GCOV - Varnish Cache


/*-
 * Copyright 2005 Colin Percival
 * All rights reserved.
 *
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * From:
 * $FreeBSD: sys/crypto/sha2/sha256c.c 300966 2016-05-29 17:26:40Z cperciva $
 */

#include "config.h"

#ifndef __APPLE__
#  include <endian.h>
#  ifdef _BYTE_ORDER
#    define VBYTE_ORDER _BYTE_ORDER
#  else
#    define VBYTE_ORDER __BYTE_ORDER
#  endif
#  ifdef _BIG_ENDIAN
#    define VBIG_ENDIAN _BIG_ENDIAN
#  else
#    define VBIG_ENDIAN __BIG_ENDIAN
#  endif
#else
#  define VBYTE_ORDER   __DARWIN_BYTE_ORDER
#  define VBIG_ENDIAN   __DARWIN_BIG_ENDIAN
#endif

#ifndef VBYTE_ORDER
# error VBYTE_ORDER not defined
#endif
#ifndef VBIG_ENDIAN
# error VBIG_ENDIAN not defined
#endif


#include <sys/types.h>
#include <stdint.h>
#include <string.h>

#include "vdef.h"

#include "vas.h"
#include "vend.h"
#include "vsha256.h"

#if VBYTE_ORDER == VBIG_ENDIAN

/* Copy a vector of big-endian uint32_t into a vector of bytes */
#define be32enc_vect(dst, src, len)     \
        memcpy((void *)dst, (const void *)src, (size_t)len)

/* Copy a vector of bytes into a vector of big-endian uint32_t */
#define be32dec_vect(dst, src, len)     \
        memcpy((void *)dst, (const void *)src, (size_t)len)

#else /* BYTE_ORDER != BIG_ENDIAN or in doubt... */

/*
 * Encode a length len/4 vector of (uint32_t) into a length len vector of
 * (unsigned char) in big-endian form.  Assumes len is a multiple of 4.
 */
static void
be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
{
        size_t i;

        for (i = 0; i < len / 4; i++)
                vbe32enc(dst + i * 4, src[i]);
}

/*
 * Decode a big-endian length len vector of (unsigned char) into a length
 * len/4 vector of (uint32_t).  Assumes len is a multiple of 4.
 */
static void
be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
{
        size_t i;

        for (i = 0; i < len / 4; i++)
                dst[i] = vbe32dec(src + i * 4);
}

#endif /* BYTE_ORDER != BIG_ENDIAN */

/* SHA256 round constants. */
static const uint32_t K[64] = {
        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
        0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
        0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
        0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
        0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
        0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
        0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
        0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
        0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
};

/* Elementary functions used by SHA256 */
#define Ch(x, y, z)     ((x & (y ^ z)) ^ z)
#define Maj(x, y, z)    ((x & (y | z)) | (y & z))
#define SHR(x, n)       (x >> n)
#define ROTR(x, n)      ((x >> n) | (x << (32 - n)))
#define S0(x)           (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
#define S1(x)           (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
#define s0(x)           (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
#define s1(x)           (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))

/* SHA256 round function */
#define RND(a, b, c, d, e, f, g, h, k)                          \
        do {                                                    \
                h += S1(e) + Ch(e, f, g) + (k);                 \
                d += h;                                         \
                h += S0(a) + Maj(a, b, c);                      \
        } while (0)

/* Adjusted round function for rotating state */
#define RNDr(S, W, i, ii)                       \
        RND(S[(64 - i) % 8], S[(65 - i) % 8],   \
            S[(66 - i) % 8], S[(67 - i) % 8],   \
            S[(68 - i) % 8], S[(69 - i) % 8],   \
            S[(70 - i) % 8], S[(71 - i) % 8],   \
            W[i + ii] + K[i + ii])

/* Message schedule computation */
#define MSCH(W, ii, i)                                          \
        do {                                                    \
                W[i + ii + 16] =                                \
                    s1(W[i + ii + 14]) + W[i + ii + 9] +        \
                    s0(W[i + ii + 1]) + W[i + ii];              \
        } while (0)

/*
 * SHA256 block compression function.  The 256-bit state is transformed via
 * the 512-bit input block to produce a new state.
 */
static void
VSHA256_Transform(uint32_t * state, const unsigned char block[64])
{
        uint32_t W[64];
        uint32_t S[8];
        int i;

        /* 1. Prepare the first part of the message schedule W. */
        be32dec_vect(W, block, 64);

        /* 2. Initialize working variables. */
        memcpy(S, state, 32);

        /* 3. Mix. */
        for (i = 0; i < 64; i += 16) {
                RNDr(S, W, 0, i);
                RNDr(S, W, 1, i);
                RNDr(S, W, 2, i);
                RNDr(S, W, 3, i);
                RNDr(S, W, 4, i);
                RNDr(S, W, 5, i);
                RNDr(S, W, 6, i);
                RNDr(S, W, 7, i);
                RNDr(S, W, 8, i);
                RNDr(S, W, 9, i);
                RNDr(S, W, 10, i);
                RNDr(S, W, 11, i);
                RNDr(S, W, 12, i);
                RNDr(S, W, 13, i);
                RNDr(S, W, 14, i);
                RNDr(S, W, 15, i);

                if (i == 48)
                        break;
                MSCH(W, 0, i);
                MSCH(W, 1, i);
                MSCH(W, 2, i);
                MSCH(W, 3, i);
                MSCH(W, 4, i);
                MSCH(W, 5, i);
                MSCH(W, 6, i);
                MSCH(W, 7, i);
                MSCH(W, 8, i);
                MSCH(W, 9, i);
                MSCH(W, 10, i);
                MSCH(W, 11, i);
                MSCH(W, 12, i);
                MSCH(W, 13, i);
                MSCH(W, 14, i);
                MSCH(W, 15, i);
        }

        /* 4. Mix local working variables into global state */
        for (i = 0; i < 8; i++)
                state[i] += S[i];
}

static const unsigned char PAD[64] = {
        0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* Add padding and terminating bit-count. */
static void
VSHA256_Pad(VSHA256_CTX * ctx)
{
        size_t r;

        /* Figure out how many bytes we have buffered. */
        r = (ctx->count >> 3) & 0x3f;

        /* Pad to 56 mod 64, transforming if we finish a block en route. */
        if (r < 56) {
                /* Pad to 56 mod 64. */
                memcpy(&ctx->buf[r], PAD, 56 - r);
        } else {
                /* Finish the current block and mix. */
                memcpy(&ctx->buf[r], PAD, 64 - r);
                VSHA256_Transform(ctx->state, ctx->buf);

                /* The start of the final block is all zeroes. */
                memset(&ctx->buf[0], 0, 56);
        }

        /* Add the terminating bit-count. */
        vbe64enc(&ctx->buf[56], ctx->count);

        /* Mix in the final block. */
        VSHA256_Transform(ctx->state, ctx->buf);
}

/* SHA-256 initialization.  Begins a SHA-256 operation. */
void
VSHA256_Init(VSHA256_CTX * ctx)
{

        /* Zero bits processed so far */
        ctx->count = 0;

        /* Magic initialization constants */
        ctx->state[0] = 0x6A09E667;
        ctx->state[1] = 0xBB67AE85;
        ctx->state[2] = 0x3C6EF372;
        ctx->state[3] = 0xA54FF53A;
        ctx->state[4] = 0x510E527F;
        ctx->state[5] = 0x9B05688C;
        ctx->state[6] = 0x1F83D9AB;
        ctx->state[7] = 0x5BE0CD19;
}

/* Add bytes into the hash */
void
VSHA256_Update(VSHA256_CTX * ctx, const void *in, size_t len)
{
        uint64_t bitlen;
        uint32_t r;
        const unsigned char *src = in;

        /* Number of bytes left in the buffer from previous updates */
        r = (ctx->count >> 3) & 0x3f;

        /* Convert the length into a number of bits */
        bitlen = len << 3;

        /* Update number of bits */
        ctx->count += bitlen;

        /* Handle the case where we don't need to perform any transforms */
        if (len < 64 - r) {
                memcpy(&ctx->buf[r], src, len);
                return;
        }

        /* Finish the current block */
        memcpy(&ctx->buf[r], src, 64 - r);
        VSHA256_Transform(ctx->state, ctx->buf);
        src += 64 - r;
        len -= 64 - r;

        /* Perform complete blocks */
        while (len >= 64) {
                VSHA256_Transform(ctx->state, src);
                src += 64;
                len -= 64;
        }

        /* Copy left over data into buffer */
        memcpy(ctx->buf, src, len);
}

/*
 * SHA-256 finalization.  Pads the input data, exports the hash value,
 * and clears the context state.
 */
void
VSHA256_Final(unsigned char digest[static VSHA256_DIGEST_LENGTH],
    VSHA256_CTX *ctx)
{

        /* Add padding */
        VSHA256_Pad(ctx);

        /* Write the hash */
        be32enc_vect(digest, ctx->state, VSHA256_DIGEST_LENGTH);

        /* Clear the context state */
        memset((void *)ctx, 0, sizeof(*ctx));
}

/*
 * A few test-vectors, just in case
 */

static const struct sha256test {
        const char              *input;
        const unsigned char     output[32];
} sha256test[] = {
    { "",
        {0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4,
         0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b,
         0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55} },
    { "message digest",
        {0xf7, 0x84, 0x6f, 0x55, 0xcf, 0x23, 0xe1, 0x4e, 0xeb, 0xea, 0xb5,
         0xb4, 0xe1, 0x55, 0x0c, 0xad, 0x5b, 0x50, 0x9e, 0x33, 0x48, 0xfb,
         0xc4, 0xef, 0xa3, 0xa1, 0x41, 0x3d, 0x39, 0x3c, 0xb6, 0x50} },
    { "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
        {0xdb, 0x4b, 0xfc, 0xbd, 0x4d, 0xa0, 0xcd, 0x85, 0xa6, 0x0c, 0x3c,
         0x37, 0xd3, 0xfb, 0xd8, 0x80, 0x5c, 0x77, 0xf1, 0x5f, 0xc6, 0xb1,
         0xfd, 0xfe, 0x61, 0x4e, 0xe0, 0xa7, 0xc8, 0xfd, 0xb4, 0xc0} },
    { NULL }
};


void
VSHA256_Test(void)
{
        struct VSHA256Context c;
        const struct sha256test *p;
        unsigned char o[32];

        for (p = sha256test; p->input != NULL; p++) {
                VSHA256_Init(&c);
                VSHA256_Update(&c, p->input, strlen(p->input));
                VSHA256_Final(o, &c);
                AZ(memcmp(o, p->output, 32));
        }
}

		varnish-cache/lib/libvarnish/vsha256.c
0		/*-
1		* Copyright 2005 Colin Percival
2		* All rights reserved.
3		*
4		* SPDX-License-Identifier: BSD-2-Clause
5		*
6		* Redistribution and use in source and binary forms, with or without
7		* modification, are permitted provided that the following conditions
8		* are met:
9		* 1. Redistributions of source code must retain the above copyright
10		* notice, this list of conditions and the following disclaimer.
11		* 2. Redistributions in binary form must reproduce the above copyright
12		* notice, this list of conditions and the following disclaimer in the
13		* documentation and/or other materials provided with the distribution.
14		*
15		* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16		* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18		* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19		* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20		* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21		* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23		* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24		* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25		* SUCH DAMAGE.
26		*
27		* From:
28		* $FreeBSD: sys/crypto/sha2/sha256c.c 300966 2016-05-29 17:26:40Z cperciva $
29		*/
30
31		#include "config.h"
32
33		#ifndef __APPLE__
34		# include <endian.h>
35		# ifdef _BYTE_ORDER
36		# define VBYTE_ORDER _BYTE_ORDER
37		# else
38		# define VBYTE_ORDER __BYTE_ORDER
39		# endif
40		# ifdef _BIG_ENDIAN
41		# define VBIG_ENDIAN _BIG_ENDIAN
42		# else
43		# define VBIG_ENDIAN __BIG_ENDIAN
44		# endif
45		#else
46		# define VBYTE_ORDER __DARWIN_BYTE_ORDER
47		# define VBIG_ENDIAN __DARWIN_BIG_ENDIAN
48		#endif
49
50		#ifndef VBYTE_ORDER
51		# error VBYTE_ORDER not defined
52		#endif
53		#ifndef VBIG_ENDIAN
54		# error VBIG_ENDIAN not defined
55		#endif
56
57
58		#include <sys/types.h>
59		#include <stdint.h>
60		#include <string.h>
61
62		#include "vdef.h"
63
64		#include "vas.h"
65		#include "vend.h"
66		#include "vsha256.h"
67
68		#if VBYTE_ORDER == VBIG_ENDIAN
69
70		/* Copy a vector of big-endian uint32_t into a vector of bytes */
71		#define be32enc_vect(dst, src, len) \
72		memcpy((void )dst, (const void )src, (size_t)len)
73
74		/* Copy a vector of bytes into a vector of big-endian uint32_t */
75		#define be32dec_vect(dst, src, len) \
76		memcpy((void )dst, (const void )src, (size_t)len)
77
78		#else /* BYTE_ORDER != BIG_ENDIAN or in doubt... */
79
80		/*
81		* Encode a length len/4 vector of (uint32_t) into a length len vector of
82		* (unsigned char) in big-endian form. Assumes len is a multiple of 4.
83		*/
84		static void
85	81275	be32enc_vect(unsigned char dst, const uint32_t src, size_t len)
86		{
87		size_t i;
88
89	731438	for (i = 0; i < len / 4; i++)
90	650163	vbe32enc(dst + i * 4, src[i]);
91	81275	}
92
93		/*
94		* Decode a big-endian length len vector of (unsigned char) into a length
95		* len/4 vector of (uint32_t). Assumes len is a multiple of 4.
96		*/
97		static void
98	154969	be32dec_vect(uint32_t dst, const unsigned char src, size_t len)
99		{
100		size_t i;
101
102	2634412	for (i = 0; i < len / 4; i++)
103	2479443	dst[i] = vbe32dec(src + i * 4);
104	154969	}
105
106		#endif /* BYTE_ORDER != BIG_ENDIAN */
107
108		/* SHA256 round constants. */
109		static const uint32_t K[64] = {
110		0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
111		0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
112		0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
113		0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
114		0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
115		0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
116		0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
117		0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
118		0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
119		0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
120		0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
121		0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
122		0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
123		0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
124		0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
125		0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
126		};
127
128		/* Elementary functions used by SHA256 */
129		#define Ch(x, y, z) ((x & (y ^ z)) ^ z)
130		#define Maj(x, y, z) ((x & (y \| z)) \| (y & z))
131		#define SHR(x, n) (x >> n)
132		#define ROTR(x, n) ((x >> n) \| (x << (32 - n)))
133		#define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
134		#define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
135		#define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
136		#define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
137
138		/* SHA256 round function */
139		#define RND(a, b, c, d, e, f, g, h, k) \
140		do { \
141		h += S1(e) + Ch(e, f, g) + (k); \
142		d += h; \
143		h += S0(a) + Maj(a, b, c); \
144		} while (0)
145
146		/* Adjusted round function for rotating state */
147		#define RNDr(S, W, i, ii) \
148		RND(S[(64 - i) % 8], S[(65 - i) % 8], \
149		S[(66 - i) % 8], S[(67 - i) % 8], \
150		S[(68 - i) % 8], S[(69 - i) % 8], \
151		S[(70 - i) % 8], S[(71 - i) % 8], \
152		W[i + ii] + K[i + ii])
153
154		/* Message schedule computation */
155		#define MSCH(W, ii, i) \
156		do { \
157		W[i + ii + 16] = \
158		s1(W[i + ii + 14]) + W[i + ii + 9] + \
159		s0(W[i + ii + 1]) + W[i + ii]; \
160		} while (0)
161
162		/*
163		* SHA256 block compression function. The 256-bit state is transformed via
164		* the 512-bit input block to produce a new state.
165		*/
166		static void
167	154974	VSHA256_Transform(uint32_t * state, const unsigned char block[64])
168		{
169		uint32_t W[64];
170		uint32_t S[8];
171		int i;
172
173		/* 1. Prepare the first part of the message schedule W. */
174	154974	be32dec_vect(W, block, 64);
175
176		/* 2. Initialize working variables. */
177	154974	memcpy(S, state, 32);
178
179		/* 3. Mix. */
180	619871	for (i = 0; i < 64; i += 16) {
181	619870	RNDr(S, W, 0, i);
182	619870	RNDr(S, W, 1, i);
183	619870	RNDr(S, W, 2, i);
184	619870	RNDr(S, W, 3, i);
185	619870	RNDr(S, W, 4, i);
186	619870	RNDr(S, W, 5, i);
187	619870	RNDr(S, W, 6, i);
188	619870	RNDr(S, W, 7, i);
189	619870	RNDr(S, W, 8, i);
190	619870	RNDr(S, W, 9, i);
191	619870	RNDr(S, W, 10, i);
192	619870	RNDr(S, W, 11, i);
193	619870	RNDr(S, W, 12, i);
194	619870	RNDr(S, W, 13, i);
195	619870	RNDr(S, W, 14, i);
196	619870	RNDr(S, W, 15, i);
197
198	619870	if (i == 48)
199	154973	break;
200	464897	MSCH(W, 0, i);
201	464897	MSCH(W, 1, i);
202	464897	MSCH(W, 2, i);
203	464897	MSCH(W, 3, i);
204	464897	MSCH(W, 4, i);
205	464897	MSCH(W, 5, i);
206	464897	MSCH(W, 6, i);
207	464897	MSCH(W, 7, i);
208	464897	MSCH(W, 8, i);
209	464897	MSCH(W, 9, i);
210	464897	MSCH(W, 10, i);
211	464897	MSCH(W, 11, i);
212	464897	MSCH(W, 12, i);
213	464897	MSCH(W, 13, i);
214	464897	MSCH(W, 14, i);
215	464897	MSCH(W, 15, i);
216	464897	}
217
218		/* 4. Mix local working variables into global state */
219	1394737	for (i = 0; i < 8; i++)
220	1239763	state[i] += S[i];
221	154972	}
222
223		static const unsigned char PAD[64] = {
224		0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
225		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
226		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
227		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
228		};
229
230		/* Add padding and terminating bit-count. */
231		static void
232	81269	VSHA256_Pad(VSHA256_CTX * ctx)
233		{
234		size_t r;
235
236		/* Figure out how many bytes we have buffered. */
237	81269	r = (ctx->count >> 3) & 0x3f;
238
239		/* Pad to 56 mod 64, transforming if we finish a block en route. */
240	81269	if (r < 56) {
241		/* Pad to 56 mod 64. */
242	74520	memcpy(&ctx->buf[r], PAD, 56 - r);
243	74520	} else {
244		/* Finish the current block and mix. */
245	6749	memcpy(&ctx->buf[r], PAD, 64 - r);
246	6749	VSHA256_Transform(ctx->state, ctx->buf);
247
248		/* The start of the final block is all zeroes. */
249	6749	memset(&ctx->buf[0], 0, 56);
250		}
251
252		/* Add the terminating bit-count. */
253	81269	vbe64enc(&ctx->buf[56], ctx->count);
254
255		/* Mix in the final block. */
256	81269	VSHA256_Transform(ctx->state, ctx->buf);
257	81269	}
258
259		/* SHA-256 initialization. Begins a SHA-256 operation. */
260		void
261	78770	VSHA256_Init(VSHA256_CTX * ctx)
262		{
263
264		/* Zero bits processed so far */
265	78770	ctx->count = 0;
266
267		/* Magic initialization constants */
268	78770	ctx->state[0] = 0x6A09E667;
269	78770	ctx->state[1] = 0xBB67AE85;
270	78770	ctx->state[2] = 0x3C6EF372;
271	78770	ctx->state[3] = 0xA54FF53A;
272	78770	ctx->state[4] = 0x510E527F;
273	78770	ctx->state[5] = 0x9B05688C;
274	78770	ctx->state[6] = 0x1F83D9AB;
275	78770	ctx->state[7] = 0x5BE0CD19;
276	78770	}
277
278		/* Add bytes into the hash */
279		void
280	3314541	VSHA256_Update(VSHA256_CTX * ctx, const void *in, size_t len)
281		{
282		uint64_t bitlen;
283		uint32_t r;
284	3314541	const unsigned char *src = in;
285
286		/* Number of bytes left in the buffer from previous updates */
287	3314541	r = (ctx->count >> 3) & 0x3f;
288
289		/* Convert the length into a number of bits */
290	3314541	bitlen = len << 3;
291
292		/* Update number of bits */
293	3314541	ctx->count += bitlen;
294
295		/* Handle the case where we don't need to perform any transforms */
296	3314541	if (len < 64 - r) {
297	3250129	memcpy(&ctx->buf[r], src, len);
298	3250129	return;
299		}
300
301		/* Finish the current block */
302	64412	memcpy(&ctx->buf[r], src, 64 - r);
303	64412	VSHA256_Transform(ctx->state, ctx->buf);
304	64412	src += 64 - r;
305	64412	len -= 64 - r;
306
307		/* Perform complete blocks */
308	66950	while (len >= 64) {
309	2538	VSHA256_Transform(ctx->state, src);
310	2538	src += 64;
311	2538	len -= 64;
312		}
313
314		/* Copy left over data into buffer */
315	64412	memcpy(ctx->buf, src, len);
316	3314541	}
317
318		/*
319		* SHA-256 finalization. Pads the input data, exports the hash value,
320		* and clears the context state.
321		*/
322		void
323	81269	VSHA256_Final(unsigned char digest[static VSHA256_DIGEST_LENGTH],
324		VSHA256_CTX *ctx)
325		{
326
327		/* Add padding */
328	81269	VSHA256_Pad(ctx);
329
330		/* Write the hash */
331	81269	be32enc_vect(digest, ctx->state, VSHA256_DIGEST_LENGTH);
332
333		/* Clear the context state */
334	81269	memset((void )ctx, 0, sizeof(ctx));
335	81269	}
336
337		/*
338		* A few test-vectors, just in case
339		*/
340
341		static const struct sha256test {
342		const char *input;
343		const unsigned char output[32];
344		} sha256test[] = {
345		{ "",
346		{0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4,
347		0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b,
348		0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55} },
349		{ "message digest",
350		{0xf7, 0x84, 0x6f, 0x55, 0xcf, 0x23, 0xe1, 0x4e, 0xeb, 0xea, 0xb5,
351		0xb4, 0xe1, 0x55, 0x0c, 0xad, 0x5b, 0x50, 0x9e, 0x33, 0x48, 0xfb,
352		0xc4, 0xef, 0xa3, 0xa1, 0x41, 0x3d, 0x39, 0x3c, 0xb6, 0x50} },
353		{ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
354		{0xdb, 0x4b, 0xfc, 0xbd, 0x4d, 0xa0, 0xcd, 0x85, 0xa6, 0x0c, 0x3c,
355		0x37, 0xd3, 0xfb, 0xd8, 0x80, 0x5c, 0x77, 0xf1, 0x5f, 0xc6, 0xb1,
356		0xfd, 0xfe, 0x61, 0x4e, 0xe0, 0xa7, 0xc8, 0xfd, 0xb4, 0xc0} },
357		{ NULL }
358		};
359
360
361		void
362	6347	VSHA256_Test(void)
363		{
364		struct VSHA256Context c;
365		const struct sha256test *p;
366		unsigned char o[32];
367
368	25388	for (p = sha256test; p->input != NULL; p++) {
369	19041	VSHA256_Init(&c);
370	19041	VSHA256_Update(&c, p->input, strlen(p->input));
371	19041	VSHA256_Final(o, &c);
372	19041	AZ(memcmp(o, p->output, 32));
373	19041	}
374	6347	}