---
name: "libressl-BIO_new_CMS"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-BIO_new_CMS"
---

# libressl-BIO\_new\_CMS(3)

CMS streaming filter BIO

## NAME

**BIO\_new\_CMS** – CMS streaming filter BIO

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/cms.h\>**

*BIO* *\**\

**BIO\_new\_CMS**(*BIO \*out*, *CMS\_ContentInfo \*cms*);

## DESCRIPTION

**BIO\_new\_CMS**() returns a streaming filter *BIO* chain based on *cms*. The output of the filter is written to *out*. Any data written to the chain is automatically translated to a BER format CMS structure of the appropriate type.

The chain returned by this function behaves like a standard filter *BIO*. It supports non blocking I/O. Content is processed and streamed on the fly and not all held in memory at once: so it is possible to encode very large structures. After all content has been written through the chain, BIO\_flush(3) must be called to finalise the structure.

The CMS\_STREAM flag must be included in the corresponding *flags* parameter of the *cms* creation function.

If an application wishes to write additional data to *out*, BIOs should be removed from the chain using BIO\_pop(3) and freed with BIO\_free(3) until *out* is reached. If no additional data needs to be written, BIO\_free\_all(3) can be called to free up the whole chain.

Any content written through the filter is used verbatim: no canonical translation is performed.

It is possible to chain multiple BIOs to, for example, create a triple wrapped signed, enveloped, signed structure. In this case it is the application's responsibility to set the inner content type of any outer *CMS\_ContentInfo* structures.

Large numbers of small writes through the chain should be avoided as this will produce an output consisting of lots of OCTET STRING structures. Prepending a BIO\_f\_buffer(3) buffering BIO will prevent this.

## RETURN VALUES

**BIO\_new\_CMS**() returns a *BIO* chain when successful or NULL if an error occurred. The error can be obtained from ERR\_get\_error(3).

## SEE ALSO

BIO\_new(3), CMS\_ContentInfo\_new(3), CMS\_encrypt(3), CMS\_sign(3)

## HISTORY

**BIO\_new\_CMS**() first appeared in OpenSSL 1.0.0 and has been available since OpenBSD 6.7.

## BUGS

There is currently no corresponding inverse BIO which can decode a CMS structure on the fly.