Refactor and cleanup duplicate code in the isc_hmac functions

bin/named/server.c

@@ -28,7 +28,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/httpd.h>
 #include <isc/lex.h>
 #include <isc/meminfo.h>

bin/tests/optional/.gitignore

@@ -0,0 +1,5 @@
+/backtrace_test.dSYM/
+/backtrace_test0.dSYM/
+/backtrace_test_nosymtbl
+/backtrace_test_nosymtbl.dSYM/
+/nsecify

bin/tests/optional/hash_test.c

@@ -15,8 +15,7 @@
 #include <stdio.h>
 #include <string.h>
 
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/md5.h>
 #include <isc/sha1.h>
 #include <isc/util.h>
@@ -105,7 +104,7 @@ main(int argc, char **argv) {
 	isc_hmacmd5_init(&hmacmd5, key, 16);
 	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-	isc_hmacmd5_sign(&hmacmd5, digest);
+	isc_hmacmd5_sign(&hmacmd5, digest, ISC_MD5_DIGESTLENGTH);
 	print_digest(s, "hmacmd5", digest, 4);
 
 	s = "what do ya want for nothing?";
@@ -113,7 +112,7 @@ main(int argc, char **argv) {
 	isc_hmacmd5_init(&hmacmd5, key, 4);
 	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-	isc_hmacmd5_sign(&hmacmd5, digest);
+	isc_hmacmd5_sign(&hmacmd5, digest, ISC_MD5_DIGESTLENGTH);
 	print_digest(s, "hmacmd5", digest, 4);
 
 	s = "\335\335\335\335\335\335\335\335\335\335"
@@ -125,7 +124,7 @@ main(int argc, char **argv) {
 	isc_hmacmd5_init(&hmacmd5, key, 16);
 	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-	isc_hmacmd5_sign(&hmacmd5, digest);
+	isc_hmacmd5_sign(&hmacmd5, digest, ISC_MD5_DIGESTLENGTH);
 	print_digest(s, "hmacmd5", digest, 4);
 #endif
 

contrib/dnsperf-2.1.0.0-1/dns.c

@@ -42,8 +42,7 @@
 
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -388,7 +387,7 @@ hmac_sign(perf_dnstsigkey_t *tsigkey, hmac_ctx_t *ctx, unsigned char *digest,
 {
 	switch (tsigkey->hmactype) {
 	case TSIG_HMACMD5:
-		isc_hmacmd5_sign(&ctx->hmacmd5, digest);
+		isc_hmacmd5_sign(&ctx->hmacmd5, digest, digestlen);
 		break;
 	case TSIG_HMACSHA1:
 		isc_hmacsha1_sign(&ctx->hmacsha1, digest, digestlen);

lib/dns/dst_api.c

@@ -33,7 +33,7 @@
 #include <isc/buffer.h>
 #include <isc/dir.h>
 #include <isc/fsaccess.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>

lib/dns/dst_internal.h

@@ -38,8 +38,7 @@
 #include <isc/sha1.h>
 #include <isc/sha2.h>
 #include <isc/stdtime.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 
 #include <pk11/site.h>
 

lib/dns/hmac_link.c

@@ -26,8 +26,7 @@
 #include <config.h>
 
 #include <isc/buffer.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/md5.h>
 #include <isc/random.h>
 #include <isc/sha1.h>
@@ -106,7 +105,7 @@ hmacmd5_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	if (isc_buffer_availablelength(sig) < ISC_MD5_DIGESTLENGTH)
 		return (ISC_R_NOSPACE);
 	digest = isc_buffer_used(sig);
-	isc_hmacmd5_sign(hmacmd5ctx, digest);
+	isc_hmacmd5_sign(hmacmd5ctx, digest, ISC_MD5_DIGESTLENGTH);
 	isc_buffer_add(sig, ISC_MD5_DIGESTLENGTH);
 
 	return (ISC_R_SUCCESS);
@@ -119,7 +118,7 @@ hmacmd5_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	if (sig->length > ISC_MD5_DIGESTLENGTH)
 		return (DST_R_VERIFYFAILURE);
 
-	if (isc_hmacmd5_verify2(hmacmd5ctx, sig->base, sig->length))
+	if (isc_hmacmd5_verify(hmacmd5ctx, sig->base, sig->length))
 		return (ISC_R_SUCCESS);
 	else
 		return (DST_R_VERIFYFAILURE);
@@ -358,7 +357,6 @@ dst__hmacmd5_init(dst_func_t **funcp) {
 	 */
 
 	RUNTIME_CHECK(isc_md5_check(ISC_FALSE));
-	RUNTIME_CHECK(isc_hmacmd5_check(0));
 
 	REQUIRE(funcp != NULL);
 	if (*funcp == NULL)
@@ -649,7 +647,6 @@ dst__hmacsha1_init(dst_func_t **funcp) {
 	 * Prevent use of incorrect crypto
 	 */
 	RUNTIME_CHECK(isc_sha1_check(ISC_FALSE));
-	RUNTIME_CHECK(isc_hmacsha1_check(0));
 
 	REQUIRE(funcp != NULL);
 	if (*funcp == NULL)

lib/dns/resolver.c

@@ -29,7 +29,7 @@
 #ifdef AES_CC
 #include <isc/aes.h>
 #else
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #endif
 
 #include <dns/acl.h>

lib/isc/Makefile.in

@@ -52,11 +52,12 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
 		aes.@O@ assertions.@O@ backtrace.@O@ base32.@O@ base64.@O@ \
 		bind9.@O@ buffer.@O@ bufferlist.@O@ \
 		commandline.@O@ counter.@O@ crc64.@O@ error.@O@ event.@O@ \
-		hash.@O@ ht.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ \
-		hmacsha.@O@ httpd.@O@ iterated_hash.@O@ \
+		hash.@O@ ht.@O@ heap.@O@ hex.@O@ hmac.@O@ \
+		httpd.@O@ iterated_hash.@O@ \
 		lex.@O@ lfsr.@O@ lib.@O@ log.@O@ \
 		md5.@O@ mem.@O@ mutexblock.@O@ \
 		netaddr.@O@ netscope.@O@ pool.@O@ \
+		openssl_shim.@O@ \
 		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
 		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
 		rwlock.@O@ \
@@ -70,10 +71,11 @@ SYMTBLOBJS =	backtrace-emptytbl.@O@
 SRCS =		@ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
 		aes.c assertions.c backtrace.c base32.c base64.c bind9.c \
 		buffer.c bufferlist.c commandline.c counter.c crc64.c \
-		error.c event.c hash.c ht.c heap.c hex.c hmacmd5.c \
-		hmacsha.c httpd.c iterated_hash.c \
+		error.c event.c hash.c ht.c heap.c hex.c hmac.c \
+		httpd.c iterated_hash.c \
 		lex.c lfsr.c lib.c log.c \
 		md5.c mem.c mutexblock.c \
+		openssl_shim.c \
 		netaddr.c netscope.c pool.c \
 		parseint.c portset.c quota.c radix.c random.c \
 		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \

lib/isc/aes.c

@@ -27,18 +27,10 @@
 #include <openssl/opensslv.h>
 #include <openssl/evp.h>
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define EVP_CIPHER_CTX_new() &(_context), EVP_CIPHER_CTX_init(&_context)
-#define EVP_CIPHER_CTX_free(c) RUNTIME_CHECK(EVP_CIPHER_CTX_cleanup(c) == 1)
-#endif
-
 void
 isc_aes128_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out)
 {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif
 	EVP_CIPHER_CTX *c;
 	int len;
 
@@ -56,9 +48,6 @@ void
 isc_aes192_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out)
 {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif
 	EVP_CIPHER_CTX *c;
 	int len;
 
@@ -76,9 +65,6 @@ void
 isc_aes256_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out)
 {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif
 	EVP_CIPHER_CTX *c;
 	int len;
 

lib/isc/hmac.c

@@ -0,0 +1,386 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include "config.h"
+
+#include <isc/assertions.h>
+#include <isc/hmac.h>
+#include <isc/platform.h>
+#include <isc/safe.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
+#include <isc/string.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+static size_t
+isc_hmac_digestlength(isc_hmac_algo_t algo) {
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return 64;
+	case ISC_HMAC_ALGO_SHA1: return ISC_SHA1_BLOCK_LENGTH;
+	case ISC_HMAC_ALGO_SHA224: return ISC_SHA224_BLOCK_LENGTH;
+	case ISC_HMAC_ALGO_SHA256: return ISC_SHA256_BLOCK_LENGTH;
+	case ISC_HMAC_ALGO_SHA384: return ISC_SHA384_BLOCK_LENGTH;
+	case ISC_HMAC_ALGO_SHA512: return ISC_SHA512_BLOCK_LENGTH;
+	default:
+		REQUIRE(0);
+	}
+}	
+
+#define isc_hmac_blocklength(algo) isc_hmac_digestlength(algo)
+
+#ifdef OPENSSL
+
+#include <isc/openssl_shim.h>
+
+static const EVP_MD *
+isc_hmac_evp_md(isc_hmac_algo_t algo) {
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return EVP_md5(); break;
+	case ISC_HMAC_ALGO_SHA1: return EVP_sha1(); break;
+	case ISC_HMAC_ALGO_SHA224: return EVP_sha224(); break;
+	case ISC_HMAC_ALGO_SHA256: return EVP_sha256(); break;
+	case ISC_HMAC_ALGO_SHA384: return EVP_sha384(); break;
+	case ISC_HMAC_ALGO_SHA512: return EVP_sha512(); break;
+	default:
+		REQUIRE(0);
+	}
+}
+
+void
+isc_hmac_init_openssl(isc_hmac_t *ctx, const unsigned char *key, unsigned int len, isc_hmac_algo_t algo) {
+	ctx->ctx = HMAC_CTX_new();
+	RUNTIME_CHECK(ctx->ctx != NULL);
+	RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *)key, (int)len,
+				   isc_hmac_evp_md(algo), NULL) == 1);
+}
+
+void
+isc_hmac_invalidate_openssl(isc_hmac_t *ctx, isc_hmac_algo_t algo)
+{
+	UNUSED(algo);
+	if (ctx->ctx == NULL) {
+		return;
+	}
+	HMAC_CTX_free(ctx->ctx);
+	ctx->ctx = NULL;
+}
+
+void
+isc_hmac_update_openssl(isc_hmac_t *ctx, const unsigned char *buf, unsigned int len,
+		isc_hmac_algo_t algo)
+{
+	UNUSED(algo);
+	if (len == 0) {
+		return;
+	}
+	RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int)len) == 1);
+}
+
+
+void
+isc_hmac_sign_openssl(isc_hmac_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo)
+{
+	size_t digestlen = isc_hmac_digestlength(algo);
+	REQUIRE(len <= digestlen);
+
+	unsigned char newdigest[digestlen];
+
+	RUNTIME_CHECK(HMAC_Final(ctx->ctx, newdigest, NULL));
+	isc_hmac_invalidate_openssl(ctx, algo);
+	memcpy(digest, newdigest, len);
+	isc_safe_memwipe(newdigest, sizeof(newdigest));
+}
+
+isc_boolean_t
+isc_hmac_verify_openssl(isc_hmac_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo) {
+	size_t digestlen = isc_hmac_digestlength(algo);
+	unsigned char newdigest[digestlen];
+
+	REQUIRE(len <= digestlen);
+	isc_hmac_sign_openssl(ctx, newdigest, digestlen, algo);
+	return (isc_safe_memequal(digest, newdigest, len));
+}
+
+#elif PKCS11CRYPTO
+
+#include <pk11/internal.h>
+#include <pk11/pk11.h>
+#include <pkcs11/pkcs11.h>
+
+static CK_BBOOL truevalue = TRUE;
+static CK_BBOOL falsevalue = FALSE;
+
+static CK_MECHANISM_TYPE
+isc_hmac_mechanism_type_pkcs11(isc_hmac_algo_t algo)
+{
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return CKM_MD5_HMAC;
+	case ISC_HMAC_ALGO_SHA1: return CKM_SHA_1_HMAC;
+	case ISC_HMAC_ALGO_SHA224: return CKM_SHA224_HMAC;
+	case ISC_HMAC_ALGO_SHA256: return CKM_SHA256_HMAC;
+	case ISC_HMAC_ALGO_SHA384: return CKM_SHA384_HMAC;
+	case ISC_HMAC_ALGO_SHA512: return CKM_SHA512_HMAC;
+	default:
+		REQUIRE(0);
+	}
+}
+
+static CK_KEY_TYPE
+isc_hmac_key_type_pkcs11(isc_hmac_algo_t algo)
+{
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return CKK_MD5_HMAC;
+	case ISC_HMAC_ALGO_SHA1: return CKK_SHA_1_HMAC;
+	case ISC_HMAC_ALGO_SHA224: return CKK_SHA224_HMAC;
+	case ISC_HMAC_ALGO_SHA256: return CKK_SHA256_HMAC;
+	case ISC_HMAC_ALGO_SHA384: return CKK_SHA384_HMAC;
+	case ISC_HMAC_ALGO_SHA512: return CKK_SHA512_HMAC;
+	default:
+		REQUIRE(0);
+	}
+}
+
+void
+isc_hmac_init_pkcs11(isc_hmac_t *ctx, const unsigned char *key,
+	      unsigned int len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	CK_MECHANISM mech = { isc_hmac_mechanism_type_pkcs11(algo), NULL, 0 };
+	CK_OBJECT_CLASS keyClass = CKO_SECRET_KEY;
+	CK_KEY_TYPE keyType = isc_hmac_key_type_pkcs11(algo);
+	CK_ATTRIBUTE keyTemplate[] =
+	{
+		{ CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },
+		{ CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
+		{ CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
+		{ CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
+		{ CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },
+		{ CKA_VALUE, NULL, (CK_ULONG) len }
+	};
+#ifdef PK11_PAD_HMAC_KEYS
+	size_t digestlen = isc_hmac_digestlength(algo);
+	CK_BYTE keypad[digestlen];
+
+	if (len < digestlen) {
+		memset(keypad, 0, digestlen);
+		memcpy(keypad, key, len);
+		keyTemplate[5].pValue = keypad;
+		keyTemplate[5].ulValueLen = digestlen;
+	} else {
+		DE_CONST(key, keyTemplate[5].pValue);
+	}
+#else
+	DE_CONST(key, keyTemplate[5].pValue);
+#endif
+	RUNTIME_CHECK(pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
+				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS);
+	ctx->object = CK_INVALID_HANDLE;
+	PK11_FATALCHECK(pkcs_C_CreateObject,
+			(ctx->session, keyTemplate,
+			 (CK_ULONG) 6, &ctx->object));
+	INSIST(ctx->object != CK_INVALID_HANDLE);
+	PK11_FATALCHECK(pkcs_C_SignInit, (ctx->session, &mech, ctx->object));
+}
+
+void
+isc_hmac_invalidate_pkcs11(isc_hmac_t *ctx, isc_hmac_algo_t algo) {
+	CK_ULONG digestlen = (CK_ULONG)isc_hmac_digestlength(algo);
+	CK_BYTE garbage[digestlen];
+
+	if (ctx->handle == NULL) {
+		return;
+	}
+	(void) pkcs_C_SignFinal(ctx->session, garbage, &digestlen);
+	isc_safe_memwipe(garbage, sizeof(garbage));
+	if (ctx->object != CK_INVALID_HANDLE) {
+		(void) pkcs_C_DestroyObject(ctx->session, ctx->object);
+	}
+	ctx->object = CK_INVALID_HANDLE;
+	pk11_return_session(ctx);
+}
+
+void
+isc_hmac_update_pkcs11(isc_hmac_t *ctx, const unsigned char *buf,
+		    unsigned int len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	CK_BYTE_PTR pPart;
+
+	UNUSED(algo);
+	
+	DE_CONST(buf, pPart);
+	PK11_FATALCHECK(pkcs_C_SignUpdate,
+			(ctx->session, pPart, (CK_ULONG) len));
+}
+
+void
+isc_hmac_sign_pkcs11(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo) {
+	CK_RV rv;
+	size_t digestlen = isc_hmac_digestlength(algo);
+	CK_BYTE newdigest[digestlen];
+	CK_ULONG psl = digestlen;
+
+	REQUIRE(len <= digestlen);
+
+	PK11_FATALCHECK(pkcs_C_SignFinal, (ctx->session, newdigest, &psl));
+	if (ctx->object != CK_INVALID_HANDLE)
+		(void) pkcs_C_DestroyObject(ctx->session, ctx->object);
+	ctx->object = CK_INVALID_HANDLE;
+	pk11_return_session(ctx);
+	memmove(digest, newdigest, len);
+	isc_safe_memwipe(newdigest, sizeof(newdigest));
+}
+
+isc_boolean_t
+isc_hmac_verify_pkcs11(isc_hmac_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo) {
+	size_t digestlen = isc_hmac_digestlength(algo);
+	unsigned char newdigest[digestlen];
+
+	REQUIRE(len <= digestlen);
+	isc_hmac_sign_pkcs11(ctx, newdigest, digestlen, algo);
+	return (isc_safe_memequal(digest, newdigest, len));
+}
+
+#define PADLEN 64
+#define IPAD 0x36
+#define OPAD 0x5C
+
+static CK_MECHANISM_TYPE
+isc_hmac_mechanism_type_pkcs11_replace(isc_hmac_algo_t algo)
+{
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return CKM_MD5;
+	case ISC_HMAC_ALGO_SHA1: return CKM_SHA_1;
+	case ISC_HMAC_ALGO_SHA224: return CKM_SHA224;
+	case ISC_HMAC_ALGO_SHA256: return CKM_SHA256;
+	case ISC_HMAC_ALGO_SHA384: return CKM_SHA384;
+	case ISC_HMAC_ALGO_SHA512: return CKM_SHA512;
+	default:
+		REQUIRE(0);
+	}
+}
+
+void
+isc_hmac_init_pkcs11_replace(isc_hmacsha1_t *ctx, const unsigned char *key,
+	      unsigned int len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	CK_MECHANISM mech = { isc_hmac_mechanism_type_pkcs11_replace(algo), NULL, 0 };
+	size_t blocklen = isc_hmac_blocklength(algo);
+	unsigned char ipad[blocklen];
+	unsigned int i;
+
+	RUNTIME_CHECK(pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
+				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS);
+	RUNTIME_CHECK((ctx->key = pk11_mem_get(blocklen)) != NULL);
+	if (len > blocklen) {
+		CK_BYTE_PTR kPart;
+		CK_ULONG kl;
+
+		PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
+		DE_CONST(key, kPart);
+		PK11_FATALCHECK(pkcs_C_DigestUpdate,
+				(ctx->session, kPart, (CK_ULONG) len));
+		kl = blocklen;
+		PK11_FATALCHECK(pkcs_C_DigestFinal,
+				(ctx->session, (CK_BYTE_PTR) ctx->key, &kl));
+	} else {
+		memcpy(ctx->key, key, len);
+	}
+	PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
+	memset(ipad, IPAD, blocklen);
+	for (i = 0; i < blocklen; i++) {
+		ipad[i] ^= ctx->key[i];
+	}
+	PK11_FATALCHECK(pkcs_C_DigestUpdate,
+			(ctx->session, ipad,
+			 (CK_ULONG) blocklen));
+}
+
+void
+isc_hmac_invalidate_pkcs11_replace(isc_hmac_t *ctx, isc_hmac_algo_t algo) {
+	size_t blocklen = isc_hmac_blocklength(algo);
+	CK_BYTE garbage[blocklen];
+	CK_ULONG len = blocklen;
+
+	if (ctx->key != NULL) {
+		pk11_mem_put(ctx->key, blocklen);
+		ctx->key = NULL;
+	}
+
+	if (ctx->handle == NULL) {
+		return;
+	}
+	(void) pkcs_C_DigestFinal(ctx->session, garbage, &len);
+	isc_safe_memwipe(garbage, sizeof(garbage));
+	pk11_return_session(ctx);
+}
+
+void
+isc_hmac_update_pkcs11_replace(isc_hmac_t *ctx, const unsigned char *buf,
+			       unsigned int len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	CK_BYTE_PTR pPart;
+
+	UNUSED(algo);
+	
+	DE_CONST(buf, pPart);
+	PK11_FATALCHECK(pkcs_C_DigestUpdate,
+			(ctx->session, pPart, (CK_ULONG) len));
+}
+
+void
+isc_hmac_sign_pkcs11_replace(isc_hmacsha1_t *ctx, unsigned char *digest,
+			      size_t len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	size_t digestlen = isc_hmac_digestlength(algo);
+	size_t blocklen = isc_hmac_blocklength(algo);
+	CK_BYTE newdigest[digestlen];
+	CK_ULONG psl = digestlen;
+	CK_MECHANISM mech = { isc_hmac_mechanism_type_pkcs11_replace(algo), NULL, 0 };
+	CK_BYTE opad[blocklen];
+	unsigned int i;
+
+	REQUIRE(len <= digestlen);
+
+	PK11_FATALCHECK(pkcs_C_DigestFinal, (ctx->session, newdigest, &psl));
+	memset(opad, OPAD, blocklen);
+	for (i = 0; i < blocklen; i++) {
+		opad[i] ^= ctx->key[i];
+	}
+	pk11_mem_put(ctx->key, blocklen);
+	ctx->key = NULL;
+	PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
+	PK11_FATALCHECK(pkcs_C_DigestUpdate,
+			(ctx->session, opad,
+			 (CK_ULONG) blocklen));
+	PK11_FATALCHECK(pkcs_C_DigestUpdate,
+			(ctx->session, (CK_BYTE_PTR) newdigest, psl));
+	PK11_FATALCHECK(pkcs_C_DigestFinal, (ctx->session, newdigest, &psl));
+	pk11_return_session(ctx);
+	memmove(digest, newdigest, len);
+	isc_safe_memwipe(newdigest, sizeof(newdigest));
+}
+
+isc_boolean_t
+isc_hmac_verify_pkcs11_replace(isc_hmac_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo) {
+	size_t digestlen = isc_hmac_digestlength(algo);
+	unsigned char newdigest[digestlen];
+
+	REQUIRE(len <= digestlen);
+	isc_hmac_sign_pkcs11_replace(ctx, newdigest, digestlen, algo);
+	return (isc_safe_memequal(digest, newdigest, len));
+}
+
+#endif /* OPENSSL || PKCS11CRYPTO */

lib/isc/hmacmd5.c

@@ -1,419 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file
- * This code implements the HMAC-MD5 keyed hash algorithm
- * described in RFC2104.
- */
-
-#include "config.h"
-
-#include <pk11/site.h>
-
-#ifndef PK11_MD5_DISABLE
-
-#include <isc/assertions.h>
-#include <isc/hmacmd5.h>
-#include <isc/md5.h>
-#include <isc/platform.h>
-#include <isc/safe.h>
-#include <isc/string.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#if HAVE_PKCS11
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-#endif
-
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define HMAC_CTX_new() &(ctx->_ctx), HMAC_CTX_init(&(ctx->_ctx))
-#define HMAC_CTX_free(ptr) HMAC_CTX_cleanup(ptr)
-#endif
-
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len)
-{
-	ctx->ctx = HMAC_CTX_new();
-	RUNTIME_CHECK(ctx->ctx != NULL);
-	RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *) key,
-				   (int) len, EVP_md5(), NULL) == 1);
-}
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
-	if (ctx->ctx == NULL)
-		return;
-	HMAC_CTX_free(ctx->ctx);
-	ctx->ctx = NULL;
-}
-
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len)
-{
-	RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int) len) == 1);
-}
-
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	RUNTIME_CHECK(HMAC_Final(ctx->ctx, digest, NULL) == 1);
-	HMAC_CTX_free(ctx->ctx);
-	ctx->ctx = NULL;
-}
-
-#elif HAVE_PKCS11
-
-#ifndef PK11_MD5_HMAC_REPLACE
-
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len)
-{
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_MD5_HMAC, NULL, 0 };
-	CK_OBJECT_CLASS keyClass = CKO_SECRET_KEY;
-	CK_KEY_TYPE keyType = CKK_MD5_HMAC;
-	CK_ATTRIBUTE keyTemplate[] =
-	{
-		{ CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },
-		{ CKA_VALUE, NULL, (CK_ULONG) len }
-	};
-#ifdef PK11_PAD_HMAC_KEYS
-	CK_BYTE keypad[ISC_MD5_DIGESTLENGTH];
-
-	if (len < ISC_MD5_DIGESTLENGTH) {
-		memset(keypad, 0, ISC_MD5_DIGESTLENGTH);
-		memmove(keypad, key, len);
-		keyTemplate[5].pValue = keypad;
-		keyTemplate[5].ulValueLen = ISC_MD5_DIGESTLENGTH;
-	} else
-		DE_CONST(key, keyTemplate[5].pValue);
-#else
-	DE_CONST(key, keyTemplate[5].pValue);
-#endif
-	RUNTIME_CHECK(pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
-				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS);
-	ctx->object = CK_INVALID_HANDLE;
-	PK11_FATALCHECK(pkcs_C_CreateObject,
-			(ctx->session, keyTemplate,
-			 (CK_ULONG) 6, &ctx->object));
-	INSIST(ctx->object != CK_INVALID_HANDLE);
-	PK11_FATALCHECK(pkcs_C_SignInit, (ctx->session, &mech, ctx->object));
-}
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
-	CK_BYTE garbage[ISC_MD5_DIGESTLENGTH];
-	CK_ULONG len = ISC_MD5_DIGESTLENGTH;
-
-	if (ctx->handle == NULL)
-		return;
-	(void) pkcs_C_SignFinal(ctx->session, garbage, &len);
-	isc_safe_memwipe(garbage, sizeof(garbage));
-	if (ctx->object != CK_INVALID_HANDLE)
-		(void) pkcs_C_DestroyObject(ctx->session, ctx->object);
-	ctx->object = CK_INVALID_HANDLE;
-	pk11_return_session(ctx);
-}
-
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len)
-{
-	CK_RV rv;
-	CK_BYTE_PTR pPart;
-
-	DE_CONST(buf, pPart);
-	PK11_FATALCHECK(pkcs_C_SignUpdate,
-			(ctx->session, pPart, (CK_ULONG) len));
-}
-
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	CK_RV rv;
-	CK_ULONG len = ISC_MD5_DIGESTLENGTH;
-
-	PK11_FATALCHECK(pkcs_C_SignFinal,
-			(ctx->session, (CK_BYTE_PTR) digest, &len));
-	if (ctx->object != CK_INVALID_HANDLE)
-		(void) pkcs_C_DestroyObject(ctx->session, ctx->object);
-	ctx->object = CK_INVALID_HANDLE;
-	pk11_return_session(ctx);
-}
-#else
-/* Replace missing CKM_MD5_HMAC PKCS#11 mechanism */
-
-#define PADLEN 64
-#define IPAD 0x36
-#define OPAD 0x5C
-
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len)
-{
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_MD5, NULL, 0 };
-	unsigned char ipad[PADLEN];
-	unsigned int i;
-
-	RUNTIME_CHECK(pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
-				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS);
-	RUNTIME_CHECK((ctx->key = pk11_mem_get(PADLEN)) != NULL);
-	if (len > PADLEN) {
-		CK_BYTE_PTR kPart;
-		CK_ULONG kl;
-
-		PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
-		DE_CONST(key, kPart);
-		PK11_FATALCHECK(pkcs_C_DigestUpdate,
-				(ctx->session, kPart, (CK_ULONG) len));
-		kl = ISC_MD5_DIGESTLENGTH;
-		PK11_FATALCHECK(pkcs_C_DigestFinal,
-				(ctx->session, (CK_BYTE_PTR) ctx->key, &kl));
-	} else
-		memmove(ctx->key, key, len);
-	PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
-	memset(ipad, IPAD, PADLEN);
-	for (i = 0; i < PADLEN; i++)
-		ipad[i] ^= ctx->key[i];
-	PK11_FATALCHECK(pkcs_C_DigestUpdate,
-			(ctx->session, ipad, (CK_ULONG) PADLEN));
-}
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
-	if (ctx->key != NULL)
-		pk11_mem_put(ctx->key, PADLEN);
-	ctx->key = NULL;
-	isc_md5_invalidate(ctx);
-}
-
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len)
-{
-	CK_RV rv;
-	CK_BYTE_PTR pPart;
-
-	DE_CONST(buf, pPart);
-	PK11_FATALCHECK(pkcs_C_DigestUpdate,
-			(ctx->session, pPart, (CK_ULONG) len));
-}
-
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_MD5, NULL, 0 };
-	CK_ULONG len = ISC_MD5_DIGESTLENGTH;
-	CK_BYTE opad[PADLEN];
-	unsigned int i;
-
-	PK11_FATALCHECK(pkcs_C_DigestFinal,
-			(ctx->session, (CK_BYTE_PTR) digest,
-			 (CK_ULONG_PTR) &len));
-	memset(opad, OPAD, PADLEN);
-	for (i = 0; i < PADLEN; i++)
-		opad[i] ^= ctx->key[i];
-	pk11_mem_put(ctx->key, PADLEN);
-	ctx->key = NULL;
-	PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
-	PK11_FATALCHECK(pkcs_C_DigestUpdate,
-			(ctx->session, opad, (CK_ULONG) PADLEN));
-	PK11_FATALCHECK(pkcs_C_DigestUpdate,
-			(ctx->session, (CK_BYTE_PTR) digest, len));
-	PK11_FATALCHECK(pkcs_C_DigestFinal,
-			(ctx->session,
-			 (CK_BYTE_PTR) digest,
-			 (CK_ULONG_PTR) &len));
-	pk11_return_session(ctx);
-}
-#endif
-
-#else
-
-#define PADLEN 64
-#define IPAD 0x36
-#define OPAD 0x5C
-
-/*!
- * Start HMAC-MD5 process.  Initialize an md5 context and digest the key.
- */
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len)
-{
-	unsigned char ipad[PADLEN];
-	int i;
-
-	memset(ctx->key, 0, sizeof(ctx->key));
-	if (len > sizeof(ctx->key)) {
-		isc_md5_t md5ctx;
-		isc_md5_init(&md5ctx);
-		isc_md5_update(&md5ctx, key, len);
-		isc_md5_final(&md5ctx, ctx->key);
-	} else
-		memmove(ctx->key, key, len);
-
-	isc_md5_init(&ctx->md5ctx);
-	memset(ipad, IPAD, sizeof(ipad));
-	for (i = 0; i < PADLEN; i++)
-		ipad[i] ^= ctx->key[i];
-	isc_md5_update(&ctx->md5ctx, ipad, sizeof(ipad));
-}
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
-	isc_md5_invalidate(&ctx->md5ctx);
-	isc_safe_memwipe(ctx->key, sizeof(ctx->key));
-}
-
-/*!
- * Update context to reflect the concatenation of another buffer full
- * of bytes.
- */
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len)
-{
-	isc_md5_update(&ctx->md5ctx, buf, len);
-}
-
-/*!
- * Compute signature - finalize MD5 operation and reapply MD5.
- */
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	unsigned char opad[PADLEN];
-	int i;
-
-	isc_md5_final(&ctx->md5ctx, digest);
-
-	memset(opad, OPAD, sizeof(opad));
-	for (i = 0; i < PADLEN; i++)
-		opad[i] ^= ctx->key[i];
-
-	isc_md5_init(&ctx->md5ctx);
-	isc_md5_update(&ctx->md5ctx, opad, sizeof(opad));
-	isc_md5_update(&ctx->md5ctx, digest, ISC_MD5_DIGESTLENGTH);
-	isc_md5_final(&ctx->md5ctx, digest);
-	isc_hmacmd5_invalidate(ctx);
-}
-
-#endif /* !ISC_PLATFORM_OPENSSLHASH */
-
-/*!
- * Verify signature - finalize MD5 operation and reapply MD5, then
- * compare to the supplied digest.
- */
-isc_boolean_t
-isc_hmacmd5_verify(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	return (isc_hmacmd5_verify2(ctx, digest, ISC_MD5_DIGESTLENGTH));
-}
-
-isc_boolean_t
-isc_hmacmd5_verify2(isc_hmacmd5_t *ctx, unsigned char *digest, size_t len) {
-	unsigned char newdigest[ISC_MD5_DIGESTLENGTH];
-
-	REQUIRE(len <= ISC_MD5_DIGESTLENGTH);
-	isc_hmacmd5_sign(ctx, newdigest);
-	return (isc_safe_memequal(digest, newdigest, len));
-}
-
-/*
- * Check for MD5 support; if it does not work, raise a fatal error.
- *
- * Use the first test vector from RFC 2104, with a second round using
- * a too-short key.
- *
- * Standard use is testing 0 and expecting result true.
- * Testing use is testing 1..4 and expecting result false.
- */
-isc_boolean_t
-isc_hmacmd5_check(int testing) {
-	isc_hmacmd5_t ctx;
-	unsigned char key[] = { /* 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b */
-		0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
-		0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b
-	};
-	unsigned char input[] = { /* "Hi There" */
-		0x48, 0x69, 0x20, 0x54, 0x68, 0x65, 0x72, 0x65
-	};
-	unsigned char expected[] = {
-		0x92, 0x94, 0x72, 0x7a, 0x36, 0x38, 0xbb, 0x1c,
-		0x13, 0xf4, 0x8e, 0xf8, 0x15, 0x8b, 0xfc, 0x9d
-	};
-	unsigned char expected2[] = {
-		0xad, 0xb8, 0x48, 0x05, 0xb8, 0x8d, 0x03, 0xe5,
-		0x90, 0x1e, 0x4b, 0x05, 0x69, 0xce, 0x35, 0xea
-	};
-	isc_boolean_t result;
-
-	/*
-	 * Introduce a fault for testing.
-	 */
-	switch (testing) {
-	case 0:
-	default:
-		break;
-	case 1:
-		key[0] ^= 0x01;
-		break;
-	case 2:
-		input[0] ^= 0x01;
-		break;
-	case 3:
-		expected[0] ^= 0x01;
-		break;
-	case 4:
-		expected2[0] ^= 0x01;
-		break;
-	}
-
-	/*
-	 * These functions do not return anything; any failure will be fatal.
-	 */
-	isc_hmacmd5_init(&ctx, key, 16U);
-	isc_hmacmd5_update(&ctx, input, 8U);
-	result = isc_hmacmd5_verify2(&ctx, expected, sizeof(expected));
-	if (!result) {
-		return (result);
-	}
-
-	/* Second round using a byte key */
-	isc_hmacmd5_init(&ctx, key, 1U);
-	isc_hmacmd5_update(&ctx, input, 8U);
-	return (isc_hmacmd5_verify2(&ctx, expected2, sizeof(expected2)));
-}
-
-#else /* !PK11_MD5_DISABLE */
-#ifdef WIN32
-/* Make the Visual Studio linker happy */
-#include <isc/util.h>
-
-void isc_hmacmd5_init() { INSIST(0); }
-void isc_hmacmd5_invalidate() { INSIST(0); }
-void isc_hmacmd5_sign() { INSIST(0); }
-void isc_hmacmd5_update() { INSIST(0); }
-void isc_hmacmd5_verify() { INSIST(0); }
-void isc_hmacmd5_verify2() { INSIST(0); }
-void isc_hmacmd5_check() { INSIST(0); }
-#endif
-#endif /* PK11_MD5_DISABLE */

lib/isc/include/isc/Makefile.in

@@ -23,7 +23,7 @@ HEADERS =	aes.h app.h assertions.h backtrace.h base32.h base64.h \
 		commandline.h counter.h crc64.h deprecated.h \
 		entropy.h errno.h error.h event.h eventclass.h \
 		file.h formatcheck.h fsaccess.h fuzz.h \
-		hash.h heap.h hex.h hmacmd5.h hmacsha.h ht.h httpd.h \
+		hash.h heap.h hex.h hmac.h ht.h httpd.h \
 		interfaceiter.h @ISC_IPV6_H@ iterated_hash.h \
 		json.h lang.h lex.h lfsr.h lib.h likely.h list.h log.h \
 		magic.h md5.h mem.h meminfo.h msgcat.h msgs.h mutexblock.h \

lib/isc/include/isc/hmac.h

@@ -0,0 +1,237 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#ifndef ISC_HMAC_H
+#define ISC_HMAC_H
+
+#include <config.h>
+
+#include <isc/types.h>
+#include <isc/platform.h>
+#include <isc/md5.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
+
+typedef enum {
+	ISC_HMAC_MD5_DIGESTLENGTH	= ISC_MD5_BLOCK_LENGTH,
+	ISC_HMAC_SHA1_DIGESTLENGTH	= ISC_SHA1_BLOCK_LENGTH,
+	ISC_HMAC_SHA224_DIGESTLENGTH	= ISC_SHA224_BLOCK_LENGTH,
+	ISC_HMAC_SHA256_DIGESTLENGTH	= ISC_SHA256_BLOCK_LENGTH,
+	ISC_HMAC_SHA384_DIGESTLENGTH	= ISC_SHA384_BLOCK_LENGTH,
+	ISC_HMAC_SHA512_DIGESTLENGTH	= ISC_SHA512_BLOCK_LENGTH
+} isc_hmac_digestlen_t;
+
+typedef enum {
+	ISC_HMAC_ALGO_MD5,
+	ISC_HMAC_ALGO_SHA1,
+	ISC_HMAC_ALGO_SHA224,
+	ISC_HMAC_ALGO_SHA256,
+	ISC_HMAC_ALGO_SHA384,
+	ISC_HMAC_ALGO_SHA512,
+	ISC_HMAC_ALOG_MAX = ISC_HMAC_ALGO_SHA512
+} isc_hmac_algo_t;
+
+#define isc_hmacmd5_t isc_hmac_t
+#define isc_hmacsha1_t isc_hmac_t
+#define isc_hmacsha224_t isc_hmac_t
+#define isc_hmacsha256_t isc_hmac_t
+#define isc_hmacsha384_t isc_hmac_t
+#define isc_hmacsha512_t isc_hmac_t
+
+#ifdef OPENSSL
+#include <openssl/hmac.h>
+
+/* OpenSSL 1.1 compatibility wrappers */
+typedef struct {
+	HMAC_CTX *ctx;
+} isc_hmac_t;
+
+#define isc_hmacmd5_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+
+#define isc_hmacsha1_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+
+#define isc_hmacsha224_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+
+#define isc_hmacsha256_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+
+#define isc_hmacsha384_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+
+#define isc_hmacsha512_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+
+void
+isc_hmac_init_openssl(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_invalidate_openssl(isc_hmac_t *, isc_hmac_algo_t)
+	__attribute__((nonnull(1)));
+
+void
+isc_hmac_update_openssl(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t)
+	__attribute__((nonnull(1)));
+
+void
+isc_hmac_sign_openssl(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t)
+	__attribute__((nonnull(1)));
+
+isc_boolean_t
+isc_hmac_verify_openssl(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t)
+	__attribute__((nonnull(1)));
+
+#elif PKCS11CRYPTO
+
+typedef pk11_context_t isc_hmac_t;
+
+#ifdef PK11_MD5_HMAC_REPLACE
+#define isc_hmacmd5_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#else
+#define isc_hmacmd5_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#endif
+
+#ifdef PK11_SHA_1_HMAC_REPLACE
+#define isc_hmacsha1_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#else
+#define isc_hmacsha1_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#endif	
+
+#ifdef PK11_SHA224_HMAC_REPLACE
+#define isc_hmacsha224_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#else
+#define isc_hmacsha224_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#endif
+
+#ifdef PK11_SHA256_HMAC_REPLACE
+#define isc_hmacsha256_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#else
+#define isc_hmacsha256_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#endif
+
+#ifdef PK11_SHA384_HMAC_REPLACE
+#define isc_hmacsha384_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#else
+#define isc_hmacsha384_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#endif
+
+#ifdef PK11_SHA512_HMAC_REPLACE
+#define isc_hmacsha512_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#else
+#define isc_hmacsha512_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#endif
+
+void
+isc_hmac_init_pkcs11(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_invalidate_pkcs11(isc_hmac_t *, isc_hmac_algo_t);
+
+void
+isc_hmac_update_pkcs11(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_sign_pkcs11(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t);
+
+isc_boolean_t
+isc_hmac_verify_pkcs11(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t);
+
+void
+isc_hmac_init_pkcs11_replace(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_invalidate_pkcs11_replace(isc_hmac_t *, isc_hmac_algo_t);
+
+void
+isc_hmac_update_pkcs11_replace(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_sign_pkcs11_replace(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t);
+
+isc_boolean_t
+isc_hmac_verify_pkcs11_replace(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t);
+
+#else
+
+#error Either OpenSSL or PKCS#11 cryptographic provider is mandatory.
+
+#endif
+
+
+#endif /* ISC_HMAC_H */

lib/isc/include/isc/hmacmd5.h

@@ -1,85 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-
-/*! \file isc/hmacmd5.h
- * \brief This is the header file for the HMAC-MD5 keyed hash algorithm
- * described in RFC2104.
- */
-
-#ifndef ISC_HMACMD5_H
-#define ISC_HMACMD5_H 1
-
-#include <pk11/site.h>
-
-#ifndef PK11_MD5_DISABLE
-
-#include <isc/lang.h>
-#include <isc/md5.h>
-#include <isc/platform.h>
-#include <isc/types.h>
-
-#define ISC_HMACMD5_KEYLENGTH 64
-
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#include <openssl/opensslv.h>
-#include <openssl/hmac.h>
-
-typedef struct {
-	HMAC_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	HMAC_CTX _ctx;
-#endif
-} isc_hmacmd5_t;
-
-#elif HAVE_PKCS11
-#include <pk11/pk11.h>
-
-typedef pk11_context_t isc_hmacmd5_t;
-
-#else
-
-typedef struct {
-	isc_md5_t md5ctx;
-	unsigned char key[ISC_HMACMD5_KEYLENGTH];
-} isc_hmacmd5_t;
-#endif
-
-ISC_LANG_BEGINDECLS
-
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len);
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx);
-
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len);
-
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest);
-
-isc_boolean_t
-isc_hmacmd5_verify(isc_hmacmd5_t *ctx, unsigned char *digest);
-
-isc_boolean_t
-isc_hmacmd5_verify2(isc_hmacmd5_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacmd5_check(int testing);
-
-ISC_LANG_ENDDECLS
-
-#endif /* !PK11_MD5_DISABLE */
-
-#endif /* ISC_HMACMD5_H */

lib/isc/include/isc/hmacsha.h

@@ -1,183 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-
-/*! \file isc/hmacsha.h
- * This is the header file for the HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
- * HMAC-SHA334 and HMAC-SHA512 hash algorithm described in RFC 2104.
- */
-
-#ifndef ISC_HMACSHA_H
-#define ISC_HMACSHA_H 1
-
-#include <isc/lang.h>
-#include <isc/platform.h>
-#include <isc/sha1.h>
-#include <isc/sha2.h>
-#include <isc/types.h>
-
-#define ISC_HMACSHA1_KEYLENGTH ISC_SHA1_BLOCK_LENGTH
-#define ISC_HMACSHA224_KEYLENGTH ISC_SHA224_BLOCK_LENGTH
-#define ISC_HMACSHA256_KEYLENGTH ISC_SHA256_BLOCK_LENGTH
-#define ISC_HMACSHA384_KEYLENGTH ISC_SHA384_BLOCK_LENGTH
-#define ISC_HMACSHA512_KEYLENGTH ISC_SHA512_BLOCK_LENGTH
-
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#include <openssl/opensslv.h>
-#include <openssl/hmac.h>
-
-typedef struct {
-	HMAC_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	HMAC_CTX _ctx;
-#endif
-} isc_hmacsha_t;
-
-typedef isc_hmacsha_t isc_hmacsha1_t;
-typedef isc_hmacsha_t isc_hmacsha224_t;
-typedef isc_hmacsha_t isc_hmacsha256_t;
-typedef isc_hmacsha_t isc_hmacsha384_t;
-typedef isc_hmacsha_t isc_hmacsha512_t;
-
-#elif HAVE_PKCS11
-#include <pk11/pk11.h>
-
-typedef pk11_context_t isc_hmacsha1_t;
-typedef pk11_context_t isc_hmacsha224_t;
-typedef pk11_context_t isc_hmacsha256_t;
-typedef pk11_context_t isc_hmacsha384_t;
-typedef pk11_context_t isc_hmacsha512_t;
-
-#else
-
-typedef struct {
-	isc_sha1_t sha1ctx;
-	unsigned char key[ISC_HMACSHA1_KEYLENGTH];
-} isc_hmacsha1_t;
-
-typedef struct {
-	isc_sha224_t sha224ctx;
-	unsigned char key[ISC_HMACSHA224_KEYLENGTH];
-} isc_hmacsha224_t;
-
-typedef struct {
-	isc_sha256_t sha256ctx;
-	unsigned char key[ISC_HMACSHA256_KEYLENGTH];
-} isc_hmacsha256_t;
-
-typedef struct {
-	isc_sha384_t sha384ctx;
-	unsigned char key[ISC_HMACSHA384_KEYLENGTH];
-} isc_hmacsha384_t;
-
-typedef struct {
-	isc_sha512_t sha512ctx;
-	unsigned char key[ISC_HMACSHA512_KEYLENGTH];
-} isc_hmacsha512_t;
-#endif
-
-ISC_LANG_BEGINDECLS
-
-void
-isc_hmacsha1_init(isc_hmacsha1_t *ctx, const unsigned char *key,
-		  unsigned int len);
-
-void
-isc_hmacsha1_invalidate(isc_hmacsha1_t *ctx);
-
-void
-isc_hmacsha1_update(isc_hmacsha1_t *ctx, const unsigned char *buf,
-		    unsigned int len);
-
-void
-isc_hmacsha1_sign(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha1_verify(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha1_check(int testing);
-
-
-void
-isc_hmacsha224_init(isc_hmacsha224_t *ctx, const unsigned char *key,
-		    unsigned int len);
-
-void
-isc_hmacsha224_invalidate(isc_hmacsha224_t *ctx);
-
-void
-isc_hmacsha224_update(isc_hmacsha224_t *ctx, const unsigned char *buf,
-		      unsigned int len);
-
-void
-isc_hmacsha224_sign(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha224_verify(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len);
-
-
-void
-isc_hmacsha256_init(isc_hmacsha256_t *ctx, const unsigned char *key,
-		    unsigned int len);
-
-void
-isc_hmacsha256_invalidate(isc_hmacsha256_t *ctx);
-
-void
-isc_hmacsha256_update(isc_hmacsha256_t *ctx, const unsigned char *buf,
-		      unsigned int len);
-
-void
-isc_hmacsha256_sign(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha256_verify(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len);
-
-
-void
-isc_hmacsha384_init(isc_hmacsha384_t *ctx, const unsigned char *key,
-		    unsigned int len);
-
-void
-isc_hmacsha384_invalidate(isc_hmacsha384_t *ctx);
-
-void
-isc_hmacsha384_update(isc_hmacsha384_t *ctx, const unsigned char *buf,
-		      unsigned int len);
-
-void
-isc_hmacsha384_sign(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha384_verify(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len);
-
-
-void
-isc_hmacsha512_init(isc_hmacsha512_t *ctx, const unsigned char *key,
-		    unsigned int len);
-
-void
-isc_hmacsha512_invalidate(isc_hmacsha512_t *ctx);
-
-void
-isc_hmacsha512_update(isc_hmacsha512_t *ctx, const unsigned char *buf,
-		      unsigned int len);
-
-void
-isc_hmacsha512_sign(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha512_verify(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len);
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_HMACSHA_H */

lib/isc/include/isc/md5.h

@@ -53,9 +53,6 @@
 
 typedef struct {
 	EVP_MD_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_MD_CTX _ctx;
-#endif
 } isc_md5_t;
 
 #elif HAVE_PKCS11

lib/isc/include/isc/openssl_shim.h

@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#ifndef ISC_OPENSSL_P_H
+#define ISC_OPENSSL_P_H
+
+#include <config.h>
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+
+#include <openssl/engine.h>
+#include <openssl/hmac.h>
+
+void *OPENSSL_zalloc(size_t size);
+EVP_CIPHER_CTX* EVP_CIPHER_CTX_new(void);
+void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx);
+EVP_MD_CTX *EVP_MD_CTX_new(void);
+void EVP_MD_CTX_free(EVP_MD_CTX *ctx);
+int EVP_MD_CTX_reset(EVP_MD_CTX *ctx);
+HMAC_CTX *HMAC_CTX_new(void);
+void HMAC_CTX_free(HMAC_CTX *ctx);
+int HMAC_CTX_reset(HMAC_CTX *ctx);
+
+#endif /* ISC_OPENSSL_P_H */
+
+#endif /* ISC_OPENSSL_P_H */

lib/isc/include/isc/sha1.h

@@ -34,9 +34,6 @@
 
 typedef struct {
 	EVP_MD_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_MD_CTX _ctx;
-#endif
 } isc_sha1_t;
 
 #elif HAVE_PKCS11

lib/isc/include/isc/sha2.h

@@ -72,19 +72,12 @@
 
 /*** SHA-256/384/512 Context Structures *******************************/
 
-#if defined(ISC_PLATFORM_OPENSSLHASH)
+#if OPENSSL
 #include <openssl/opensslv.h>
 #include <openssl/evp.h>
-#endif
-
-#if defined(ISC_PLATFORM_OPENSSLHASH) && !defined(LIBRESSL_VERSION_NUMBER)
-
 
 typedef struct {
 	EVP_MD_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_MD_CTX _ctx;
-#endif
 } isc_sha2_t;
 
 typedef isc_sha2_t isc_sha256_t;
@@ -96,25 +89,6 @@ typedef isc_sha2_t isc_sha512_t;
 typedef pk11_context_t isc_sha256_t;
 typedef pk11_context_t isc_sha512_t;
 
-#else
-
-/*
- * Keep buffer immediately after bitcount to preserve alignment.
- */
-typedef struct {
-	isc_uint32_t	state[8];
-	isc_uint64_t	bitcount;
-	isc_uint8_t	buffer[ISC_SHA256_BLOCK_LENGTH];
-} isc_sha256_t;
-
-/*
- * Keep buffer immediately after bitcount to preserve alignment.
- */
-typedef struct {
-	isc_uint64_t	state[8];
-	isc_uint64_t	bitcount[2];
-	isc_uint8_t	buffer[ISC_SHA512_BLOCK_LENGTH];
-} isc_sha512_t;
 #endif
 
 typedef isc_sha256_t isc_sha224_t;

lib/isc/md5.c

@@ -47,11 +47,9 @@
 
 #include <isc/util.h>
 
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define EVP_MD_CTX_new() &(ctx->_ctx)
-#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
-#endif
+#ifdef OPENSSL
+
+#include <isc/openssl_shim.h>
 
 void
 isc_md5_init(isc_md5_t *ctx) {
@@ -127,216 +125,6 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
 			(ctx->session, (CK_BYTE_PTR) digest, &len));
 	pk11_return_session(ctx);
 }
-
-#else
-
-static void
-byteSwap(isc_uint32_t *buf, unsigned words)
-{
-	unsigned char *p = (unsigned char *)buf;
-
-	do {
-		*buf++ = (isc_uint32_t)((unsigned)p[3] << 8 | p[2]) << 16 |
-			((unsigned)p[1] << 8 | p[0]);
-		p += 4;
-	} while (--words);
-}
-
-/*!
- * Start MD5 accumulation.  Set bit count to 0 and buffer to mysterious
- * initialization constants.
- */
-void
-isc_md5_init(isc_md5_t *ctx) {
-	ctx->buf[0] = 0x67452301;
-	ctx->buf[1] = 0xefcdab89;
-	ctx->buf[2] = 0x98badcfe;
-	ctx->buf[3] = 0x10325476;
-
-	ctx->bytes[0] = 0;
-	ctx->bytes[1] = 0;
-}
-
-void
-isc_md5_invalidate(isc_md5_t *ctx) {
-	isc_safe_memwipe(ctx, sizeof(*ctx));
-}
-
-/*@{*/
-/*! The four core functions - F1 is optimized somewhat */
-
-/* #define F1(x, y, z) (x & y | ~x & z) */
-#define F1(x, y, z) (z ^ (x & (y ^ z)))
-#define F2(x, y, z) F1(z, x, y)
-#define F3(x, y, z) (x ^ y ^ z)
-#define F4(x, y, z) (y ^ (x | ~z))
-/*@}*/
-
-/*! This is the central step in the MD5 algorithm. */
-#define MD5STEP(f,w,x,y,z,in,s) \
-	 (w += f(x,y,z) + in, w = (w<<s | w>>(32-s)) + x)
-
-/*!
- * The core of the MD5 algorithm, this alters an existing MD5 hash to
- * reflect the addition of 16 longwords of new data.  MD5Update blocks
- * the data and converts bytes into longwords for this routine.
- */
-static void
-transform(isc_uint32_t buf[4], isc_uint32_t const in[16]) {
-	register isc_uint32_t a, b, c, d;
-
-	a = buf[0];
-	b = buf[1];
-	c = buf[2];
-	d = buf[3];
-
-	MD5STEP(F1, a, b, c, d, in[0] + 0xd76aa478, 7);
-	MD5STEP(F1, d, a, b, c, in[1] + 0xe8c7b756, 12);
-	MD5STEP(F1, c, d, a, b, in[2] + 0x242070db, 17);
-	MD5STEP(F1, b, c, d, a, in[3] + 0xc1bdceee, 22);
-	MD5STEP(F1, a, b, c, d, in[4] + 0xf57c0faf, 7);
-	MD5STEP(F1, d, a, b, c, in[5] + 0x4787c62a, 12);
-	MD5STEP(F1, c, d, a, b, in[6] + 0xa8304613, 17);
-	MD5STEP(F1, b, c, d, a, in[7] + 0xfd469501, 22);
-	MD5STEP(F1, a, b, c, d, in[8] + 0x698098d8, 7);
-	MD5STEP(F1, d, a, b, c, in[9] + 0x8b44f7af, 12);
-	MD5STEP(F1, c, d, a, b, in[10] + 0xffff5bb1, 17);
-	MD5STEP(F1, b, c, d, a, in[11] + 0x895cd7be, 22);
-	MD5STEP(F1, a, b, c, d, in[12] + 0x6b901122, 7);
-	MD5STEP(F1, d, a, b, c, in[13] + 0xfd987193, 12);
-	MD5STEP(F1, c, d, a, b, in[14] + 0xa679438e, 17);
-	MD5STEP(F1, b, c, d, a, in[15] + 0x49b40821, 22);
-
-	MD5STEP(F2, a, b, c, d, in[1] + 0xf61e2562, 5);
-	MD5STEP(F2, d, a, b, c, in[6] + 0xc040b340, 9);
-	MD5STEP(F2, c, d, a, b, in[11] + 0x265e5a51, 14);
-	MD5STEP(F2, b, c, d, a, in[0] + 0xe9b6c7aa, 20);
-	MD5STEP(F2, a, b, c, d, in[5] + 0xd62f105d, 5);
-	MD5STEP(F2, d, a, b, c, in[10] + 0x02441453, 9);
-	MD5STEP(F2, c, d, a, b, in[15] + 0xd8a1e681, 14);
-	MD5STEP(F2, b, c, d, a, in[4] + 0xe7d3fbc8, 20);
-	MD5STEP(F2, a, b, c, d, in[9] + 0x21e1cde6, 5);
-	MD5STEP(F2, d, a, b, c, in[14] + 0xc33707d6, 9);
-	MD5STEP(F2, c, d, a, b, in[3] + 0xf4d50d87, 14);
-	MD5STEP(F2, b, c, d, a, in[8] + 0x455a14ed, 20);
-	MD5STEP(F2, a, b, c, d, in[13] + 0xa9e3e905, 5);
-	MD5STEP(F2, d, a, b, c, in[2] + 0xfcefa3f8, 9);
-	MD5STEP(F2, c, d, a, b, in[7] + 0x676f02d9, 14);
-	MD5STEP(F2, b, c, d, a, in[12] + 0x8d2a4c8a, 20);
-
-	MD5STEP(F3, a, b, c, d, in[5] + 0xfffa3942, 4);
-	MD5STEP(F3, d, a, b, c, in[8] + 0x8771f681, 11);
-	MD5STEP(F3, c, d, a, b, in[11] + 0x6d9d6122, 16);
-	MD5STEP(F3, b, c, d, a, in[14] + 0xfde5380c, 23);
-	MD5STEP(F3, a, b, c, d, in[1] + 0xa4beea44, 4);
-	MD5STEP(F3, d, a, b, c, in[4] + 0x4bdecfa9, 11);
-	MD5STEP(F3, c, d, a, b, in[7] + 0xf6bb4b60, 16);
-	MD5STEP(F3, b, c, d, a, in[10] + 0xbebfbc70, 23);
-	MD5STEP(F3, a, b, c, d, in[13] + 0x289b7ec6, 4);
-	MD5STEP(F3, d, a, b, c, in[0] + 0xeaa127fa, 11);
-	MD5STEP(F3, c, d, a, b, in[3] + 0xd4ef3085, 16);
-	MD5STEP(F3, b, c, d, a, in[6] + 0x04881d05, 23);
-	MD5STEP(F3, a, b, c, d, in[9] + 0xd9d4d039, 4);
-	MD5STEP(F3, d, a, b, c, in[12] + 0xe6db99e5, 11);
-	MD5STEP(F3, c, d, a, b, in[15] + 0x1fa27cf8, 16);
-	MD5STEP(F3, b, c, d, a, in[2] + 0xc4ac5665, 23);
-
-	MD5STEP(F4, a, b, c, d, in[0] + 0xf4292244, 6);
-	MD5STEP(F4, d, a, b, c, in[7] + 0x432aff97, 10);
-	MD5STEP(F4, c, d, a, b, in[14] + 0xab9423a7, 15);
-	MD5STEP(F4, b, c, d, a, in[5] + 0xfc93a039, 21);
-	MD5STEP(F4, a, b, c, d, in[12] + 0x655b59c3, 6);
-	MD5STEP(F4, d, a, b, c, in[3] + 0x8f0ccc92, 10);
-	MD5STEP(F4, c, d, a, b, in[10] + 0xffeff47d, 15);
-	MD5STEP(F4, b, c, d, a, in[1] + 0x85845dd1, 21);
-	MD5STEP(F4, a, b, c, d, in[8] + 0x6fa87e4f, 6);
-	MD5STEP(F4, d, a, b, c, in[15] + 0xfe2ce6e0, 10);
-	MD5STEP(F4, c, d, a, b, in[6] + 0xa3014314, 15);
-	MD5STEP(F4, b, c, d, a, in[13] + 0x4e0811a1, 21);
-	MD5STEP(F4, a, b, c, d, in[4] + 0xf7537e82, 6);
-	MD5STEP(F4, d, a, b, c, in[11] + 0xbd3af235, 10);
-	MD5STEP(F4, c, d, a, b, in[2] + 0x2ad7d2bb, 15);
-	MD5STEP(F4, b, c, d, a, in[9] + 0xeb86d391, 21);
-
-	buf[0] += a;
-	buf[1] += b;
-	buf[2] += c;
-	buf[3] += d;
-}
-
-/*!
- * Update context to reflect the concatenation of another buffer full
- * of bytes.
- */
-void
-isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) {
-	isc_uint32_t t;
-
-	/* Update byte count */
-
-	t = ctx->bytes[0];
-	if ((ctx->bytes[0] = t + len) < t)
-		ctx->bytes[1]++;	/* Carry from low to high */
-
-	t = 64 - (t & 0x3f);	/* Space available in ctx->in (at least 1) */
-	if (t > len) {
-		memmove((unsigned char *)ctx->in + 64 - t, buf, len);
-		return;
-	}
-	/* First chunk is an odd size */
-	memmove((unsigned char *)ctx->in + 64 - t, buf, t);
-	byteSwap(ctx->in, 16);
-	transform(ctx->buf, ctx->in);
-	buf += t;
-	len -= t;
-
-	/* Process data in 64-byte chunks */
-	while (len >= 64) {
-		memmove(ctx->in, buf, 64);
-		byteSwap(ctx->in, 16);
-		transform(ctx->buf, ctx->in);
-		buf += 64;
-		len -= 64;
-	}
-
-	/* Handle any remaining bytes of data. */
-	memmove(ctx->in, buf, len);
-}
-
-/*!
- * Final wrapup - pad to 64-byte boundary with the bit pattern
- * 1 0* (64-bit count of bits processed, MSB-first)
- */
-void
-isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
-	int count = ctx->bytes[0] & 0x3f;    /* Number of bytes in ctx->in */
-	unsigned char *p = (unsigned char *)ctx->in + count;
-
-	/* Set the first char of padding to 0x80.  There is always room. */
-	*p++ = 0x80;
-
-	/* Bytes of padding needed to make 56 bytes (-8..55) */
-	count = 56 - 1 - count;
-
-	if (count < 0) {	/* Padding forces an extra block */
-		memset(p, 0, count + 8);
-		byteSwap(ctx->in, 16);
-		transform(ctx->buf, ctx->in);
-		p = (unsigned char *)ctx->in;
-		count = 56;
-	}
-	memset(p, 0, count);
-	byteSwap(ctx->in, 14);
-
-	/* Append length in bits and transform */
-	ctx->in[14] = ctx->bytes[0] << 3;
-	ctx->in[15] = ctx->bytes[1] << 3 | ctx->bytes[0] >> 29;
-	transform(ctx->buf, ctx->in);
-
-	byteSwap(ctx->buf, 4);
-	memmove(digest, ctx->buf, 16);
-	isc_safe_memwipe(ctx, sizeof(*ctx));	/* In case it's sensitive */
-}
 #endif
 
 /*

lib/isc/openssl_shim.c

@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#if defined(OPENSSL) && (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER))
+
+#include "config.h"
+#include <stdlib.h>
+#include <string.h>
+#include <isc/openssl_shim.h>
+#include <openssl/engine.h>
+#include <openssl/hmac.h>
+#include <openssl/crypto.h>
+
+void *OPENSSL_zalloc(size_t size)
+{
+	void *ret = OPENSSL_malloc(size);
+	if (ret != NULL) {
+		memset(ret, 0, size);
+	}
+	return ret;
+}
+
+EVP_CIPHER_CTX* EVP_CIPHER_CTX_new(void)
+{
+	EVP_CIPHER_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
+	return ctx;
+}
+
+void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)
+{
+	if (ctx != NULL) {
+		EVP_CIPHER_CTX_cleanup(ctx);
+		OPENSSL_free(ctx);
+	}
+}
+
+EVP_MD_CTX *EVP_MD_CTX_new(void)
+{
+	EVP_MD_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
+	if (ctx != NULL) {
+		memset(ctx, 0, sizeof(*ctx));
+	}
+	return ctx;
+}
+
+void EVP_MD_CTX_free(EVP_MD_CTX *ctx)
+{
+	if (ctx != NULL) {
+		EVP_MD_CTX_cleanup(ctx);
+		OPENSSL_free(ctx);
+	}
+}
+
+int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
+{
+	return EVP_MD_CTX_cleanup(ctx);
+}
+
+HMAC_CTX *HMAC_CTX_new(void)
+{
+	HMAC_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
+	if (ctx != NULL) {
+		if (!HMAC_CTX_reset(ctx)) {
+			HMAC_CTX_free(ctx);
+			return NULL;
+		}
+	}
+	return ctx;
+}
+
+void HMAC_CTX_free(HMAC_CTX *ctx)
+{
+	if (ctx != NULL) {
+		HMAC_CTX_cleanup(ctx);
+		OPENSSL_free(ctx);
+	}
+}
+
+int HMAC_CTX_reset(HMAC_CTX *ctx) {
+	HMAC_CTX_cleanup(ctx);
+	return 1;
+}
+		
+#endif

lib/isc/sha1.c

@@ -42,11 +42,9 @@
 #include <pk11/pk11.h>
 #endif
 
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define EVP_MD_CTX_new() &(context->_ctx)
-#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
-#endif
+#ifdef OPENSSL
+
+#include <isc/openssl_shim.h>
 
 void
 isc_sha1_init(isc_sha1_t *context)
@@ -134,281 +132,7 @@ isc_sha1_final(isc_sha1_t *ctx, unsigned char *digest) {
 	pk11_return_session(ctx);
 }
 
-#else
-
-#define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
-
-/*@{*/
-/*!
- * blk0() and blk() perform the initial expand.
- * I got the idea of expanding during the round function from SSLeay
- */
-#if !defined(WORDS_BIGENDIAN)
-# define blk0(i) \
-	(block->l[i] = (rol(block->l[i], 24) & 0xFF00FF00) \
-	 | (rol(block->l[i], 8) & 0x00FF00FF))
-#else
-# define blk0(i) block->l[i]
-#endif
-#define blk(i) \
-	(block->l[i & 15] = rol(block->l[(i + 13) & 15] \
-				^ block->l[(i + 8) & 15] \
-				^ block->l[(i + 2) & 15] \
-				^ block->l[i & 15], 1))
-
-/*@}*/
-/*@{*/
-/*!
- * (R0+R1), R2, R3, R4 are the different operations (rounds) used in SHA1
- */
-#define R0(v,w,x,y,z,i) \
-	z += ((w & (x ^ y)) ^ y) + blk0(i) + 0x5A827999 + rol(v, 5); \
-	w = rol(w, 30);
-#define R1(v,w,x,y,z,i) \
-	z += ((w & (x ^ y)) ^ y) + blk(i) + 0x5A827999 + rol(v, 5); \
-	w = rol(w, 30);
-#define R2(v,w,x,y,z,i) \
-	z += (w ^ x ^ y) + blk(i) + 0x6ED9EBA1 + rol(v, 5); \
-	w = rol(w, 30);
-#define R3(v,w,x,y,z,i) \
-	z += (((w | x) & y) | (w & x)) + blk(i) + 0x8F1BBCDC + rol(v, 5); \
-	w = rol(w, 30);
-#define R4(v,w,x,y,z,i) \
-	z += (w ^ x ^ y) + blk(i) + 0xCA62C1D6 + rol(v, 5); \
-	w = rol(w, 30);
-
-/*@}*/
-
-typedef union {
-	unsigned char c[64];
-	unsigned int l[16];
-} CHAR64LONG16;
-
-#ifdef __sparc_v9__
-static void do_R01(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c,
-		   isc_uint32_t *d, isc_uint32_t *e, CHAR64LONG16 *);
-static void do_R2(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c,
-		  isc_uint32_t *d, isc_uint32_t *e, CHAR64LONG16 *);
-static void do_R3(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c,
-		  isc_uint32_t *d, isc_uint32_t *e, CHAR64LONG16 *);
-static void do_R4(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c,
-		  isc_uint32_t *d, isc_uint32_t *e, CHAR64LONG16 *);
-
-#define nR0(v,w,x,y,z,i) R0(*v,*w,*x,*y,*z,i)
-#define nR1(v,w,x,y,z,i) R1(*v,*w,*x,*y,*z,i)
-#define nR2(v,w,x,y,z,i) R2(*v,*w,*x,*y,*z,i)
-#define nR3(v,w,x,y,z,i) R3(*v,*w,*x,*y,*z,i)
-#define nR4(v,w,x,y,z,i) R4(*v,*w,*x,*y,*z,i)
-
-static void
-do_R01(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
-       isc_uint32_t *e, CHAR64LONG16 *block)
-{
-	nR0(a,b,c,d,e, 0); nR0(e,a,b,c,d, 1); nR0(d,e,a,b,c, 2);
-	nR0(c,d,e,a,b, 3); nR0(b,c,d,e,a, 4); nR0(a,b,c,d,e, 5);
-	nR0(e,a,b,c,d, 6); nR0(d,e,a,b,c, 7); nR0(c,d,e,a,b, 8);
-	nR0(b,c,d,e,a, 9); nR0(a,b,c,d,e,10); nR0(e,a,b,c,d,11);
-	nR0(d,e,a,b,c,12); nR0(c,d,e,a,b,13); nR0(b,c,d,e,a,14);
-	nR0(a,b,c,d,e,15); nR1(e,a,b,c,d,16); nR1(d,e,a,b,c,17);
-	nR1(c,d,e,a,b,18); nR1(b,c,d,e,a,19);
-}
-
-static void
-do_R2(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
-      isc_uint32_t *e, CHAR64LONG16 *block)
-{
-	nR2(a,b,c,d,e,20); nR2(e,a,b,c,d,21); nR2(d,e,a,b,c,22);
-	nR2(c,d,e,a,b,23); nR2(b,c,d,e,a,24); nR2(a,b,c,d,e,25);
-	nR2(e,a,b,c,d,26); nR2(d,e,a,b,c,27); nR2(c,d,e,a,b,28);
-	nR2(b,c,d,e,a,29); nR2(a,b,c,d,e,30); nR2(e,a,b,c,d,31);
-	nR2(d,e,a,b,c,32); nR2(c,d,e,a,b,33); nR2(b,c,d,e,a,34);
-	nR2(a,b,c,d,e,35); nR2(e,a,b,c,d,36); nR2(d,e,a,b,c,37);
-	nR2(c,d,e,a,b,38); nR2(b,c,d,e,a,39);
-}
-
-static void
-do_R3(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
-      isc_uint32_t *e, CHAR64LONG16 *block)
-{
-	nR3(a,b,c,d,e,40); nR3(e,a,b,c,d,41); nR3(d,e,a,b,c,42);
-	nR3(c,d,e,a,b,43); nR3(b,c,d,e,a,44); nR3(a,b,c,d,e,45);
-	nR3(e,a,b,c,d,46); nR3(d,e,a,b,c,47); nR3(c,d,e,a,b,48);
-	nR3(b,c,d,e,a,49); nR3(a,b,c,d,e,50); nR3(e,a,b,c,d,51);
-	nR3(d,e,a,b,c,52); nR3(c,d,e,a,b,53); nR3(b,c,d,e,a,54);
-	nR3(a,b,c,d,e,55); nR3(e,a,b,c,d,56); nR3(d,e,a,b,c,57);
-	nR3(c,d,e,a,b,58); nR3(b,c,d,e,a,59);
-}
-
-static void
-do_R4(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
-      isc_uint32_t *e, CHAR64LONG16 *block)
-{
-	nR4(a,b,c,d,e,60); nR4(e,a,b,c,d,61); nR4(d,e,a,b,c,62);
-	nR4(c,d,e,a,b,63); nR4(b,c,d,e,a,64); nR4(a,b,c,d,e,65);
-	nR4(e,a,b,c,d,66); nR4(d,e,a,b,c,67); nR4(c,d,e,a,b,68);
-	nR4(b,c,d,e,a,69); nR4(a,b,c,d,e,70); nR4(e,a,b,c,d,71);
-	nR4(d,e,a,b,c,72); nR4(c,d,e,a,b,73); nR4(b,c,d,e,a,74);
-	nR4(a,b,c,d,e,75); nR4(e,a,b,c,d,76); nR4(d,e,a,b,c,77);
-	nR4(c,d,e,a,b,78); nR4(b,c,d,e,a,79);
-}
-#endif
-
-/*!
- * Hash a single 512-bit block. This is the core of the algorithm.
- */
-static void
-transform(isc_uint32_t state[5], const unsigned char buffer[64]) {
-	isc_uint32_t a, b, c, d, e;
-	CHAR64LONG16 *block;
-	CHAR64LONG16 workspace;
-
-	INSIST(buffer != NULL);
-	INSIST(state != NULL);
-
-	block = &workspace;
-	(void)memmove(block, buffer, 64);
-
-	/* Copy context->state[] to working vars */
-	a = state[0];
-	b = state[1];
-	c = state[2];
-	d = state[3];
-	e = state[4];
-
-#ifdef __sparc_v9__
-	do_R01(&a, &b, &c, &d, &e, block);
-	do_R2(&a, &b, &c, &d, &e, block);
-	do_R3(&a, &b, &c, &d, &e, block);
-	do_R4(&a, &b, &c, &d, &e, block);
-#else
-	/* 4 rounds of 20 operations each. Loop unrolled. */
-	R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
-	R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
-	R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
-	R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
-	R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
-	R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
-	R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
-	R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
-	R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
-	R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
-	R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
-	R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
-	R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
-	R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
-	R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
-	R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
-	R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
-	R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
-	R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
-	R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
-#endif
-
-	/* Add the working vars back into context.state[] */
-	state[0] += a;
-	state[1] += b;
-	state[2] += c;
-	state[3] += d;
-	state[4] += e;
-
-	/* Wipe variables */
-	a = b = c = d = e = 0;
-	/* Avoid compiler warnings */
-	POST(a); POST(b); POST(c); POST(d); POST(e);
-}
-
-
-/*!
- * isc_sha1_init - Initialize new context
- */
-void
-isc_sha1_init(isc_sha1_t *context)
-{
-	INSIST(context != NULL);
-
-	/* SHA1 initialization constants */
-	context->state[0] = 0x67452301;
-	context->state[1] = 0xEFCDAB89;
-	context->state[2] = 0x98BADCFE;
-	context->state[3] = 0x10325476;
-	context->state[4] = 0xC3D2E1F0;
-	context->count[0] = 0;
-	context->count[1] = 0;
-}
-
-void
-isc_sha1_invalidate(isc_sha1_t *context) {
-	isc_safe_memwipe(context, sizeof(*context));
-}
-
-/*!
- * Run your data through this.
- */
-void
-isc_sha1_update(isc_sha1_t *context, const unsigned char *data,
-		unsigned int len)
-{
-	unsigned int i, j;
-
-	INSIST(context != 0);
-	INSIST(data != 0);
-
-	j = context->count[0];
-	if ((context->count[0] += len << 3) < j)
-		context->count[1] += (len >> 29) + 1;
-	j = (j >> 3) & 63;
-	if ((j + len) > 63) {
-		(void)memmove(&context->buffer[j], data, (i = 64 - j));
-		transform(context->state, context->buffer);
-		for (; i + 63 < len; i += 64)
-			transform(context->state, &data[i]);
-		j = 0;
-	} else {
-		i = 0;
-	}
-
-	(void)memmove(&context->buffer[j], &data[i], len - i);
-}
-
-
-/*!
- * Add padding and return the message digest.
- */
-
-static const unsigned char final_200 = 128;
-static const unsigned char final_0 = 0;
-
-void
-isc_sha1_final(isc_sha1_t *context, unsigned char *digest) {
-	unsigned int i;
-	unsigned char finalcount[8];
-
-	INSIST(digest != 0);
-	INSIST(context != 0);
-
-	for (i = 0; i < 8; i++) {
-		/* Endian independent */
-		finalcount[i] = (unsigned char)
-			((context->count[(i >= 4 ? 0 : 1)]
-			  >> ((3 - (i & 3)) * 8)) & 255);
-	}
-
-	isc_sha1_update(context, &final_200, 1);
-	while ((context->count[0] & 504) != 448)
-		isc_sha1_update(context, &final_0, 1);
-	/* The next Update should cause a transform() */
-	isc_sha1_update(context, finalcount, 8);
-
-	if (digest) {
-		for (i = 0; i < 20; i++)
-			digest[i] = (unsigned char)
-				((context->state[i >> 2]
-				  >> ((3 - (i & 3)) * 8)) & 255);
-	}
-
-	isc_safe_memwipe(context, sizeof(*context));
-}
-#endif
+#endif /* OPENSSL || PKCS11CRYPTO */
 
 /*
  * Check for SHA-1 support; if it does not work, raise a fatal error.

lib/isc/tests/hash_test.c

@@ -21,8 +21,7 @@
 #include <isc/hash.h>
 
 #include <isc/crc64.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/md5.h>
 #include <isc/sha1.h>
 #include <isc/util.h>
@@ -1773,7 +1772,7 @@ ATF_TC_BODY(isc_hmacmd5, tc) {
 		isc_hmacmd5_update(&hmacmd5,
 				   (const isc_uint8_t *) testcase->input,
 				   testcase->input_len);
-		isc_hmacmd5_sign(&hmacmd5, digest);
+		isc_hmacmd5_sign(&hmacmd5, digest, ISC_MD5_DIGESTLENGTH);
 		tohexstr(digest, ISC_MD5_DIGESTLENGTH, str, sizeof(str));
 		ATF_CHECK_STREQ(str, testcase->result);
 
@@ -1973,12 +1972,6 @@ ATF_TC_BODY(md5_check, tc) {
 
 	ATF_REQUIRE(isc_md5_check(ISC_FALSE));
 	ATF_CHECK(!isc_md5_check(ISC_TRUE));
-
-	ATF_REQUIRE(isc_hmacmd5_check(0));
-	ATF_CHECK(!isc_hmacmd5_check(1));
-	ATF_CHECK(!isc_hmacmd5_check(2));
-	ATF_CHECK(!isc_hmacmd5_check(3));
-	ATF_CHECK(!isc_hmacmd5_check(4));
 }
 #endif
 
@@ -1991,12 +1984,6 @@ ATF_TC_BODY(sha1_check, tc) {
 
 	ATF_REQUIRE(isc_sha1_check(ISC_FALSE));
 	ATF_CHECK(!isc_sha1_check(ISC_TRUE));
-
-	ATF_REQUIRE(isc_hmacsha1_check(0));
-	ATF_CHECK(!isc_hmacsha1_check(1));
-	ATF_CHECK(!isc_hmacsha1_check(2));
-	ATF_CHECK(!isc_hmacsha1_check(3));
-	ATF_CHECK(!isc_hmacsha1_check(4));
 }
 
 /*

lib/isc/win32/libisc.def.in

@@ -259,39 +259,25 @@ isc_heap_insert
 isc_hex_decodestring
 isc_hex_tobuffer
 isc_hex_totext
-isc_hmacmd5_check
-isc_hmacmd5_init
-isc_hmacmd5_invalidate
-isc_hmacmd5_sign
-isc_hmacmd5_update
-isc_hmacmd5_verify
-isc_hmacmd5_verify2
-isc_hmacsha1_check
-isc_hmacsha1_init
-isc_hmacsha1_invalidate
-isc_hmacsha1_sign
-isc_hmacsha1_update
-isc_hmacsha1_verify
-isc_hmacsha224_init
-isc_hmacsha224_invalidate
-isc_hmacsha224_sign
-isc_hmacsha224_update
-isc_hmacsha224_verify
-isc_hmacsha256_init
-isc_hmacsha256_invalidate
-isc_hmacsha256_sign
-isc_hmacsha256_update
-isc_hmacsha256_verify
-isc_hmacsha384_init
-isc_hmacsha384_invalidate
-isc_hmacsha384_sign
-isc_hmacsha384_update
-isc_hmacsha384_verify
-isc_hmacsha512_init
-isc_hmacsha512_invalidate
-isc_hmacsha512_sign
-isc_hmacsha512_update
-isc_hmacsha512_verify
+@IF OPENSSL
+isc_hmac_init_openssl
+isc_hmac_invalidate_openssl
+isc_hmac_sign_openssl
+isc_hmac_update_openssl
+isc_hmac_verify_openssl
+@END OPENSSL
+@IF PKCS11CRYPTO
+isc_hmac_init_pkcs11
+isc_hmac_invalidate_pkcs11
+isc_hmac_sign_pkcs11
+isc_hmac_update_pkcs11
+isc_hmac_verify_pkcs11
+isc_hmac_init_pkcs11_replace
+isc_hmac_invalidate_pkcs11_replace
+isc_hmac_sign_pkcs11_replace
+isc_hmac_update_pkcs11_replace
+isc_hmac_verify_pkcs11_replace
+@END PKCS11CRYPTO
 isc_ht_add
 isc_ht_count
 isc_ht_delete

lib/isc/win32/libisc.vcxproj.filters.in

@@ -97,10 +97,7 @@
     <ClInclude Include="..\include\isc\hex.h">
       <Filter>Library Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="..\include\isc\hmacmd5.h">
-      <Filter>Library Header Files</Filter>
-    </ClInclude>
-    <ClInclude Include="..\include\isc\hmacsha.h">
+    <ClInclude Include="..\include\isc\hmac.h">
       <Filter>Library Header Files</Filter>
     </ClInclude>
     <ClInclude Include="..\include\isc\ht.h">
@@ -525,10 +522,7 @@
     <ClCompile Include="..\hex.c">
       <Filter>Library Source Files</Filter>
     </ClCompile>
-    <ClCompile Include="..\hmacmd5.c">
-      <Filter>Library Source Files</Filter>
-    </ClCompile>
-    <ClCompile Include="..\hmacsha.c">
+    <ClCompile Include="..\hmac.c">
       <Filter>Library Source Files</Filter>
     </ClCompile>
     <ClCompile Include="..\ht.c">

lib/isc/win32/libisc.vcxproj.in

@@ -319,8 +319,7 @@ copy InstallFiles ..\Build\Release\
     <ClInclude Include="..\include\isc\hash.h" />
     <ClInclude Include="..\include\isc\heap.h" />
     <ClInclude Include="..\include\isc\hex.h" />
-    <ClInclude Include="..\include\isc\hmacmd5.h" />
-    <ClInclude Include="..\include\isc\hmacsha.h" />
+    <ClInclude Include="..\include\isc\hmac.h" />
     <ClInclude Include="..\include\isc\ht.h" />
     <ClInclude Include="..\include\isc\httpd.h" />
     <ClInclude Include="..\include\isc\interfaceiter.h" />
@@ -441,8 +440,7 @@ copy InstallFiles ..\Build\Release\
     <ClCompile Include="..\hash.c" />
     <ClCompile Include="..\heap.c" />
     <ClCompile Include="..\hex.c" />
-    <ClCompile Include="..\hmacmd5.c" />
-    <ClCompile Include="..\hmacsha.c" />
+    <ClCompile Include="..\hmac.c" />
     <ClCompile Include="..\ht.c" />
     <ClCompile Include="..\httpd.c" />
     <ClCompile Include="..\inet_ntop.c" />

lib/isccc/cc.c

@@ -32,8 +32,7 @@
 #include <errno.h>
 
 #include <isc/assertions.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/print.h>
 #include <isc/safe.h>
 #include <isc/stdlib.h>
@@ -273,7 +272,7 @@ sign(unsigned char *data, unsigned int length, unsigned char *hmac,
 		isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
 				 REGION_SIZE(*secret));
 		isc_hmacmd5_update(&ctx.hmd5, data, length);
-		isc_hmacmd5_sign(&ctx.hmd5, digest);
+		isc_hmacmd5_sign(&ctx.hmd5, digest, ISC_MD5_DIGESTLENGTH);
 		source.rend = digest + ISC_MD5_DIGESTLENGTH;
 		break;
 #endif
@@ -458,7 +457,7 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
 		isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
 				 REGION_SIZE(*secret));
 		isc_hmacmd5_update(&ctx.hmd5, data, length);
-		isc_hmacmd5_sign(&ctx.hmd5, digest);
+		isc_hmacmd5_sign(&ctx.hmd5, digest, ISC_MD5_DIGESTLENGTH);
 		source.rend = digest + ISC_MD5_DIGESTLENGTH;
 		break;
 #endif

lib/ns/client.c

@@ -14,7 +14,7 @@
 #include <isc/aes.h>
 #include <isc/formatcheck.h>
 #include <isc/fuzz.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/mutex.h>
 #include <isc/once.h>
 #include <isc/platform.h>

util/copyrights

@@ -3488,8 +3488,7 @@
 ./lib/isc/hash.c				C	2003,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017,2018
 ./lib/isc/heap.c				C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2010,2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/isc/hex.c					C	2000,2001,2002,2003,2004,2005,2007,2008,2013,2014,2015,2016,2018
-./lib/isc/hmacmd5.c				C	2000,2001,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017,2018
-./lib/isc/hmacsha.c				C	2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018
+./lib/isc/hmac.c				C	2000,2001,2004,2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/isc/ht.c					C	2016,2017,2018
 ./lib/isc/httpd.c				C	2006,2007,2008,2010,2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/isc/ia64/Makefile.in			MAKE	2007,2012,2016,2018
@@ -3523,8 +3522,7 @@
 ./lib/isc/include/isc/hash.h			C	2003,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017,2018
 ./lib/isc/include/isc/heap.h			C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2009,2012,2016,2018
 ./lib/isc/include/isc/hex.h			C	2000,2001,2004,2005,2006,2007,2008,2016,2018
-./lib/isc/include/isc/hmacmd5.h			C	2000,2001,2004,2005,2006,2007,2009,2014,2016,2017,2018
-./lib/isc/include/isc/hmacsha.h			C	2005,2006,2007,2009,2014,2016,2017,2018
+./lib/isc/include/isc/hmac.h			C	2000,2001,2004,2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/isc/include/isc/ht.h			C	2016,2017,2018
 ./lib/isc/include/isc/httpd.h			C	2006,2007,2008,2014,2016,2018
 ./lib/isc/include/isc/interfaceiter.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018

win32utils/Configure

@@ -1965,14 +1965,6 @@ if ($cryptolib ne "") {
     die "No cryptography library has been found or provided."
 }
 
-# enable-openssl-hash
-if ($enable_openssl_hash eq "yes") {
-    if ($use_openssl eq "no") {
-        die "No OpenSSL for hash functions\n";
-    }
-    $configdefp{"ISC_PLATFORM_OPENSSLHASH"} = 1;
-}
-
 # with-pkcs11
 if ($use_pkcs11 ne "no") {
     $configcond{"PKCS11"} = 1;