It Dv CMS_PARTIAL
145If this flag is set in addition to
146.Dv CMS_REUSE_DIGEST ,
147then the
148.Vt CMS_SignerInfo
149structure will not be finalized so additional attributes can be added.
150In this case an explicit call to
151.Fn CMS_SignerInfo_sign
152is needed to finalize it.
153.It Dv CMS_NOCERTS
154Do not include the signer's certificate in the
155.Vt CMS_ContentInfo
156structure.
157The signer's certificate must still be supplied in the
158.Fa signcert
159parameter though.
160This can reduce the size of the signature if the signer's certificate can
161be obtained by other means, for example from a previously signed message.
162.Pp
163The SignedData structure includes several CMS signedAttributes including
164the signing time, the CMS content type and the supported list of ciphers
165in an SMIMECapabilities attribute.
166.It Dv CMS_NOATTR
167Use no signedAttributes.
168.It Dv CMS_NOSMIMECAP
169Omit just the SMIMECapabilities.
170.It Dv CMS_USE_KEYID
171Use the subject key identifier value to identify signing certificates.
172An error occurs if the signing certificate does not have a subject key
173identifier extension.
174By default, issuer name and serial number are used instead.
175.El
176.Pp
177If present, the SMIMECapabilities attribute indicates support for the
178following algorithms in preference order: 256 bit AES, Gost R3411-94,
179Gost 28147-89, 192 bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit
180RC2, DES and 40 bit RC2.
181If any of these algorithms is not available then it will not be
182included: for example the GOST algorithms will not be included if
183the GOST ENGINE is not loaded.
184.Pp
185.Fn CMS_add1_signer
186returns an internal pointer to the
187.Vt CMS_SignerInfo
188structure just added.
189This can be used to set additional attributes before it is finalized.
190.Sh RETURN VALUES
191.Fn CMS_add1_signer
192returns an internal pointer to the
193.Vt CMS_SignerInfo
194structure just added or
195.Dv NULL
196if an error occurs.
197.Sh SEE ALSO
198.Xr CMS_final 3 ,
199.Xr CMS_sign 3 ,
200.Xr ERR_get_error 3
201.Sh HISTORY
202.Fn CMS_add1_signer
203was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_compress.3 b/src/lib/libcrypto/man/CMS_compress.3
new file mode 100644
index 0000000000..64bab79617
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_compress.3
@@ -0,0 +1,157 @@
1.\" $OpenBSD: CMS_compress.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_COMPRESS 3
53.Os
54.Sh NAME
55.Nm CMS_compress
56.Nd create a CMS CompressedData structure
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft CMS_ContentInfo *
60.Fo CMS_compress
61.Fa "BIO *in"
62.Fa "int comp_nid"
63.Fa "unsigned int flags"
64.Fc
65.Sh DESCRIPTION
66.Fn CMS_compress
67creates and returns a CMS CompressedData structure.
68.Fa comp_nid
69is the compression algorithm to use or
70.Dv NID_undef
71to use the default algorithm (zlib compression).
72.Fa in
73is the content to be compressed.
74.Fa flags
75is an optional set of flags.
76.Pp
77The only currently supported compression algorithm is zlib using the NID
78.Dv NID_zlib_compression .
79.Pp
80If zlib support is not compiled in, then
81.Fn CMS_compress
82will return an error.
83.Pp
84If the
85.Dv CMS_TEXT
86flag is set, MIME headers for type text/plain are prepended to the data.
87.Pp
88Normally the supplied content is translated into MIME canonical format
89(as required by the S/MIME specifications); if
90.Dv CMS_BINARY
91is set, no translation occurs.
92This option should be used if the supplied data is in binary format.
93Otherwise, the translation will corrupt it.
94If
95.Dv CMS_BINARY
96is set then
97.Dv CMS_TEXT
98is ignored.
99.Pp
100If the
101.Dv CMS_STREAM
102flag is set, a partial
103.Vt CMS_ContentInfo
104structure is returned suitable for streaming I/O: no data is read from
105the BIO
106.Fa in .
107.Pp
108The compressed data is included in the
109.Vt CMS_ContentInfo
110structure unless
111.Dv CMS_DETACHED
112is set, in which case it is omitted.
113This is rarely used in practice and is not supported by
114.Xr SMIME_write_CMS 3 .
115.Pp
116If the flag
117.Dv CMS_STREAM
118is set, the returned
119.Vt CMS_ContentInfo
120structure is
121.Em not
122complete and outputting its contents via a function that does not
123properly finalize the
124.Vt CMS_ContentInfo
125structure will give unpredictable results.
126.Pp
127Several functions including
128.Xr SMIME_write_CMS 3 ,
129.Xr i2d_CMS_bio_stream 3 ,
130and
131.Xr PEM_write_bio_CMS_stream 3
132finalize the structure.
133Alternatively finalization can be performed by obtaining the streaming
134ASN1
135.Vt BIO
136directly using
137.Xr BIO_new_CMS 3 .
138.Pp
139Additional compression parameters such as the zlib compression level
140cannot currently be set.
141.Sh RETURN VALUES
142.Fn CMS_compress
143returns either a
144.Vt CMS_ContentInfo
145structure or
146.Dv NULL
147if an error occurred.
148The error can be obtained from
149.Xr ERR_get_error 3 .
150.Sh SEE ALSO
151.Xr CMS_uncompress 3
152.Sh HISTORY
153.Fn CMS_compress
154was added to OpenSSL 0.9.8.
155The
156.Dv CMS_STREAM
157flag was added in OpenSSL 1.0.0.
diff --git a/src/lib/libcrypto/man/CMS_decrypt.3 b/src/lib/libcrypto/man/CMS_decrypt.3
new file mode 100644
index 0000000000..de37b357a1
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_decrypt.3
@@ -0,0 +1,169 @@
1.\" $OpenBSD: CMS_decrypt.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL e9b77246 Jan 20 19:58:49 2017 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008, 2014 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_DECRYPT 3
53.Os
54.Sh NAME
55.Nm CMS_decrypt
56.Nd decrypt content from a CMS envelopedData structure
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft int
60.Fo CMS_decrypt
61.Fa "CMS_ContentInfo *cms"
62.Fa "EVP_PKEY *pkey"
63.Fa "X509 *cert"
64.Fa "BIO *dcont"
65.Fa "BIO *out"
66.Fa "unsigned int flags"
67.Fc
68.Sh DESCRIPTION
69.Fn CMS_decrypt
70extracts and decrypts the content from a CMS EnvelopedData structure.
71.Fa pkey
72is the private key of the recipient,
73.Fa cert
74is the recipient's certificate,
75.Fa out
76is a
77.Vt BIO
78to write the content to and
79.Fa flags
80is an optional set of flags.
81.Pp
82The
83.Fa dcont
84parameter is used in the rare case where the encrypted content is
85detached.
86It will normally be set to
87.Dv NULL .
88.Pp
89Although the recipients certificate is not needed to decrypt the data it
90is needed to locate the appropriate (of possible several) recipients in
91the CMS structure.
92.Pp
93If
94.Fa cert
95is set to
96.Dv NULL ,
97all possible recipients are tried.
98This case however is problematic.
99To thwart the MMA attack (Bleichenbacher's attack on PKCS #1 v1.5 RSA
100padding) all recipients are tried whether they succeed or not.
101If no recipient succeeds then a random symmetric key is used to decrypt
102the content: this will typically output garbage and may (but is not
103guaranteed to) ultimately return a padding error only.
104If
105.Fn CMS_decrypt
106just returned an error when all recipient encrypted keys failed to
107decrypt an attacker could use this in a timing attack.
108If the special flag
109.Dv CMS_DEBUG_DECRYPT
110is set, then the above behaviour is modified and an error
111.Em is
112returned if no recipient encrypted key can be decrypted
113.Em without
114generating a random content encryption key.
115Applications should use this flag with extreme caution
116especially in automated gateways as it can leave them open to attack.
117.Pp
118It is possible to determine the correct recipient key by other means
119(for example looking them up in a database) and setting them in the CMS
120structure in advance using the CMS utility functions such as
121.Xr CMS_set1_pkey 3 .
122In this case both
123.Fa cert
124and
125.Fa pkey
126should be set to
127.Dv NULL .
128.Pp
129To process KEKRecipientInfo types,
130.Xr CMS_set1_key 3
131or
132.Xr CMS_RecipientInfo_set0_key 3
133and
134.Xr CMS_RecipientInfo_decrypt 3
135should be called before
136.Fn CMS_decrypt
137and
138.Fa cert
139and
140.Fa pkey
141set to
142.Dv NULL .
143.Pp
144The following flags can be passed in the
145.Fa flags
146parameter:
147.Pp
148If the
149.Dv CMS_TEXT
150flag is set, MIME headers for type text/plain
151are deleted from the content.
152If the content is not of type text/plain,
153then an error is returned.
154.Sh RETURN VALUES
155.Fn CMS_decrypt
156returns either 1 for success or 0 for failure.
157The error can be obtained from
158.Xr ERR_get_error 3 .
159.Sh SEE ALSO
160.Xr CMS_encrypt 3
161.Sh HISTORY
162.Fn CMS_decrypt
163was added to OpenSSL 0.9.8.
164.Sh BUGS
165The lack of single pass processing and the need to hold all data in
166memory as mentioned in
167.Xr CMS_verify 3
168also applies to
169.Fn CMS_decrypt .
diff --git a/src/lib/libcrypto/man/CMS_encrypt.3 b/src/lib/libcrypto/man/CMS_encrypt.3
new file mode 100644
index 0000000000..8550de2c9f
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_encrypt.3
@@ -0,0 +1,190 @@
1.\" $OpenBSD: CMS_encrypt.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 83cf7abf May 29 13:07:08 2018 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_ENCRYPT 3
53.Os
54.Sh NAME
55.Nm CMS_encrypt
56.Nd create a CMS envelopedData structure
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft CMS_ContentInfo *
60.Fo CMS_encrypt
61.Fa "STACK_OF(X509) *certs"
62.Fa "BIO *in"
63.Fa "const EVP_CIPHER *cipher"
64.Fa "unsigned int flags"
65.Fc
66.Sh DESCRIPTION
67.Fn CMS_encrypt
68creates and returns a CMS EnvelopedData structure.
69.Fa certs
70is a list of recipient certificates.
71.Fa in
72is the content to be encrypted.
73.Fa cipher
74is the symmetric cipher to use.
75.Fa flags
76is an optional set of flags.
77.Pp
78Only certificates carrying RSA, Diffie-Hellman or EC keys are supported
79by this function.
80.Pp
81.Xr EVP_des_ede3_cbc 3
82(triple DES) is the algorithm of choice for S/MIME use because most
83clients will support it.
84.Pp
85The algorithm passed in the
86.Fa cipher
87parameter must support ASN1 encoding of its parameters.
88.Pp
89Many browsers implement a "sign and encrypt" option which is simply an
90S/MIME envelopedData containing an S/MIME signed message.
91This can be readily produced by storing the S/MIME signed message in a
92memory BIO and passing it to
93.Fn CMS_encrypt .
94.Pp
95The following flags can be passed in the
96.Fa flags
97parameter:
98.Bl -tag -width Ds
99.It Dv CMS_TEXT
100MIME headers for type text/plain are prepended to the data.
101.It Dv CMS_BINARY
102Do not translate the supplied content into MIME canonical format
103even though that is required by the S/MIME specifications.
104This option should be used if the supplied data is in binary format.
105Otherwise, the translation will corrupt it.
106If
107.Dv CMS_BINARY
108is set, then
109.Dv CMS_TEXT
110is ignored.
111.It Dv CMS_USE_KEYID
112Use the subject key identifier value to identify recipient certificates.
113An error occurs if all recipient certificates do not have a subject key
114identifier extension.
115By default, issuer name and serial number are used instead.
116.It Dv CMS_STREAM
117Return a partial
118.Vt CMS_ContentInfo
119structure suitable for streaming I/O: no data is read from the BIO
120.Fa in .
121.It Dv CMS_PARTIAL
122Return a partial
123.Vt CMS_ContentInfo
124structure to which additional recipients and attributes can
125be added before finalization.
126.It Dv CMS_DETACHED
127Omit the data being encrypted from the
128.Vt CMS_ContentInfo
129structure.
130This is rarely used in practice and is not supported by
131.Xr SMIME_write_CMS 3 .
132.El
133.Pp
134If the flag
135.Dv CMS_STREAM
136is set, the returned
137.Vt CMS_ContentInfo
138structure is
139.Em not
140complete and outputting its contents via a function that does not
141properly finalize the
142.Vt CMS_ContentInfo
143structure will give unpredictable results.
144.Pp
145Several functions including
146.Xr SMIME_write_CMS 3 ,
147.Xr i2d_CMS_bio_stream 3 ,
148.Xr PEM_write_bio_CMS_stream 3
149finalize the structure.
150Alternatively finalization can be performed by obtaining the streaming
151ASN1
152.Vt BIO
153directly using
154.Xr BIO_new_CMS 3 .
155.Pp
156The recipients specified in
157.Fa certs
158use a CMS KeyTransRecipientInfo info structure.
159KEKRecipientInfo is also supported using the flag
160.Dv CMS_PARTIAL
161and
162.Xr CMS_add0_recipient_key 3 .
163.Pp
164The parameter
165.Fa certs
166may be
167.Dv NULL
168if
169.Dv CMS_PARTIAL
170is set and recipients are added later using
171.Xr CMS_add1_recipient_cert 3
172or
173.Xr CMS_add0_recipient_key 3 .
174.Sh RETURN VALUES
175.Fn CMS_encrypt
176returns either a
177.Vt CMS_ContentInfo
178structure or
179.Dv NULL
180if an error occurred.
181The error can be obtained from
182.Xr ERR_get_error 3 .
183.Sh SEE ALSO
184.Xr CMS_decrypt 3
185.Sh HISTORY
186.Fn CMS_encrypt
187was added to OpenSSL 0.9.8.
188The
189.Sy CMS_STREAM
190flag was first supported in OpenSSL 1.0.0.
diff --git a/src/lib/libcrypto/man/CMS_final.3 b/src/lib/libcrypto/man/CMS_final.3
new file mode 100644
index 0000000000..8404005c74
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_final.3
@@ -0,0 +1,98 @@
1.\" $OpenBSD: CMS_final.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 25ccb589 Jul 1 02:02:06 2019 +0800
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_FINAL 3
53.Os
54.Sh NAME
55.Nm CMS_final
56.Nd finalise a CMS_ContentInfo structure
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft int
60.Fo CMS_final
61.Fa "CMS_ContentInfo *cms"
62.Fa "BIO *data"
63.Fa "BIO *dcont"
64.Fa "unsigned int flags"
65.Fc
66.Sh DESCRIPTION
67.Fn CMS_final
68finalises the structure
69.Fa cms .
70Its purpose is to perform any operations necessary on
71.Fa cms
72(digest computation for example) and set the appropriate fields.
73The parameter
74.Fa data
75contains the content to be processed.
76The
77.Fa dcont
78parameter contains a
79.Vt BIO
80to write content to after processing: this is
81only used with detached data and will usually be set to
82.Dv NULL .
83.Pp
84This function will normally be called when the
85.Dv CMS_PARTIAL
86flag is used.
87It should only be used when streaming is not performed because the
88streaming I/O functions perform finalisation operations internally.
89.Sh RETURN VALUES
90.Fn CMS_final
91returns 1 for success or 0 for failure.
92.Sh SEE ALSO
93.Xr CMS_encrypt 3 ,
94.Xr CMS_sign 3 ,
95.Xr ERR_get_error 3
96.Sh HISTORY
97.Fn CMS_final
98was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_get0_RecipientInfos.3 b/src/lib/libcrypto/man/CMS_get0_RecipientInfos.3
new file mode 100644
index 0000000000..07c16c5675
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_get0_RecipientInfos.3
@@ -0,0 +1,323 @@
1.\" $OpenBSD: CMS_get0_RecipientInfos.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL e9b77246 Jan 20 19:58:49 2017 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008, 2013 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_GET0_RECIPIENTINFOS 3
53.Os
54.Sh NAME
55.Nm CMS_get0_RecipientInfos ,
56.Nm CMS_RecipientInfo_type ,
57.Nm CMS_RecipientInfo_ktri_get0_signer_id ,
58.Nm CMS_RecipientInfo_ktri_cert_cmp ,
59.Nm CMS_RecipientInfo_set0_pkey ,
60.Nm CMS_RecipientInfo_kekri_get0_id ,
61.Nm CMS_RecipientInfo_kekri_id_cmp ,
62.Nm CMS_RecipientInfo_set0_key ,
63.Nm CMS_RecipientInfo_decrypt ,
64.Nm CMS_RecipientInfo_encrypt
65.Nd CMS envelopedData RecipientInfo routines
66.Sh SYNOPSIS
67.In openssl/cms.h
68.Ft STACK_OF(CMS_RecipientInfo) *
69.Fo CMS_get0_RecipientInfos
70.Fa "CMS_ContentInfo *cms"
71.Fc
72.Ft int
73.Fo CMS_RecipientInfo_type
74.Fa "CMS_RecipientInfo *ri"
75.Fc
76.Ft int
77.Fo CMS_RecipientInfo_ktri_get0_signer_id
78.Fa "CMS_RecipientInfo *ri"
79.Fa "ASN1_OCTET_STRING **keyid"
80.Fa "X509_NAME **issuer"
81.Fa "ASN1_INTEGER **sno"
82.Fc
83.Ft int
84.Fo CMS_RecipientInfo_ktri_cert_cmp
85.Fa "CMS_RecipientInfo *ri"
86.Fa "X509 *cert"
87.Fc
88.Ft int
89.Fo CMS_RecipientInfo_set0_pkey
90.Fa "CMS_RecipientInfo *ri"
91.Fa "EVP_PKEY *pkey"
92.Fc
93.Ft int
94.Fo CMS_RecipientInfo_kekri_get0_id
95.Fa "CMS_RecipientInfo *ri"
96.Fa "X509_ALGOR **palg"
97.Fa "ASN1_OCTET_STRING **pid"
98.Fa "ASN1_GENERALIZEDTIME **pdate"
99.Fa "ASN1_OBJECT **potherid"
100.Fa "ASN1_TYPE **pothertype"
101.Fc
102.Ft int
103.Fo CMS_RecipientInfo_kekri_id_cmp
104.Fa "CMS_RecipientInfo *ri"
105.Fa "const unsigned char *id"
106.Fa "size_t idlen"
107.Fc
108.Ft int
109.Fo CMS_RecipientInfo_set0_key
110.Fa "CMS_RecipientInfo *ri"
111.Fa "unsigned char *key"
112.Fa "size_t keylen"
113.Fc
114.Ft int
115.Fo CMS_RecipientInfo_decrypt
116.Fa "CMS_ContentInfo *cms"
117.Fa "CMS_RecipientInfo *ri"
118.Fc
119.Ft int
120.Fo CMS_RecipientInfo_encrypt
121.Fa "CMS_ContentInfo *cms"
122.Fa "CMS_RecipientInfo *ri"
123.Fc
124.Sh DESCRIPTION
125The function
126.Fn CMS_get0_RecipientInfos
127returns all the
128.Vt CMS_RecipientInfo
129structures associated with a CMS EnvelopedData structure.
130.Pp
131.Fn CMS_RecipientInfo_type
132returns the type of the
133.Vt CMS_RecipientInfo
134structure
135.Fa ri .
136It will currently return
137.Dv CMS_RECIPINFO_TRANS ,
138.Dv CMS_RECIPINFO_AGREE ,
139.Dv CMS_RECIPINFO_KEK ,
140.Dv CMS_RECIPINFO_PASS ,
141or
142.Dv CMS_RECIPINFO_OTHER .
143.Pp
144.Fn CMS_RecipientInfo_ktri_get0_signer_id
145retrieves the certificate recipient identifier associated with a
146specific
147.Vt CMS_RecipientInfo
148structure
149.Fa ri ,
150which must be of type
151.Dv CMS_RECIPINFO_TRANS .
152Either the keyidentifier will be set in
153.Fa keyid
154or
155.Em both
156issuer name and serial number in
157.Fa issuer
158and
159.Fa sno .
160.Pp
161.Fn CMS_RecipientInfo_ktri_cert_cmp
162compares the certificate
163.Fa cert
164against the
165.Vt CMS_RecipientInfo
166structure
167.Fa ri ,
168which must be of type
169.Dv CMS_RECIPINFO_TRANS .
170It returns zero if the comparison is successful or non-zero if not.
171.Pp
172.Fn CMS_RecipientInfo_set0_pkey
173associates the private key
174.Fa pkey
175with the
176.Vt CMS_RecipientInfo
177structure
178.Fa ri ,
179which must be of type
180.Dv CMS_RECIPINFO_TRANS .
181.Pp
182.Fn CMS_RecipientInfo_kekri_get0_id
183retrieves the key information from the
184.Vt CMS_RecipientInfo
185structure
186.Fa ri
187which must be of type
188.Dv CMS_RECIPINFO_KEK .
189Any of the remaining parameters can be
190.Dv NULL
191if the application is not interested in the value of a field.
192Where a field is optional and absent,
193.Dv NULL
194will be written to the corresponding parameter.
195The keyEncryptionAlgorithm field is written to
196.Fa palg ,
197the keyIdentifier field is written to
198.Fa pid ,
199the
200.Sy date
201field if present is written to
202.Fa pdate .
203If the
204.Sy other
205field is present the components
206.Sy keyAttrId
207and
208.Sy keyAttr
209are written to the parameters
210.Fa potherid
211and
212.Fa pothertype .
213.Pp
214.Fn CMS_RecipientInfo_kekri_id_cmp
215compares the ID in the
216.Fa id
217and
218.Fa idlen
219parameters against the keyIdentifier
220.Vt CMS_RecipientInfo
221structure
222.Fa ri ,
223which must be of type
224.Dv CMS_RECIPINFO_KEK .
225It returns zero if the comparison is successful or non-zero if not.
226.Pp
227.Fn CMS_RecipientInfo_set0_key
228associates the symmetric key
229.Fa key
230of length
231.Fa keylen
232with the
233.Vt CMS_RecipientInfo
234structure
235.Fa ri ,
236which must be of type
237.Dv CMS_RECIPINFO_KEK .
238.Pp
239.Fn CMS_RecipientInfo_decrypt
240attempts to decrypt the
241.Vt CMS_RecipientInfo
242structure
243.Fa ri
244in structure
245.Fa cms .
246A key must have been associated with the structure first.
247.Pp
248.Fn CMS_RecipientInfo_encrypt
249attempts to encrypt the
250.Vt CMS_RecipientInfo
251structure
252.Fa ri
253in structure
254.Fa cms .
255A key must have been associated with the structure first and the content
256encryption key must be available: for example by a previous call to
257.Fn CMS_RecipientInfo_decrypt .
258.Pp
259The main purpose of these functions is to enable an application to
260lookup recipient keys using any appropriate technique when the simpler
261method of
262.Xr CMS_decrypt 3
263is not appropriate.
264.Pp
265In typical usage, an application will retrieve all
266.Vt CMS_RecipientInfo
267structures using
268.Fn CMS_get0_RecipientInfos
269and check the type of each using
270.Fn CMS_RecipientInfo_type .
271Depending on the type, the
272.Vt CMS_RecipientInfo
273structure can be ignored or its key identifier data retrieved using
274an appropriate function.
275If the corresponding secret or private key can be obtained by any
276appropriate means it can then be associated with the structure and
277.Fn CMS_RecipientInfo_decrypt
278called.
279If successful,
280.Xr CMS_decrypt 3
281can be called with a
282.Dv NULL
283key to decrypt the enveloped content.
284.Pp
285The function
286.Fn CMS_RecipientInfo_encrypt
287can be used to add a new recipient to an existing enveloped data
288structure.
289Typically an application will first decrypt an appropriate
290.Vt CMS_RecipientInfo
291structure to make the content encrypt key available.
292Ot will then add a new recipient using a function such as
293.Xr CMS_add1_recipient_cert 3
294and finally encrypt the content encryption key using
295.Fn CMS_RecipientInfo_encrypt .
296.Sh RETURN VALUES
297.Fn CMS_get0_RecipientInfos
298returns all
299.Vt CMS_RecipientInfo
300structures, or
301.Dv NULL
302if an error occurs.
303.Pp
304.Fn CMS_RecipientInfo_ktri_get0_signer_id ,
305.Fn CMS_RecipientInfo_set0_pkey ,
306.Fn CMS_RecipientInfo_kekri_get0_id ,
307.Fn CMS_RecipientInfo_set0_key ,
308.Fn CMS_RecipientInfo_decrypt ,
309and
310.Fn CMS_RecipientInfo_encrypt
311return 1 for success or 0 if an error occurs.
312.Pp
313.Fn CMS_RecipientInfo_ktri_cert_cmp
314and
315.Fn CMS_RecipientInfo_kekri_id_cmp
316return 0 for a successful comparison or non-zero otherwise.
317.Pp
318Any error can be obtained from
319.Xr ERR_get_error 3 .
320.Sh SEE ALSO
321.Xr CMS_decrypt 3
322.Sh HISTORY
323These functions were first was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_get0_SignerInfos.3 b/src/lib/libcrypto/man/CMS_get0_SignerInfos.3
new file mode 100644
index 0000000000..b9c8fee366
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_get0_SignerInfos.3
@@ -0,0 +1,180 @@
1.\" $OpenBSD: CMS_get0_SignerInfos.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 83cf7abf May 29 13:07:08 2018 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008, 2013 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_GET0_SIGNERINFOS 3
53.Os
54.Sh NAME
55.Nm CMS_get0_SignerInfos ,
56.Nm CMS_SignerInfo_get0_signer_id ,
57.Nm CMS_SignerInfo_get0_signature ,
58.Nm CMS_SignerInfo_cert_cmp ,
59.Nm CMS_SignerInfo_set1_signer_cert
60.Nd CMS signedData signer functions
61.Sh SYNOPSIS
62.In openssl/cms.h
63.Ft STACK_OF(CMS_SignerInfo) *
64.Fo CMS_get0_SignerInfos
65.Fa "CMS_ContentInfo *cms"
66.Fc
67.Ft int
68.Fo CMS_SignerInfo_get0_signer_id
69.Fa "CMS_SignerInfo *si"
70.Fa "ASN1_OCTET_STRING **keyid"
71.Fa "X509_NAME **issuer"
72.Fa "ASN1_INTEGER **sno"
73.Fc
74.Ft ASN1_OCTET_STRING *
75.Fo CMS_SignerInfo_get0_signature
76.Fa "CMS_SignerInfo *si"
77.Fc
78.Ft int
79.Fo CMS_SignerInfo_cert_cmp
80.Fa "CMS_SignerInfo *si"
81.Fa "X509 *cert"
82.Fc
83.Ft void
84.Fo CMS_SignerInfo_set1_signer_cert
85.Fa "CMS_SignerInfo *si"
86.Fa "X509 *signer"
87.Fc
88.Sh DESCRIPTION
89The function
90.Fn CMS_get0_SignerInfos
91returns all the
92.Vt CMS_SignerInfo
93structures associated with a CMS signedData structure.
94.Pp
95.Fn CMS_SignerInfo_get0_signer_id
96retrieves the certificate signer identifier associated with a specific
97.Vt CMS_SignerInfo
98structure
99.Fa si .
100Either the keyidentifier will be set in
101.Fa keyid
102or
103.Em both
104issuer name and serial number in
105.Fa issuer
106and
107.Fa sno .
108.Pp
109.Fn CMS_SignerInfo_get0_signature
110retrieves the signature associated with
111.Fa si
112in a pointer to an
113.Vt ASN1_OCTET_STRING
114structure.
115This pointer returned corresponds to the internal signature value of
116.Fa si
117so it may be read or modified.
118.Pp
119.Fn CMS_SignerInfo_cert_cmp
120compares the certificate
121.Fa cert
122against the signer identifier
123.Fa si .
124It returns zero if the comparison is successful or non-zero if not.
125.Pp
126.Fn CMS_SignerInfo_set1_signer_cert
127sets the signers certificate of
128.Fa si
129to
130.Fa signer .
131.Pp
132The main purpose of these functions is to enable an application to
133lookup signers certificates using any appropriate technique when the
134simpler method of
135.Xr CMS_verify 3
136is not appropriate.
137.Pp
138In typical usage an application will retrieve all
139.Vt CMS_SignerInfo
140structures using
141.Fn CMS_get0_SignerInfos
142and retrieve the identifier information using CMS.
143It will then obtain the signer certificate by some unspecified means
144(or return and error if it cannot be found) and set it using
145.Fn CMS_SignerInfo_set1_signer_cert .
146.Pp
147Once all signer certificates have been set,
148.Xr CMS_verify 3
149can be used.
150.Pp
151Although
152.Fn CMS_get0_SignerInfos
153can return
154.Dv NULL
155if an error occurs
156.Em or
157if there are no signers, this is not a problem in practice because the
158only error which can occur is if the
159.Fa cms
160structure is not of type signedData due to application error.
161.Sh RETURN VALUES
162.Fn CMS_get0_SignerInfos
163returns all
164.Vt CMS_SignerInfo
165structures, or
166.Dv NULL
167if there are no signers or an error occurs.
168.Pp
169.Fn CMS_SignerInfo_get0_signer_id
170returns 1 for success or 0 for failure.
171.Pp
172.Fn CMS_SignerInfo_cert_cmp
173returns 0 for a successful comparison or non-zero otherwise.
174.Pp
175Any error can be obtained from
176.Xr ERR_get_error 3 .
177.Sh SEE ALSO
178.Xr CMS_verify 3
179.Sh HISTORY
180These functions were first was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_get0_type.3 b/src/lib/libcrypto/man/CMS_get0_type.3
new file mode 100644
index 0000000000..982826c7ca
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_get0_type.3
@@ -0,0 +1,174 @@
1.\" $OpenBSD: CMS_get0_type.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 72a7a702 Feb 26 14:05:09 2019 +0000
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008, 2015 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_GET0_TYPE 3
53.Os
54.Sh NAME
55.Nm CMS_get0_type ,
56.Nm CMS_set1_eContentType ,
57.Nm CMS_get0_eContentType ,
58.Nm CMS_get0_content
59.Nd get and set CMS content types and content
60.Sh SYNOPSIS
61.In openssl/cms.h
62.Ft const ASN1_OBJECT *
63.Fo CMS_get0_type
64.Fa "const CMS_ContentInfo *cms"
65.Fc
66.Ft int
67.Fo CMS_set1_eContentType
68.Fa "CMS_ContentInfo *cms"
69.Fa "const ASN1_OBJECT *oid"
70.Fc
71.Ft const ASN1_OBJECT *
72.Fo CMS_get0_eContentType
73.Fa "CMS_ContentInfo *cms"
74.Fc
75.Ft ASN1_OCTET_STRING **
76.Fo CMS_get0_content
77.Fa "CMS_ContentInfo *cms"
78.Fc
79.Sh DESCRIPTION
80.Fn CMS_get0_type
81returns the content type of a
82.Vt CMS_ContentInfo
83structure as an
84.Vt ASN1_OBJECT
85pointer.
86An application can then decide how to process the
87.Vt CMS_ContentInfo
88structure based on this value.
89.Pp
90.Fn CMS_set1_eContentType
91sets the embedded content type of a
92.Vt CMS_ContentInfo
93structure.
94It should be called with CMS functions (such as
95.Xr CMS_sign 3 ,
96.Xr CMS_encrypt 3 )
97with the
98.Dv CMS_PARTIAL
99flag and
100.Em before
101the structure is finalised, otherwise the results are undefined.
102.Pp
103.Fn CMS_get0_eContentType
104returns a pointer to the embedded content type.
105.Pp
106.Fn CMS_get0_content
107returns a pointer to the
108.Vt ASN1_OCTET_STRING
109pointer containing the embedded content.
110.Pp
111As the
112.Sq 0
113in the function names imply,
114.Fn CMS_get0_type ,
115.Fn CMS_get0_eContentType ,
116and
117.Fn CMS_get0_content
118return internal pointers which should
119.Em not
120be freed up.
121.Fn CMS_set1_eContentType
122copies the supplied OID and it
123.Em should
124be freed up after use.
125.Pp
126The
127.Vt ASN1_OBJECT
128values returned can be converted to an integer NID value using
129.Xr OBJ_obj2nid 3 .
130For the currently supported content types the following values are
131returned:
132.Dv NID_pkcs7_data ,
133.Dv NID_pkcs7_signed ,
134.Dv NID_pkcs7_digest ,
135.Dv NID_id_smime_ct_compressedData ,
136.Dv NID_pkcs7_encrypted ,
137.Dv NID_pkcs7_enveloped .
138.Pp
139The return value of
140.Fn CMS_get0_content
141is a pointer to the
142.Vt ASN1_OCTET_STRING
143content pointer.
144That means that for example after
145.Pp
146.Dl ASN1_OCTET_STRING **pconf = CMS_get0_content(cms);
147.Pp
148.Pf * Va pconf
149could be
150.Dv NULL
151if there is no embedded content.
152Applications can access, modify or create the embedded content in a
153.Vt CMS_ContentInfo
154structure using this function.
155Applications usually will not need to modify the embedded content as it
156is normally set by higher level functions.
157.Sh RETURN VALUES
158.Fn CMS_get0_type
159and
160.Fn CMS_get0_eContentType
161return an
162.Vt ASN1_OBJECT
163structure.
164.Pp
165.Fn CMS_set1_eContentType
166returns 1 for success or 0 if an error occurred.
167The error can be obtained from
168.Xr ERR_get_error 3 .
169.Sh HISTORY
170.Fn CMS_get0_type ,
171.Fn CMS_set1_eContentType ,
172and
173.Fn CMS_get0_eContentType
174were all first added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 b/src/lib/libcrypto/man/CMS_get1_ReceiptRequest.3
new file mode 100644
index 0000000000..d944f606d8
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_get1_ReceiptRequest.3
@@ -0,0 +1,175 @@
1.\" $OpenBSD: CMS_get1_ReceiptRequest.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 83cf7abf May 29 13:07:08 2018 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_GET1_RECEIPTREQUEST 3
53.Os
54.Sh NAME
55.Nm CMS_ReceiptRequest_create0 ,
56.Nm CMS_add1_ReceiptRequest ,
57.Nm CMS_get1_ReceiptRequest ,
58.Nm CMS_ReceiptRequest_get0_values
59.Nd CMS signed receipt request functions
60.Sh SYNOPSIS
61.In openssl/cms.h
62.Ft CMS_ReceiptRequest *
63.Fo CMS_ReceiptRequest_create0
64.Fa "unsigned char *id"
65.Fa "int idlen"
66.Fa "int allorfirst"
67.Fa "STACK_OF(GENERAL_NAMES) *receiptList"
68.Fa "STACK_OF(GENERAL_NAMES) *receiptsTo"
69.Fc
70.Ft int
71.Fo CMS_add1_ReceiptRequest
72.Fa "CMS_SignerInfo *si"
73.Fa "CMS_ReceiptRequest *rr"
74.Fc
75.Ft int
76.Fo CMS_get1_ReceiptRequest
77.Fa "CMS_SignerInfo *si"
78.Fa "CMS_ReceiptRequest **prr"
79.Fc
80.Ft void
81.Fo CMS_ReceiptRequest_get0_values
82.Fa "CMS_ReceiptRequest *rr"
83.Fa "ASN1_STRING **pcid"
84.Fa "int *pallorfirst"
85.Fa "STACK_OF(GENERAL_NAMES) **plist"
86.Fa "STACK_OF(GENERAL_NAMES) **prto"
87.Fc
88.Sh DESCRIPTION
89.Fn CMS_ReceiptRequest_create0
90creates a signed receipt request structure.
91The signedContentIdentifier field is set using
92.Fa id
93and
94.Fa idlen ,
95or it is set to 32 bytes of pseudo random data if
96.Fa id
97is
98.Dv NULL .
99If
100.Fa receiptList
101is
102.Dv NULL ,
103the allOrFirstTier option in receiptsFrom
104is used and set to the value of the
105.Fa allorfirst
106parameter.
107If
108.Fa receiptList
109is not
110.Dv NULL ,
111the receiptList option in receiptsFrom is used.
112The
113.Fa receiptsTo
114parameter specifies the receiptsTo field value.
115.Pp
116The
117.Fn CMS_add1_ReceiptRequest
118function adds a signed receipt request
119.Fa rr
120to the
121.Vt CMS_SignerInfo
122structure
123.Fa si .
124.Pp
125.Fn CMS_get1_ReceiptRequest
126looks for a signed receipt request in
127.Fa si .
128If any is found, it is decoded and written to
129.Fa prr .
130.Pp
131.Fn CMS_ReceiptRequest_get0_values
132retrieves the values of a receipt request.
133The signedContentIdentifier is copied to
134.Fa pcid .
135If the allOrFirstTier option of receiptsFrom is used,
136its value is copied to
137.Fa pallorfirst ;
138otherwise the receiptList field is copied to
139.Fa plist .
140The receiptsTo parameter is copied to
141.Fa prto .
142.Pp
143For more details on the meaning of the fields see RFC2634.
144.Pp
145The contents of a signed receipt should only be considered meaningful if
146the corresponding
147.Vt CMS_ContentInfo
148structure can be successfully verified using
149.Xr CMS_verify 3 .
150.Sh RETURN VALUES
151.Fn CMS_ReceiptRequest_create0
152returns a signed receipt request structure or
153.Dv NULL
154if an error occurred.
155.Pp
156.Fn CMS_add1_ReceiptRequest
157returns 1 for success or 0 if an error occurred.
158.Pp
159.Fn CMS_get1_ReceiptRequest
160returns 1 is a signed receipt request is found and decoded.
161It returns 0 if a signed receipt request is not present or -1 if it is
162present but malformed.
163.Sh SEE ALSO
164.Xr CMS_sign 3 ,
165.Xr CMS_sign_receipt 3 ,
166.Xr CMS_verify 3 ,
167.Xr CMS_verify_receipt 3 ,
168.Xr ERR_get_error 3
169.Sh HISTORY
170.Fn CMS_ReceiptRequest_create0 ,
171.Fn CMS_add1_ReceiptRequest ,
172.Fn CMS_get1_ReceiptRequest ,
173and
174.Fn CMS_ReceiptRequest_get0_values
175were added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_sign.3 b/src/lib/libcrypto/man/CMS_sign.3
new file mode 100644
index 0000000000..54d95f4a5d
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_sign.3
@@ -0,0 +1,224 @@
1.\" $OpenBSD: CMS_sign.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL e9b77246 Jan 20 19:58:49 2017 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_SIGN 3
53.Os
54.Sh NAME
55.Nm CMS_sign
56.Nd create a CMS SignedData structure
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft CMS_ContentInfo *
60.Fo CMS_sign
61.Fa "X509 *signcert"
62.Fa "EVP_PKEY *pkey"
63.Fa "STACK_OF(X509) *certs"
64.Fa "BIO *data"
65.Fa "unsigned int flags"
66.Fc
67.Sh DESCRIPTION
68.Fn CMS_sign
69creates and returns a CMS SignedData structure.
70.Fa signcert
71is the certificate to sign with,
72.Fa pkey
73is the corresponding private key.
74.Fa certs
75is an optional additional set of certificates to include in the CMS
76structure (for example any intermediate CAs in the chain).
77Any or all of these parameters can be
78.Dv NULL .
79.Pp
80The data to be signed is read from
81.Fa data .
82.Pp
83.Fa flags
84is an optional set of flags.
85.Pp
86Any of the following flags (OR'ed together) can be passed in the
87.Fa flags
88parameter:
89.Bl -tag -width Ds
90.It Dv CMS_TEXT
91Prepend MIME headers for the type text/plain to the data.
92Many S/MIME clients expect the signed content to include valid MIME
93headers.
94.It Dv CMS_NOCERTS
95Do not include the signer's certificate in the
96.Vt CMS_ContentInfo
97structure.
98The signer's certificate must still be supplied in the
99.Fa signcert
100parameter though.
101This can reduce the size of the signature if the signers certificate can
102be obtained by other means: for example a previously signed message.
103.It Dv CMS_DETACHED
104Omit the data being signed from the
105.Vt CMS_ContentInfo
106structure.
107This is used for
108.Vt CMS_ContentInfo
109detached signatures which are used in S/MIME plaintext signed messages
110for example.
111.It Dv CMS_BINARY
112Do not translate the supplied content into MIME canonical format
113even though that is required by the S/MIME specifications.
114This option should be used if the supplied data is in binary format.
115Otherwise the translation will corrupt it.
116.It Dv CMS_NOATTR
117Do not use any signedAttributes.
118By default, the SignedData structure includes several CMS
119signedAttributes including the signing time, the CMS content type,
120and the supported list of ciphers in an SMIMECapabilities attribute.
121.It Dv CMS_NOSMIMECAP
122Omit just the SMIMECapabilities.
123If present, the SMIMECapabilities attribute indicates support for the
124following algorithms in preference order: 256 bit AES, Gost R3411-94,
125Gost 28147-89, 192 bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit
126RC2, DES and 40 bit RC2.
127If any of these algorithms is not available, then it will not be
128included: for example the GOST algorithms will not be included if
129the GOST ENGINE is not loaded.
130.It Dv CMS_USE_KEYID
131Use the subject key identifier value to identify signing certificates.
132An error occurs if the signing certificate does not have a subject key
133identifier extension.
134By default, issuer name and serial number are used instead.
135.It Dv CMS_STREAM
136Only initialize the returned
137.Vt CMS_ContentInfo
138structure to prepare it for performing the signing operation.
139The signing is however
140.Em not
141performed and the data to be signed is not read from the
142.Fa data
143parameter.
144Signing is deferred until after the data has been written.
145In this way, data can be signed in a single pass.
146The returned
147.Vt CMS_ContentInfo
148structure is
149.Em not
150complete and outputting its contents via a function that does not
151properly finalize the
152.Vt CMS_ContentInfo
153structure will give unpredictable results.
154Several functions including
155.Xr SMIME_write_CMS 3 ,
156.Xr i2d_CMS_bio_stream 3 ,
157or
158.Xr PEM_write_bio_CMS_stream 3
159finalize the structure.
160Alternatively, finalization can be performed by obtaining the streaming
161ASN1
162.Vt BIO
163directly using
164.Xr BIO_new_CMS 3 .
165.It Dv CMS_PARTIAL
166Output a partial
167.Vt CMS_ContentInfo
168structure to which additional signers and capabilities can be
169added before finalization.
170.El
171.Pp
172If a signer is specified, it will use the default digest for the signing
173algorithm.
174This is SHA1 for both RSA and DSA keys.
175.Pp
176If
177.Fa signcert
178and
179.Fa pkey
180are
181.Dv NULL ,
182then a certificates only CMS structure is output.
183.Pp
184The function
185.Fn CMS_sign
186is a basic CMS signing function whose output will be suitable for many
187purposes.
188For finer control of the output format the
189.Fa certs ,
190.Fa signcert
191and
192.Fa pkey
193parameters can all be
194.Dv NULL
195and the
196.Dv CMS_PARTIAL
197flag set.
198Then one or more signers can be added using the function
199.Xr CMS_sign_add1_signer 3 ,
200non default digests can be used and custom attributes added.
201.Xr CMS_final 3
202must then be called to finalize the structure if streaming is not
203enabled.
204.Sh RETURN VALUES
205.Fn CMS_sign
206returns either a valid
207.Vt CMS_ContentInfo
208structure or
209.Dv NULL
210if an error occurred.
211The error can be obtained from
212.Xr ERR_get_error 3 .
213.Sh SEE ALSO
214.Xr CMS_verify 3
215.Sh HISTORY
216.Fn CMS_sign
217was added to OpenSSL 0.9.8.
218.Pp
219The
220.Dv CMS_STREAM
221flag is only supported for detached data in OpenSSL 0.9.8, it is
222supported for embedded data in OpenSSL 1.0.0 and later.
223.Sh BUGS
224Some attributes such as counter signatures are not supported.
diff --git a/src/lib/libcrypto/man/CMS_sign_receipt.3 b/src/lib/libcrypto/man/CMS_sign_receipt.3
new file mode 100644
index 0000000000..7ddff976cc
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_sign_receipt.3
@@ -0,0 +1,110 @@
1.\" $OpenBSD: CMS_sign_receipt.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL e9b77246 Jan 20 19:58:49 2017 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_SIGN_RECEIPT 3
53.Os
54.Sh NAME
55.Nm CMS_sign_receipt
56.Nd create a CMS signed receipt
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft CMS_ContentInfo *
60.Fo CMS_sign_receipt
61.Fa "CMS_SignerInfo *si"
62.Fa "X509 *signcert"
63.Fa "EVP_PKEY *pkey"
64.Fa "STACK_OF(X509) *certs"
65.Fa "unsigned int flags"
66.Fc
67.Sh DESCRIPTION
68.Fn CMS_sign_receipt
69creates and returns a CMS signed receipt structure.
70.Fa si
71is the
72.Vt CMS_SignerInfo
73structure containing the signed receipt request.
74.Fa signcert
75is the certificate to sign with,
76.Fa pkey
77is the corresponding private key.
78.Fa certs
79is an optional additional set of certificates to include in the CMS
80structure (for example any intermediate CAs in the chain).
81.Pp
82.Fa flags
83is an optional set of flags.
84.Pp
85This functions behaves in a similar way to
86.Xr CMS_sign 3
87except the flag values
88.Dv CMS_DETACHED ,
89.Dv CMS_BINARY ,
90.Dv CMS_NOATTR ,
91.Dv CMS_TEXT ,
92and
93.Dv CMS_STREAM
94are not supported since they do not make sense in the context of
95signed receipts.
96.Sh RETURN VALUES
97.Fn CMS_sign_receipt
98returns either a valid
99.Vt CMS_ContentInfo
100structure or
101.Dv NULL
102if an error occurred.
103The error can be obtained from
104.Xr ERR_get_error 3 .
105.Sh SEE ALSO
106.Xr CMS_sign 3 ,
107.Xr CMS_verify_receipt 3
108.Sh HISTORY
109.Fn CMS_sign_receipt
110was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/CMS_uncompress.3 b/src/lib/libcrypto/man/CMS_uncompress.3
new file mode 100644
index 0000000000..50926b7358
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_uncompress.3
@@ -0,0 +1,111 @@
1.\" $OpenBSD: CMS_uncompress.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_UNCOMPRESS 3
53.Os
54.Sh NAME
55.Nm CMS_uncompress
56.Nd uncompress a CMS CompressedData structure
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft int
60.Fo CMS_uncompress
61.Fa "CMS_ContentInfo *cms"
62.Fa "BIO *dcont"
63.Fa "BIO *out"
64.Fa "unsigned int flags"
65.Fc
66.Sh DESCRIPTION
67.Fn CMS_uncompress
68extracts and uncompresses the content from a CMS CompressedData
69structure
70.Fa cms .
71.Fa out
72is a
73.Vt BIO
74to write the content to and
75.Fa flags
76is an optional set of flags.
77.Pp
78The
79.Fa dcont
80parameter is used in the rare case where the compressed content is
81detached.
82It will normally be set to
83.Dv NULL .
84.Pp
85The only currently supported compression algorithm is zlib: if the
86structure indicates the use of any other algorithm, an error is returned.
87.Pp
88If zlib support is not compiled in, then
89.Fn CMS_uncompress
90will always return an error.
91.Pp
92If the
93.Dv CMS_TEXT
94flag is set, MIME headers for type text/plain are deleted from the content.
95If the content is not of type text/plain, an error is returned.
96.Sh RETURN VALUES
97.Fn CMS_uncompress
98returns either 1 for success or 0 for failure.
99The error can be obtained from
100.Xr ERR_get_error 3 .
101.Sh SEE ALSO
102.Xr CMS_compress 3
103.Sh HISTORY
104.Fn CMS_uncompress
105was added to OpenSSL 0.9.8.
106.Sh BUGS
107The lack of single pass processing and the need to hold all data in
108memory as mentioned in
109.Xr CMS_verify 3
110also applies to
111.Fn CMS_uncompress .
diff --git a/src/lib/libcrypto/man/CMS_verify.3 b/src/lib/libcrypto/man/CMS_verify.3
new file mode 100644
index 0000000000..cec1dc06d8
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_verify.3
@@ -0,0 +1,223 @@
1.\" $OpenBSD: CMS_verify.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 35fd9953 May 28 14:49:38 2019 +0200
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_VERIFY 3
53.Os
54.Sh NAME
55.Nm CMS_verify ,
56.Nm CMS_get0_signers
57.Nd verify a CMS SignedData structure
58.Sh SYNOPSIS
59.In openssl/cms.h
60.Ft int
61.Fo CMS_verify
62.Fa "CMS_ContentInfo *cms"
63.Fa "STACK_OF(X509) *certs"
64.Fa "X509_STORE *store"
65.Fa "BIO *indata"
66.Fa "BIO *out"
67.Fa "unsigned int flags"
68.Fc
69.Ft STACK_OF(X509) *
70.Fo CMS_get0_signers
71.Fa "CMS_ContentInfo *cms"
72.Fc
73.Sh DESCRIPTION
74.Fn CMS_verify
75verifies a CMS SignedData structure.
76.Fa cms
77is the
78.Vt CMS_ContentInfo
79structure to verify.
80.Fa certs
81is a set of certificates in which to search for the signing
82certificate(s).
83.Fa store
84is a trusted certificate store used for chain verification.
85.Fa indata
86is the detached content if the content is not present in
87.Fa cms .
88The content is written to
89.Fa out
90if it is not
91.Dv NULL .
92.Pp
93.Fa flags
94is an optional set of flags, which can be used to modify the verify
95operation.
96.Pp
97.Fn CMS_get0_signers
98retrieves the signing certificate(s) from
99.Fa cms .
100It must be called after a successful
101.Fn CMS_verify
102operation.
103.Pp
104Normally the verify process proceeds as follows.
105.Pp
106Initially some sanity checks are performed on
107.Fa cms .
108The type of
109.Fa cms
110must be SignedData.
111There must be at least one signature on the data and if the content is
112detached;
113.Fa indata
114cannot be
115.Dv NULL .
116.Pp
117An attempt is made to locate all the signing certificate(s), first
118looking in the
119.Fa certs
120parameter (if it is not
121.Dv NULL )
122and then looking in any certificates contained in the
123.Fa cms
124structure itself.
125If any signing certificate cannot be located, the operation fails.
126.Pp
127Each signing certificate is chain verified using the
128.Sy smimesign
129purpose and the supplied trusted certificate store.
130Any internal certificates in the message are used as untrusted CAs.
131If CRL checking is enabled in
132.Fa store ,
133any internal CRLs are used in addition to attempting to look them up in
134.Fa store .
135If any chain verify fails, an error code is returned.
136.Pp
137Finally the signed content is read (and written to
138.Fa out
139if it is not
140.Dv NULL )
141and the signature is checked.
142.Pp
143If all signatures verify correctly, then the function is successful.
144.Pp
145Any of the following flags (OR'ed together) can be passed in the
146.Fa flags
147parameter to change the default verify behaviour:
148.Bl -tag -width Ds
149.It Dv CMS_NOINTERN
150Do not use the certificates in the message itself when
151locating the signing certificate(s).
152This means that all the signing certificates must be in the
153.Fa certs
154parameter.
155.It Dv CMS_NOCRL
156If CRL checking is enabled in
157.Fa store ,
158then any CRLs in the message itself are ignored.
159It Dv CMS_TEXT
160MIME headers for type text/plain are deleted from the content.
161If the content is not of type text/plain, an error is returned.
162.It Dv CMS_NO_SIGNER_CERT_VERIFY
163Do not verify signing certificates.
164.It Dv CMS_NO_ATTR_VERIFY
165Do not check the signed attributes signature.
166.It Dv CMS_NO_CONTENT_VERIFY
167Do not check the content digest.
168.El
169.Pp
170One application of
171.Dv CMS_NOINTERN
172is to only accept messages signed by a small number of certificates.
173The acceptable certificates would be passed in the
174.Fa certs
175parameter.
176In this case, if the signer is not one of the certificates supplied in
177.Fa certs ,
178then the verify will fail because the signer cannot be found.
179.Pp
180In some cases the standard techniques for looking up and validating
181certificates are not appropriate: for example an application may wish to
182lookup certificates in a database or perform customised verification.
183This can be achieved by setting and verifying the signers certificates
184manually using the signed data utility functions.
185.Pp
186Care should be taken when modifying the default verify behaviour, for
187example setting
188.Dv CMS_NO_CONTENT_VERIFY
189will totally disable all content verification and any modified content
190will be considered valid.
191This combination is however useful if one merely wishes to write the
192content to
193.Fa out
194and its validity is not considered important.
195.Pp
196Chain verification should arguably be performed using the signing time
197rather than the current time.
198However since the signing time is supplied by the signer it cannot be
199trusted without additional evidence (such as a trusted timestamp).
200.Sh RETURN VALUES
201.Fn CMS_verify
202returns 1 for a successful verification or zero if an error occurred.
203.Pp
204.Fn CMS_get0_signers
205returns all signers or
206.Dv NULL
207if an error occurred.
208.Pp
209The error can be obtained from
210.Xr ERR_get_error 3 .
211.Sh SEE ALSO
212.Xr CMS_sign 3
213.Sh HISTORY
214.Fn CMS_verify
215was added to OpenSSL 0.9.8.
216.Sh BUGS
217The trusted certificate store is not searched for the signing certificate.
218This is primarily due to the inadequacies of the current
219.Vt X509_STORE
220functionality.
221.Pp
222The lack of single pass processing means that the signed content must
223all be held in memory if it is not detached.
diff --git a/src/lib/libcrypto/man/CMS_verify_receipt.3 b/src/lib/libcrypto/man/CMS_verify_receipt.3
new file mode 100644
index 0000000000..33bb43ed8d
--- /dev/null
+++ b/src/lib/libcrypto/man/CMS_verify_receipt.3
@@ -0,0 +1,104 @@
1.\" $OpenBSD: CMS_verify_receipt.3,v 1.3 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL e9b77246 Jan 20 19:58:49 2017 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt CMS_VERIFY_RECEIPT 3
53.Os
54.Sh NAME
55.Nm CMS_verify_receipt
56.Nd verify a CMS signed receipt
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft int
60.Fo CMS_verify_receipt
61.Fa "CMS_ContentInfo *rcms"
62.Fa "CMS_ContentInfo *ocms"
63.Fa "STACK_OF(X509) *certs"
64.Fa "X509_STORE *store"
65.Fa "unsigned int flags"
66.Fc
67.Sh DESCRIPTION
68.Fn CMS_verify_receipt
69verifies a CMS signed receipt.
70.Fa rcms
71is the signed receipt to verify.
72.Fa ocms
73is the original SignedData structure containing the receipt request.
74.Fa certs
75is a set of certificates in which to search for the signing certificate.
76.Fa store
77is a trusted certificate store (used for chain verification).
78.Pp
79.Fa flags
80is an optional set of flags, which can be used to modify the verify
81operation.
82.Pp
83This functions behaves in a similar way to
84.Xr CMS_verify 3
85except the flag values
86.Dv CMS_DETACHED ,
87.Dv CMS_BINARY ,
88.Dv CMS_TEXT ,
89and
90.Dv CMS_STREAM
91are not supported since they do not make sense in the context of signed
92receipts.
93.Sh RETURN VALUES
94.Fn CMS_verify_receipt
95returns 1 for a successful verification or zero if an error occurred.
96.Pp
97The error can be obtained from
98.Xr ERR_get_error 3 .
99.Sh SEE ALSO
100.Xr CMS_sign_receipt 3 ,
101.Xr CMS_verify 3
102.Sh HISTORY
103.Fn CMS_verify_receipt
104was added to OpenSSL 0.9.8.
diff --git a/src/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 b/src/lib/libcrypto/man/PEM_write_bio_CMS_stream.3
new file mode 100644
index 0000000000..ad1688ba14
--- /dev/null
+++ b/src/lib/libcrypto/man/PEM_write_bio_CMS_stream.3
@@ -0,0 +1,93 @@
1.\" $OpenBSD: PEM_write_bio_CMS_stream.3,v 1.1 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL df75c2bf Dec 9 01:02:36 2018 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt PEM_WRITE_BIO_CMS_STREAM 3
53.Os
54.Sh NAME
55.Nm PEM_write_bio_CMS_stream
56.Nd output CMS_ContentInfo structure in PEM format
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft int
60.Fo PEM_write_bio_CMS_stream
61.Fa "BIO *out"
62.Fa "CMS_ContentInfo *cms"
63.Fa "BIO *data"
64.Fa "int flags"
65.Fc
66.Sh DESCRIPTION
67.Fn PEM_write_bio_CMS_stream
68outputs a
69.Vt CMS_ContentInfo
70structure in PEM format.
71.Pp
72It is otherwise identical to the function
73.Xr SMIME_write_CMS 3 .
74.Pp
75This function is effectively a version of
76.Xr PEM_write_bio_CMS 3
77supporting streaming.
78.Sh RETURN VALUES
79.Fn PEM_write_bio_CMS_stream
80returns 1 for success or 0 for failure.
81.Sh SEE ALSO
82.Xr CMS_decrypt 3 ,
83.Xr CMS_encrypt 3 ,
84.Xr CMS_sign 3 ,
85.Xr CMS_verify 3 ,
86.Xr ERR_get_error 3 ,
87.Xr i2d_CMS_bio_stream 3 ,
88.Xr PEM_write 3 ,
89.Xr SMIME_write_CMS 3
90.Sh HISTORY
91The
92.Fn PEM_write_bio_CMS_stream
93function was added in OpenSSL 1.0.0.
diff --git a/src/lib/libcrypto/man/SMIME_read_CMS.3 b/src/lib/libcrypto/man/SMIME_read_CMS.3
new file mode 100644
index 0000000000..17f60b11ec
--- /dev/null
+++ b/src/lib/libcrypto/man/SMIME_read_CMS.3
@@ -0,0 +1,146 @@
1.\" $OpenBSD: SMIME_read_CMS.3,v 1.1 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt SMIME_READ_CMS 3
53.Os
54.Sh NAME
55.Nm SMIME_read_CMS
56.Nd parse S/MIME message
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft CMS_ContentInfo *
60.Fo SMIME_read_CMS
61.Fa "BIO *in"
62.Fa "BIO **bcont"
63.Fc
64.Sh DESCRIPTION
65.Fn SMIME_read_CMS
66parses a message in S/MIME format.
67.Pp
68.Fa in
69is a
70.Vt BIO
71to read the message from.
72.Pp
73If cleartext signing is used, then the content is saved in a memory BIO
74which is written to
75.Pf * Fa bcont ;
76otherwise
77.Pf * Fa bcont
78is set to
79.Dv NULL .
80.Pp
81The parsed
82.Vt CMS_ContentInfo
83structure is returned, or
84.Dv NULL
85if an error occurred.
86.Pp
87If
88.Pf * Fa bcont
89is not
90.Dv NULL ,
91then the message is clear text signed.
92.Pf * Fa bcont
93can then be passed to
94.Xr CMS_verify 3
95with the
96.Dv CMS_DETACHED
97flag set.
98.Pp
99Otherwise the type of the returned structure can be determined using
100.Xr CMS_get0_type 3 .
101.Pp
102To support future functionality if
103.Fa bcont
104is not
105.Dv NULL ,
106.Pf * Fa bcont
107should be initialized to
108.Dv NULL .
109For example:
110.Bd -literal -offset indent
111BIO *cont = NULL;
112CMS_ContentInfo *cms;
113
114cms = SMIME_read_CMS(in, &cont);
115.Ed
116.Sh RETURN VALUES
117.Fn SMIME_read_CMS
118returns a valid
119.Vt CMS_ContentInfo
120structure or
121.Dv NULL
122if an error occurred.
123The error can be obtained from
124.Xr ERR_get_error 3 .
125.Sh SEE ALSO
126.Xr CMS_decrypt 3 ,
127.Xr CMS_encrypt 3 ,
128.Xr CMS_sign 3 ,
129.Xr CMS_type 3 ,
130.Xr CMS_verify 3 ,
131.Xr SMIME_write_CMS 3
132.Sh BUGS
133The MIME parser used by
134.Fn SMIME_read_CMS
135is somewhat primitive.
136While it will handle most S/MIME messages, more complex compound formats
137may not work.
138.Pp
139The parser assumes that the
140.Vt CMS_ContentInfo
141structure is always base64 encoded and will not handle the case
142where it is in binary format or uses quoted printable format.
143.Pp
144The use of a memory BIO to hold the signed content limits the size of
145message which can be processed due to memory restraints: a streaming
146single pass option should be available.
diff --git a/src/lib/libcrypto/man/SMIME_write_CMS.3 b/src/lib/libcrypto/man/SMIME_write_CMS.3
new file mode 100644
index 0000000000..c9afa5e5a5
--- /dev/null
+++ b/src/lib/libcrypto/man/SMIME_write_CMS.3
@@ -0,0 +1,133 @@
1.\" $OpenBSD: SMIME_write_CMS.3,v 1.1 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt SMIME_WRITE_CMS 3
53.Os
54.Sh NAME
55.Nm SMIME_write_CMS
56.Nd convert CMS structure to S/MIME format
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft int
60.Fo SMIME_write_CMS
61.Fa "BIO *out"
62.Fa "CMS_ContentInfo *cms"
63.Fa "BIO *data"
64.Fa "int flags"
65.Fc
66.Sh DESCRIPTION
67.Fn SMIME_write_CMS
68adds the appropriate MIME headers to a CMS structure to produce an
69S/MIME message.
70.Pp
71.Fa out
72is the
73.Vt BIO
74to write the data to.
75.Fa cms
76is the appropriate
77.Vt CMS_ContentInfo
78structure.
79If streaming is enabled, then the content must be supplied in the
80.Fa data
81argument.
82.Fa flags
83is an optional set of flags.
84.Pp
85The following flags can be passed in the
86.Fa flags
87parameter:
88.Bl -tag -width Ds
89.It Dv CMS_DETACHED
90Use cleartext signing.
91This option only makes sense for SignedData where
92.Dv CMS_DETACHED
93is also set when
94.Xr CMS_sign 3
95is called.
96.Pp
97If cleartext signing is used and
98.Dv CMS_STREAM
99is not set, then the data must be read twice:
100once to compute the signature in
101.Xr CMS_sign 3
102and once to output the S/MIME message.
103.It Dv CMS_TEXT
104Add MIME headers for type text/plain to the content.
105This only makes sense if
106.Dv CMS_DETACHED
107is also set.
108.It Dv CMS_STREAM
109Perform streaming.
110This flag should only be set if
111.Dv CMS_STREAM
112was also set in the previous call to a
113.Vt CMS_ContentInfo
114creation function.
115.Pp
116If streaming is performed, the content is output in BER format using
117indefinite length constructed encoding except in the case of signed data
118with detached content where the content is absent and DER format is
119used.
120.El
121.Sh RETURN VALUES
122.Fn SMIME_write_CMS
123returns 1 for success or 0 for failure.
124.Sh SEE ALSO
125.Xr CMS_decrypt 3 ,
126.Xr CMS_encrypt 3 ,
127.Xr CMS_sign 3 ,
128.Xr CMS_verify 3 ,
129.Xr ERR_get_error 3
130.Sh BUGS
131.Fn SMIME_write_CMS
132always base64 encodes CMS structures.
133There should be an option to disable this.
diff --git a/src/lib/libcrypto/man/i2d_CMS_bio_stream.3 b/src/lib/libcrypto/man/i2d_CMS_bio_stream.3
new file mode 100644
index 0000000000..3615c01ccb
--- /dev/null
+++ b/src/lib/libcrypto/man/i2d_CMS_bio_stream.3
@@ -0,0 +1,95 @@
1.\" $OpenBSD: i2d_CMS_bio_stream.3,v 1.1 2019/08/10 23:41:22 schwarze Exp $
2.\" full merge up to: OpenSSL df75c2bf Dec 9 01:02:36 2018 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2008 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: August 10 2019 $
52.Dt I2D_CMS_BIO_STREAM 3
53.Os
54.Sh NAME
55.Nm i2d_CMS_bio_stream
56.Nd output CMS_ContentInfo structure in BER format
57.Sh SYNOPSIS
58.In openssl/cms.h
59.Ft int
60.Fo i2d_CMS_bio_stream
61.Fa "BIO *out"
62.Fa "CMS_ContentInfo *cms"
63.Fa "BIO *data"
64.Fa "int flags"
65.Fc
66.Sh DESCRIPTION
67.Fn i2d_CMS_bio_stream
68outputs a
69.Vt CMS_ContentInfo
70structure in BER format.
71.Pp
72It is otherwise identical to the function
73.Xr SMIME_write_CMS 3 .
74.Pp
75This function is effectively a version of
76.Xr i2d_CMS_bio 3
77supporting streaming.
78.Sh RETURN VALUES
79.Fn i2d_CMS_bio_stream
80returns 1 for success or 0 for failure.
81.Sh SEE ALSO
82.Xr CMS_decrypt 3 ,
83.Xr CMS_encrypt 3 ,
84.Xr CMS_sign 3 ,
85.Xr CMS_verify 3 ,
86.Xr ERR_get_error 3 ,
87.Xr PEM_write_bio_CMS_stream 3 ,
88.Xr SMIME_write_CMS 3
89.Sh HISTORY
90The
91.Fn i2d_CMS_bio_stream
92function was added in OpenSSL 1.0.0.
93.Sh BUGS
94The prefix "i2d" is arguably wrong because the function outputs BER
95format.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-23 20:10:16 +0000