CMS: add verify method

openssl-sys/src/cms.rs

@@ -88,4 +88,14 @@ extern "C" {
         out: *mut ::BIO,
         flags: c_uint,
     ) -> c_int;
+
+    #[cfg(ossl101)]
+    pub fn CMS_verify(
+        cms: *mut ::CMS_ContentInfo,
+        certs: *mut ::stack_st_X509,
+        store: *mut ::X509_STORE,
+        indata: *mut ::BIO,
+        out: *mut ::BIO,
+        flags: c_uint,
+    ) -> c_int;
 }

openssl/src/cms.rs

@@ -15,8 +15,9 @@ use libc::c_uint;
 use pkey::{HasPrivate, PKeyRef};
 use stack::StackRef;
 use x509::{X509Ref, X509};
+use x509::store::X509Store;
 use symm::Cipher;
-use {cvt, cvt_p};
+use {cvt, cvt_n, cvt_p};
 
 bitflags! {
     pub struct CMSOptions : c_uint {
@@ -96,6 +97,43 @@ impl CmsContentInfoRef {
         }
     }
 
+    /// Verify the sender's signature given an optional sender's certificate `cert` and CA store
+    /// `store`. If the signature is correct, signed data are returned, otherwise `None`.
+    ///
+    /// OpenSSL documentation at [`CMS_verify`]
+    /// 
+    /// [`CMS_verify`]: https://www.openssl.org/docs/manmaster/man3/CMS_verify.html
+    pub fn verify(
+        &self,
+        certs: Option<&StackRef<X509>>,
+        store: &X509Store,
+        flags: CMSOptions,
+    ) -> Result<Option<Vec<u8>>, ErrorStack> {
+        unsafe {
+            let certs = match certs {
+                Some(certs) => certs.as_ptr(),
+                None => ptr::null_mut(),
+            };
+            let store =store.as_ptr();
+            let out = MemBio::new()?;
+
+            let is_valid = cvt_n(ffi::CMS_verify(
+                self.as_ptr(),
+                certs,
+                store,
+                ptr::null_mut(),
+                out.as_ptr(),
+                flags.bits(),
+            ))? == 1;
+
+            if is_valid {
+                Ok(Some(out.get_buf().to_owned()))
+            } else {
+                Ok(None)
+            }
+        }
+    }
+
     to_der! {
     /// Serializes this CmsContentInfo using DER.
     ///
@@ -207,6 +245,7 @@ mod test {
     use super::*;
     use stack::Stack;
     use x509::X509;
+    use x509::store::X509StoreBuilder;
     use pkcs12::Pkcs12;
 
     #[test]
@@ -236,4 +275,34 @@ mod test {
 
         assert_eq!(input, decrypt);
     }
+
+    #[test]
+    fn cms_sign_verify() {
+        // load cert with private key
+        let priv_cert_bytes = include_bytes!("../test/cms.p12");
+        let priv_cert = Pkcs12::from_der(priv_cert_bytes).expect("failed to load priv cert");
+        let priv_cert = priv_cert.parse("mypass").expect("failed to parse priv cert");
+
+        // sign cms message using private key cert
+        let input = String::from("My Message");
+        let sign = CmsContentInfo::sign(Some(&priv_cert.cert), Some(&priv_cert.pkey), None, Some(&input.as_bytes()), CMSOptions::empty())
+            .expect("failed create signed cms");
+        let sign = sign.to_der().expect("failed to create der from cms");
+
+        // verify signature on cms message
+        let verify = CmsContentInfo::from_der(&sign).expect("failed read cms from der");
+
+        let mut cert_stack = Stack::new().expect("failed to create stack");
+        cert_stack.push(priv_cert.cert.clone()).expect("failed to add cert to stack");
+
+        let mut store_builder = X509StoreBuilder::new().expect("failed to create store builder");
+        store_builder.add_cert(priv_cert.cert.clone()).expect("failed to add certificate to store");
+        let store = store_builder.build();
+
+        let verify = verify.verify(Some(&cert_stack), &store, CMSOptions::empty()).expect("failed to verify cms");
+        let verify = verify.expect("cms verification returned None");
+        let verify = String::from_utf8(verify).expect("failed to create string from cms content");
+
+        assert_eq!(input, verify);
+    }
 }