GCOV - Varnish Cache


/*-
 * Copyright 2005 Colin Percival
 * All rights reserved.
 *
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * From:
 * $FreeBSD: sys/crypto/sha2/sha256c.c 300966 2016-05-29 17:26:40Z cperciva $
 */

#include "config.h"

#ifndef __APPLE__
#  include <endian.h>
#  ifdef _BYTE_ORDER
#    define VBYTE_ORDER _BYTE_ORDER
#  else
#    define VBYTE_ORDER __BYTE_ORDER
#  endif
#  ifdef _BIG_ENDIAN
#    define VBIG_ENDIAN _BIG_ENDIAN
#  else
#    define VBIG_ENDIAN __BIG_ENDIAN
#  endif
#else
#  define VBYTE_ORDER   __DARWIN_BYTE_ORDER
#  define VBIG_ENDIAN   __DARWIN_BIG_ENDIAN
#endif

#ifndef VBYTE_ORDER
# error VBYTE_ORDER not defined
#endif
#ifndef VBIG_ENDIAN
# error VBIG_ENDIAN not defined
#endif


#include <sys/types.h>
#include <stdint.h>
#include <string.h>

#include "vdef.h"

#include "vas.h"
#include "vend.h"
#include "vsha256.h"

#if VBYTE_ORDER == VBIG_ENDIAN

/* Copy a vector of big-endian uint32_t into a vector of bytes */
#define be32enc_vect(dst, src, len)     \
        memcpy((void *)dst, (const void *)src, (size_t)len)

/* Copy a vector of bytes into a vector of big-endian uint32_t */
#define be32dec_vect(dst, src, len)     \
        memcpy((void *)dst, (const void *)src, (size_t)len)

#else /* BYTE_ORDER != BIG_ENDIAN or in doubt... */

/*
 * Encode a length len/4 vector of (uint32_t) into a length len vector of
 * (unsigned char) in big-endian form.  Assumes len is a multiple of 4.
 */
static void
be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
{
        size_t i;

        for (i = 0; i < len / 4; i++)
                vbe32enc(dst + i * 4, src[i]);
}

/*
 * Decode a big-endian length len vector of (unsigned char) into a length
 * len/4 vector of (uint32_t).  Assumes len is a multiple of 4.
 */
static void
be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
{
        size_t i;

        for (i = 0; i < len / 4; i++)
                dst[i] = vbe32dec(src + i * 4);
}

#endif /* BYTE_ORDER != BIG_ENDIAN */

/* SHA256 round constants. */
static const uint32_t K[64] = {
        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
        0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
        0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
        0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
        0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
        0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
        0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
        0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
        0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
};

/* Elementary functions used by SHA256 */
#define Ch(x, y, z)     ((x & (y ^ z)) ^ z)
#define Maj(x, y, z)    ((x & (y | z)) | (y & z))
#define SHR(x, n)       (x >> n)
#define ROTR(x, n)      ((x >> n) | (x << (32 - n)))
#define S0(x)           (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
#define S1(x)           (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
#define s0(x)           (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
#define s1(x)           (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))

/* SHA256 round function */
#define RND(a, b, c, d, e, f, g, h, k)                          \
        do {                                                    \
                h += S1(e) + Ch(e, f, g) + (k);                 \
                d += h;                                         \
                h += S0(a) + Maj(a, b, c);                      \
        } while (0)

/* Adjusted round function for rotating state */
#define RNDr(S, W, i, ii)                       \
        RND(S[(64 - i) % 8], S[(65 - i) % 8],   \
            S[(66 - i) % 8], S[(67 - i) % 8],   \
            S[(68 - i) % 8], S[(69 - i) % 8],   \
            S[(70 - i) % 8], S[(71 - i) % 8],   \
            W[i + ii] + K[i + ii])

/* Message schedule computation */
#define MSCH(W, ii, i)                                          \
        do {                                                    \
                W[i + ii + 16] =                                \
                    s1(W[i + ii + 14]) + W[i + ii + 9] +        \
                    s0(W[i + ii + 1]) + W[i + ii];              \
        } while (0)

/*
 * SHA256 block compression function.  The 256-bit state is transformed via
 * the 512-bit input block to produce a new state.
 */
static void
VSHA256_Transform(uint32_t * state, const unsigned char block[64])
{
        uint32_t W[64];
        uint32_t S[8];
        int i;

        /* 1. Prepare the first part of the message schedule W. */
        be32dec_vect(W, block, 64);

        /* 2. Initialize working variables. */
        memcpy(S, state, 32);

        /* 3. Mix. */
        for (i = 0; i < 64; i += 16) {
                RNDr(S, W, 0, i);
                RNDr(S, W, 1, i);
                RNDr(S, W, 2, i);
                RNDr(S, W, 3, i);
                RNDr(S, W, 4, i);
                RNDr(S, W, 5, i);
                RNDr(S, W, 6, i);
                RNDr(S, W, 7, i);
                RNDr(S, W, 8, i);
                RNDr(S, W, 9, i);
                RNDr(S, W, 10, i);
                RNDr(S, W, 11, i);
                RNDr(S, W, 12, i);
                RNDr(S, W, 13, i);
                RNDr(S, W, 14, i);
                RNDr(S, W, 15, i);

                if (i == 48)
                        break;
                MSCH(W, 0, i);
                MSCH(W, 1, i);
                MSCH(W, 2, i);
                MSCH(W, 3, i);
                MSCH(W, 4, i);
                MSCH(W, 5, i);
                MSCH(W, 6, i);
                MSCH(W, 7, i);
                MSCH(W, 8, i);
                MSCH(W, 9, i);
                MSCH(W, 10, i);
                MSCH(W, 11, i);
                MSCH(W, 12, i);
                MSCH(W, 13, i);
                MSCH(W, 14, i);
                MSCH(W, 15, i);
        }

        /* 4. Mix local working variables into global state */
        for (i = 0; i < 8; i++)
                state[i] += S[i];
}

static const unsigned char PAD[64] = {
        0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* Add padding and terminating bit-count. */
static void
VSHA256_Pad(VSHA256_CTX * ctx)
{
        size_t r;

        /* Figure out how many bytes we have buffered. */
        r = (ctx->count >> 3) & 0x3f;

        /* Pad to 56 mod 64, transforming if we finish a block en route. */
        if (r < 56) {
                /* Pad to 56 mod 64. */
                memcpy(&ctx->buf[r], PAD, 56 - r);
        } else {
                /* Finish the current block and mix. */
                memcpy(&ctx->buf[r], PAD, 64 - r);
                VSHA256_Transform(ctx->state, ctx->buf);

                /* The start of the final block is all zeroes. */
                memset(&ctx->buf[0], 0, 56);
        }

        /* Add the terminating bit-count. */
        vbe64enc(&ctx->buf[56], ctx->count);

        /* Mix in the final block. */
        VSHA256_Transform(ctx->state, ctx->buf);
}

/* SHA-256 initialization.  Begins a SHA-256 operation. */
void
VSHA256_Init(VSHA256_CTX * ctx)
{

        /* Zero bits processed so far */
        ctx->count = 0;

        /* Magic initialization constants */
        ctx->state[0] = 0x6A09E667;
        ctx->state[1] = 0xBB67AE85;
        ctx->state[2] = 0x3C6EF372;
        ctx->state[3] = 0xA54FF53A;
        ctx->state[4] = 0x510E527F;
        ctx->state[5] = 0x9B05688C;
        ctx->state[6] = 0x1F83D9AB;
        ctx->state[7] = 0x5BE0CD19;
}

/* Add bytes into the hash */
void
VSHA256_Update(VSHA256_CTX * ctx, const void *in, size_t len)
{
        uint64_t bitlen;
        uint32_t r;
        const unsigned char *src = in;

        /* Number of bytes left in the buffer from previous updates */
        r = (ctx->count >> 3) & 0x3f;

        /* Convert the length into a number of bits */
        bitlen = len << 3;

        /* Update number of bits */
        ctx->count += bitlen;

        /* Handle the case where we don't need to perform any transforms */
        if (len < 64 - r) {
                memcpy(&ctx->buf[r], src, len);
                return;
        }

        /* Finish the current block */
        memcpy(&ctx->buf[r], src, 64 - r);
        VSHA256_Transform(ctx->state, ctx->buf);
        src += 64 - r;
        len -= 64 - r;

        /* Perform complete blocks */
        while (len >= 64) {
                VSHA256_Transform(ctx->state, src);
                src += 64;
                len -= 64;
        }

        /* Copy left over data into buffer */
        memcpy(ctx->buf, src, len);
}

/*
 * SHA-256 finalization.  Pads the input data, exports the hash value,
 * and clears the context state.
 */
void
VSHA256_Final(unsigned char digest[static VSHA256_DIGEST_LENGTH],
    VSHA256_CTX *ctx)
{

        /* Add padding */
        VSHA256_Pad(ctx);

        /* Write the hash */
        be32enc_vect(digest, ctx->state, VSHA256_DIGEST_LENGTH);

        /* Clear the context state */
        memset((void *)ctx, 0, sizeof(*ctx));
}

/*
 * A few test-vectors, just in case
 */

static const struct sha256test {
        const char              *input;
        const unsigned char     output[32];
} sha256test[] = {
    { "",
        {0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4,
         0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b,
         0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55} },
    { "message digest",
        {0xf7, 0x84, 0x6f, 0x55, 0xcf, 0x23, 0xe1, 0x4e, 0xeb, 0xea, 0xb5,
         0xb4, 0xe1, 0x55, 0x0c, 0xad, 0x5b, 0x50, 0x9e, 0x33, 0x48, 0xfb,
         0xc4, 0xef, 0xa3, 0xa1, 0x41, 0x3d, 0x39, 0x3c, 0xb6, 0x50} },
    { "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
        {0xdb, 0x4b, 0xfc, 0xbd, 0x4d, 0xa0, 0xcd, 0x85, 0xa6, 0x0c, 0x3c,
         0x37, 0xd3, 0xfb, 0xd8, 0x80, 0x5c, 0x77, 0xf1, 0x5f, 0xc6, 0xb1,
         0xfd, 0xfe, 0x61, 0x4e, 0xe0, 0xa7, 0xc8, 0xfd, 0xb4, 0xc0} },
    { NULL }
};


void
VSHA256_Test(void)
{
        struct VSHA256Context c;
        const struct sha256test *p;
        unsigned char o[32];

        for (p = sha256test; p->input != NULL; p++) {
                VSHA256_Init(&c);
                VSHA256_Update(&c, p->input, strlen(p->input));
                VSHA256_Final(o, &c);
                AZ(memcmp(o, p->output, 32));
        }
}

		varnish-cache/lib/libvarnish/vsha256.c
0		/*-
1		* Copyright 2005 Colin Percival
2		* All rights reserved.
3		*
4		* SPDX-License-Identifier: BSD-2-Clause
5		*
6		* Redistribution and use in source and binary forms, with or without
7		* modification, are permitted provided that the following conditions
8		* are met:
9		* 1. Redistributions of source code must retain the above copyright
10		* notice, this list of conditions and the following disclaimer.
11		* 2. Redistributions in binary form must reproduce the above copyright
12		* notice, this list of conditions and the following disclaimer in the
13		* documentation and/or other materials provided with the distribution.
14		*
15		* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16		* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18		* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19		* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20		* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21		* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23		* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24		* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25		* SUCH DAMAGE.
26		*
27		* From:
28		* $FreeBSD: sys/crypto/sha2/sha256c.c 300966 2016-05-29 17:26:40Z cperciva $
29		*/
30
31		#include "config.h"
32
33		#ifndef __APPLE__
34		# include <endian.h>
35		# ifdef _BYTE_ORDER
36		# define VBYTE_ORDER _BYTE_ORDER
37		# else
38		# define VBYTE_ORDER __BYTE_ORDER
39		# endif
40		# ifdef _BIG_ENDIAN
41		# define VBIG_ENDIAN _BIG_ENDIAN
42		# else
43		# define VBIG_ENDIAN __BIG_ENDIAN
44		# endif
45		#else
46		# define VBYTE_ORDER __DARWIN_BYTE_ORDER
47		# define VBIG_ENDIAN __DARWIN_BIG_ENDIAN
48		#endif
49
50		#ifndef VBYTE_ORDER
51		# error VBYTE_ORDER not defined
52		#endif
53		#ifndef VBIG_ENDIAN
54		# error VBIG_ENDIAN not defined
55		#endif
56
57
58		#include <sys/types.h>
59		#include <stdint.h>
60		#include <string.h>
61
62		#include "vdef.h"
63
64		#include "vas.h"
65		#include "vend.h"
66		#include "vsha256.h"
67
68		#if VBYTE_ORDER == VBIG_ENDIAN
69
70		/* Copy a vector of big-endian uint32_t into a vector of bytes */
71		#define be32enc_vect(dst, src, len) \
72		memcpy((void )dst, (const void )src, (size_t)len)
73
74		/* Copy a vector of bytes into a vector of big-endian uint32_t */
75		#define be32dec_vect(dst, src, len) \
76		memcpy((void )dst, (const void )src, (size_t)len)
77
78		#else /* BYTE_ORDER != BIG_ENDIAN or in doubt... */
79
80		/*
81		* Encode a length len/4 vector of (uint32_t) into a length len vector of
82		* (unsigned char) in big-endian form. Assumes len is a multiple of 4.
83		*/
84		static void
85	540497	be32enc_vect(unsigned char dst, const uint32_t src, size_t len)
86		{
87		size_t i;
88
89	4864172	for (i = 0; i < len / 4; i++)
90	4323675	vbe32enc(dst + i * 4, src[i]);
91	540497	}
92
93		/*
94		* Decode a big-endian length len vector of (unsigned char) into a length
95		* len/4 vector of (uint32_t). Assumes len is a multiple of 4.
96		*/
97		static void
98	1030560	be32dec_vect(uint32_t dst, const unsigned char src, size_t len)
99		{
100		size_t i;
101
102	17518766	for (i = 0; i < len / 4; i++)
103	16488206	dst[i] = vbe32dec(src + i * 4);
104	1030560	}
105
106		#endif /* BYTE_ORDER != BIG_ENDIAN */
107
108		/* SHA256 round constants. */
109		static const uint32_t K[64] = {
110		0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
111		0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
112		0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
113		0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
114		0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
115		0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
116		0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
117		0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
118		0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
119		0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
120		0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
121		0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
122		0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
123		0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
124		0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
125		0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
126		};
127
128		/* Elementary functions used by SHA256 */
129		#define Ch(x, y, z) ((x & (y ^ z)) ^ z)
130		#define Maj(x, y, z) ((x & (y \| z)) \| (y & z))
131		#define SHR(x, n) (x >> n)
132		#define ROTR(x, n) ((x >> n) \| (x << (32 - n)))
133		#define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
134		#define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
135		#define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
136		#define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
137
138		/* SHA256 round function */
139		#define RND(a, b, c, d, e, f, g, h, k) \
140		do { \
141		h += S1(e) + Ch(e, f, g) + (k); \
142		d += h; \
143		h += S0(a) + Maj(a, b, c); \
144		} while (0)
145
146		/* Adjusted round function for rotating state */
147		#define RNDr(S, W, i, ii) \
148		RND(S[(64 - i) % 8], S[(65 - i) % 8], \
149		S[(66 - i) % 8], S[(67 - i) % 8], \
150		S[(68 - i) % 8], S[(69 - i) % 8], \
151		S[(70 - i) % 8], S[(71 - i) % 8], \
152		W[i + ii] + K[i + ii])
153
154		/* Message schedule computation */
155		#define MSCH(W, ii, i) \
156		do { \
157		W[i + ii + 16] = \
158		s1(W[i + ii + 14]) + W[i + ii + 9] + \
159		s0(W[i + ii + 1]) + W[i + ii]; \
160		} while (0)
161
162		/*
163		* SHA256 block compression function. The 256-bit state is transformed via
164		* the 512-bit input block to produce a new state.
165		*/
166		static void
167	1030588	VSHA256_Transform(uint32_t * state, const unsigned char block[64])
168		{
169		uint32_t W[64];
170		uint32_t S[8];
171		int i;
172
173		/* 1. Prepare the first part of the message schedule W. */
174	1030588	be32dec_vect(W, block, 64);
175
176		/* 2. Initialize working variables. */
177	1030588	memcpy(S, state, 32);
178
179		/* 3. Mix. */
180	4122202	for (i = 0; i < 64; i += 16) {
181	4122198	RNDr(S, W, 0, i);
182	4122198	RNDr(S, W, 1, i);
183	4122198	RNDr(S, W, 2, i);
184	4122198	RNDr(S, W, 3, i);
185	4122198	RNDr(S, W, 4, i);
186	4122198	RNDr(S, W, 5, i);
187	4122198	RNDr(S, W, 6, i);
188	4122198	RNDr(S, W, 7, i);
189	4122198	RNDr(S, W, 8, i);
190	4122198	RNDr(S, W, 9, i);
191	4122198	RNDr(S, W, 10, i);
192	4122198	RNDr(S, W, 11, i);
193	4122198	RNDr(S, W, 12, i);
194	4122198	RNDr(S, W, 13, i);
195	4122198	RNDr(S, W, 14, i);
196	4122198	RNDr(S, W, 15, i);
197
198	4122198	if (i == 48)
199	1030584	break;
200	3091614	MSCH(W, 0, i);
201	3091614	MSCH(W, 1, i);
202	3091614	MSCH(W, 2, i);
203	3091614	MSCH(W, 3, i);
204	3091614	MSCH(W, 4, i);
205	3091614	MSCH(W, 5, i);
206	3091614	MSCH(W, 6, i);
207	3091614	MSCH(W, 7, i);
208	3091614	MSCH(W, 8, i);
209	3091614	MSCH(W, 9, i);
210	3091614	MSCH(W, 10, i);
211	3091614	MSCH(W, 11, i);
212	3091614	MSCH(W, 12, i);
213	3091614	MSCH(W, 13, i);
214	3091614	MSCH(W, 14, i);
215	3091614	MSCH(W, 15, i);
216	3091614	}
217
218		/* 4. Mix local working variables into global state */
219	9274793	for (i = 0; i < 8; i++)
220	8244205	state[i] += S[i];
221	1030582	}
222
223		static const unsigned char PAD[64] = {
224		0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
225		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
226		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
227		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
228		};
229
230		/* Add padding and terminating bit-count. */
231		static void
232	540502	VSHA256_Pad(VSHA256_CTX * ctx)
233		{
234		size_t r;
235
236		/* Figure out how many bytes we have buffered. */
237	540502	r = (ctx->count >> 3) & 0x3f;
238
239		/* Pad to 56 mod 64, transforming if we finish a block en route. */
240	540502	if (r < 56) {
241		/* Pad to 56 mod 64. */
242	495623	memcpy(&ctx->buf[r], PAD, 56 - r);
243	495623	} else {
244		/* Finish the current block and mix. */
245	44879	memcpy(&ctx->buf[r], PAD, 64 - r);
246	44879	VSHA256_Transform(ctx->state, ctx->buf);
247
248		/* The start of the final block is all zeroes. */
249	44879	memset(&ctx->buf[0], 0, 56);
250		}
251
252		/* Add the terminating bit-count. */
253	540502	vbe64enc(&ctx->buf[56], ctx->count);
254
255		/* Mix in the final block. */
256	540502	VSHA256_Transform(ctx->state, ctx->buf);
257	540502	}
258
259		/* SHA-256 initialization. Begins a SHA-256 operation. */
260		void
261	523812	VSHA256_Init(VSHA256_CTX * ctx)
262		{
263
264		/* Zero bits processed so far */
265	523812	ctx->count = 0;
266
267		/* Magic initialization constants */
268	523812	ctx->state[0] = 0x6A09E667;
269	523812	ctx->state[1] = 0xBB67AE85;
270	523812	ctx->state[2] = 0x3C6EF372;
271	523812	ctx->state[3] = 0xA54FF53A;
272	523812	ctx->state[4] = 0x510E527F;
273	523812	ctx->state[5] = 0x9B05688C;
274	523812	ctx->state[6] = 0x1F83D9AB;
275	523812	ctx->state[7] = 0x5BE0CD19;
276	523812	}
277
278		/* Add bytes into the hash */
279		void
280	22034330	VSHA256_Update(VSHA256_CTX * ctx, const void *in, size_t len)
281		{
282		uint64_t bitlen;
283		uint32_t r;
284	22034330	const unsigned char *src = in;
285
286		/* Number of bytes left in the buffer from previous updates */
287	22034330	r = (ctx->count >> 3) & 0x3f;
288
289		/* Convert the length into a number of bits */
290	22034330	bitlen = len << 3;
291
292		/* Update number of bits */
293	22034330	ctx->count += bitlen;
294
295		/* Handle the case where we don't need to perform any transforms */
296	22034330	if (len < 64 - r) {
297	21606070	memcpy(&ctx->buf[r], src, len);
298	21606070	return;
299		}
300
301		/* Finish the current block */
302	428260	memcpy(&ctx->buf[r], src, 64 - r);
303	428260	VSHA256_Transform(ctx->state, ctx->buf);
304	428260	src += 64 - r;
305	428260	len -= 64 - r;
306
307		/* Perform complete blocks */
308	445180	while (len >= 64) {
309	16920	VSHA256_Transform(ctx->state, src);
310	16920	src += 64;
311	16920	len -= 64;
312		}
313
314		/* Copy left over data into buffer */
315	428260	memcpy(ctx->buf, src, len);
316	22034330	}
317
318		/*
319		* SHA-256 finalization. Pads the input data, exports the hash value,
320		* and clears the context state.
321		*/
322		void
323	540497	VSHA256_Final(unsigned char digest[static VSHA256_DIGEST_LENGTH],
324		VSHA256_CTX *ctx)
325		{
326
327		/* Add padding */
328	540497	VSHA256_Pad(ctx);
329
330		/* Write the hash */
331	540497	be32enc_vect(digest, ctx->state, VSHA256_DIGEST_LENGTH);
332
333		/* Clear the context state */
334	540497	memset((void )ctx, 0, sizeof(ctx));
335	540497	}
336
337		/*
338		* A few test-vectors, just in case
339		*/
340
341		static const struct sha256test {
342		const char *input;
343		const unsigned char output[32];
344		} sha256test[] = {
345		{ "",
346		{0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4,
347		0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b,
348		0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55} },
349		{ "message digest",
350		{0xf7, 0x84, 0x6f, 0x55, 0xcf, 0x23, 0xe1, 0x4e, 0xeb, 0xea, 0xb5,
351		0xb4, 0xe1, 0x55, 0x0c, 0xad, 0x5b, 0x50, 0x9e, 0x33, 0x48, 0xfb,
352		0xc4, 0xef, 0xa3, 0xa1, 0x41, 0x3d, 0x39, 0x3c, 0xb6, 0x50} },
353		{ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
354		{0xdb, 0x4b, 0xfc, 0xbd, 0x4d, 0xa0, 0xcd, 0x85, 0xa6, 0x0c, 0x3c,
355		0x37, 0xd3, 0xfb, 0xd8, 0x80, 0x5c, 0x77, 0xf1, 0x5f, 0xc6, 0xb1,
356		0xfd, 0xfe, 0x61, 0x4e, 0xe0, 0xa7, 0xc8, 0xfd, 0xb4, 0xc0} },
357		{ NULL }
358		};
359
360
361		void
362	42199	VSHA256_Test(void)
363		{
364		struct VSHA256Context c;
365		const struct sha256test *p;
366		unsigned char o[32];
367
368	168796	for (p = sha256test; p->input != NULL; p++) {
369	126597	VSHA256_Init(&c);
370	126597	VSHA256_Update(&c, p->input, strlen(p->input));
371	126597	VSHA256_Final(o, &c);
372	126597	AZ(memcmp(o, p->output, 32));
373	126597	}
374	42199	}