BIO_NEW_CMS(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 BIO_new_CMS — the CMS streaming filter BIO 💖

okay bestie, this is BIO_new_CMS(3ossl) from the OpenSSL manual, and it's genuinely one of the slay-est little streaming functions in the whole crypto lib. sit with me, we're gonna get you fluent 💅

✨ NAME ✨

BIO_new_CMS — CMS streaming filter BIO 🎀

🌸 SYNOPSIS 🌸

#include <openssl/cms.h>

BIO *BIO_new_CMS(BIO *out, CMS_ContentInfo *cms);

🦋 DESCRIPTION 🦋

So BIO_new_CMS() hands you back a streaming filter BIO chain built on top of cms. Everything the filter spits out gets written to out. And the cute part? Anything you write into that chain gets automatically translated into a BER format CMS structure of the appropriate type. automatic. no manual labour. we love a self-sufficient queen 👑

🌈 NOTES 🌈

  • The chain this function returns behaves like a standard filter BIO. it's not doing anything weird, it's just a filter, periodt.
  • It supports non blocking I/O. yes bestie, async girlies, this one's for you.
  • Content is processed and streamed on the fly and is not all held in memory at once — which means you can encode very large structures. she's scalable, she's efficient, she's that girl 💅
  • Once all the content has been written through the chain, you must call BIO_flush() to finalise the structure. do not skip this. do not be casual about this. the structure is not done until you flush. 😤
  • The CMS_STREAM flag must be included in the corresponding flags parameter of the cms creation function. no flag, no stream, no vibe check passed. 🚩
  • If your application wants to write additional data to out, BIOs should be removed from the chain using BIO_pop() and freed with BIO_free() — keep doing that until you reach out. If you don't need to write any additional data, you can just call BIO_free_all() to free up the whole chain. tidy. organised. iconic. 🧚
  • Any content written through the filter is used verbatim: no canonical translation is performed. what you put in is what comes out, exactly as-is, no notes.
  • You can chain multiple BIOs together to make, for example, a triple wrapped signed, enveloped, signed structure. nested like russian dolls, obsessed. BUT — in that case it is the application's responsibility to set the inner content type of any outer CMS_ContentInfo structures. that's on you, bestie, not on OpenSSL. 🫶
  • Avoid large numbers of small writes through the chain. why? because it'll produce an output consisting of lots of OCTET STRING structures. so messy. so chaotic. not the aesthetic. the fix: prepend a BIO_f_buffer() buffering BIO and it prevents this. buffer first, slay always ✨

💀 BUGS 💀

There is currently no corresponding inverse BIO — like, nothing that can decode a CMS structure on the fly. so we can encode streaming-ly but we can't decode streaming-ly. one direction only. it's giving one-way street 😭

👑 RETURN VALUES 👑

BIO_new_CMS() returns a BIO chain when successful, or NULL if an error occurred. and if it errors? you can grab the deets with ERR_get_error(3). she tells you what went wrong, you just gotta ask. 💖

🌟 SEE ALSO 🌟

🎀 HISTORY 🎀

The BIO_new_CMS() function was added in OpenSSL 1.0.0. an elder icon fr fr. been serving since way back. 🫡

Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, you ate it 💅✨ this was OpenSSL 3.5.9, dated 2026-09-29, and it's the BIO_NEW_CMS(3ossl) man page. go stream something huge, flush it, and free the chain. mwah 🎀💖

📦 where this page comes from