2  * Copyright 2012-2021 The OpenSSL Project Authors. All Rights Reserved.
21  * MD5 and SHA-1 low level APIs are deprecated for public use, but still ok for
69  * length field. (SHA-384/512 have 128-bit length.)
75  * Currently SHA-384/512 has a 128-byte block size and that's the largest
82  * u32toLE serializes an unsigned, 32-bit number (n) as four bytes at (p) in
83  * little-endian order. The value of p is advanced by four.
85 # define u32toLE(n, p) \  argument
86          (*((p)++)=(unsigned char)(n), \
87           *((p)++)=(unsigned char)(n>>8), \
88           *((p)++)=(unsigned char)(n>>16), \
89           *((p)++)=(unsigned char)(n>>24))
99     u32toLE(md5->A, md_out);  in tls1_md5_final_raw()
100     u32toLE(md5->B, md_out);  in tls1_md5_final_raw()
101     u32toLE(md5->C, md_out);  in tls1_md5_final_raw()
102     u32toLE(md5->D, md_out);  in tls1_md5_final_raw()
109     l2n(sha1->h0, md_out);  in tls1_sha1_final_raw()
110     l2n(sha1->h1, md_out);  in tls1_sha1_final_raw()
111     l2n(sha1->h2, md_out);  in tls1_sha1_final_raw()
112     l2n(sha1->h3, md_out);  in tls1_sha1_final_raw()
113     l2n(sha1->h4, md_out);  in tls1_sha1_final_raw()
122         l2n(sha256->h[i], md_out);  in tls1_sha256_final_raw()
132         l2n8(sha512->h[i], md_out);  in tls1_sha512_final_raw()
139 /*-
146  *   md_out_size: if non-NULL, the number of output bytes is written here.
147  *   header: the 13-byte, TLS record header.
153  *   is_sslv3: non-zero if we are to use SSLv3. Otherwise, TLS.
222     } else if (EVP_MD_is_a(md, "SHA2-224")) {  in ssl3_cbc_digest_record()
229      } else if (EVP_MD_is_a(md, "SHA2-256")) {  in ssl3_cbc_digest_record()
236      } else if (EVP_MD_is_a(md, "SHA2-384")) {  in ssl3_cbc_digest_record()
242         md_size = 384 / 8;  in ssl3_cbc_digest_record()
245     } else if (EVP_MD_is_a(md, "SHA2-512")) {  in ssl3_cbc_digest_record()
283      * of hash termination (0x80 + 64-bit length) don't fit in the final  in ssl3_cbc_digest_record()
285      * TLSv1 has MACs up to 48 bytes long (SHA-384) and the padding is not  in ssl3_cbc_digest_record()
292 … variance_blocks = is_sslv3 ? 2 : ( ((255 + 1 + md_size + md_block_size - 1) / md_block_size) + 1);  in ssl3_cbc_digest_record()
303     max_mac_bytes = len - md_size - 1;  in ssl3_cbc_digest_record()
306         (max_mac_bytes + 1 + md_length_size + md_block_size -  in ssl3_cbc_digest_record()
337      * index_b is the hash block number that contains the 64-bit hash length,  in ssl3_cbc_digest_record()
342      * bits is the hash-length in bits. It includes the additional hash block  in ssl3_cbc_digest_record()
351         num_starting_blocks = num_blocks - variance_blocks;  in ssl3_cbc_digest_record()
374         memset(length_bytes, 0, md_length_size - 4);  in ssl3_cbc_digest_record()
375         length_bytes[md_length_size - 4] = (unsigned char)(bits >> 24);  in ssl3_cbc_digest_record()
376         length_bytes[md_length_size - 3] = (unsigned char)(bits >> 16);  in ssl3_cbc_digest_record()
377         length_bytes[md_length_size - 2] = (unsigned char)(bits >> 8);  in ssl3_cbc_digest_record()
378         length_bytes[md_length_size - 1] = (unsigned char)bits;  in ssl3_cbc_digest_record()
381         length_bytes[md_length_size - 5] = (unsigned char)(bits >> 24);  in ssl3_cbc_digest_record()
382         length_bytes[md_length_size - 6] = (unsigned char)(bits >> 16);  in ssl3_cbc_digest_record()
383         length_bytes[md_length_size - 7] = (unsigned char)(bits >> 8);  in ssl3_cbc_digest_record()
384         length_bytes[md_length_size - 8] = (unsigned char)bits;  in ssl3_cbc_digest_record()
404             overhang = header_length - md_block_size;  in ssl3_cbc_digest_record()
407             memcpy(first_block + overhang, data, md_block_size - overhang);  in ssl3_cbc_digest_record()
409             for (i = 1; i < k / md_block_size - 1; i++)  in ssl3_cbc_digest_record()
410                 md_transform(md_state.c, data + md_block_size * i - overhang);  in ssl3_cbc_digest_record()
414             memcpy(first_block + 13, data, md_block_size - 13);  in ssl3_cbc_digest_record()
417                 md_transform(md_state.c, data + md_block_size * i - 13);  in ssl3_cbc_digest_record()
439                 b = data[k - header_length];  in ssl3_cbc_digest_record()
457              * of the data), then the 64-bit length didn't fit into index_a  in ssl3_cbc_digest_record()
465             if (j >= md_block_size - md_length_size) {  in ssl3_cbc_digest_record()
468                                            length_bytes[j -  in ssl3_cbc_digest_record()
469                                                         (md_block_size -  in ssl3_cbc_digest_record()