C++ EVP_CIPHER_CTX_cipher函数代码示例

static int cms_wrap_init(CMS_KeyAgreeRecipientInfo *kari,
                         const EVP_CIPHER *cipher)
{
    EVP_CIPHER_CTX *ctx = &kari->ctx;
    const EVP_CIPHER *kekcipher;
    int keylen = EVP_CIPHER_key_length(cipher);
    /* If a suitable wrap algorithm is already set nothing to do */
    kekcipher = EVP_CIPHER_CTX_cipher(ctx);

    if (kekcipher) {
        if (EVP_CIPHER_CTX_mode(ctx) != EVP_CIPH_WRAP_MODE)
            return 0;
        return 1;
    }
    /*
     * Pick a cipher based on content encryption cipher. If it is DES3 use
     * DES3 wrap otherwise use AES wrap similar to key size.
     */
    if (EVP_CIPHER_type(cipher) == NID_des_ede3_cbc)
        kekcipher = EVP_des_ede3_wrap();
    else if (keylen <= 16)
        kekcipher = EVP_aes_128_wrap();
    else if (keylen <= 24)
        kekcipher = EVP_aes_192_wrap();
    else
        kekcipher = EVP_aes_256_wrap();
    return EVP_EncryptInit_ex(ctx, kekcipher, NULL, NULL, NULL);
}

static VALUE
ossl_cipher_pkcs5_keyivgen(int argc, VALUE *argv, VALUE self)
{
    EVP_CIPHER_CTX *ctx;
    const EVP_MD *digest;
    VALUE vpass, vsalt, viter, vdigest;
    unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH], *salt = NULL;
    int iter;

    rb_scan_args(argc, argv, "13", &vpass, &vsalt, &viter, &vdigest);
    StringValue(vpass);
    if(!NIL_P(vsalt)){
	StringValue(vsalt);
	if(RSTRING(vsalt)->len != PKCS5_SALT_LEN)
	    rb_raise(eCipherError, "salt must be an 8-octet string");
	salt = RSTRING(vsalt)->ptr;
    }
    iter = NIL_P(viter) ? 2048 : NUM2INT(viter);
    digest = NIL_P(vdigest) ? EVP_md5() : GetDigestPtr(vdigest);
    GetCipher(self, ctx);
    EVP_BytesToKey(EVP_CIPHER_CTX_cipher(ctx), digest, salt,
		   RSTRING(vpass)->ptr, RSTRING(vpass)->len, iter, key, iv); 
    if (EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, -1) != 1)
	ossl_raise(eCipherError, NULL);
    OPENSSL_cleanse(key, sizeof key);
    OPENSSL_cleanse(iv, sizeof iv);

    return Qnil;
}

int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen, 
			const EVP_CIPHER *cipher, ENGINE *impl)
	{
	static unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH];
#ifdef OPENSSL_FIPS
	if (FIPS_mode())
		{
		/* If we have an ENGINE need to allow non FIPS */
		if ((impl || ctx->cctx.engine)
			&& !(ctx->cctx.flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))

			{
			EVPerr(EVP_F_CMAC_INIT, EVP_R_DISABLED_FOR_FIPS);
			return 0;
			}
		/* Other algorithm blocking will be done in FIPS_cmac_init,
		 * via FIPS_cipherinit().
		 */
		if (!impl && !ctx->cctx.engine)
			return FIPS_cmac_init(ctx, key, keylen, cipher, NULL);
		}
#endif
	/* All zeros means restart */
	if (!key && !cipher && !impl && keylen == 0)
		{
		/* Not initialised */
		if (ctx->nlast_block == -1)
			return 0;
		if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, NULL, zero_iv))
			return 0;
		return 1;
		}
	/* Initialiase context */
	if (cipher && !EVP_EncryptInit_ex(&ctx->cctx, cipher, impl, NULL, NULL))
		return 0;
	/* Non-NULL key means initialisation complete */
	if (key)
		{
		int bl;
		if (!EVP_CIPHER_CTX_cipher(&ctx->cctx))
			return 0;
		if (!EVP_CIPHER_CTX_set_key_length(&ctx->cctx, keylen))
			return 0;
		if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, key, zero_iv))
			return 0;
		bl = EVP_CIPHER_CTX_block_size(&ctx->cctx);
		if (!EVP_Cipher(&ctx->cctx, ctx->tbl, zero_iv, bl))
			return 0;
		make_kn(ctx->k1, ctx->tbl, bl);
		make_kn(ctx->k2, ctx->k1, bl);
		OPENSSL_cleanse(ctx->tbl, bl);
		/* Reset context again ready for first data block */
		if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, NULL, zero_iv))
			return 0;
		/* Zero tbl so resume works */
		memset(ctx->tbl, 0, bl);
		ctx->nlast_block = 0;
		}
	return 1;
	}

static VALUE
ossl_cipher_name(VALUE self)
{
    EVP_CIPHER_CTX *ctx;

    GetCipher(self, ctx);

    return rb_str_new2(EVP_CIPHER_name(EVP_CIPHER_CTX_cipher(ctx)));
}

/*
 * PUBLIC
 */
const EVP_CIPHER *
GetCipherPtr(VALUE obj)
{
    EVP_CIPHER_CTX *ctx;

    SafeGetCipher(obj, ctx);

    return EVP_CIPHER_CTX_cipher(ctx);
}

static int aead_rc4_sha1_tls_get_rc4_state(const EVP_AEAD_CTX *ctx,
                                           const RC4_KEY **out_key) {
  const AEAD_TLS_CTX *tls_ctx = (AEAD_TLS_CTX*) ctx->aead_state;
  if (EVP_CIPHER_CTX_cipher(&tls_ctx->cipher_ctx) != EVP_rc4()) {
    return 0;
  }

  *out_key = (const RC4_KEY*) tls_ctx->cipher_ctx.cipher_data;
  return 1;
}

int
aes_init (crypt_data_t* crypt_data, crypt_init_t crypt_init)
{
    const EVP_CIPHER* cipher = 0;

    switch (crypt_data->keysize) {
    case 16:
        cipher = EVP_aes_128_cbc ();
        break;
    case 24:
        cipher = EVP_aes_192_cbc ();
        break;
    case 32:
        cipher = EVP_aes_256_cbc ();
        break;
    default:
        fprintf (stderr, "Invalid key size.\n");
        return -1;
    }

    EVP_CIPHER_CTX_init (&crypt_data->ctx);
    if (!crypt_init (&crypt_data->ctx,
                     cipher,
                     NULL,
                     crypt_data->keybuf,
                     crypt_data->ivbuf)) {
        fprintf (stderr, "OpenSSL initialization failed.\n");
        return 1;
    }
    if (verbose) {
        fprintf (stderr,
                 "EVP Initialized\n  Algorithm: %s\n",
                 EVP_CIPHER_name (EVP_CIPHER_CTX_cipher (&crypt_data->ctx)));
        fprintf (stderr, "  IV:  ");
        pp_buf (stderr, crypt_data->ivbuf, crypt_data->ivsize, 16, 2);
        fprintf (stderr, "  Key: ");
        pp_buf (stderr, crypt_data->keybuf, crypt_data->keysize, 16, 2);
    }
    crypt_data->buf_size = INBUFSIZE;
    crypt_data->out_buf =
        (char*)malloc (crypt_data->buf_size +
                       EVP_CIPHER_CTX_block_size (&crypt_data->ctx));
    crypt_data->in_buf = (char*)malloc (crypt_data->buf_size);
    if (!crypt_data->out_buf || !crypt_data->in_buf) {
        fprintf (stderr, "Unable to allocate memory.\n");
        return 1;
    }
    return 0;
}

static LUA_FUNCTION(openssl_cipher_ctx_info)
{
  EVP_CIPHER_CTX *ctx = CHECK_OBJECT(1, EVP_CIPHER_CTX, "openssl.evp_cipher_ctx");
  lua_newtable(L);
  AUXILIAR_SET(L, -1, "block_size", EVP_CIPHER_CTX_block_size(ctx), integer);
  AUXILIAR_SET(L, -1, "key_length", EVP_CIPHER_CTX_key_length(ctx), integer);
  AUXILIAR_SET(L, -1, "iv_length", EVP_CIPHER_CTX_iv_length(ctx), integer);
  AUXILIAR_SET(L, -1, "flags", EVP_CIPHER_CTX_flags(ctx), integer);
  AUXILIAR_SET(L, -1, "nid", EVP_CIPHER_CTX_nid(ctx), integer);
  AUXILIAR_SET(L, -1, "type", EVP_CIPHER_CTX_mode(ctx), integer);
  AUXILIAR_SET(L, -1, "mode", EVP_CIPHER_CTX_type(ctx), integer);

  AUXILIAR_SETOBJECT(L, EVP_CIPHER_CTX_cipher(ctx), "openssl.evp_cipher", -1, "cipher");
  return 1;
}

static int cms_wrap_init(CMS_KeyAgreeRecipientInfo *kari,
                         const EVP_CIPHER *cipher)
{
    EVP_CIPHER_CTX *ctx = kari->ctx;
    const EVP_CIPHER *kekcipher;
#ifndef OPENSSL_NO_AES
    int keylen = EVP_CIPHER_key_length(cipher);
#endif
    /* If a suitable wrap algorithm is already set nothing to do */
    kekcipher = EVP_CIPHER_CTX_cipher(ctx);

    if (kekcipher) {
        if (EVP_CIPHER_CTX_mode(ctx) != EVP_CIPH_WRAP_MODE)
            return 0;
        return 1;
    }
    /*
     * Pick a cipher based on content encryption cipher. If it is DES3 use
     * DES3 wrap otherwise use AES wrap similar to key size.
     */
#if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_SHA)
    /* EVP_des_ede3_wrap() depends on EVP_sha1() */
    if (EVP_CIPHER_type(cipher) == NID_des_ede3_cbc)
        kekcipher = EVP_des_ede3_wrap();
    else
#endif
#ifndef OPENSSL_NO_SMS4
    if (EVP_CIPHER_type(cipher) == NID_sms4_cbc
        || EVP_CIPHER_type(cipher) == NID_sm1_cbc
        || EVP_CIPHER_type(cipher) == NID_ssf33_cbc)
        kekcipher = EVP_sms4_wrap();
    else
#endif
#ifndef OPENSSL_NO_AES
    if (keylen <= 16)
        kekcipher = EVP_aes_128_wrap();
    else if (keylen <= 24)
        kekcipher = EVP_aes_192_wrap();
    else
        kekcipher = EVP_aes_256_wrap();
#endif
    if (kekcipher == NULL)
        return 0;

    return EVP_EncryptInit_ex(ctx, kekcipher, NULL, NULL, NULL);
}

int
CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
    const EVP_CIPHER *cipher, ENGINE *impl)
{
	static unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH];

	/* All zeros means restart */
	if (!key && !cipher && !impl && keylen == 0) {
		/* Not initialised */
		if (ctx->nlast_block == -1)
			return 0;
		if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, NULL, zero_iv))
			return 0;
		memset(ctx->tbl, 0, EVP_CIPHER_CTX_block_size(&ctx->cctx));
		ctx->nlast_block = 0;
		return 1;
	}
	/* Initialiase context */
	if (cipher && !EVP_EncryptInit_ex(&ctx->cctx, cipher, impl, NULL, NULL))
		return 0;
	/* Non-NULL key means initialisation complete */
	if (key) {
		int bl;

		if (!EVP_CIPHER_CTX_cipher(&ctx->cctx))
			return 0;
		if (!EVP_CIPHER_CTX_set_key_length(&ctx->cctx, keylen))
			return 0;
		if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, key, zero_iv))
			return 0;
		bl = EVP_CIPHER_CTX_block_size(&ctx->cctx);
		if (!EVP_Cipher(&ctx->cctx, ctx->tbl, zero_iv, bl))
			return 0;
		make_kn(ctx->k1, ctx->tbl, bl);
		make_kn(ctx->k2, ctx->k1, bl);
		OPENSSL_cleanse(ctx->tbl, bl);
		/* Reset context again ready for first data block */
		if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, NULL, zero_iv))
			return 0;
		/* Zero tbl so resume works */
		memset(ctx->tbl, 0, bl);
		ctx->nlast_block = 0;
	}
	return 1;
}

static VALUE
ossl_cipher_init(int argc, VALUE *argv, VALUE self, int mode)
{
    EVP_CIPHER_CTX *ctx;
    unsigned char key[EVP_MAX_KEY_LENGTH], *p_key = NULL;
    unsigned char iv[EVP_MAX_IV_LENGTH], *p_iv = NULL;
    VALUE pass, init_v;

    if(rb_scan_args(argc, argv, "02", &pass, &init_v) > 0){
	/*
	 * oops. this code mistakes salt for IV.
	 * We deprecated the arguments for this method, but we decided
	 * keeping this behaviour for backward compatibility.
	 */
	VALUE cname  = rb_class_path(rb_obj_class(self));
	rb_warn("arguments for %"PRIsVALUE"#encrypt and %"PRIsVALUE"#decrypt were deprecated; "
                "use %"PRIsVALUE"#pkcs5_keyivgen to derive key and IV",
                cname, cname, cname);
	StringValue(pass);
	GetCipher(self, ctx);
	if (NIL_P(init_v)) memcpy(iv, "OpenSSL for Ruby rulez!", sizeof(iv));
	else{
	    StringValue(init_v);
	    if (EVP_MAX_IV_LENGTH > RSTRING_LEN(init_v)) {
		memset(iv, 0, EVP_MAX_IV_LENGTH);
		memcpy(iv, RSTRING_PTR(init_v), RSTRING_LEN(init_v));
	    }
	    else memcpy(iv, RSTRING_PTR(init_v), sizeof(iv));
	}
	EVP_BytesToKey(EVP_CIPHER_CTX_cipher(ctx), EVP_md5(), iv,
		       (unsigned char *)RSTRING_PTR(pass), RSTRING_LENINT(pass), 1, key, NULL);
	p_key = key;
	p_iv = iv;
    }
    else {
	GetCipher(self, ctx);
    }
    if (EVP_CipherInit_ex(ctx, NULL, NULL, p_key, p_iv, mode) != 1) {
	ossl_raise(eCipherError, NULL);
    }

    return self;
}

static VALUE
ossl_cipher_init(int argc, VALUE *argv, VALUE self, int mode)
{
    EVP_CIPHER_CTX *ctx;
    unsigned char key[EVP_MAX_KEY_LENGTH], *p_key = NULL;
    unsigned char iv[EVP_MAX_IV_LENGTH], *p_iv = NULL;
    VALUE pass, init_v;

    if(rb_scan_args(argc, argv, "02", &pass, &init_v) > 0){
	/*
	 * oops. this code mistakes salt for IV.
	 * We deprecated the arguments for this method, but we decided
	 * keeping this behaviour for backward compatibility.
	 */
	StringValue(pass);
	GetCipher(self, ctx);
	if (NIL_P(init_v)) memcpy(iv, "OpenSSL for Ruby rulez!", sizeof(iv));
	else{
	    char *cname  = rb_class2name(rb_obj_class(self));
	    rb_warning("key derivation by %s#encrypt is deprecated; "
		       "use %s::pkcs5_keyivgen instead", cname, cname);
	    StringValue(init_v);
	    if (EVP_MAX_IV_LENGTH > RSTRING(init_v)->len) {
		memset(iv, 0, EVP_MAX_IV_LENGTH);
		memcpy(iv, RSTRING(init_v)->ptr, RSTRING(init_v)->len);
	    }
	    else memcpy(iv, RSTRING(init_v)->ptr, sizeof(iv));
	}
	EVP_BytesToKey(EVP_CIPHER_CTX_cipher(ctx), EVP_md5(), iv,
		       RSTRING(pass)->ptr, RSTRING(pass)->len, 1, key, NULL);
	p_key = key;
	p_iv = iv;
    }
    else {
	GetCipher(self, ctx);
    }
    if (EVP_CipherInit_ex(ctx, NULL, NULL, p_key, p_iv, mode) != 1) {
	ossl_raise(eCipherError, NULL);
    }

    return self;
}

int dtls1_enc(SSL *s, int send)
	{
	SSL3_RECORD *rec;
	EVP_CIPHER_CTX *ds;
	unsigned long l;
	int bs,i,ii,j,k,n=0;
	const EVP_CIPHER *enc;

	if (send)
		{
		if (EVP_MD_CTX_md(s->write_hash))
			{
			n=EVP_MD_CTX_size(s->write_hash);
			if (n < 0)
				return -1;
			}
		ds=s->enc_write_ctx;
		rec= &(s->s3->wrec);
		if (s->enc_write_ctx == NULL)
			enc=NULL;
		else
			{
			enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
			if ( rec->data != rec->input)
				/* we can't write into the input stream */
#ifndef OPENSSL_SYS_WINDOWS
				TINYCLR_SSL_PRINTF("%s:%d: rec->data != rec->input\n",
					__FILE__, __LINE__);

#else
				TINYCLR_SSL_FPRINTF(OPENSSL_TYPE__FILE_STDERR, "%s:%d: rec->data != rec->input\n",
					__FILE__, __LINE__);
#endif
			else if ( EVP_CIPHER_block_size(ds->cipher) > 1)
				{
				if (RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)) <= 0)
					return -1;
				}
			}
		}

/*-
 * dtls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
 *
 * Returns:
 *   0: (in non-constant time) if the record is publically invalid (i.e. too
 *       short etc).
 *   1: if the record's padding is valid / the encryption was successful.
 *   -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
 *       an internal error occured.
 */
int dtls1_enc(SSL *s, int send)
{
    SSL3_RECORD *rec;
    EVP_CIPHER_CTX *ds;
    unsigned long l;
    int bs, i, j, k, mac_size = 0;
    const EVP_CIPHER *enc;

    if (send) {
        if (EVP_MD_CTX_md(s->write_hash)) {
            mac_size = EVP_MD_CTX_size(s->write_hash);
            if (mac_size < 0)
                return -1;
        }
        ds = s->enc_write_ctx;
        rec = &(s->s3->wrec);
        if (s->enc_write_ctx == NULL)
            enc = NULL;
        else {
            enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
            if (rec->data != rec->input)
                /* we can't write into the input stream */
                fprintf(stderr, "%s:%d: rec->data != rec->input\n",
                        __FILE__, __LINE__);
            else if (EVP_CIPHER_block_size(ds->cipher) > 1) {
                if (RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher))
                    <= 0)
                    return -1;
            }
        }
    } else {
        if (EVP_MD_CTX_md(s->read_hash)) {
            mac_size = EVP_MD_CTX_size(s->read_hash);
            OPENSSL_assert(mac_size >= 0);
        }
        ds = s->enc_read_ctx;
        rec = &(s->s3->rrec);
        if (s->enc_read_ctx == NULL)
            enc = NULL;
        else
            enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
    }

#ifdef KSSL_DEBUG
    printf("dtls1_enc(%d)\n", send);
#endif                          /* KSSL_DEBUG */

    if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
        memmove(rec->data, rec->input, rec->length);
        rec->input = rec->data;
    } else {
        l = rec->length;
        bs = EVP_CIPHER_block_size(ds->cipher);

        if ((bs != 1) && send) {
            i = bs - ((int)l % bs);

            /* Add weird padding of upto 256 bytes */

            /* we need to add 'i' padding bytes of value j */
            j = i - 1;
            if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) {
                if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
                    j++;
            }
            for (k = (int)l; k < (int)(l + i); k++)
                rec->input[k] = j;
            l += i;
            rec->length += i;
        }
#ifdef KSSL_DEBUG
        {
            unsigned long ui;
            printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
                   ds, rec->data, rec->input, l);
            printf
                ("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",
                 ds->buf_len, ds->cipher->key_len, DES_KEY_SZ,
                 DES_SCHEDULE_SZ, ds->cipher->iv_len);
            printf("\t\tIV: ");
            for (i = 0; i < ds->cipher->iv_len; i++)
                printf("%02X", ds->iv[i]);
            printf("\n");
            printf("\trec->input=");
            for (ui = 0; ui < l; ui++)
                printf(" %02x", rec->input[ui]);
            printf("\n");
        }
#endif                          /* KSSL_DEBUG */

//.........这里部分代码省略.........

int dtls1_enc(SSL *s, int send)
{
    SSL3_RECORD *rec;
    EVP_CIPHER_CTX *ds;
    unsigned long l;
    int bs,i,ii,j,k;
    const EVP_CIPHER *enc;

    if (send)
    {
        ds=s->enc_write_ctx;
        rec= &(s->s3->wrec);
        if (s->enc_write_ctx == NULL)
            enc=NULL;
        else
        {
            enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
            if ( rec->data != rec->input)
                /* we can't write into the input stream */
                fprintf(stderr, "%s:%d: rec->data != rec->input\n",
                        __FILE__, __LINE__);
            else if ( EVP_CIPHER_block_size(ds->cipher) > 1)
            {
                if (RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)) <= 0)
                    return -1;
            }
        }
    }
    else
    {
        ds=s->enc_read_ctx;
        rec= &(s->s3->rrec);
        if (s->enc_read_ctx == NULL)
            enc=NULL;
        else
            enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
    }

#ifdef KSSL_DEBUG
    printf("dtls1_enc(%d)\n", send);
#endif    /* KSSL_DEBUG */

    if ((s->session == NULL) || (ds == NULL) ||
            (enc == NULL))
    {
        memmove(rec->data,rec->input,rec->length);
        rec->input=rec->data;
    }
    else
    {
        l=rec->length;
        bs=EVP_CIPHER_block_size(ds->cipher);

        if ((bs != 1) && send)
        {
            i=bs-((int)l%bs);

            /* Add weird padding of upto 256 bytes */

            /* we need to add 'i' padding bytes of value j */
            j=i-1;
            if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG)
            {
                if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
                    j++;
            }
            for (k=(int)l; k<(int)(l+i); k++)
                rec->input[k]=j;
            l+=i;
            rec->length+=i;
        }

#ifdef KSSL_DEBUG
        {
            unsigned long ui;
            printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
                   (void *)ds,rec->data,rec->input,l);
            printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%ld %ld], %d iv_len\n",
                   ds->buf_len, ds->cipher->key_len,
                   (unsigned long)DES_KEY_SZ,
                   (unsigned long)DES_SCHEDULE_SZ,
                   ds->cipher->iv_len);
            printf("\t\tIV: ");
            for (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);
            printf("\n");
            printf("\trec->input=");
            for (ui=0; ui<l; ui++) printf(" %02x", rec->input[ui]);
            printf("\n");
        }
#endif	/* KSSL_DEBUG */

        if (!send)
        {
            if (l == 0 || l%bs != 0)
                return -1;
        }

        EVP_Cipher(ds,rec->data,rec->input,l);

#ifdef KSSL_DEBUG
//.........这里部分代码省略.........