From: Todd Short Date: Fri, 17 Jul 2026 17:35:56 +0000 (-0400) Subject: CMS/PKCS7: use EVP_CIPHER_fetch() for SMIMECapabilities X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=HEAD;p=thirdparty%2Fopenssl.git CMS/PKCS7: use EVP_CIPHER_fetch() for SMIMECapabilities Fixes #25919 Replace EVP_get_cipherbynid()/EVP_get_digestbynid() with EVP_CIPHER_fetch()/EVP_MD_fetch() when building SMIMECapabilities attributes, so that only algorithms available in the active providers are advertised. This prevents RC2, DES, and GOST from appearing by default when only the default provider is loaded. Add CMS_add_standard_smimecap_ex() as a provider-aware replacement for the newly-deprecated CMS_add_standard_smimecap(). Adds missing documention and new unit-tests validating the new behavior. Signed-off-by: Todd Short Reviewed-by: Dmitry Belyavskiy Reviewed-by: Jakub Zelenka MergeDate: Mon Aug 3 07:06:44 2026 (Merged from https://github.com/openssl/openssl/pull/31990) --- diff --git a/CHANGES.md b/CHANGES.md index 9b1dbcd979e..4e5b0219684 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -31,6 +31,15 @@ OpenSSL Releases ### Changes between 4.0 and 4.1 [xx XXX xxxx] + * Added `CMS_add_standard_smimecap_ex()`, which populates an SMIMECapabilities + list using `EVP_CIPHER_fetch()` and `EVP_MD_fetch()` so that only algorithms + available in the active providers are advertised. `PKCS7_sign_add_signer()` + was updated in the same way, so that legacy ciphers such as RC2 and DES are + no longer included in SMIMECapabilities by default when only the default + provider is loaded. + + *Todd Short* + * Added various optimizations for the Elbrus2000 architecture in the cryptographic and BN code. diff --git a/crypto/cms/cms_sd.c b/crypto/cms/cms_sd.c index e53a5232075..20f60235aa7 100644 --- a/crypto/cms/cms_sd.c +++ b/crypto/cms/cms_sd.c @@ -677,7 +677,8 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, if (!(flags & CMS_NOSMIMECAP)) { STACK_OF(X509_ALGOR) *smcap = NULL; - i = CMS_add_standard_smimecap(&smcap); + i = CMS_add_standard_smimecap_ex(&smcap, ossl_cms_ctx_get0_libctx(ctx), + ossl_cms_ctx_get0_propq(ctx)); if (i) i = CMS_add_smimecap(si, smcap); sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free); @@ -1584,34 +1585,47 @@ int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, } /* Check to see if a cipher exists and if so add S/MIME capabilities */ -static int cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg) +static int cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg, + OSSL_LIB_CTX *libctx, const char *propq) { - if (EVP_get_cipherbynid(nid)) + EVP_CIPHER *cipher = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), propq); + + if (cipher != NULL) { + EVP_CIPHER_free(cipher); return CMS_add_simple_smimecap(sk, nid, arg); + } return 1; } -static int cms_add_digest_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg) +static int cms_add_digest_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg, + OSSL_LIB_CTX *libctx, const char *propq) { - if (EVP_get_digestbynid(nid)) + EVP_MD *md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), propq); + + if (md != NULL) { + EVP_MD_free(md); return CMS_add_simple_smimecap(sk, nid, arg); + } return 1; } -int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap) +int CMS_add_standard_smimecap_ex(STACK_OF(X509_ALGOR) **smcap, + OSSL_LIB_CTX *libctx, const char *propq) { - if (!cms_add_cipher_smcap(smcap, NID_aes_256_cbc, -1) - || !cms_add_digest_smcap(smcap, NID_id_GostR3411_2012_256, -1) - || !cms_add_digest_smcap(smcap, NID_id_GostR3411_2012_512, -1) - || !cms_add_digest_smcap(smcap, NID_id_GostR3411_94, -1) - || !cms_add_cipher_smcap(smcap, NID_id_Gost28147_89, -1) - || !cms_add_cipher_smcap(smcap, NID_aes_192_cbc, -1) - || !cms_add_cipher_smcap(smcap, NID_aes_128_cbc, -1) - || !cms_add_cipher_smcap(smcap, NID_des_ede3_cbc, -1) - || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 128) - || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 64) - || !cms_add_cipher_smcap(smcap, NID_des_cbc, -1) - || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 40)) + if (!cms_add_cipher_smcap(smcap, NID_aes_256_cbc, -1, libctx, propq) + || !cms_add_digest_smcap(smcap, NID_id_GostR3411_2012_256, -1, libctx, propq) + || !cms_add_digest_smcap(smcap, NID_id_GostR3411_2012_512, -1, libctx, propq) + || !cms_add_digest_smcap(smcap, NID_id_GostR3411_94, -1, libctx, propq) + || !cms_add_cipher_smcap(smcap, NID_id_Gost28147_89, -1, libctx, propq) + || !cms_add_cipher_smcap(smcap, NID_aes_192_cbc, -1, libctx, propq) + || !cms_add_cipher_smcap(smcap, NID_aes_128_cbc, -1, libctx, propq) + || !cms_add_cipher_smcap(smcap, NID_des_ede3_cbc, -1, libctx, propq) + || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 128, libctx, propq)) return 0; return 1; } + +int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap) +{ + return CMS_add_standard_smimecap_ex(smcap, NULL, NULL); +} diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c index 7ede4b66942..6bd33245d1c 100644 --- a/crypto/pkcs7/pk7_smime.c +++ b/crypto/pkcs7/pk7_smime.c @@ -97,17 +97,27 @@ err: /* Check to see if a cipher exists and if so add S/MIME capabilities */ -static int add_cipher_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg) +static int add_cipher_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg, + OSSL_LIB_CTX *libctx, const char *propq) { - if (EVP_get_cipherbynid(nid)) + EVP_CIPHER *cipher = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), propq); + + if (cipher != NULL) { + EVP_CIPHER_free(cipher); return PKCS7_simple_smimecap(sk, nid, arg); + } return 1; } -static int add_digest_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg) +static int add_digest_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg, + OSSL_LIB_CTX *libctx, const char *propq) { - if (EVP_get_digestbynid(nid)) + EVP_MD *md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), propq); + + if (md != NULL) { + EVP_MD_free(md); return PKCS7_simple_smimecap(sk, nid, arg); + } return 1; } @@ -117,6 +127,8 @@ PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert, { PKCS7_SIGNER_INFO *si = NULL; STACK_OF(X509_ALGOR) *smcap = NULL; + OSSL_LIB_CTX *libctx; + const char *propq; if (!X509_check_private_key(signcert, pkey)) { ERR_raise(ERR_LIB_PKCS7, @@ -144,18 +156,17 @@ PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert, ERR_raise(ERR_LIB_PKCS7, ERR_R_CRYPTO_LIB); goto err; } - if (!add_cipher_smcap(smcap, NID_aes_256_cbc, -1) - || !add_digest_smcap(smcap, NID_id_GostR3411_2012_256, -1) - || !add_digest_smcap(smcap, NID_id_GostR3411_2012_512, -1) - || !add_digest_smcap(smcap, NID_id_GostR3411_94, -1) - || !add_cipher_smcap(smcap, NID_id_Gost28147_89, -1) - || !add_cipher_smcap(smcap, NID_aes_192_cbc, -1) - || !add_cipher_smcap(smcap, NID_aes_128_cbc, -1) - || !add_cipher_smcap(smcap, NID_des_ede3_cbc, -1) - || !add_cipher_smcap(smcap, NID_rc2_cbc, 128) - || !add_cipher_smcap(smcap, NID_rc2_cbc, 64) - || !add_cipher_smcap(smcap, NID_des_cbc, -1) - || !add_cipher_smcap(smcap, NID_rc2_cbc, 40) + libctx = ossl_pkcs7_ctx_get0_libctx(si->ctx); + propq = ossl_pkcs7_ctx_get0_propq(si->ctx); + if (!add_cipher_smcap(smcap, NID_aes_256_cbc, -1, libctx, propq) + || !add_digest_smcap(smcap, NID_id_GostR3411_2012_256, -1, libctx, propq) + || !add_digest_smcap(smcap, NID_id_GostR3411_2012_512, -1, libctx, propq) + || !add_digest_smcap(smcap, NID_id_GostR3411_94, -1, libctx, propq) + || !add_cipher_smcap(smcap, NID_id_Gost28147_89, -1, libctx, propq) + || !add_cipher_smcap(smcap, NID_aes_192_cbc, -1, libctx, propq) + || !add_cipher_smcap(smcap, NID_aes_128_cbc, -1, libctx, propq) + || !add_cipher_smcap(smcap, NID_des_ede3_cbc, -1, libctx, propq) + || !add_cipher_smcap(smcap, NID_rc2_cbc, 128, libctx, propq) || !PKCS7_add_attrib_smimecap(si, smcap)) goto err; sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free); diff --git a/doc/build.info b/doc/build.info index c36ff802c78..1ed8458bc69 100644 --- a/doc/build.info +++ b/doc/build.info @@ -827,6 +827,10 @@ DEPEND[html/man3/CMS_add1_signer.html]=man3/CMS_add1_signer.pod GENERATE[html/man3/CMS_add1_signer.html]=man3/CMS_add1_signer.pod DEPEND[man/man3/CMS_add1_signer.3]=man3/CMS_add1_signer.pod GENERATE[man/man3/CMS_add1_signer.3]=man3/CMS_add1_signer.pod +DEPEND[html/man3/CMS_add_standard_smimecap_ex.html]=man3/CMS_add_standard_smimecap_ex.pod +GENERATE[html/man3/CMS_add_standard_smimecap_ex.html]=man3/CMS_add_standard_smimecap_ex.pod +DEPEND[man/man3/CMS_add_standard_smimecap_ex.3]=man3/CMS_add_standard_smimecap_ex.pod +GENERATE[man/man3/CMS_add_standard_smimecap_ex.3]=man3/CMS_add_standard_smimecap_ex.pod DEPEND[html/man3/CMS_compress.html]=man3/CMS_compress.pod GENERATE[html/man3/CMS_compress.html]=man3/CMS_compress.pod DEPEND[man/man3/CMS_compress.3]=man3/CMS_compress.pod @@ -3266,6 +3270,7 @@ html/man3/CMS_EnvelopedData_create.html \ html/man3/CMS_add0_cert.html \ html/man3/CMS_add1_recipient_cert.html \ html/man3/CMS_add1_signer.html \ +html/man3/CMS_add_standard_smimecap_ex.html \ html/man3/CMS_compress.html \ html/man3/CMS_data_create.html \ html/man3/CMS_decrypt.html \ @@ -3943,6 +3948,7 @@ man/man3/CMS_EnvelopedData_create.3 \ man/man3/CMS_add0_cert.3 \ man/man3/CMS_add1_recipient_cert.3 \ man/man3/CMS_add1_signer.3 \ +man/man3/CMS_add_standard_smimecap_ex.3 \ man/man3/CMS_compress.3 \ man/man3/CMS_data_create.3 \ man/man3/CMS_decrypt.3 \ diff --git a/doc/man3/CMS_add1_signer.pod b/doc/man3/CMS_add1_signer.pod index 58b8bcc51d7..a24abce583a 100644 --- a/doc/man3/CMS_add1_signer.pod +++ b/doc/man3/CMS_add1_signer.pod @@ -76,10 +76,10 @@ and serial number. If B is set it will use the subject key identifier value instead. An error occurs if the signing certificate does not have a subject key identifier extension. -If present the SMIMECapabilities attribute indicates support for the following -algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 -bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. -If any of these algorithms is not available then it will not be included. +If present, the SMIMECapabilities attribute indicates support for only the +algorithms that are available in the providers associated with the +B structure. See L for the +full candidate list and further details. Note that, in the case signedAttributes are not used, for some hash-less signing schemes the given hash B will be ignored and a hash required by the signing @@ -109,7 +109,7 @@ L, =head1 COPYRIGHT -Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2014-2026 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/CMS_add_standard_smimecap_ex.pod b/doc/man3/CMS_add_standard_smimecap_ex.pod new file mode 100644 index 00000000000..226d81635d2 --- /dev/null +++ b/doc/man3/CMS_add_standard_smimecap_ex.pod @@ -0,0 +1,85 @@ +=pod + +=head1 NAME + +CMS_add_standard_smimecap_ex, CMS_add_standard_smimecap, +CMS_add_smimecap, CMS_add_simple_smimecap +- CMS SMIMECapabilities attribute utilities + +=head1 SYNOPSIS + + #include + + int CMS_add_standard_smimecap_ex(STACK_OF(X509_ALGOR) **smcap, + OSSL_LIB_CTX *libctx, const char *propq); + int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap); + + int CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs); + int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, + int algnid, int keysize); + +=head1 DESCRIPTION + +CMS_add_standard_smimecap_ex() populates B<*smcap> with the set of +algorithms that should be advertised in an SMIMECapabilities signed +attribute. Only algorithms that are available in the providers +associated with B and the property query string B are +included, so the list accurately reflects what the caller can actually +use. If B is NULL the default library context is used. If +B<*smcap> is NULL a new B is allocated; otherwise +entries are appended to the existing stack. + +The candidate algorithms, listed in preference order, are: AES-256-CBC, +GOST R 34.11-2012 (256-bit), GOST R 34.11-2012 (512-bit), GOST R +34.11-94, GOST 28147-89, AES-192-CBC, AES-128-CBC, DES-EDE3-CBC, +RC2-CBC (128-bit key), RC2-CBC (64-bit key), DES-CBC, and RC2-CBC +(40-bit key). Algorithms not available in the active providers +(for example, RC2 and DES when only the default provider is loaded) +are silently omitted. + +CMS_add_standard_smimecap() is a wrapper that calls +CMS_add_standard_smimecap_ex() with a NULL library context and NULL +property query string. + +CMS_add_smimecap() adds a pre-built stack of algorithm identifiers +B as the SMIMECapabilities signed attribute on the +B B. + +CMS_add_simple_smimecap() appends a single algorithm entry to B<*algs>. +B is the NID of the algorithm and B is the key size in +bits, or -1 if the algorithm does not use a variable key size. + +=head1 NOTES + +Applications that need accurate capability advertisements should use +CMS_add_standard_smimecap_ex(), passing the same B and B +used for the rest of the CMS operation. This ensures that only +algorithms genuinely available to the application are listed. + +CMS_add1_signer() calls CMS_add_standard_smimecap_ex() internally using +the library context associated with the CMS_ContentInfo structure, so +applications that use CMS_add1_signer() without B do not +need to call these functions directly. + +=head1 RETURN VALUES + +All functions return 1 for success or 0 for failure. + +=head1 SEE ALSO + +L, L, L + +=head1 HISTORY + +CMS_add_standard_smimecap_ex() was added in OpenSSL 4.1. + +=head1 COPYRIGHT + +Copyright 2026 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/include/openssl/cms.h.in b/include/openssl/cms.h.in index 20af42015c2..1184e126261 100644 --- a/include/openssl/cms.h.in +++ b/include/openssl/cms.h.in @@ -312,6 +312,8 @@ BIO *CMS_SignedData_verify(CMS_SignedData *sd, BIO *detached_data, int CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs); int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, int algnid, int keysize); +int CMS_add_standard_smimecap_ex(STACK_OF(X509_ALGOR) **smcap, + OSSL_LIB_CTX *libctx, const char *propq); int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap); int CMS_signed_get_attr_count(const CMS_SignerInfo *si); diff --git a/test/cmsapitest.c b/test/cmsapitest.c index 977095b3f80..d1851b41212 100644 --- a/test/cmsapitest.c +++ b/test/cmsapitest.c @@ -277,6 +277,44 @@ static int test_encrypt_decrypt_aes_256_gcm(void) return test_encrypt_decrypt(EVP_aes_256_gcm()); } +static int smimecap_has_nid(STACK_OF(X509_ALGOR) *smcap, int nid) +{ + int i; + + for (i = 0; i < sk_X509_ALGOR_num(smcap); i++) { + X509_ALGOR *alg = sk_X509_ALGOR_value(smcap, i); + if (OBJ_obj2nid(alg->algorithm) == nid) + return 1; + } + return 0; +} + +static int test_CMS_add_standard_smimecap_ex(void) +{ + STACK_OF(X509_ALGOR) *smcap = NULL; + int ret = 0; + + if (!TEST_true(CMS_add_standard_smimecap_ex(&smcap, NULL, NULL))) + goto end; + + /* AES ciphers must be present with the default provider */ + if (!TEST_true(smimecap_has_nid(smcap, NID_aes_256_cbc)) + || !TEST_true(smimecap_has_nid(smcap, NID_aes_192_cbc)) + || !TEST_true(smimecap_has_nid(smcap, NID_aes_128_cbc))) + goto end; + + /* RC2, DES, and GOST must NOT be present with just the default provider */ + if (!TEST_false(smimecap_has_nid(smcap, NID_rc2_cbc)) + || !TEST_false(smimecap_has_nid(smcap, NID_des_cbc)) + || !TEST_false(smimecap_has_nid(smcap, NID_id_Gost28147_89))) + goto end; + + ret = 1; +end: + sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free); + return ret; +} + static int test_CMS_add1_cert(void) { CMS_ContentInfo *cms = NULL; @@ -831,6 +869,7 @@ int setup_tests(void) ADD_TEST(test_non_aead_on_auth_envelope_enc); ADD_TEST(test_non_aead_on_auth_envelope_dec); ADD_TEST(test_short_mac_on_auth_envelope_data); + ADD_TEST(test_CMS_add_standard_smimecap_ex); ADD_TEST(test_CMS_add1_cert); ADD_TEST(test_d2i_CMS_bio_NULL); ADD_TEST(test_CMS_set1_key_mem_leak); diff --git a/test/pkcs7_test.c b/test/pkcs7_test.c index 2fe7064c01a..b48cbd847a9 100644 --- a/test/pkcs7_test.c +++ b/test/pkcs7_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -8,6 +8,7 @@ */ #include +#include #include #include #include @@ -15,6 +16,57 @@ #include "internal/nelem.h" #include "testutil.h" +static X509 *smimecap_cert = NULL; +static EVP_PKEY *smimecap_privkey = NULL; + +static int smimecap_has_nid(STACK_OF(X509_ALGOR) *smcap, int nid) +{ + int i; + + for (i = 0; i < sk_X509_ALGOR_num(smcap); i++) { + X509_ALGOR *alg = sk_X509_ALGOR_value(smcap, i); + if (OBJ_obj2nid(alg->algorithm) == nid) + return 1; + } + return 0; +} + +static int test_pkcs7_smimecap(void) +{ + PKCS7 *p7 = NULL; + PKCS7_SIGNER_INFO *si = NULL; + STACK_OF(X509_ALGOR) *smcap = NULL; + int ret = 0; + + if (!TEST_ptr(p7 = PKCS7_new()) + || !TEST_true(PKCS7_set_type(p7, NID_pkcs7_signed)) + || !TEST_true(PKCS7_content_new(p7, NID_pkcs7_data)) + || !TEST_ptr(si = PKCS7_sign_add_signer(p7, smimecap_cert, + smimecap_privkey, NULL, 0))) + goto end; + + if (!TEST_ptr(smcap = PKCS7_get_smimecap(si))) + goto end; + + /* AES ciphers must be present with the default provider */ + if (!TEST_true(smimecap_has_nid(smcap, NID_aes_256_cbc)) + || !TEST_true(smimecap_has_nid(smcap, NID_aes_192_cbc)) + || !TEST_true(smimecap_has_nid(smcap, NID_aes_128_cbc))) + goto end; + + /* RC2, DES, and GOST must NOT be present with just the default provider */ + if (!TEST_false(smimecap_has_nid(smcap, NID_rc2_cbc)) + || !TEST_false(smimecap_has_nid(smcap, NID_des_cbc)) + || !TEST_false(smimecap_has_nid(smcap, NID_id_Gost28147_89))) + goto end; + + ret = 1; +end: + sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free); + PKCS7_free(p7); + return ret; +} + static int pkcs7_issuer_and_serial_negative_idx_test(void) { PKCS7 *p7 = NULL; @@ -462,6 +514,27 @@ static int pkcs7_stream_enveloped_signed_no_content_test(void) int setup_tests(void) { + const char *certin, *privkeyin; + BIO *bio = NULL; + + if (!test_skip_common_options()) { + TEST_error("Error parsing test options\n"); + return 0; + } + + certin = test_get_argument(0); + privkeyin = test_get_argument(1); + if (certin != NULL && privkeyin != NULL) { + if (TEST_ptr(bio = BIO_new_file(certin, "r"))) { + PEM_read_bio_X509(bio, &smimecap_cert, NULL, NULL); + BIO_free(bio); + } + if (TEST_ptr(bio = BIO_new_file(privkeyin, "r"))) { + PEM_read_bio_PrivateKey(bio, &smimecap_privkey, NULL, NULL); + BIO_free(bio); + } + } + ADD_TEST(pkcs7_issuer_and_serial_negative_idx_test); #ifndef OPENSSL_NO_EC ADD_TEST(pkcs7_verify_test); @@ -469,5 +542,13 @@ int setup_tests(void) #endif /* OPENSSL_NO_EC */ ADD_TEST(pkcs7_stream_enveloped_no_content_test); ADD_TEST(pkcs7_stream_enveloped_signed_no_content_test); + if (smimecap_cert != NULL && smimecap_privkey != NULL) + ADD_TEST(test_pkcs7_smimecap); return 1; } + +void cleanup_tests(void) +{ + X509_free(smimecap_cert); + EVP_PKEY_free(smimecap_privkey); +} diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t index bd7ed2cc1e8..c3d75e6e297 100644 --- a/test/recipes/80-test_cms.t +++ b/test/recipes/80-test_cms.t @@ -58,7 +58,8 @@ $no_rc2 = 1 if disabled("legacy"); plan tests => 41; -ok(run(test(["pkcs7_test"])), "test pkcs7"); +ok(run(test(["pkcs7_test", srctop_file("test", "certs", "servercert.pem"), + srctop_file("test", "certs", "serverkey.pem")])), "test pkcs7"); unless ($no_fips) { my $provconf = srctop_file("test", "fips-and-base.cnf"); diff --git a/util/libcrypto.num b/util/libcrypto.num index c7b7777cc4d..0acb162dde0 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -5727,3 +5727,4 @@ EVP_KDF_CTX_get1_kdf ? 4_1_0 EXIST::FUNCTION: ASN1_STRING_set_data ? 4_1_0 EXIST::FUNCTION: ASN1_STRING_set_string ? 4_1_0 EXIST::FUNCTION: ASN1_STRING_length_ex ? 4_1_0 EXIST::FUNCTION: +CMS_add_standard_smimecap_ex ? 4_1_0 EXIST::FUNCTION:CMS diff --git a/util/missingcrypto.txt b/util/missingcrypto.txt index 5e8126d12ce..b49861044d7 100644 --- a/util/missingcrypto.txt +++ b/util/missingcrypto.txt @@ -285,9 +285,6 @@ CMS_SignerInfo_get0_pkey_ctx(3) CMS_add0_CertificateChoices(3) CMS_add0_RevocationInfoChoice(3) CMS_add0_recipient_password(3) -CMS_add_simple_smimecap(3) -CMS_add_smimecap(3) -CMS_add_standard_smimecap(3) CMS_data(3) CMS_dataInit(3) CMS_decrypt_set1_key(3)