The ENGINE arguments to EVP_DigestInit_ex, EVP_Digest and HMAC_Init_ex,
a cleanup with an ENGINE set and an init with an EVP_PKEY_CTX set throw
because that support is missing, not because the input is invalid.
Asserting it would break once the support exists, so the test no longer
checks these paths. The production guards and the debt entry stay.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
HMAC with a 64-byte key for SHA-256 and a 128-byte key for SHA-512 must
copy the key unhashed, as LibreSSL 2.5.4's hmac.c only hashes keys longer
than the block. The expected MACs, key lengths and flags (MD5 0,
SHA-256/384/512 0xc) were produced by LibreSSL 2.5.4's own hmac.c,
digest.c, m_sha1.c and m_md5.c.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The canonical include/Api.hpp still declared the 20 implemented EVP and
HMAC exports with the unknown no-parameter signature. It now holds the
EVP_MD, EVP_MD_CTX and HMAC_CTX layouts and the real signatures, and
Evp.cpp and the guest test use it instead of local declarations.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
EVP_md5, EVP_sha256, EVP_sha384, EVP_sha512, EVP_MD_size, the
EVP_MD_CTX init/create/cleanup/destroy functions, EVP_DigestInit_ex,
EVP_DigestUpdate, EVP_DigestFinal_ex, EVP_Digest and HMAC_CTX_init,
HMAC_CTX_cleanup, HMAC_Init, HMAC_Init_ex, HMAC_Update, HMAC_Final and
HMAC threw. They now behave as LibreSSL's digest.c and hmac.c, on the
public EVP_MD, EVP_MD_CTX and HMAC_CTX layouts, and call through the
EVP_MD function table, so a context the title copies or inspects and a
digest table the title defines keep working.
The module exports SSL_get0_param and X509_VERIFY_PARAM_set1_host (new
in LibreSSL 2.7) and HMAC_CTX_init (gone in 3.5); between 2.7.2 and
3.4.1 these layouts and functions do not change. ENGINE and
EVP_PKEY_CTX use, and calls LibreSSL would crash on, throw.
When allocating the digest data fails, the context is left without a
digest instead of with a digest and no data, so initialising it again
allocates rather than running the digest's init on a null pointer.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude