Mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2026-01-18 17:11:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove support for custom MD methods

Browse Source 
Custom MD methods are considered legacy and have been deprecated
since 3.0. With the removal of ENGINEs they become a lot less useful
and add significant complexity to the code. We should therefore remove
them in 4.0.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29366)
This commit is contained in:
Matt Caswell
2025-12-10 10:56:49 +00:00
parent 1bfdcf9057
commit 992368ec46
7 changed files with 10 additions and 477 deletions
Download Patch File Download Diff File Expand all files Collapse all files

122
crypto/evp/digest.c
View File

@@ -178,27 +178,8 @@ static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type,
type = ctx->digest;
}
/*
* If there is EVP_MD_CTX_FLAG_NO_INIT set then we
* should use legacy handling for now.
*/
if ((ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0
|| (type != NULL && type->origin == EVP_ORIG_METH)
|| (type == NULL && ctx->digest != NULL
&& ctx->digest->origin == EVP_ORIG_METH)) {
/* If we were using provided hash before, cleanup algctx */
if (!evp_md_ctx_free_algctx(ctx))
return 0;
if (ctx->digest == ctx->fetched_digest)
ctx->digest = NULL;
EVP_MD_free(ctx->fetched_digest);
ctx->fetched_digest = NULL;
goto legacy;
}
cleanup_old_md_data(ctx, 1);
/* Start of non-legacy code below */
if (ossl_likely(ctx->digest == type)) {
if (ossl_unlikely(!ossl_assert(type->prov != NULL))) {
ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
@@ -254,35 +235,6 @@ static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type,
}
return ctx->digest->dinit(ctx->algctx, params);
/* Code below to be removed when legacy support is dropped. */
legacy:
if (ctx->digest != type) {
cleanup_old_md_data(ctx, 1);
ctx->digest = type;
if (!(ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) && type->ctx_size) {
ctx->update = type->update;
ctx->md_data = OPENSSL_zalloc(type->ctx_size);
if (ctx->md_data == NULL)
return 0;
}
}
#ifndef FIPS_MODULE
if (ctx->pctx != NULL
&& (!EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx->pctx)
|| ctx->pctx->op.sig.signature == NULL)) {
int r;
r = EVP_PKEY_CTX_ctrl(ctx->pctx, -1, EVP_PKEY_OP_TYPE_SIG,
EVP_PKEY_CTRL_DIGESTINIT, 0, ctx);
if (r <= 0 && (r != -2))
return 0;
}
#endif
if (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT)
return 1;
return ctx->digest->init(ctx);
}
int EVP_DigestInit_ex2(EVP_MD_CTX *ctx, const EVP_MD *type,
@@ -335,20 +287,16 @@ int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count)
return 0;
}
if (ctx->digest == NULL
|| ctx->digest->prov == NULL
|| ossl_unlikely((ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0))
goto legacy;
if (ctx->digest == NULL || ctx->digest->prov == NULL) {
ERR_raise(ERR_LIB_EVP, EVP_R_UPDATE_ERROR);
return 0;
}
if (ossl_unlikely(ctx->digest->dupdate == NULL)) {
ERR_raise(ERR_LIB_EVP, EVP_R_UPDATE_ERROR);
return 0;
}
return ctx->digest->dupdate(ctx->algctx, data, count);
/* Code below to be removed when legacy support is dropped. */
legacy:
return ctx->update != NULL ? ctx->update(ctx, data, count) : 0;
}
/* The caller can assume that this removes any secret data from the context */
@@ -565,7 +513,6 @@ int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
{
int digest_change = 0;
unsigned char *tmp_buf;
if (in == NULL) {
ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
@@ -581,11 +528,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
goto clone_pkey;
}
if (in->digest->prov == NULL
|| (in->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0)
goto legacy;
if (in->digest->dupctx == NULL) {
if (in->digest->prov == NULL || in->digest->dupctx == NULL) {
ERR_raise(ERR_LIB_EVP, EVP_R_NOT_ABLE_TO_COPY_CTX);
return 0;
}
@@ -638,55 +581,6 @@ clone_pkey:
#endif
return 1;
/* Code below to be removed when legacy support is dropped. */
legacy:
if (out->digest == in->digest) {
tmp_buf = out->md_data;
EVP_MD_CTX_set_flags(out, EVP_MD_CTX_FLAG_REUSE);
} else
tmp_buf = NULL;
EVP_MD_CTX_reset(out);
memcpy(out, in, sizeof(*out));
/* copied EVP_MD_CTX should free the copied EVP_PKEY_CTX */
EVP_MD_CTX_clear_flags(out, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
/* Null these variables, since they are getting fixed up
* properly below. Anything else may cause a memleak and/or
* double free if any of the memory allocations below fail
*/
out->md_data = NULL;
out->pctx = NULL;
if (in->md_data && out->digest->ctx_size) {
if (tmp_buf)
out->md_data = tmp_buf;
else {
out->md_data = OPENSSL_malloc(out->digest->ctx_size);
if (out->md_data == NULL)
return 0;
}
memcpy(out->md_data, in->md_data, out->digest->ctx_size);
}
out->update = in->update;
#ifndef FIPS_MODULE
if (in->pctx) {
out->pctx = EVP_PKEY_CTX_dup(in->pctx);
if (!out->pctx) {
EVP_MD_CTX_reset(out);
return 0;
}
}
#endif
if (out->digest->copy)
return out->digest->copy(out, in);
return 1;
}
int EVP_Digest(const void *data, size_t count,
@@ -1162,7 +1056,11 @@ void EVP_MD_free(EVP_MD *md)
CRYPTO_DOWN_REF(&md->refcnt, &i);
if (i > 0)
return;
evp_md_free_int(md);
OPENSSL_free(md->type_name);
ossl_provider_free(md->prov);
CRYPTO_FREE_REF(&md->refcnt);
OPENSSL_free(md);
}
void EVP_MD_do_all_provided(OSSL_LIB_CTX *libctx,

176
crypto/evp/evp_lib.c
View File

@@ -826,182 +826,6 @@ unsigned long EVP_MD_get_flags(const EVP_MD *md)
return md->flags;
}
EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type)
{
EVP_MD *md = evp_md_new();
if (md != NULL) {
md->type = md_type;
md->pkey_type = pkey_type;
md->origin = EVP_ORIG_METH;
}
return md;
}
EVP_MD *EVP_MD_meth_dup(const EVP_MD *md)
{
EVP_MD *to = NULL;
/*
* Non-legacy EVP_MDs can't be duplicated like this.
* Use EVP_MD_up_ref() instead.
*/
if (md->prov != NULL)
return NULL;
if ((to = EVP_MD_meth_new(md->type, md->pkey_type)) != NULL) {
CRYPTO_REF_COUNT refcnt = to->refcnt;
memcpy(to, md, sizeof(*to));
to->refcnt = refcnt;
to->origin = EVP_ORIG_METH;
}
return to;
}
void evp_md_free_int(EVP_MD *md)
{
OPENSSL_free(md->type_name);
ossl_provider_free(md->prov);
CRYPTO_FREE_REF(&md->refcnt);
OPENSSL_free(md);
}
void EVP_MD_meth_free(EVP_MD *md)
{
if (md == NULL || md->origin != EVP_ORIG_METH)
return;
evp_md_free_int(md);
}
int EVP_MD_meth_set_input_blocksize(EVP_MD *md, int blocksize)
{
if (md->block_size != 0)
return 0;
md->block_size = blocksize;
return 1;
}
int EVP_MD_meth_set_result_size(EVP_MD *md, int resultsize)
{
if (md->md_size != 0)
return 0;
md->md_size = resultsize;
return 1;
}
int EVP_MD_meth_set_app_datasize(EVP_MD *md, int datasize)
{
if (md->ctx_size != 0)
return 0;
md->ctx_size = datasize;
return 1;
}
int EVP_MD_meth_set_flags(EVP_MD *md, unsigned long flags)
{
if (md->flags != 0)
return 0;
md->flags = flags;
return 1;
}
int EVP_MD_meth_set_init(EVP_MD *md, int (*init)(EVP_MD_CTX *ctx))
{
if (md->init != NULL)
return 0;
md->init = init;
return 1;
}
int EVP_MD_meth_set_update(EVP_MD *md, int (*update)(EVP_MD_CTX *ctx, const void *data, size_t count))
{
if (md->update != NULL)
return 0;
md->update = update;
return 1;
}
int EVP_MD_meth_set_final(EVP_MD *md, int (*final)(EVP_MD_CTX *ctx, unsigned char *md))
{
if (md->final != NULL)
return 0;
md->final = final;
return 1;
}
int EVP_MD_meth_set_copy(EVP_MD *md, int (*copy)(EVP_MD_CTX *to, const EVP_MD_CTX *from))
{
if (md->copy != NULL)
return 0;
md->copy = copy;
return 1;
}
int EVP_MD_meth_set_cleanup(EVP_MD *md, int (*cleanup)(EVP_MD_CTX *ctx))
{
if (md->cleanup != NULL)
return 0;
md->cleanup = cleanup;
return 1;
}
int EVP_MD_meth_set_ctrl(EVP_MD *md, int (*ctrl)(EVP_MD_CTX *ctx, int cmd, int p1, void *p2))
{
if (md->md_ctrl != NULL)
return 0;
md->md_ctrl = ctrl;
return 1;
}
int EVP_MD_meth_get_input_blocksize(const EVP_MD *md)
{
return md->block_size;
}
int EVP_MD_meth_get_result_size(const EVP_MD *md)
{
return md->md_size;
}
int EVP_MD_meth_get_app_datasize(const EVP_MD *md)
{
return md->ctx_size;
}
unsigned long EVP_MD_meth_get_flags(const EVP_MD *md)
{
return md->flags;
}
int (*EVP_MD_meth_get_init(const EVP_MD *md))(EVP_MD_CTX *ctx)
{
return md->init;
}
int (*EVP_MD_meth_get_update(const EVP_MD *md))(EVP_MD_CTX *ctx,
const void *data,
size_t count)
{
return md->update;
}
int (*EVP_MD_meth_get_final(const EVP_MD *md))(EVP_MD_CTX *ctx,
unsigned char *md)
{
return md->final;
}
int (*EVP_MD_meth_get_copy(const EVP_MD *md))(EVP_MD_CTX *to,
const EVP_MD_CTX *from)
{
return md->copy;
}
int (*EVP_MD_meth_get_cleanup(const EVP_MD *md))(EVP_MD_CTX *ctx)
{
return md->cleanup;
}
int (*EVP_MD_meth_get_ctrl(const EVP_MD *md))(EVP_MD_CTX *ctx, int cmd,
int p1, void *p2)
{
return md->md_ctrl;
}
#ifndef OPENSSL_NO_DEPRECATED_3_0
const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx)
{

1
crypto/evp/evp_local.h
View File

@@ -401,7 +401,6 @@ OSSL_PARAM *evp_pkey_to_param(EVP_PKEY *pkey, size_t *sz);
void evp_pkey_ctx_free_old_ops(EVP_PKEY_CTX *ctx);
void evp_cipher_free_int(EVP_CIPHER *md);
void evp_md_free_int(EVP_MD *md);
/* OSSL_PROVIDER * is only used to get the library context */
int evp_is_a(OSSL_PROVIDER *prov, int number,

1
include/crypto/evp.h
View File

@@ -251,7 +251,6 @@ struct evp_kdf_st {
#define EVP_ORIG_DYNAMIC 0
#define EVP_ORIG_GLOBAL 1
#define EVP_ORIG_METH 2
struct evp_md_st {
/* nid */

45
include/openssl/evp.h
View File

@@ -127,51 +127,6 @@ int EVP_default_properties_enable_fips(OSSL_LIB_CTX *libctx, int enable);
#define EVP_PKEY_MO_DECRYPT 0x0008
#ifndef EVP_MD
#ifndef OPENSSL_NO_DEPRECATED_3_0
OSSL_DEPRECATEDIN_3_0 EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type);
OSSL_DEPRECATEDIN_3_0 EVP_MD *EVP_MD_meth_dup(const EVP_MD *md);
OSSL_DEPRECATEDIN_3_0 void EVP_MD_meth_free(EVP_MD *md);
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_input_blocksize(EVP_MD *md, int blocksize);
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_result_size(EVP_MD *md, int resultsize);
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_app_datasize(EVP_MD *md, int datasize);
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_flags(EVP_MD *md, unsigned long flags);
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_init(EVP_MD *md, int (*init)(EVP_MD_CTX *ctx));
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_update(EVP_MD *md, int (*update)(EVP_MD_CTX *ctx, const void *data, size_t count));
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_final(EVP_MD *md, int (*final)(EVP_MD_CTX *ctx, unsigned char *md));
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_copy(EVP_MD *md, int (*copy)(EVP_MD_CTX *to, const EVP_MD_CTX *from));
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_cleanup(EVP_MD *md, int (*cleanup)(EVP_MD_CTX *ctx));
OSSL_DEPRECATEDIN_3_0
int EVP_MD_meth_set_ctrl(EVP_MD *md, int (*ctrl)(EVP_MD_CTX *ctx, int cmd, int p1, void *p2));
OSSL_DEPRECATEDIN_3_0 int EVP_MD_meth_get_input_blocksize(const EVP_MD *md);
OSSL_DEPRECATEDIN_3_0 int EVP_MD_meth_get_result_size(const EVP_MD *md);
OSSL_DEPRECATEDIN_3_0 int EVP_MD_meth_get_app_datasize(const EVP_MD *md);
OSSL_DEPRECATEDIN_3_0 unsigned long EVP_MD_meth_get_flags(const EVP_MD *md);
OSSL_DEPRECATEDIN_3_0
int (*EVP_MD_meth_get_init(const EVP_MD *md))(EVP_MD_CTX *ctx);
OSSL_DEPRECATEDIN_3_0
int (*EVP_MD_meth_get_update(const EVP_MD *md))(EVP_MD_CTX *ctx,
const void *data, size_t count);
OSSL_DEPRECATEDIN_3_0
int (*EVP_MD_meth_get_final(const EVP_MD *md))(EVP_MD_CTX *ctx,
unsigned char *md);
OSSL_DEPRECATEDIN_3_0
int (*EVP_MD_meth_get_copy(const EVP_MD *md))(EVP_MD_CTX *to,
const EVP_MD_CTX *from);
OSSL_DEPRECATEDIN_3_0
int (*EVP_MD_meth_get_cleanup(const EVP_MD *md))(EVP_MD_CTX *ctx);
OSSL_DEPRECATEDIN_3_0
int (*EVP_MD_meth_get_ctrl(const EVP_MD *md))(EVP_MD_CTX *ctx, int cmd,
int p1, void *p2);
#endif
/* digest can only handle a single block */
#define EVP_MD_FLAG_ONESHOT 0x0001

119
test/evp_extra_test.c
View File

@@ -5989,123 +5989,6 @@ err:
custom_pmeth = NULL;
return testresult;
}
static int test_evp_md_meth(void)
{
EVP_MD *md = EVP_MD_meth_dup(EVP_sha256());
int testresult = 0;
if (!TEST_ptr(md))
goto err;
testresult = 1;
err:
EVP_MD_meth_free(md);
return testresult;
}
typedef struct {
int data;
} custom_dgst_ctx;
static int custom_md_init_called = 0;
static int custom_md_cleanup_called = 0;
static int custom_md_init(EVP_MD_CTX *ctx)
{
custom_dgst_ctx *p = EVP_MD_CTX_md_data(ctx);
if (p == NULL)
return 0;
custom_md_init_called++;
return 1;
}
static int custom_md_cleanup(EVP_MD_CTX *ctx)
{
custom_dgst_ctx *p = EVP_MD_CTX_md_data(ctx);
if (p == NULL)
/* Nothing to do */
return 1;
custom_md_cleanup_called++;
return 1;
}
static int test_custom_md_meth(void)
{
ASN1_OBJECT *o = NULL;
EVP_MD_CTX *mdctx = NULL;
EVP_MD *tmp = NULL;
char mess[] = "Test Message\n";
unsigned char md_value[EVP_MAX_MD_SIZE];
unsigned int md_len;
int testresult = 0;
int nid;
/*
* We are testing deprecated functions. We don't support a non-default
* library context in this test.
*/
if (testctx != NULL)
return TEST_skip("Non-default libctx");
custom_md_init_called = custom_md_cleanup_called = 0;
nid = OBJ_create("1.3.6.1.4.1.16604.998866.1", "custom-md", "custom-md");
if (!TEST_int_ne(nid, NID_undef))
goto err;
if (!TEST_int_eq(OBJ_txt2nid("1.3.6.1.4.1.16604.998866.1"), nid))
goto err;
tmp = EVP_MD_meth_new(nid, NID_undef);
if (!TEST_ptr(tmp))
goto err;
if (!TEST_true(EVP_MD_meth_set_init(tmp, custom_md_init))
|| !TEST_true(EVP_MD_meth_set_cleanup(tmp, custom_md_cleanup))
|| !TEST_true(EVP_MD_meth_set_app_datasize(tmp,
sizeof(custom_dgst_ctx))))
goto err;
mdctx = EVP_MD_CTX_new();
if (!TEST_ptr(mdctx)
/*
* Initing our custom md and then initing another md should
* result in the init and cleanup functions of the custom md
* being called.
*/
|| !TEST_true(EVP_DigestInit_ex(mdctx, tmp, NULL))
|| !TEST_true(EVP_DigestInit_ex(mdctx, EVP_sha256(), NULL))
|| !TEST_true(EVP_DigestUpdate(mdctx, mess, strlen(mess)))
|| !TEST_true(EVP_DigestFinal_ex(mdctx, md_value, &md_len))
|| !TEST_int_eq(custom_md_init_called, 1)
|| !TEST_int_eq(custom_md_cleanup_called, 1))
goto err;
if (!TEST_int_eq(OBJ_create("1.3.6.1.4.1.16604.998866.1",
"custom-md", "custom-md"),
NID_undef)
|| !TEST_int_eq(ERR_GET_LIB(ERR_peek_error()), ERR_LIB_OBJ)
|| !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), OBJ_R_OID_EXISTS))
goto err;
o = ASN1_OBJECT_create(nid, (unsigned char *)"\53\6\1\4\1\201\201\134\274\373\122\1", 12,
"custom-md", "custom-md");
if (!TEST_int_eq(OBJ_add_object(o), nid))
goto err;
testresult = 1;
err:
ASN1_OBJECT_free(o);
EVP_MD_CTX_free(mdctx);
EVP_MD_meth_free(tmp);
return testresult;
}
#endif /* OPENSSL_NO_DEPRECATED_3_0 */
#ifndef OPENSSL_NO_ECX
@@ -6928,8 +6811,6 @@ int setup_tests(void)
#ifndef OPENSSL_NO_DEPRECATED_3_0
ADD_ALL_TESTS(test_custom_pmeth, 12);
ADD_TEST(test_evp_md_meth);
ADD_TEST(test_custom_md_meth);
#endif
#ifndef OPENSSL_NO_ECX

23
util/libcrypto.num
View File

@@ -827,29 +827,6 @@ EVP_set_default_properties ? 4_0_0 EXIST::FUNCTION:
EVP_get1_default_properties ? 4_0_0 EXIST::FUNCTION:
EVP_default_properties_is_fips_enabled ? 4_0_0 EXIST::FUNCTION:
EVP_default_properties_enable_fips ? 4_0_0 EXIST::FUNCTION:
EVP_MD_meth_new ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_dup ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_free ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_input_blocksize ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_result_size ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_app_datasize ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_init ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_update ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_final ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_copy ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_cleanup ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_set_ctrl ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_input_blocksize ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_result_size ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_app_datasize ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_init ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_update ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_final ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_copy ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_cleanup ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_meth_get_ctrl ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0
EVP_MD_get_type ? 4_0_0 EXIST::FUNCTION:
EVP_MD_get0_name ? 4_0_0 EXIST::FUNCTION:
EVP_MD_get0_description ? 4_0_0 EXIST::FUNCTION: