SignedData is not being produced detached. BIO_new_CMS with CMS_Sign

[RedEye via openssl-users <openssl-users@xxxxxxxxxxx>]

Hello, fellows.

I am implementing a new streamer for CMS SignedData with CMS_sign.
I use BIO_new_CMS.

My program successfuly produces a SignedData structure in the end, but
the actual data is embedded. I have passed (CMS_BINARY | CMS_DETACHED
| CMS_STREAM) as flags to the initial call to CMS_sign but still the
SignedData is not being produced detached.

Am I missing something? Is there another way I can achieve the same thing?

The code that follows is a true fragment from my original program.

Thanks
Have a nice day))

void SignInit(ca::CryptPacket &packet) //use once for initialization
{
	CK_ULONG certCount = NULL;
	std::vector<CK_OBJECT_HANDLE>certHandles;
	std::vector<CK_BYTE> certValue;
	X509* x509Cert = nullptr;
	CK_BYTE* p_CKA_ID;

	try
	{
		Rtk_CertInfo2* p_rtk_certinfo2_object =
m_pCryptoModule->m_CertsCollection.GetCert(packet.request.senderCertId);
		if (!p_rtk_certinfo2_object)
			ca_throw_cert_need_log(packet.request.senderCertId);

		std::vector <CK_BYTE> ckId = p_rtk_certinfo2_object->m_ckId;
		p_CKA_ID = new CK_BYTE[ckId.size()];
		std::copy(ckId.begin(), ckId.end(), p_CKA_ID);

		CK_ATTRIBUTE certificateTemplate[] = CERTIFICATE_TEMPLATE(ckId, p_CKA_ID);

		m_key = GetKeyPair(ckId, m_session, m_pCryptoModule->m_functionList);
		if (!m_key)
		{
			ca_throw_log(RTK_E_FIND_KEY_FAILED);
		}

		if (m_pCryptoModule->m_functionList->C_FindObjectsInit(m_session,
certificateTemplate, arraysize(certificateTemplate)) != CKR_OK)
		{
			ca_throw_log(RTK_E_FIND_OBJECTS_INIT_FAILED);
		}

		certHandles.clear();
		certHandles.resize(10000);

		if (m_pCryptoModule->m_functionList->C_FindObjects(m_session,
certHandles.data(), (CK_ULONG)certHandles.size(), &certCount) != CKR_OK ||
certCount == 0)
		{
			ca_throw_log(RTK_E_FIND_OBJECTS_FAILED);
		}

		if (m_pCryptoModule->m_functionList->C_FindObjectsFinal(m_session) !=
CKR_OK)
		{
			ca_throw_log(RTK_E_FIND_OBJECTS_FINAL_FAILED);
		}

		CK_ATTRIBUTE certValueAttr = { CKA_VALUE, NULL_PTR, 0 };

		if (m_pCryptoModule->m_functionList->C_GetAttributeValue(m_session,
certHandles[0], &certValueAttr, 1) != CKR_OK)
			ca_throw_log(RTK_E_GET_CKA_VALUE_FAILED);

		certValue.resize(certValueAttr.ulValueLen);
		certValueAttr.pValue = certValue.data();

		if (m_pCryptoModule->m_functionList->C_GetAttributeValue(m_session,
certHandles[0], &certValueAttr, 1) != CKR_OK)
			ca_throw_log(RTK_E_GET_CKA_VALUE_FAILED);

		x509Cert = CertToX509(CertToPem(certValue));

		if (!x509Cert)
		{
			ca_throw_log(RTK_E_CERT_TO_X509_FAILED);
		}

		m_cms = CMS_sign(x509Cert, m_key, NULL, NULL, CMS_STREAM | CMS_BINARY |
CMS_DETACHED);
		if (!m_cms)
		{
			ca_throw_log(RTK_E_SIGN_DATA_FAILED);
		}

		m_input = BIO_new_CMS(m_output, m_cms);

		X509_free(x509Cert);
		delete[] p_CKA_ID;
	}
	ca_catch
	{
		if (x509Cert)
			X509_free(x509Cert);

		delete[] p_CKA_ID;

		packet.response.errorCode = ex;
		packet.response.errorMessage = GetErrorMessage(ex);
	}
}

void CStreamSigner::Stream(ca::CryptPacket & packet) //for multiple calls
{
	ca_lock;
	try
	{
		if (!m_cms)
			SignInit(packet); //initialization

		BYTE* pbData = packet.request.GetFileData();
		DWORD cbData = packet.request.GetFileDataSize();

		if (BIO_write(m_input, pbData, cbData) <= 0)
			ca_throw_log(RTK_E_WRITE_TO_OUT_BUF_FAILED);

		if (packet.request.streamFinalChunk)
			BIO_flush(m_input);

		std::vector<uint8_t> cmsBuf = ReadMemBio(m_output);
		if (!cmsBuf.size())
			ca_throw_log(RTK_E_READ_FROM_BUF_FAILED);

		packet.response.SetFileData(cmsBuf.data(), cmsBuf.size());
	}
	ca_catch
	{
		packet.response.errorCode = ex;
		packet.response.errorMessage = GetErrorMessage(ex);
	}
}



--
Sent from: http://openssl.6102.n7.nabble.com/OpenSSL-User-f3.html