GCOV - Varnish Cache


/*-
 * Copyright 2005 Colin Percival
 * All rights reserved.
 *
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * From:
 * $FreeBSD: sys/crypto/sha2/sha256c.c 300966 2016-05-29 17:26:40Z cperciva $
 */

#include "config.h"

#ifndef __DARWIN_BYTE_ORDER
#  include <endian.h>
#  ifdef _BYTE_ORDER
#    define VBYTE_ORDER _BYTE_ORDER
#  else
#    define VBYTE_ORDER __BYTE_ORDER
#  endif
#  ifdef _BIG_ENDIAN
#    define VBIG_ENDIAN _BIG_ENDIAN
#  else
#    define VBIG_ENDIAN __BIG_ENDIAN
#  endif
#else
#  define VBYTE_ORDER   __DARWIN_BYTE_ORDER
#  define VBIG_ENDIAN   __DARWIN_BIG_ENDIAN
#endif

#ifndef VBYTE_ORDER
# error VBYTE_ORDER not defined
#endif
#ifndef VBIG_ENDIAN
# error VBIG_ENDIAN not defined
#endif


#include <sys/types.h>
#include <stdint.h>
#include <string.h>

#include "vdef.h"

#include "vas.h"
#include "vend.h"
#include "vsha256.h"

#if VBYTE_ORDER == VBIG_ENDIAN

/* Copy a vector of big-endian uint32_t into a vector of bytes */
#define be32enc_vect(dst, src, len)     \
        memcpy((void *)dst, (const void *)src, (size_t)len)

/* Copy a vector of bytes into a vector of big-endian uint32_t */
#define be32dec_vect(dst, src, len)     \
        memcpy((void *)dst, (const void *)src, (size_t)len)

#else /* BYTE_ORDER != BIG_ENDIAN or in doubt... */

/*
 * Encode a length len/4 vector of (uint32_t) into a length len vector of
 * (unsigned char) in big-endian form.  Assumes len is a multiple of 4.
 */
static void
be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
{
        size_t i;

        for (i = 0; i < len / 4; i++)
                vbe32enc(dst + i * 4, src[i]);
}

/*
 * Decode a big-endian length len vector of (unsigned char) into a length
 * len/4 vector of (uint32_t).  Assumes len is a multiple of 4.
 */
static void
be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
{
        size_t i;

        for (i = 0; i < len / 4; i++)
                dst[i] = vbe32dec(src + i * 4);
}

#endif /* BYTE_ORDER != BIG_ENDIAN */

/* SHA256 round constants. */
static const uint32_t K[64] = {
        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
        0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
        0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
        0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
        0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
        0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
        0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
        0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
        0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
};

/* Elementary functions used by SHA256 */
#define Ch(x, y, z)     ((x & (y ^ z)) ^ z)
#define Maj(x, y, z)    ((x & (y | z)) | (y & z))
#define SHR(x, n)       (x >> n)
#define ROTR(x, n)      ((x >> n) | (x << (32 - n)))
#define S0(x)           (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
#define S1(x)           (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
#define s0(x)           (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
#define s1(x)           (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))

/* SHA256 round function */
#define RND(a, b, c, d, e, f, g, h, k)                          \
        do {                                                    \
                h += S1(e) + Ch(e, f, g) + (k);                 \
                d += h;                                         \
                h += S0(a) + Maj(a, b, c);                      \
        } while (0)

/* Adjusted round function for rotating state */
#define RNDr(S, W, i, ii)                       \
        RND(S[(64 - i) % 8], S[(65 - i) % 8],   \
            S[(66 - i) % 8], S[(67 - i) % 8],   \
            S[(68 - i) % 8], S[(69 - i) % 8],   \
            S[(70 - i) % 8], S[(71 - i) % 8],   \
            W[i + ii] + K[i + ii])

/* Message schedule computation */
#define MSCH(W, ii, i)                                          \
        do {                                                    \
                W[i + ii + 16] =                                \
                    s1(W[i + ii + 14]) + W[i + ii + 9] +        \
                    s0(W[i + ii + 1]) + W[i + ii];              \
        } while (0)

/*
 * SHA256 block compression function.  The 256-bit state is transformed via
 * the 512-bit input block to produce a new state.
 */
static void
VSHA256_Transform(uint32_t * state, const unsigned char block[64])
{
        uint32_t W[64];
        uint32_t S[8];
        int i;

        /* 1. Prepare the first part of the message schedule W. */
        be32dec_vect(W, block, 64);

        /* 2. Initialize working variables. */
        memcpy(S, state, 32);

        /* 3. Mix. */
        for (i = 0; i < 64; i += 16) {
                RNDr(S, W, 0, i);
                RNDr(S, W, 1, i);
                RNDr(S, W, 2, i);
                RNDr(S, W, 3, i);
                RNDr(S, W, 4, i);
                RNDr(S, W, 5, i);
                RNDr(S, W, 6, i);
                RNDr(S, W, 7, i);
                RNDr(S, W, 8, i);
                RNDr(S, W, 9, i);
                RNDr(S, W, 10, i);
                RNDr(S, W, 11, i);
                RNDr(S, W, 12, i);
                RNDr(S, W, 13, i);
                RNDr(S, W, 14, i);
                RNDr(S, W, 15, i);

                if (i == 48)
                        break;
                MSCH(W, 0, i);
                MSCH(W, 1, i);
                MSCH(W, 2, i);
                MSCH(W, 3, i);
                MSCH(W, 4, i);
                MSCH(W, 5, i);
                MSCH(W, 6, i);
                MSCH(W, 7, i);
                MSCH(W, 8, i);
                MSCH(W, 9, i);
                MSCH(W, 10, i);
                MSCH(W, 11, i);
                MSCH(W, 12, i);
                MSCH(W, 13, i);
                MSCH(W, 14, i);
                MSCH(W, 15, i);
        }

        /* 4. Mix local working variables into global state */
        for (i = 0; i < 8; i++)
                state[i] += S[i];
}

static const unsigned char PAD[64] = {
        0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* Add padding and terminating bit-count. */
static void
VSHA256_Pad(VSHA256_CTX * ctx)
{
        size_t r;

        /* Figure out how many bytes we have buffered. */
        r = (ctx->count >> 3) & 0x3f;

        /* Pad to 56 mod 64, transforming if we finish a block en route. */
        if (r < 56) {
                /* Pad to 56 mod 64. */
                memcpy(&ctx->buf[r], PAD, 56 - r);
        } else {
                /* Finish the current block and mix. */
                memcpy(&ctx->buf[r], PAD, 64 - r);
                VSHA256_Transform(ctx->state, ctx->buf);

                /* The start of the final block is all zeroes. */
                memset(&ctx->buf[0], 0, 56);
        }

        /* Add the terminating bit-count. */
        vbe64enc(&ctx->buf[56], ctx->count);

        /* Mix in the final block. */
        VSHA256_Transform(ctx->state, ctx->buf);
}

/* SHA-256 initialization.  Begins a SHA-256 operation. */
void
VSHA256_Init(VSHA256_CTX * ctx)
{

        /* Zero bits processed so far */
        ctx->count = 0;

        /* Magic initialization constants */
        ctx->state[0] = 0x6A09E667;
        ctx->state[1] = 0xBB67AE85;
        ctx->state[2] = 0x3C6EF372;
        ctx->state[3] = 0xA54FF53A;
        ctx->state[4] = 0x510E527F;
        ctx->state[5] = 0x9B05688C;
        ctx->state[6] = 0x1F83D9AB;
        ctx->state[7] = 0x5BE0CD19;
}

/* Add bytes into the hash */
void
VSHA256_Update(VSHA256_CTX * ctx, const void *in, size_t len)
{
        uint64_t bitlen;
        uint32_t r;
        const unsigned char *src = in;

        /* Number of bytes left in the buffer from previous updates */
        r = (ctx->count >> 3) & 0x3f;

        /* Convert the length into a number of bits */
        bitlen = len << 3;

        /* Update number of bits */
        ctx->count += bitlen;

        /* Handle the case where we don't need to perform any transforms */
        if (len < 64 - r) {
                memcpy(&ctx->buf[r], src, len);
                return;
        }

        /* Finish the current block */
        memcpy(&ctx->buf[r], src, 64 - r);
        VSHA256_Transform(ctx->state, ctx->buf);
        src += 64 - r;
        len -= 64 - r;

        /* Perform complete blocks */
        while (len >= 64) {
                VSHA256_Transform(ctx->state, src);
                src += 64;
                len -= 64;
        }

        /* Copy left over data into buffer */
        memcpy(ctx->buf, src, len);
}

/*
 * SHA-256 finalization.  Pads the input data, exports the hash value,
 * and clears the context state.
 */
void
VSHA256_Final(unsigned char digest[static VSHA256_DIGEST_LENGTH],
    VSHA256_CTX *ctx)
{

        /* Add padding */
        VSHA256_Pad(ctx);

        /* Write the hash */
        be32enc_vect(digest, ctx->state, VSHA256_DIGEST_LENGTH);

        /* Clear the context state */
        memset((void *)ctx, 0, sizeof(*ctx));
}

/*
 * A few test-vectors, just in case
 */

static const struct sha256test {
        const char              *input;
        const unsigned char     output[32];
} sha256test[] = {
    { "",
        {0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4,
         0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b,
         0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55} },
    { "message digest",
        {0xf7, 0x84, 0x6f, 0x55, 0xcf, 0x23, 0xe1, 0x4e, 0xeb, 0xea, 0xb5,
         0xb4, 0xe1, 0x55, 0x0c, 0xad, 0x5b, 0x50, 0x9e, 0x33, 0x48, 0xfb,
         0xc4, 0xef, 0xa3, 0xa1, 0x41, 0x3d, 0x39, 0x3c, 0xb6, 0x50} },
    { "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
        {0xdb, 0x4b, 0xfc, 0xbd, 0x4d, 0xa0, 0xcd, 0x85, 0xa6, 0x0c, 0x3c,
         0x37, 0xd3, 0xfb, 0xd8, 0x80, 0x5c, 0x77, 0xf1, 0x5f, 0xc6, 0xb1,
         0xfd, 0xfe, 0x61, 0x4e, 0xe0, 0xa7, 0xc8, 0xfd, 0xb4, 0xc0} },
    { NULL }
};


void
VSHA256_Test(void)
{
        struct VSHA256Context c;
        const struct sha256test *p;
        unsigned char o[32];

        for (p = sha256test; p->input != NULL; p++) {
                VSHA256_Init(&c);
                VSHA256_Update(&c, p->input, strlen(p->input));
                VSHA256_Final(o, &c);
                AZ(memcmp(o, p->output, 32));
        }
}

		varnish-cache/lib/libvarnish/vsha256.c
0		/*-
1		* Copyright 2005 Colin Percival
2		* All rights reserved.
3		*
4		* SPDX-License-Identifier: BSD-2-Clause
5		*
6		* Redistribution and use in source and binary forms, with or without
7		* modification, are permitted provided that the following conditions
8		* are met:
9		* 1. Redistributions of source code must retain the above copyright
10		* notice, this list of conditions and the following disclaimer.
11		* 2. Redistributions in binary form must reproduce the above copyright
12		* notice, this list of conditions and the following disclaimer in the
13		* documentation and/or other materials provided with the distribution.
14		*
15		* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16		* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18		* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19		* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20		* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21		* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23		* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24		* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25		* SUCH DAMAGE.
26		*
27		* From:
28		* $FreeBSD: sys/crypto/sha2/sha256c.c 300966 2016-05-29 17:26:40Z cperciva $
29		*/
30
31		#include "config.h"
32
33		#ifndef __DARWIN_BYTE_ORDER
34		# include <endian.h>
35		# ifdef _BYTE_ORDER
36		# define VBYTE_ORDER _BYTE_ORDER
37		# else
38		# define VBYTE_ORDER __BYTE_ORDER
39		# endif
40		# ifdef _BIG_ENDIAN
41		# define VBIG_ENDIAN _BIG_ENDIAN
42		# else
43		# define VBIG_ENDIAN __BIG_ENDIAN
44		# endif
45		#else
46		# define VBYTE_ORDER __DARWIN_BYTE_ORDER
47		# define VBIG_ENDIAN __DARWIN_BIG_ENDIAN
48		#endif
49
50		#ifndef VBYTE_ORDER
51		# error VBYTE_ORDER not defined
52		#endif
53		#ifndef VBIG_ENDIAN
54		# error VBIG_ENDIAN not defined
55		#endif
56
57
58		#include <sys/types.h>
59		#include <stdint.h>
60		#include <string.h>
61
62		#include "vdef.h"
63
64		#include "vas.h"
65		#include "vend.h"
66		#include "vsha256.h"
67
68		#if VBYTE_ORDER == VBIG_ENDIAN
69
70		/* Copy a vector of big-endian uint32_t into a vector of bytes */
71		#define be32enc_vect(dst, src, len) \
72		memcpy((void )dst, (const void )src, (size_t)len)
73
74		/* Copy a vector of bytes into a vector of big-endian uint32_t */
75		#define be32dec_vect(dst, src, len) \
76		memcpy((void )dst, (const void )src, (size_t)len)
77
78		#else /* BYTE_ORDER != BIG_ENDIAN or in doubt... */
79
80		/*
81		* Encode a length len/4 vector of (uint32_t) into a length len vector of
82		* (unsigned char) in big-endian form. Assumes len is a multiple of 4.
83		*/
84		static void
85	39502	be32enc_vect(unsigned char dst, const uint32_t src, size_t len)
86		{
87		size_t i;
88
89	355514	for (i = 0; i < len / 4; i++)
90	316012	vbe32enc(dst + i * 4, src[i]);
91	39502	}
92
93		/*
94		* Decode a big-endian length len vector of (unsigned char) into a length
95		* len/4 vector of (uint32_t). Assumes len is a multiple of 4.
96		*/
97		static void
98	75320	be32dec_vect(uint32_t dst, const unsigned char src, size_t len)
99		{
100		size_t i;
101
102	1280440	for (i = 0; i < len / 4; i++)
103	1205120	dst[i] = vbe32dec(src + i * 4);
104	75320	}
105
106		#endif /* BYTE_ORDER != BIG_ENDIAN */
107
108		/* SHA256 round constants. */
109		static const uint32_t K[64] = {
110		0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
111		0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
112		0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
113		0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
114		0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
115		0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
116		0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
117		0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
118		0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
119		0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
120		0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
121		0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
122		0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
123		0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
124		0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
125		0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
126		};
127
128		/* Elementary functions used by SHA256 */
129		#define Ch(x, y, z) ((x & (y ^ z)) ^ z)
130		#define Maj(x, y, z) ((x & (y \| z)) \| (y & z))
131		#define SHR(x, n) (x >> n)
132		#define ROTR(x, n) ((x >> n) \| (x << (32 - n)))
133		#define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
134		#define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
135		#define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
136		#define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
137
138		/* SHA256 round function */
139		#define RND(a, b, c, d, e, f, g, h, k) \
140		do { \
141		h += S1(e) + Ch(e, f, g) + (k); \
142		d += h; \
143		h += S0(a) + Maj(a, b, c); \
144		} while (0)
145
146		/* Adjusted round function for rotating state */
147		#define RNDr(S, W, i, ii) \
148		RND(S[(64 - i) % 8], S[(65 - i) % 8], \
149		S[(66 - i) % 8], S[(67 - i) % 8], \
150		S[(68 - i) % 8], S[(69 - i) % 8], \
151		S[(70 - i) % 8], S[(71 - i) % 8], \
152		W[i + ii] + K[i + ii])
153
154		/* Message schedule computation */
155		#define MSCH(W, ii, i) \
156		do { \
157		W[i + ii + 16] = \
158		s1(W[i + ii + 14]) + W[i + ii + 9] + \
159		s0(W[i + ii + 1]) + W[i + ii]; \
160		} while (0)
161
162		/*
163		* SHA256 block compression function. The 256-bit state is transformed via
164		* the 512-bit input block to produce a new state.
165		*/
166		static void
167	75320	VSHA256_Transform(uint32_t * state, const unsigned char block[64])
168		{
169		uint32_t W[64];
170		uint32_t S[8];
171		int i;
172
173		/* 1. Prepare the first part of the message schedule W. */
174	75320	be32dec_vect(W, block, 64);
175
176		/* 2. Initialize working variables. */
177	75320	memcpy(S, state, 32);
178
179		/* 3. Mix. */
180	301276	for (i = 0; i < 64; i += 16) {
181	301276	RNDr(S, W, 0, i);
182	301276	RNDr(S, W, 1, i);
183	301276	RNDr(S, W, 2, i);
184	301276	RNDr(S, W, 3, i);
185	301276	RNDr(S, W, 4, i);
186	301276	RNDr(S, W, 5, i);
187	301276	RNDr(S, W, 6, i);
188	301276	RNDr(S, W, 7, i);
189	301276	RNDr(S, W, 8, i);
190	301276	RNDr(S, W, 9, i);
191	301276	RNDr(S, W, 10, i);
192	301276	RNDr(S, W, 11, i);
193	301276	RNDr(S, W, 12, i);
194	301276	RNDr(S, W, 13, i);
195	301276	RNDr(S, W, 14, i);
196	301276	RNDr(S, W, 15, i);
197
198	301276	if (i == 48)
199	75320	break;
200	225956	MSCH(W, 0, i);
201	225956	MSCH(W, 1, i);
202	225956	MSCH(W, 2, i);
203	225956	MSCH(W, 3, i);
204	225956	MSCH(W, 4, i);
205	225956	MSCH(W, 5, i);
206	225956	MSCH(W, 6, i);
207	225956	MSCH(W, 7, i);
208	225956	MSCH(W, 8, i);
209	225956	MSCH(W, 9, i);
210	225956	MSCH(W, 10, i);
211	225956	MSCH(W, 11, i);
212	225956	MSCH(W, 12, i);
213	225956	MSCH(W, 13, i);
214	225956	MSCH(W, 14, i);
215	225956	MSCH(W, 15, i);
216	225956	}
217
218		/* 4. Mix local working variables into global state */
219	677880	for (i = 0; i < 8; i++)
220	602560	state[i] += S[i];
221	75320	}
222
223		static const unsigned char PAD[64] = {
224		0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
225		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
226		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
227		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
228		};
229
230		/* Add padding and terminating bit-count. */
231		static void
232	39501	VSHA256_Pad(VSHA256_CTX * ctx)
233		{
234		size_t r;
235
236		/* Figure out how many bytes we have buffered. */
237	39501	r = (ctx->count >> 3) & 0x3f;
238
239		/* Pad to 56 mod 64, transforming if we finish a block en route. */
240	39501	if (r < 56) {
241		/* Pad to 56 mod 64. */
242	36231	memcpy(&ctx->buf[r], PAD, 56 - r);
243	36231	} else {
244		/* Finish the current block and mix. */
245	3270	memcpy(&ctx->buf[r], PAD, 64 - r);
246	3270	VSHA256_Transform(ctx->state, ctx->buf);
247
248		/* The start of the final block is all zeroes. */
249	3270	memset(&ctx->buf[0], 0, 56);
250		}
251
252		/* Add the terminating bit-count. */
253	39501	vbe64enc(&ctx->buf[56], ctx->count);
254
255		/* Mix in the final block. */
256	39501	VSHA256_Transform(ctx->state, ctx->buf);
257	39501	}
258
259		/* SHA-256 initialization. Begins a SHA-256 operation. */
260		void
261	38251	VSHA256_Init(VSHA256_CTX * ctx)
262		{
263
264		/* Zero bits processed so far */
265	38251	ctx->count = 0;
266
267		/* Magic initialization constants */
268	38251	ctx->state[0] = 0x6A09E667;
269	38251	ctx->state[1] = 0xBB67AE85;
270	38251	ctx->state[2] = 0x3C6EF372;
271	38251	ctx->state[3] = 0xA54FF53A;
272	38251	ctx->state[4] = 0x510E527F;
273	38251	ctx->state[5] = 0x9B05688C;
274	38251	ctx->state[6] = 0x1F83D9AB;
275	38251	ctx->state[7] = 0x5BE0CD19;
276	38251	}
277
278		/* Add bytes into the hash */
279		void
280	1606675	VSHA256_Update(VSHA256_CTX * ctx, const void *in, size_t len)
281		{
282		uint64_t bitlen;
283		uint32_t r;
284	1606675	const unsigned char *src = in;
285
286		/* Number of bytes left in the buffer from previous updates */
287	1606675	r = (ctx->count >> 3) & 0x3f;
288
289		/* Convert the length into a number of bits */
290	1606675	bitlen = len << 3;
291
292		/* Update number of bits */
293	1606675	ctx->count += bitlen;
294
295		/* Handle the case where we don't need to perform any transforms */
296	1606675	if (len < 64 - r) {
297	1575396	memcpy(&ctx->buf[r], src, len);
298	1575396	return;
299		}
300
301		/* Finish the current block */
302	31279	memcpy(&ctx->buf[r], src, 64 - r);
303	31279	VSHA256_Transform(ctx->state, ctx->buf);
304	31279	src += 64 - r;
305	31279	len -= 64 - r;
306
307		/* Perform complete blocks */
308	32548	while (len >= 64) {
309	1269	VSHA256_Transform(ctx->state, src);
310	1269	src += 64;
311	1269	len -= 64;
312		}
313
314		/* Copy left over data into buffer */
315	31279	memcpy(ctx->buf, src, len);
316	1606675	}
317
318		/*
319		* SHA-256 finalization. Pads the input data, exports the hash value,
320		* and clears the context state.
321		*/
322		void
323	39501	VSHA256_Final(unsigned char digest[static VSHA256_DIGEST_LENGTH],
324		VSHA256_CTX *ctx)
325		{
326
327		/* Add padding */
328	39501	VSHA256_Pad(ctx);
329
330		/* Write the hash */
331	39501	be32enc_vect(digest, ctx->state, VSHA256_DIGEST_LENGTH);
332
333		/* Clear the context state */
334	39501	memset((void )ctx, 0, sizeof(ctx));
335	39501	}
336
337		/*
338		* A few test-vectors, just in case
339		*/
340
341		static const struct sha256test {
342		const char *input;
343		const unsigned char output[32];
344		} sha256test[] = {
345		{ "",
346		{0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4,
347		0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b,
348		0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55} },
349		{ "message digest",
350		{0xf7, 0x84, 0x6f, 0x55, 0xcf, 0x23, 0xe1, 0x4e, 0xeb, 0xea, 0xb5,
351		0xb4, 0xe1, 0x55, 0x0c, 0xad, 0x5b, 0x50, 0x9e, 0x33, 0x48, 0xfb,
352		0xc4, 0xef, 0xa3, 0xa1, 0x41, 0x3d, 0x39, 0x3c, 0xb6, 0x50} },
353		{ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
354		{0xdb, 0x4b, 0xfc, 0xbd, 0x4d, 0xa0, 0xcd, 0x85, 0xa6, 0x0c, 0x3c,
355		0x37, 0xd3, 0xfb, 0xd8, 0x80, 0x5c, 0x77, 0xf1, 0x5f, 0xc6, 0xb1,
356		0xfd, 0xfe, 0x61, 0x4e, 0xe0, 0xa7, 0xc8, 0xfd, 0xb4, 0xc0} },
357		{ NULL }
358		};
359
360
361		void
362	3069	VSHA256_Test(void)
363		{
364		struct VSHA256Context c;
365		const struct sha256test *p;
366		unsigned char o[32];
367
368	12276	for (p = sha256test; p->input != NULL; p++) {
369	9207	VSHA256_Init(&c);
370	9207	VSHA256_Update(&c, p->input, strlen(p->input));
371	9207	VSHA256_Final(o, &c);
372	9207	AZ(memcmp(o, p->output, 32));
373	9207	}
374	3069	}