Merge branch 'sverk/crypto-openssl-0.9.7'

* sverk/crypto-openssl-0.9.7:
  crypto: Skip sha256/512 tests for openssl 0.9.7
  crypto: Refactor test with if_098 helper function
  crypto: Let info_lib return header version instead of lib version
  crypto: Make crypto:info() up to date
  crypto: Add some unlisted test cases as part of the test suite
  crypto: Fix some documentation bugs
  crypto: Throw notsup for DES3 CFB encryption for old openssl

5 files changed, 94 insertions, 34 deletions

diff --git a/lib/crypto/c_src/crypto.c b/lib/crypto/c_src/crypto.c
index 5dc088dcff..72c9e5b8e8 100644
--- a/lib/crypto/c_src/crypto.c
+++ b/lib/crypto/c_src/crypto.c
@@ -69,6 +69,9 @@
 #if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_SHA512) && defined(NID_sha512)
 # define HAVE_SHA512
 #endif
+#if OPENSSL_VERSION_NUMBER >= 0x0090705FL
+# define HAVE_DES_ede3_cfb_encrypt
+#endif
 
 #ifdef VALGRIND
     #  include <valgrind/memcheck.h>
@@ -173,7 +176,7 @@ static ERL_NIF_TERM des_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
 static ERL_NIF_TERM des_cfb_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM des_ecb_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM des_ede3_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
-static ERL_NIF_TERM des_ede3_cfb_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM des_ede3_cfb_crypt_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM aes_cfb_128_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM aes_ctr_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM aes_ctr_stream_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
@@ -281,7 +284,7 @@ static ErlNifFunc nif_funcs[] = {
     {"des_cfb_crypt", 4, des_cfb_crypt},
     {"des_ecb_crypt", 3, des_ecb_crypt},
     {"des_ede3_cbc_crypt", 6, des_ede3_cbc_crypt},
-    {"des_ede3_cfb_crypt", 6, des_ede3_cfb_crypt},
+    {"des_ede3_cfb_crypt_nif", 6, des_ede3_cfb_crypt_nif},
     {"aes_cfb_128_crypt", 4, aes_cfb_128_crypt},
     {"aes_ctr_encrypt", 3, aes_ctr_encrypt},
     {"aes_ctr_decrypt", 3, aes_ctr_encrypt},
@@ -533,12 +536,21 @@ static ERL_NIF_TERM info_lib(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
     const char* ver = SSLeay_version(SSLEAY_VERSION);
     unsigned ver_sz = strlen(ver);
     ERL_NIF_TERM name_term, ver_term;
+    int ver_num = OPENSSL_VERSION_NUMBER;
+    /* R16:
+     * Ignore library version number from SSLeay() and instead show header
+     * version. Otherwise user might try to call a function that is implemented
+     * by a newer library but not supported by the headers used at compile time.
+     * Example: DES_ede3_cfb_encrypt in 0.9.7i but not in 0.9.7d.
+     *
+     * Version string is still from library though.
+     */
 
     memcpy(enif_make_new_binary(env, name_sz, &name_term), libname, name_sz);    
     memcpy(enif_make_new_binary(env, ver_sz, &ver_term), ver, ver_sz);
 
     return enif_make_list1(env, enif_make_tuple3(env, name_term,
-						 enif_make_int(env, SSLeay()),
+						 enif_make_int(env, ver_num),						 
 						 ver_term));
 }
 
@@ -1218,8 +1230,9 @@ static ERL_NIF_TERM des_ede3_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_T
     return ret;
 }
 
-static ERL_NIF_TERM des_ede3_cfb_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+static ERL_NIF_TERM des_ede3_cfb_crypt_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (Key1, Key2, Key3, IVec, Text/Cipher, IsEncrypt) */
+#ifdef HAVE_DES_ede3_cfb_encrypt
     ErlNifBinary key1, key2, key3, ivec, text;
     DES_key_schedule schedule1, schedule2, schedule3;
     DES_cblock ivec_clone; /* writable copy */
@@ -1241,6 +1254,9 @@ static ERL_NIF_TERM des_ede3_cfb_crypt(ErlNifEnv* env, int argc, const ERL_NIF_T
 			 8, text.size, &schedule1, &schedule2, &schedule3,
 			 &ivec_clone, (argv[5] == atom_true));
     return ret;
+#else
+    return atom_notsup;
+#endif
 }
 
 static ERL_NIF_TERM aes_cfb_128_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
diff --git a/lib/crypto/doc/src/crypto.xml b/lib/crypto/doc/src/crypto.xml
index 4dcd6fc4ea..3e533158c8 100644
--- a/lib/crypto/doc/src/crypto.xml
+++ b/lib/crypto/doc/src/crypto.xml
@@ -115,6 +115,12 @@ Mpint() = <![CDATA[<<ByteLen:32/integer-big, Bytes:ByteLen/binary>>]]>
 > <input>info_lib().</input>
 [{&lt;&lt;"OpenSSL"&gt;&gt;,9469983,&lt;&lt;"OpenSSL 0.9.8a 11 Oct 2005"&gt;&gt;}]
         </pre>
+	<note><p>
+	  From OTP R16 the <em>numeric version</em> represents the version of the OpenSSL
+	  <em>header files</em> (<c>openssl/opensslv.h</c>) used when crypto was compiled.
+	  The text variant represents the OpenSSL library used at runtime.
+	  In earlier OTP versions both numeric and text was taken from the library.
+	</p></note>
       </desc>
     </func>
     <func>
@@ -265,6 +271,8 @@ Mpint() = <![CDATA[<<ByteLen:32/integer-big, Bytes:ByteLen/binary>>]]>
       </type>
       <desc>
         <p>Computes a message digest of type <c>Type</c> from <c>Data</c>.</p>
+	<p>May throw exception <c>notsup</c> in case the chosen <c>Type</c>
+	is not supported by the underlying OpenSSL implementation.</p>
       </desc>
     </func>
     <func>
@@ -277,6 +285,8 @@ Mpint() = <![CDATA[<<ByteLen:32/integer-big, Bytes:ByteLen/binary>>]]>
         <p>Initializes the context for streaming hash operations. <c>Type</c> determines
         which digest to use. The returned context should be used as argument
 	to <seealso marker="#hash_update/2">hash_update</seealso>.</p>
+	<p>May throw exception <c>notsup</c> in case the chosen <c>Type</c>
+	is not supported by the underlying OpenSSL implementation.</p>
       </desc>
     </func>
     <func>
@@ -548,6 +558,8 @@ Mpint() = <![CDATA[<<ByteLen:32/integer-big, Bytes:ByteLen/binary>>]]>
           keys, and <c>IVec</c> is an arbitrary initializing
           vector. The lengths of each of <c>Key1</c>, <c>Key2</c>,
           <c>Key3</c> and <c>IVec</c> must be 64 bits (8 bytes).</p>
+	<p>May throw exception <c>notsup</c> for old OpenSSL
+	  versions (0.9.7) that does not support this encryption mode.</p>
       </desc>
     </func>
     <func>
@@ -565,6 +577,8 @@ Mpint() = <![CDATA[<<ByteLen:32/integer-big, Bytes:ByteLen/binary>>]]>
           and <c>IVec</c> must have the same values as those used when
           encrypting.  The lengths of <c>Key1</c>, <c>Key2</c>,
           <c>Key3</c>, and <c>IVec</c> must be 64 bits (8 bytes).</p>
+	<p>May throw exception <c>notsup</c> for old OpenSSL
+	  versions (0.9.7) that does not support this encryption mode.</p>
       </desc>
     </func>
 
diff --git a/lib/crypto/doc/src/crypto_app.xml b/lib/crypto/doc/src/crypto_app.xml
index 1c01e3f099..6573a56f4c 100644
--- a/lib/crypto/doc/src/crypto_app.xml
+++ b/lib/crypto/doc/src/crypto_app.xml
@@ -62,7 +62,7 @@
   <section>
     <title>OpenSSL libraries</title>
     <p>The current implementation of the Erlang Crypto application is
-      based on the <em>OpenSSL</em> package version 0.9.7 or higher.
+      based on the <em>OpenSSL</em> package version 0.9.8 or higher.
       There are source and binary releases on the web.
       </p>
     <p>Source releases of OpenSSL can be downloaded from the <url href="http://www.openssl.org">OpenSSL</url> project home page,
diff --git a/lib/crypto/src/crypto.erl b/lib/crypto/src/crypto.erl
index 21f507f153..461558a79e 100644
--- a/lib/crypto/src/crypto.erl
+++ b/lib/crypto/src/crypto.erl
@@ -78,12 +78,11 @@
 		    md5_mac,  md5_mac_96,
 		    sha_mac,  sha_mac_96,
 		    sha224_mac, sha256_mac, sha384_mac, sha512_mac,
-                    sha_mac_init, sha_mac_update, sha_mac_final,
 		    des_cbc_encrypt, des_cbc_decrypt,
 		    des_cfb_encrypt, des_cfb_decrypt,
 		    des_ecb_encrypt, des_ecb_decrypt,
-		    des_ede3_cbc_encrypt, des_ede3_cbc_decrypt,
-		    des_ede3_cfb_encrypt, des_ede3_cfb_decrypt,
+		    des3_cbc_encrypt, des3_cbc_decrypt,
+		    des3_cfb_encrypt, des3_cfb_decrypt,
 		    aes_cfb_128_encrypt, aes_cfb_128_decrypt,
 		    rand_bytes,
 		    strong_rand_bytes,
@@ -103,6 +102,13 @@
 		    aes_cbc_256_encrypt, aes_cbc_256_decrypt,
 		    aes_ctr_encrypt, aes_ctr_decrypt,
                     aes_ctr_stream_init, aes_ctr_stream_encrypt, aes_ctr_stream_decrypt,
+		    aes_cbc_ivec, blowfish_cbc_encrypt, blowfish_cbc_decrypt,
+		    blowfish_cfb64_encrypt, blowfish_cfb64_decrypt,
+		    blowfish_ecb_encrypt, blowfish_ecb_decrypt, blowfish_ofb64_encrypt,
+		    des_cbc_ivec, des_cfb_ivec, erlint, mpint,
+		    hash, hash_init, hash_update, hash_final,
+		    hmac_init, hmac_update, hmac_final, hmac_final_n, info,
+		    rc2_cbc_encrypt, rc2_cbc_decrypt,
 		    info_lib]).
 
 -type rsa_digest_type() :: 'md5' | 'sha' | 'sha224' | 'sha256' | 'sha384' | 'sha512'.
@@ -597,12 +603,12 @@ des_ecb_crypt(_Key, _Data, _IsEncrypt) -> ?nif_stub.
 			     binary().
 
 des3_cbc_encrypt(Key1, Key2, Key3, IVec, Data) ->
-    des_ede3_cbc_encrypt(Key1, Key2, Key3, IVec, Data).
+    des_ede3_cbc_crypt(Key1, Key2, Key3, IVec, Data, true).
 des_ede3_cbc_encrypt(Key1, Key2, Key3, IVec, Data) ->
     des_ede3_cbc_crypt(Key1, Key2, Key3, IVec, Data, true).
 
 des3_cbc_decrypt(Key1, Key2, Key3, IVec, Data) ->
-    des_ede3_cbc_decrypt(Key1, Key2, Key3, IVec, Data).
+    des_ede3_cbc_crypt(Key1, Key2, Key3, IVec, Data, false).
 des_ede3_cbc_decrypt(Key1, Key2, Key3, IVec, Data) ->
     des_ede3_cbc_crypt(Key1, Key2, Key3, IVec, Data, false).
 
@@ -617,16 +623,18 @@ des_ede3_cbc_crypt(_Key1, _Key2, _Key3, _IVec, _Data, _IsEncrypt) -> ?nif_stub.
 			     binary().
 
 des3_cfb_encrypt(Key1, Key2, Key3, IVec, Data) ->
-    des_ede3_cfb_encrypt(Key1, Key2, Key3, IVec, Data).
-des_ede3_cfb_encrypt(Key1, Key2, Key3, IVec, Data) ->
     des_ede3_cfb_crypt(Key1, Key2, Key3, IVec, Data, true).
 
 des3_cfb_decrypt(Key1, Key2, Key3, IVec, Data) ->
-    des_ede3_cfb_decrypt(Key1, Key2, Key3, IVec, Data).
-des_ede3_cfb_decrypt(Key1, Key2, Key3, IVec, Data) ->
     des_ede3_cfb_crypt(Key1, Key2, Key3, IVec, Data, false).
 
-des_ede3_cfb_crypt(_Key1, _Key2, _Key3, _IVec, _Data, _IsEncrypt) -> ?nif_stub.
+des_ede3_cfb_crypt(Key1, Key2, Key3, IVec, Data, IsEncrypt) ->
+    case des_ede3_cfb_crypt_nif(Key1,Key2,Key3,IVec,Data,IsEncrypt) of
+	notsup -> erlang:error(notsup);
+	Bin -> Bin
+    end.
+
+des_ede3_cfb_crypt_nif(_Key1, _Key2, _Key3, _IVec, _Data, _IsEncrypt) -> ?nif_stub.
 
 %%
 %% Blowfish
diff --git a/lib/crypto/test/crypto_SUITE.erl b/lib/crypto/test/crypto_SUITE.erl
index 7ac693f371..8965ab6b94 100644
--- a/lib/crypto/test/crypto_SUITE.erl
+++ b/lib/crypto/test/crypto_SUITE.erl
@@ -87,10 +87,12 @@ groups() ->
      {rest, [],
       [md5, md5_update, md4, md4_update, md5_mac,
        md5_mac_io, sha, sha_update,
+       sha256, sha256_update, sha512, sha512_update,
        hmac_update_sha, hmac_update_sha_n, hmac_update_sha256, hmac_update_sha512,
        hmac_update_md5_n, hmac_update_md5_io, hmac_update_md5,
        hmac_rfc4231,
        des_cbc, aes_cfb, aes_cbc,
+       des_cfb, des_cfb_iter, des3_cbc, des3_cfb, rc2_cbc,
        aes_cbc_iter, aes_ctr, aes_ctr_stream, des_cbc_iter, des_ecb,
        rand_uniform_test, strong_rand_test,
        rsa_verify_test, dsa_verify_test, rsa_sign_test,
@@ -192,7 +194,16 @@ info(Config) when is_list(Config) ->
 	    {skip,"Missing crypto application"};
 	{_,_} ->
 	    ?line crypto:start(),
-	    ?line crypto:info(),
+	    ?line Info = crypto:info(),
+	    ?line Exports = lists:usort([F || {F,_} <- crypto:module_info(exports)]),
+	    ?line [] = Info -- Exports,
+	    ?line NotInInfo = Exports -- Info,
+	    io:format("NotInInfo = ~p\n", [NotInInfo]),
+	    BlackList = lists:sort([des_ede3_cbc_decrypt, des_ede3_cbc_encrypt,
+				    dh_check, dh_generate_parameters,
+				    module_info, start, stop, version]),
+	    ?line BlackList = NotInInfo,
+
 	    ?line InfoLib = crypto:info_lib(),
 	    ?line [_|_] = InfoLib,
 	    F = fun([{Name,VerN,VerS}|T],Me) ->
@@ -349,12 +360,8 @@ hmac_update_sha256(doc) ->
 hmac_update_sha256(suite) ->
     [];
 hmac_update_sha256(Config) when is_list(Config) ->
-    case openssl_version() of
-	V when V < 16#908000 ->
-	    {skipped,"OpenSSL version too old"};
-	_ ->
-	    hmac_update_sha256_do()
-    end.
+    if_098(fun() -> hmac_update_sha256_do() end).
+
 
 hmac_update_sha256_do() ->
     ?line Key = hexstr2bin("00010203101112132021222330313233"
@@ -376,12 +383,7 @@ hmac_update_sha512(doc) ->
 hmac_update_sha512(suite) ->
     [];
 hmac_update_sha512(Config) when is_list(Config) ->
-    case openssl_version() of
-	V when V < 16#908000 ->
-	    {skipped,"OpenSSL version too old"};
-	_ ->
-	    hmac_update_sha512_do()
-    end.
+    if_098(fun() -> hmac_update_sha512_do() end).
 
 hmac_update_sha512_do() ->
     ?line Key = hexstr2bin("00010203101112132021222330313233"
@@ -422,12 +424,7 @@ hmac_rfc4231(doc) ->
 hmac_rfc4231(suite) ->
     [];
 hmac_rfc4231(Config) when is_list(Config) ->
-    case openssl_version() of
-	V when V < 16#908000 ->
-	    {skipped,"OpenSSL version too old"};
-	_ ->
-	    hmac_rfc4231_do()
-    end.
+    if_098(fun() -> hmac_rfc4231_do() end).
 
 hmac_rfc4231_do() ->
     %% Test Case 1
@@ -746,6 +743,9 @@ sha256(doc) ->
 sha256(suite) ->
     [];
 sha256(Config) when is_list(Config) ->
+    if_098(fun() -> sha256_do() end).
+
+sha256_do() ->
     ?line m(crypto:sha256("abc"),
 	    hexstr2bin("BA7816BF8F01CFEA4141"
 		       "40DE5DAE2223B00361A396177A9CB410FF61F20015AD")),
@@ -762,6 +762,9 @@ sha256_update(doc) ->
 sha256_update(suite) ->
     [];
 sha256_update(Config) when is_list(Config) ->
+    if_098(fun() -> sha256_update_do() end).
+
+sha256_update_do() ->
     ?line Ctx = crypto:sha256_init(),
     ?line Ctx1 = crypto:sha256_update(Ctx, "abcdbcdecdefdefgefghfghighi"),
     ?line Ctx2 = crypto:sha256_update(Ctx1, "jhijkijkljklmklmnlmnomnopnopq"),
@@ -778,6 +781,9 @@ sha512(doc) ->
 sha512(suite) ->
     [];
 sha512(Config) when is_list(Config) ->
+    if_098(fun() -> sha512_do() end).
+
+sha512_do() ->
     ?line m(crypto:sha512("abc"),
 	    hexstr2bin("DDAF35A193617ABACC417349AE20413112E6FA4E89A97EA2"
 		       "0A9EEEE64B55D39A2192992A274FC1A836BA3C23A3FEEBBD"
@@ -796,6 +802,9 @@ sha512_update(doc) ->
 sha512_update(suite) ->
     [];
 sha512_update(Config) when is_list(Config) ->
+    if_098(fun() -> sha512_update_do() end).
+
+sha512_update_do() ->
     ?line Ctx = crypto:sha512_init(),
     ?line Ctx1 = crypto:sha512_update(Ctx, "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn"),
     ?line Ctx2 = crypto:sha512_update(Ctx1, "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu"),
@@ -996,6 +1005,12 @@ des3_cfb(doc) ->
 des3_cfb(suite) ->
     [];
 des3_cfb(Config) when is_list(Config) ->
+    case openssl_version() of
+	V when V < 16#90705F -> {skipped,"OpenSSL version too old"};
+	_ -> des3_cfb_do()
+    end.
+
+des3_cfb_do() ->
     ?line Key1 = hexstr2bin("0123456789abcdef"),
     ?line Key2 = hexstr2bin("fedcba9876543210"),
     ?line Key3 = hexstr2bin("0f2d4b6987a5c3e1"),
@@ -1959,3 +1974,10 @@ openssl_version() ->
 	    undefined
     end.
 
+if_098(Fun) ->
+    case openssl_version() of
+	V when V < 16#908000 ->
+	    {skipped,"OpenSSL version too old"};
+	_ ->
+	    Fun()
+    end.