1/* sha1.c - Functions to compute SHA1 message digest of files or
2   memory blocks according to the NIST specification FIPS-180-1.
3
4   Copyright (C) 2000-2001, 2003-2006, 2008-2014 Free Software Foundation, Inc.
5
6   This program is free software; you can redistribute it and/or modify it
7   under the terms of the GNU General Public License as published by the
8   Free Software Foundation; either version 3, or (at your option) any
9   later version.
10
11   This program is distributed in the hope that it will be useful,
12   but WITHOUT ANY WARRANTY; without even the implied warranty of
13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14   GNU General Public License for more details.
15
16   You should have received a copy of the GNU General Public License
17   along with this program; if not, see <http://www.gnu.org/licenses/>.  */
18
19/* Written by Scott G. Miller
20   Credits:
21      Robert Klep <robert@ilse.nl>  -- Expansion function fix
22*/
23
24#include <config.h>
25
26#if HAVE_OPENSSL_SHA1
27# define GL_OPENSSL_INLINE _GL_EXTERN_INLINE
28#endif
29#include "sha1.h"
30
31#include <stdalign.h>
32#include <stdint.h>
33#include <stdlib.h>
34#include <string.h>
35
36#if USE_UNLOCKED_IO
37# include "unlocked-io.h"
38#endif
39
40#ifdef WORDS_BIGENDIAN
41# define SWAP(n) (n)
42#else
43# define SWAP(n) \
44    (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
45#endif
46
47#define BLOCKSIZE 32768
48#if BLOCKSIZE % 64 != 0
49# error "invalid BLOCKSIZE"
50#endif
51
52#if ! HAVE_OPENSSL_SHA1
53/* This array contains the bytes used to pad the buffer to the next
54   64-byte boundary.  (RFC 1321, 3.1: Step 1)  */
55static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
56
57
58/* Take a pointer to a 160 bit block of data (five 32 bit ints) and
59   initialize it to the start constants of the SHA1 algorithm.  This
60   must be called before using hash in the call to sha1_hash.  */
61void
62sha1_init_ctx (struct sha1_ctx *ctx)
63{
64  ctx->A = 0x67452301;
65  ctx->B = 0xefcdab89;
66  ctx->C = 0x98badcfe;
67  ctx->D = 0x10325476;
68  ctx->E = 0xc3d2e1f0;
69
70  ctx->total[0] = ctx->total[1] = 0;
71  ctx->buflen = 0;
72}
73
74/* Copy the 4 byte value from v into the memory location pointed to by *cp,
75   If your architecture allows unaligned access this is equivalent to
76   * (uint32_t *) cp = v  */
77static void
78set_uint32 (char *cp, uint32_t v)
79{
80  memcpy (cp, &v, sizeof v);
81}
82
83/* Put result from CTX in first 20 bytes following RESBUF.  The result
84   must be in little endian byte order.  */
85void *
86sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf)
87{
88  char *r = resbuf;
89  set_uint32 (r + 0 * sizeof ctx->A, SWAP (ctx->A));
90  set_uint32 (r + 1 * sizeof ctx->B, SWAP (ctx->B));
91  set_uint32 (r + 2 * sizeof ctx->C, SWAP (ctx->C));
92  set_uint32 (r + 3 * sizeof ctx->D, SWAP (ctx->D));
93  set_uint32 (r + 4 * sizeof ctx->E, SWAP (ctx->E));
94
95  return resbuf;
96}
97
98/* Process the remaining bytes in the internal buffer and the usual
99   prolog according to the standard and write the result to RESBUF.  */
100void *
101sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf)
102{
103  /* Take yet unprocessed bytes into account.  */
104  uint32_t bytes = ctx->buflen;
105  size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
106
107  /* Now count remaining bytes.  */
108  ctx->total[0] += bytes;
109  if (ctx->total[0] < bytes)
110    ++ctx->total[1];
111
112  /* Put the 64-bit file length in *bits* at the end of the buffer.  */
113  ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
114  ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3);
115
116  memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
117
118  /* Process last bytes.  */
119  sha1_process_block (ctx->buffer, size * 4, ctx);
120
121  return sha1_read_ctx (ctx, resbuf);
122}
123#endif
124
125/* Compute SHA1 message digest for bytes read from STREAM.  The
126   resulting message digest number will be written into the 16 bytes
127   beginning at RESBLOCK.  */
128int
129sha1_stream (FILE *stream, void *resblock)
130{
131  struct sha1_ctx ctx;
132  size_t sum;
133
134  char *buffer = malloc (BLOCKSIZE + 72);
135  if (!buffer)
136    return 1;
137
138  /* Initialize the computation context.  */
139  sha1_init_ctx (&ctx);
140
141  /* Iterate over full file contents.  */
142  while (1)
143    {
144      /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
145         computation function processes the whole buffer so that with the
146         next round of the loop another block can be read.  */
147      size_t n;
148      sum = 0;
149
150      /* Read block.  Take care for partial reads.  */
151      while (1)
152        {
153          n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
154
155          sum += n;
156
157          if (sum == BLOCKSIZE)
158            break;
159
160          if (n == 0)
161            {
162              /* Check for the error flag IFF N == 0, so that we don't
163                 exit the loop after a partial read due to e.g., EAGAIN
164                 or EWOULDBLOCK.  */
165              if (ferror (stream))
166                {
167                  free (buffer);
168                  return 1;
169                }
170              goto process_partial_block;
171            }
172
173          /* We've read at least one byte, so ignore errors.  But always
174             check for EOF, since feof may be true even though N > 0.
175             Otherwise, we could end up calling fread after EOF.  */
176          if (feof (stream))
177            goto process_partial_block;
178        }
179
180      /* Process buffer with BLOCKSIZE bytes.  Note that
181                        BLOCKSIZE % 64 == 0
182       */
183      sha1_process_block (buffer, BLOCKSIZE, &ctx);
184    }
185
186 process_partial_block:;
187
188  /* Process any remaining bytes.  */
189  if (sum > 0)
190    sha1_process_bytes (buffer, sum, &ctx);
191
192  /* Construct result in desired memory.  */
193  sha1_finish_ctx (&ctx, resblock);
194  free (buffer);
195  return 0;
196}
197
198#if ! HAVE_OPENSSL_SHA1
199/* Compute SHA1 message digest for LEN bytes beginning at BUFFER.  The
200   result is always in little endian byte order, so that a byte-wise
201   output yields to the wanted ASCII representation of the message
202   digest.  */
203void *
204sha1_buffer (const char *buffer, size_t len, void *resblock)
205{
206  struct sha1_ctx ctx;
207
208  /* Initialize the computation context.  */
209  sha1_init_ctx (&ctx);
210
211  /* Process whole buffer but last len % 64 bytes.  */
212  sha1_process_bytes (buffer, len, &ctx);
213
214  /* Put result in desired memory area.  */
215  return sha1_finish_ctx (&ctx, resblock);
216}
217
218void
219sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx)
220{
221  /* When we already have some bits in our internal buffer concatenate
222     both inputs first.  */
223  if (ctx->buflen != 0)
224    {
225      size_t left_over = ctx->buflen;
226      size_t add = 128 - left_over > len ? len : 128 - left_over;
227
228      memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
229      ctx->buflen += add;
230
231      if (ctx->buflen > 64)
232        {
233          sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
234
235          ctx->buflen &= 63;
236          /* The regions in the following copy operation cannot overlap.  */
237          memcpy (ctx->buffer,
238                  &((char *) ctx->buffer)[(left_over + add) & ~63],
239                  ctx->buflen);
240        }
241
242      buffer = (const char *) buffer + add;
243      len -= add;
244    }
245
246  /* Process available complete blocks.  */
247  if (len >= 64)
248    {
249#if !_STRING_ARCH_unaligned
250# define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0)
251      if (UNALIGNED_P (buffer))
252        while (len > 64)
253          {
254            sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
255            buffer = (const char *) buffer + 64;
256            len -= 64;
257          }
258      else
259#endif
260        {
261          sha1_process_block (buffer, len & ~63, ctx);
262          buffer = (const char *) buffer + (len & ~63);
263          len &= 63;
264        }
265    }
266
267  /* Move remaining bytes in internal buffer.  */
268  if (len > 0)
269    {
270      size_t left_over = ctx->buflen;
271
272      memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
273      left_over += len;
274      if (left_over >= 64)
275        {
276          sha1_process_block (ctx->buffer, 64, ctx);
277          left_over -= 64;
278          memcpy (ctx->buffer, &ctx->buffer[16], left_over);
279        }
280      ctx->buflen = left_over;
281    }
282}
283
284/* --- Code below is the primary difference between md5.c and sha1.c --- */
285
286/* SHA1 round constants */
287#define K1 0x5a827999
288#define K2 0x6ed9eba1
289#define K3 0x8f1bbcdc
290#define K4 0xca62c1d6
291
292/* Round functions.  Note that F2 is the same as F4.  */
293#define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
294#define F2(B,C,D) (B ^ C ^ D)
295#define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
296#define F4(B,C,D) (B ^ C ^ D)
297
298/* Process LEN bytes of BUFFER, accumulating context into CTX.
299   It is assumed that LEN % 64 == 0.
300   Most of this code comes from GnuPG's cipher/sha1.c.  */
301
302void
303sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx)
304{
305  const uint32_t *words = buffer;
306  size_t nwords = len / sizeof (uint32_t);
307  const uint32_t *endp = words + nwords;
308  uint32_t x[16];
309  uint32_t a = ctx->A;
310  uint32_t b = ctx->B;
311  uint32_t c = ctx->C;
312  uint32_t d = ctx->D;
313  uint32_t e = ctx->E;
314  uint32_t lolen = len;
315
316  /* First increment the byte count.  RFC 1321 specifies the possible
317     length of the file up to 2^64 bits.  Here we only compute the
318     number of bytes.  Do a double word increment.  */
319  ctx->total[0] += lolen;
320  ctx->total[1] += (len >> 31 >> 1) + (ctx->total[0] < lolen);
321
322#define rol(x, n) (((x) << (n)) | ((uint32_t) (x) >> (32 - (n))))
323
324#define M(I) ( tm =   x[I&0x0f] ^ x[(I-14)&0x0f] \
325                    ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
326               , (x[I&0x0f] = rol(tm, 1)) )
327
328#define R(A,B,C,D,E,F,K,M)  do { E += rol( A, 5 )     \
329                                      + F( B, C, D )  \
330                                      + K             \
331                                      + M;            \
332                                 B = rol( B, 30 );    \
333                               } while(0)
334
335  while (words < endp)
336    {
337      uint32_t tm;
338      int t;
339      for (t = 0; t < 16; t++)
340        {
341          x[t] = SWAP (*words);
342          words++;
343        }
344
345      R( a, b, c, d, e, F1, K1, x[ 0] );
346      R( e, a, b, c, d, F1, K1, x[ 1] );
347      R( d, e, a, b, c, F1, K1, x[ 2] );
348      R( c, d, e, a, b, F1, K1, x[ 3] );
349      R( b, c, d, e, a, F1, K1, x[ 4] );
350      R( a, b, c, d, e, F1, K1, x[ 5] );
351      R( e, a, b, c, d, F1, K1, x[ 6] );
352      R( d, e, a, b, c, F1, K1, x[ 7] );
353      R( c, d, e, a, b, F1, K1, x[ 8] );
354      R( b, c, d, e, a, F1, K1, x[ 9] );
355      R( a, b, c, d, e, F1, K1, x[10] );
356      R( e, a, b, c, d, F1, K1, x[11] );
357      R( d, e, a, b, c, F1, K1, x[12] );
358      R( c, d, e, a, b, F1, K1, x[13] );
359      R( b, c, d, e, a, F1, K1, x[14] );
360      R( a, b, c, d, e, F1, K1, x[15] );
361      R( e, a, b, c, d, F1, K1, M(16) );
362      R( d, e, a, b, c, F1, K1, M(17) );
363      R( c, d, e, a, b, F1, K1, M(18) );
364      R( b, c, d, e, a, F1, K1, M(19) );
365      R( a, b, c, d, e, F2, K2, M(20) );
366      R( e, a, b, c, d, F2, K2, M(21) );
367      R( d, e, a, b, c, F2, K2, M(22) );
368      R( c, d, e, a, b, F2, K2, M(23) );
369      R( b, c, d, e, a, F2, K2, M(24) );
370      R( a, b, c, d, e, F2, K2, M(25) );
371      R( e, a, b, c, d, F2, K2, M(26) );
372      R( d, e, a, b, c, F2, K2, M(27) );
373      R( c, d, e, a, b, F2, K2, M(28) );
374      R( b, c, d, e, a, F2, K2, M(29) );
375      R( a, b, c, d, e, F2, K2, M(30) );
376      R( e, a, b, c, d, F2, K2, M(31) );
377      R( d, e, a, b, c, F2, K2, M(32) );
378      R( c, d, e, a, b, F2, K2, M(33) );
379      R( b, c, d, e, a, F2, K2, M(34) );
380      R( a, b, c, d, e, F2, K2, M(35) );
381      R( e, a, b, c, d, F2, K2, M(36) );
382      R( d, e, a, b, c, F2, K2, M(37) );
383      R( c, d, e, a, b, F2, K2, M(38) );
384      R( b, c, d, e, a, F2, K2, M(39) );
385      R( a, b, c, d, e, F3, K3, M(40) );
386      R( e, a, b, c, d, F3, K3, M(41) );
387      R( d, e, a, b, c, F3, K3, M(42) );
388      R( c, d, e, a, b, F3, K3, M(43) );
389      R( b, c, d, e, a, F3, K3, M(44) );
390      R( a, b, c, d, e, F3, K3, M(45) );
391      R( e, a, b, c, d, F3, K3, M(46) );
392      R( d, e, a, b, c, F3, K3, M(47) );
393      R( c, d, e, a, b, F3, K3, M(48) );
394      R( b, c, d, e, a, F3, K3, M(49) );
395      R( a, b, c, d, e, F3, K3, M(50) );
396      R( e, a, b, c, d, F3, K3, M(51) );
397      R( d, e, a, b, c, F3, K3, M(52) );
398      R( c, d, e, a, b, F3, K3, M(53) );
399      R( b, c, d, e, a, F3, K3, M(54) );
400      R( a, b, c, d, e, F3, K3, M(55) );
401      R( e, a, b, c, d, F3, K3, M(56) );
402      R( d, e, a, b, c, F3, K3, M(57) );
403      R( c, d, e, a, b, F3, K3, M(58) );
404      R( b, c, d, e, a, F3, K3, M(59) );
405      R( a, b, c, d, e, F4, K4, M(60) );
406      R( e, a, b, c, d, F4, K4, M(61) );
407      R( d, e, a, b, c, F4, K4, M(62) );
408      R( c, d, e, a, b, F4, K4, M(63) );
409      R( b, c, d, e, a, F4, K4, M(64) );
410      R( a, b, c, d, e, F4, K4, M(65) );
411      R( e, a, b, c, d, F4, K4, M(66) );
412      R( d, e, a, b, c, F4, K4, M(67) );
413      R( c, d, e, a, b, F4, K4, M(68) );
414      R( b, c, d, e, a, F4, K4, M(69) );
415      R( a, b, c, d, e, F4, K4, M(70) );
416      R( e, a, b, c, d, F4, K4, M(71) );
417      R( d, e, a, b, c, F4, K4, M(72) );
418      R( c, d, e, a, b, F4, K4, M(73) );
419      R( b, c, d, e, a, F4, K4, M(74) );
420      R( a, b, c, d, e, F4, K4, M(75) );
421      R( e, a, b, c, d, F4, K4, M(76) );
422      R( d, e, a, b, c, F4, K4, M(77) );
423      R( c, d, e, a, b, F4, K4, M(78) );
424      R( b, c, d, e, a, F4, K4, M(79) );
425
426      a = ctx->A += a;
427      b = ctx->B += b;
428      c = ctx->C += c;
429      d = ctx->D += d;
430      e = ctx->E += e;
431    }
432}
433#endif
434