M2Crypto.SMIME.PKCS7_Error: no content

Question

verify_data = b'MIIEEwYJKoZIhvcNAQcCoIIEBDCCBAACAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3\nDQEHAaCCAgcwggIDMIIBbAIJAKBFD8eF/nAAMA0GCSqGSIb3DQEBCwUAMEYxCzAJ\nBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRAwDgYDVQQLDAdtaXRzb2dv\nMRAwDgYDVQQDDAdoZXhub2RlMB4XDTIxMDgyMDEzNTExMVoXDTIyMDgyMDEzNTEx\nMVowRjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExEDAOBgNVBAsM\nB21pdHNvZ28xEDAOBgNVBAMMB2hleG5vZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0A\nMIGJAoGBAM/ID0YIWOtgokdkFI+DO0AAtHiN+Q+LIvBI8yD3wn/IpFIBo0erDiU+\n9NQDoeMgzphjVB2hW2iN9X6P9WtcFpk4jPtemUnDys8/d+xkwEFijayQ8slURWrE\nAZFzgdDg2a0b0SGZswuvHieWrTBl4btlMIAKU8ou8GNa4/U5q2jRAgMBAAEwDQYJ\nKoZIhvcNAQELBQADgYEAxzXFTxuk9CZajH77QjzsoYfOFiRLnjaoIohU+EMausw8\nmr5hPyDI5LsupzJmcZqAPQF8g8lSKS3p8xhqNC/FheH6WRZY2xTsn8CJ0/aMI7NF\n/dJ3FBnAXXDKa+/aJs53DbBqzLPNY/doADIOgWjzNwWHWmGLLsqylCkLdTc+Z7cx\nggHUMIIB0AIBATBTMEYxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlh\nMRAwDgYDVQQLDAdtaXRzb2dvMRAwDgYDVQQDDAdoZXhub2RlAgkAoEUPx4X+cAAw\nCQYFKw4DAhoFAKCB2DAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3\nDQEJBTEPFw0yMTA4MjQwODEzNTNaMCMGCSqGSIb3DQEJBDEWBBRiGrGGHTSM6iOJ\nxg0H89PGLgTRKjB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgB\nZQMEARYwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN\nBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0B\nAQEFAASBgLQbhQ0BiI48ng75tDc4sc7lblj9cNwG0sUUbONF07olqgfO3FHt3It6\nhIu6UBoqj4cis3TYEkDglkvr0PCql5XUabvcrERwQvz9Ou987Fp4PvBK3b3gHebK\nKhWAgLyDMCKYf16bDvpAJTtqr/jG6sH7NK0a4wxiLu8yb2ZFnijs'

This is the data I'm gonna deserialise. I'm trying to get the data out of the signed content.

from M2Crypto import SMIME, X509, BIO

s = SMIME.SMIME()
sig = b"""
-----BEGIN PKCS7-----
%s
-----END PKCS7-----
    """ % verify_data

buf = BIO.MemoryBuffer(sig)
p7 = SMIME.load_pkcs7_bio(buf)
sk = X509.X509_Stack()
signers = p7.get0_signers(sk)
signer = signers[0]
sk.push(signer)
s.set_x509_stack(sk)
stor = X509.X509_Store()
stor.add_cert(signer)
s.set_x509_store(stor)
v = s.verify(p7, flags=SMIME.PKCS7_NOVERIFY)

I'm getting this error

M2Crypto.SMIME.PKCS7_Error: no content

Answer 1

There is indeed no content.

$ openssl asn1parse <68904580.p7 -i
    0:d=0  hl=4 l=1043 cons: SEQUENCE
    4:d=1  hl=2 l=   9 prim:  OBJECT            :pkcs7-signedData
   15:d=1  hl=4 l=1028 cons:  cont [ 0 ]
   19:d=2  hl=4 l=1024 cons:   SEQUENCE
   23:d=3  hl=2 l=   1 prim:    INTEGER           :01
   26:d=3  hl=2 l=  11 cons:    SET
   28:d=4  hl=2 l=   9 cons:     SEQUENCE
   30:d=5  hl=2 l=   5 prim:      OBJECT            :sha1
   37:d=5  hl=2 l=   0 prim:      NULL
   39:d=3  hl=2 l=  11 cons:    SEQUENCE
   41:d=4  hl=2 l=   9 prim:     OBJECT            :pkcs7-data
   52:d=3  hl=4 l= 519 cons:    cont [ 0 ]
[snip cert]
  575:d=3  hl=4 l= 468 cons:    SET
  579:d=4  hl=4 l= 464 cons:     SEQUENCE
[snip signerinfo]

As you can see, the ContentInfo at 39 contains only the contentType OID and not the ASN.1-ly OPTIONAL content. This is what PKCS7 called an external signature and nowadays is usually called a detached signature -- that is, one which is transmitted and/or stored separately from the data to which it applies. Since the data is not in the message with the signature, to verify the signature the data must be supplied from somewhere else, and in OpenSSL that is a BIO.

You need to supply a data_BIO that contains/reads the data