This adds CMS support to the Ruby layer. #917

mcr · 2025-07-26T17:41:05Z

This updates the patch to support openssl 3.x.
I have maintained a patch for some years for openssl1.1.1 that adds CMS support.
(This is needed for RFC8995 code)

The CMS_ContentInfo object can be used. Access to the CMS_SignedInfo structure exists, but it can not be created or freed, as it is just a pointer into CMS_ContentInfo stack. feat: added NOINTERN and NO_SIGNER_CERT_VERIFY flags feat: look for CMS_sign, and set HAVE_CMS_SIGN if present, enabling CMS support

mcr · 2025-07-27T20:49:20Z

Not sure how to get the aws-lc-latest test case to run. Does it even work?

rhenium · 2025-07-27T12:22:00Z

ext/openssl/extconf.rb

@@ -143,6 +143,9 @@ def find_openssl_library
 # added in 1.1.0, currently not in LibreSSL
 have_func("EVP_PBE_scrypt(\"\", 0, (unsigned char *)\"\", 0, 0, 0, 0, 0, NULL, 0)", evp_h)

+# look for CMS code, normally included, but some variations compile it out
+have_func("CMS_sign", ssl_h)


ruby/openssl currently aims to support OpenSSL 1.1.1 or later, LibreSSL versions that are supported by upstream, and the latest version of AWS-LC.

I think we can use !defined(OPENSSL_NO_CMS) without this mkmf check.

Okay, I put this in during 1.1.1, because I found that some targets (maybe it was openwrt) did not include CMS for space reasons.

AFAIK OPENSSL_NO_XXX macros are provided for this purpose. Their headers should have the macro if it is compiled with ./Configure no-cms.

ext/openssl/ossl.c

ext/openssl/ossl.h

ext/openssl/ossl_pkcs7.c

ext/openssl/ossl_cms.c

rhenium · 2025-07-27T12:34:38Z

ext/openssl/ossl_cms.c

+static VALUE
+ossl_cmssi_new(CMS_SignerInfo *cmssi)
+{
+    VALUE obj;
+
+    obj = NewCMSsi(cCMSSignerInfo);
+    SetCMSsi(obj, cmssi);
+
+    return obj;
+}


The CMS_SignerInfo is only valid as long as the CMS_ContentInfo is alive, so we must prevent the CMS_ContentInfo from being free'd earlier than it.

I think you can add a reference to it in a hidden instance variable, rb_ivar_set(obj, rb_intern("cms"), cms_content_info_wrapper).

so, I think it should be:

rb_ivar_set(obj, rb_intern("cms"), cmssi);

I don't undnerstrand the cms_content_info_wrapper here.

I meant the Ruby object wrapping the CMS_ContentInfo.

rhenium · 2025-07-27T12:39:46Z

ext/openssl/ossl_cms.c

+ *
+ */
+static VALUE
+ossl_cmsci_initialize(int argc, VALUE *argv, VALUE self)


As I commented on ossl_cmssi_new(), we must avoid freeing CMS_ContentInfo or destructively changing it as long as an object wrapping CMS_SignerInfo borrowed from it exists. We'd need to prevent #initialize from being called twice.

ext/openssl/ossl_cms.c

rhenium · 2025-07-28T10:42:49Z

From a quick look, the current implementation of OpenSSL::CMS seems to support a subset of what OpenSSL::PKCS7 can currently handle. Do you plan to implement the remaining accessors or add new features that require the CMS API?

My understanding is that CMS is intended to be the successor of PKCS#7 and backwards-compatible with it. I wonder if we could avoid maintaining two separate modules for what is basically the same structure. I haven't looked into the OpenSSL API and I'm not sure if it's possible to do fully copy the existing behaviors, but would it be feasible to update OpenSSL::PKCS7 to use the CMS API and rename it?

I'm also not sure why OpenSSL decided to use different structs for PKCS#7 and CMS in the first place.

rhenium · 2025-07-28T10:45:33Z

Not sure how to get the aws-lc-latest test case to run. Does it even work?

AWS-LC doesn't appear to have openssl/cms.h. AWS-LC defines OPENSSL_NO_CMS.

mcr · 2025-07-28T13:40:13Z

My understanding is that CMS is intended to be the successor of PKCS#7 and backwards-compatible with it. I wonder if we could avoid maintaining two separate modules for what is basically the same structure. I haven't looked into the OpenSSL API and I'm not sure if it's possible to do fully copy the existing behaviors, but would it be feasible to update OpenSSL::PKCS7 to use the CMS API and rename it?

CMS > PKCS7, but PKCS7 things can not in general parse CMS.
So if one wants to generate PKCS7 things, the one needs to use the old APIs.
Why OpenSSL didn't do what you suggest, I don't know. Legacy.

If we were to do anything, it would be to rip PKCS7 code out.

…t it will not get freed before thing contained in

…CMS_get0_SignerInfos function was successful

junaruga · 2025-07-28T16:18:59Z

Not sure how to get the aws-lc-latest test case to run. Does it even work?

I ran the latest master branch of the ruby/openssl in my forked repository, and the awc-ls-latest case passed. So, this PR's change might break the awc-ls-latest case.

https://github.com/junaruga/ruby-openssl/actions/runs/16567236800

mcr · 2025-07-28T20:00:49Z

It seems that aws-lc does not include CMS support. The error that I saw, however, was about impossible version numbers, which I couldn't understand at all. With OPENSSL_NO_CMS as the key to compiling the CMS code, then aws-lc-latest "works", because it doesn't test anything.

rhenium · 2025-07-31T16:23:55Z

It seems that aws-lc does not include CMS support.
The error that I saw, however, was about impossible version numbers

Yes, AWS-LC doesn't have openssl/cms.h either. openssl/cms.h from Ubuntu's base system appears to be included incorrectly as a result.

mcr mentioned this pull request Jul 26, 2025

Openssl cms wrapper #236

Closed

mcr force-pushed the openssl-3-ruby-3-cms branch from 718a84a to a3012ee Compare July 27, 2025 20:11

mcr force-pushed the openssl-3-ruby-3-cms branch from a3012ee to 51b28bc Compare July 27, 2025 20:31

rhenium reviewed Jul 28, 2025

View reviewed changes

mcr added 2 commits July 28, 2025 09:26

review comments on PR: always define Init_ossl_cms()

1fc4386

review: remove unnecessary hmac.h, sort alphabetically

fa8efa3

mcr added 3 commits July 28, 2025 10:15

feat: stop using ePKCS7Error, make all error values static

b3d3d2c

feat: keep reference to cms_content_info from cms_signer info, so tha…

540aad6

…t it will not get freed before thing contained in

feat: no need to test result of sk_* function, it will be correct if …

e33ce43

…CMS_get0_SignerInfos function was successful

This adds CMS support to the Ruby layer. #917

Are you sure you want to change the base?

This adds CMS support to the Ruby layer. #917

Conversation

mcr commented Jul 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mcr commented Jul 27, 2025

Uh oh!

rhenium Jul 27, 2025

Choose a reason for hiding this comment

Uh oh!

mcr Jul 28, 2025

Choose a reason for hiding this comment

Uh oh!

rhenium Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rhenium Jul 27, 2025

Choose a reason for hiding this comment

Uh oh!

mcr Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rhenium Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rhenium Jul 27, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rhenium commented Jul 28, 2025

Uh oh!

rhenium commented Jul 28, 2025

Uh oh!

mcr commented Jul 28, 2025

Uh oh!

junaruga commented Jul 28, 2025

Uh oh!

mcr commented Jul 28, 2025 via email

Uh oh!

rhenium commented Jul 31, 2025

Uh oh!

Uh oh!

mcr commented Jul 26, 2025 •

edited

Loading

mcr Jul 28, 2025 •

edited

Loading

rhenium Jul 31, 2025 •

edited

Loading