From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS31976 209.132.180.0/23 X-Spam-Status: No, score=-3.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD shortcircuit=no autolearn=ham autolearn_force=no version=3.4.0 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by dcvr.yhbt.net (Postfix) with ESMTP id 2565420899 for ; Tue, 25 Jul 2017 05:57:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751031AbdGYF5p (ORCPT ); Tue, 25 Jul 2017 01:57:45 -0400 Received: from mx2.suse.de ([195.135.220.15]:58464 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750839AbdGYF5p (ORCPT ); Tue, 25 Jul 2017 01:57:45 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id C74BCAE60 for ; Tue, 25 Jul 2017 05:57:43 +0000 (UTC) Date: Tue, 25 Jul 2017 07:57:43 +0200 Message-ID: From: Takashi Iwai To: git@vger.kernel.org Cc: Andreas Stieger Subject: [PATCH] hash: Allow building with the external sha1dc library User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.2 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: git-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org Some distros provide SHA1 collision detect code as a shared library. It's the very same code as we have in git tree, and git can link with it as well; at least, it may make maintenance easier, according to our security guys. This patch allows user to build git linking with the external sha1dc library instead of the built-in sha1dc code. User needs to define DC_SHA1_EXTERNAL explicitly. As default, the built-in sha1dc code is used like before. Signed-off-by: Takashi Iwai --- Makefile | 12 ++++++++++++ hash.h | 4 +++- sha1dc_git_ext.c | 11 +++++++++++ sha1dc_git_ext.h | 25 +++++++++++++++++++++++++ 4 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 sha1dc_git_ext.c create mode 100644 sha1dc_git_ext.h diff --git a/Makefile b/Makefile index 461c845d33cb..f1a262d56254 100644 --- a/Makefile +++ b/Makefile @@ -162,6 +162,12 @@ all:: # algorithm. This is slower, but may detect attempted collision attacks. # Takes priority over other *_SHA1 knobs. # +# Define DC_SHA1_EXTERNAL in addition to DC_SHA1 if you want to build / link +# git with the external sha1collisiondetection library. +# Without this option, i.e. the default behavior is to build git with its +# own sha1dc code. If any extra linker option is required, define them in +# DC_SHA1_LINK variable in addition. +# # Define DC_SHA1_SUBMODULE in addition to DC_SHA1 to use the # sha1collisiondetection shipped as a submodule instead of the # non-submodule copy in sha1dc/. This is an experimental option used @@ -1472,6 +1478,11 @@ ifdef APPLE_COMMON_CRYPTO BASIC_CFLAGS += -DSHA1_APPLE else DC_SHA1 := YesPlease +ifdef DC_SHA1_EXTERNAL + LIB_OBJS += sha1dc_git_ext.o + BASIC_CFLAGS += -DSHA1_DC -DDC_SHA1_EXTERNAL + EXTLIBS += $(DC_SHA1_LINK) -lsha1detectcoll +else ifdef DC_SHA1_SUBMODULE LIB_OBJS += sha1collisiondetection/lib/sha1.o LIB_OBJS += sha1collisiondetection/lib/ubc_check.o @@ -1492,6 +1503,7 @@ endif endif endif endif +endif ifdef SHA1_MAX_BLOCK_SIZE LIB_OBJS += compat/sha1-chunked.o diff --git a/hash.h b/hash.h index bef3e630a093..dce327d58d07 100644 --- a/hash.h +++ b/hash.h @@ -8,7 +8,9 @@ #elif defined(SHA1_OPENSSL) #include #elif defined(SHA1_DC) -#ifdef DC_SHA1_SUBMODULE +#if defined(DC_SHA1_EXTERNAL) +#include "sha1dc_git_ext.h" +#elif defined(DC_SHA1_SUBMODULE) #include "sha1collisiondetection/lib/sha1.h" #else #include "sha1dc/sha1.h" diff --git a/sha1dc_git_ext.c b/sha1dc_git_ext.c new file mode 100644 index 000000000000..359439fc3d93 --- /dev/null +++ b/sha1dc_git_ext.c @@ -0,0 +1,11 @@ +/* Only for DC_SHA1_EXTERNAL; sharing the same hooks as built-in sha1dc */ + +#include "cache.h" +#include +#include "sha1dc_git.c" + +void git_SHA1DCInit(SHA1_CTX *ctx) +{ + SHA1DCInit(ctx); + SHA1DCSetSafeHash(ctx, 0); +} diff --git a/sha1dc_git_ext.h b/sha1dc_git_ext.h new file mode 100644 index 000000000000..d0ea8ce518db --- /dev/null +++ b/sha1dc_git_ext.h @@ -0,0 +1,25 @@ +/* + * This file is included by hash.h for DC_SHA1_EXTERNAL + */ + +#include + +/* + * Same as SHA1DCInit, but with default save_hash=0 + */ +void git_SHA1DCInit(SHA1_CTX *); + +/* + * Same as SHA1DCFinal, but convert collision attack case into a verbose die(). + */ +void git_SHA1DCFinal(unsigned char [20], SHA1_CTX *); + +/* + * Same as SHA1DCUpdate, but adjust types to match git's usual interface. + */ +void git_SHA1DCUpdate(SHA1_CTX *ctx, const void *data, unsigned long len); + +#define platform_SHA_CTX SHA1_CTX +#define platform_SHA1_Init git_SHA1DCInit +#define platform_SHA1_Update git_SHA1DCUpdate +#define platform_SHA1_Final git_SHA1DCFinal -- 2.13.3