diff options
| author | Jan Luebbe <[email protected]> | 2025-05-09 09:54:15 +0200 |
|---|---|---|
| committer | Tomas Mraz <[email protected]> | 2026-08-27 15:12:30 +0200 |
| commit | b8631f9bbcdf39641ff2443e26c2fcbe54958950 (patch) | |
| tree | 225b5bcfa321a0a03db7781fd5b916eadf12aec8 /include | |
| parent | Implement partial verification for CMS with multiple signatures (diff) | |
| download | openssl-b8631f9bbcdf39641ff2443e26c2fcbe54958950.tar.gz openssl-b8631f9bbcdf39641ff2443e26c2fcbe54958950.zip | |
Implement access to CMS verification results per signer
When verifying CMS messages with multiple signatures using
CMS_VERIFY_PARTIAL to implement additional custom requirements
regarding signatures from which certificates are required and/or
acceptable, information on which signature was considered invalid and
why by CMS_verify is useful for reporting or debugging.
Implement this by adding CMS_SignerInfo-based access to certificates
(CMS_SignerInfo_get0_signer_cert) and verification results
(CMS_SignerInfo_get_verification_result). Also use these new functions
to show more details when using 'openssl cms -verify' with
'-verify_partial'.
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: David von Oheimb <[email protected]>
Merge-date: Thu Aug 27 13:14:14 2026
Merged-from: https://github.com/openssl/openssl/pull/27604
Diffstat (limited to 'include')
| -rw-r--r-- | include/openssl/cms.h.in | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/include/openssl/cms.h.in b/include/openssl/cms.h.in index cd0a5256308..8389d3dff08 100644 --- a/include/openssl/cms.h.in +++ b/include/openssl/cms.h.in @@ -76,6 +76,11 @@ CMS_ContentInfo *CMS_ContentInfo_new_ex(OSSL_LIB_CTX *libctx, const char *propq) #define CMS_RECIPINFO_OTHER 4 #define CMS_RECIPINFO_KEM 5 +#define CMS_VERIFY_RESULT 0 +#define CMS_VERIFY_CERT 1 +#define CMS_VERIFY_ATTR 2 +#define CMS_VERIFY_CONTENT 3 + /* S/MIME related flags */ #define CMS_TEXT 0x1 @@ -290,6 +295,7 @@ EVP_MD_CTX *CMS_SignerInfo_get0_md_ctx(CMS_SignerInfo *si); STACK_OF(CMS_SignerInfo) *CMS_get0_SignerInfos(CMS_ContentInfo *cms); void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer); +X509 *CMS_SignerInfo_get0_signer_cert(const CMS_SignerInfo *si); int CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid, X509_NAME **issuer, ASN1_INTEGER **sno); @@ -300,6 +306,7 @@ void CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer, X509_ALGOR **pdig, X509_ALGOR **psig); ASN1_OCTET_STRING *CMS_SignerInfo_get0_signature(CMS_SignerInfo *si); +int CMS_SignerInfo_get_verification_result(const CMS_SignerInfo *si, int type); int CMS_SignerInfo_sign(CMS_SignerInfo *si); int CMS_SignerInfo_verify(CMS_SignerInfo *si); int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain); |