If at the input of the encryption function in the CFB mode we have
an integer number of blocks, then in the main loop all blocks will be
processed, except for the last one due to an incorrect border check.
The last block will be fully processed as a "partial" remainder, but
the initialization vector will not be updated. And, thus, the value
of IV will always be incorrect in this case.

This breaks stateless protocols due to an invalid initialization vector:
all messages except the first cannot be decrypted. (Naturally, we are
talking about a case with disabled key meshing, which does not allow
context recovery due to an erroneous implementation.)

It is worth noting here that the code for processing partial blocks
(both at the input of the encryption functions and at the output) is
a historically unnecessary artifact, since we do not set the
EVP_CIPH_FLAG_CUSTOM_CIPHER flag and, as a result, OpenSSL processes
partial blocks for us.

This patch corrects the checking of the main loop boundary.

A similar error is present in the code for the CNT mode, but there it
does not manifest itself in any way, because the restoration of the
state in this mode is impossible: even after disabling key meshing, we
still have the state-dependent transformation of the IV.

As an extra result of this fix, the code for processing partial blocks
can be completely removed now.

Fixes #149.

Fix MacOS building (openssl_1_1_0 branch)

Fixes #122

Backport testsuite and travis-ci support to 1.1.0 branch 

grasshopper-omac is not implemented in this version of engine.

(cherry picked from commit 234823a6)

(cherry picked from commit 641223f4)

openssl-1.1.0 made ctx opaque and does not allow it on stack anymore.

(cherry picked from commit 20e590a4)

(cherry picked from commit a53589ac)

Encrypt with small chunks to verify that internal state is handled
correctly between calls.

(cherry picked from commit 3b130109)

These tests are with generated test vectors from canonical TC26
implementation with truncated IVs.

(cherry picked from commit 9c0f7cd7)

(cherry picked from commit ee15414b)

Full test of OFB to match GOST R 34.13-2015 test vectors is impossible,
due to test IVs are having size (256-bits) over the maximum openssl can
allow (128-bits).

I generated new test vectors from canonical implementation
from `PR_GOSTR_bch_v9.zip` (revision of 2016-10-28) by truncating test
IVs in half.

(cherry picked from commit d40efde8)

Make sure stream modes can encrypt any block size.

(cherry picked from commit 6e163b2c)

(cherry picked from commit 370c40df)

test_grasshopper: test modes to match GOST vectors
Only ECB and CTR modes are tested. OBF, CBC, CFB modes is not testable
under openssl.

(cherry picked from commit 6547c44e)

Co-authored-by: Mikhail Gordeev <obirvalger@altlinux.org>
(cherry picked from commit 0329b9a7)

(*) convert 'openssl ciphers | grep ...' into Test:More syntax

(cherry picked from commit abf1f767)

(cherry picked from commit 1d378c56)

(cherry picked from commit 6eb11c67)

(cherry picked from commit 3461793c)

Backport grasshopper-ctr and grasshopper-ofb fixes to 1.1.0 branch

Also, document why CTR IV size is now set to 16, so user is noted to set
IV appropriately to full extent (including counter). Basically, it's for
openssh (and alike) to make it copy IV from privilege separated process.

(cherry picked from commit 74d13288)

Previous implementation was not OFB at all, and fail tests.

Note: This implementation is for fixed width 128-bit IV which makes
shift regiser redundant.

(cherry picked from commit 1e15537d)

Previously CTR did not continue unfinished block on the next cipher
iteration.

(cherry picked from commit cf2ab51a)

(cherry picked from commit 6be1ab00)