{"thread":{"id":"41968","subject":"[PATCH 1/4] imap-send: use HMAC() function provided by OpenSSL","startedAt":"2016-04-08T16:22:12Z","lastAt":"2016-04-08T16:22:16Z","messageCount":5,"participants":["Kazuki Yamaguchi"],"isPatch":true,"patchVersion":1,"patchTotal":4},"messages":[{"id":"282965","messageId":"cover.1460130092.git.k@rhe.jp","threadId":"41968","inReplyTo":null,"subject":"[PATCH 0/4] fix compilation with OpenSSL 1.1.0-pre4","fromName":"Kazuki Yamaguchi","fromEmail":"k@rhe.jp","sentAt":"2016-04-08T16:22:12Z","receivedAt":"2016-04-08T16:22:12Z","isPatch":true,"sender":{"key":"k@rhe.jp","avatar":"https://avatars.githubusercontent.com/u/1033740?v=4"},"body":"OpenSSL 1.1.0 is not released yet, but the first beta 1.1.0-pre4 was\nreleased on Mar 16[1]. According to the OpenSSL's web site[2], only bug\nfixes will be applied after beta release, and 1.1.0 final will be in a\nmonth or two.\n\nThanks,\n\n[1] https://mta.openssl.org/pipermail/openssl-announce/2016-March/000067.html\n[2] https://www.openssl.org/policies/releasestrat.html\n\nKazuki Yamaguchi (4):\n imap-send: use HMAC() function provided by OpenSSL\n imap-send: check NULL return of SSL_CTX_new()\n imap-send: avoid deprecated TLSv1_method()\n configure: remove checking for HMAC_CTX_cleanup\n\n Makefile | 6 ------\n compat/apple-common-crypto.h | 16 +++++++++++-----\n configure.ac | 4 ----\n git-compat-util.h | 3 ---\n imap-send.c | 20 ++++++++++----------\n 5 files changed, 21 insertions(+), 28 deletions(-)\n\n-- \n2.8.1.104.g0d1aca6\n"},{"id":"282962","messageId":"80c694e8e35b81a082a7e800b5330fffb25e8ff9.1460130092.git.k@rhe.jp","threadId":"41968","inReplyTo":"cover.1460130092.git.k@rhe.jp","subject":"[PATCH 1/4] imap-send: use HMAC() function provided by OpenSSL","fromName":"Kazuki Yamaguchi","fromEmail":"k@rhe.jp","sentAt":"2016-04-08T16:22:13Z","receivedAt":"2016-04-08T16:22:13Z","isPatch":true,"sender":{"key":"k@rhe.jp","avatar":"https://avatars.githubusercontent.com/u/1033740?v=4"},"body":"Fix compile errors with OpenSSL 1.1.0.\n\nHMAC_CTX is made opaque and HMAC_CTX_cleanup is removed in OpenSSL\n1.1.0. But since we just want to calculate one HMAC, we can use HMAC()\nhere, which exists since OpenSSL 0.9.6 at least.\n\nSigned-off-by: Kazuki Yamaguchi \n---\nSince I don't have OS X machines, changes in\ncompat/apple-common-crypto.h is untested, just confirmed it compiles on\nTravis CI.\n\n compat/apple-common-crypto.h | 16 +++++++++++-----\n imap-send.c | 7 ++-----\n 2 files changed, 13 insertions(+), 10 deletions(-)\n\ndiff --git a/compat/apple-common-crypto.h b/compat/apple-common-crypto.h\nindex d3fb26418134..11727f3e1ed7 100644\n--- a/compat/apple-common-crypto.h\n+++ b/compat/apple-common-crypto.h\n@@ -3,12 +3,18 @@\n #define HEADER_HMAC_H\n #define HEADER_SHA_H\n #include \n-#define HMAC_CTX CCHmacContext\n-#define HMAC_Init(hmac, key, len, algo) CCHmacInit(hmac, algo, key, len)\n-#define HMAC_Update CCHmacUpdate\n-#define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash)\n-#define HMAC_CTX_cleanup(ignore)\n #define EVP_md5(...) kCCHmacAlgMD5\n+/* CCHmac doesn't take md_len and the return type is void */\n+#define HMAC git_CC_HMAC\n+static inline unsigned char *git_CC_HMAC(CCHmacAlgorithm alg,\n+\t\tconst void *key, int key_len,\n+\t\tconst unsigned char *data, size_t data_len,\n+\t\tunsigned char *md, unsigned int *md_len)\n+{\n+\tCCHmac(alg, key, key_len, data, data_len, md);\n+\treturn md;\n+}\n+\n #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070\n #define APPLE_LION_OR_NEWER\n #include \ndiff --git a/imap-send.c b/imap-send.c\nindex 2c52027c8445..0364b326e109 100644\n--- a/imap-send.c\n+++ b/imap-send.c\n@@ -862,7 +862,6 @@ static char hexchar(unsigned int b)\n static char *cram(const char *challenge_64, const char *user, const char *pass)\n {\n \tint i, resp_len, encoded_len, decoded_len;\n-\tHMAC_CTX hmac;\n \tunsigned char hash[16];\n \tchar hex[33];\n \tchar *response, *response_64, *challenge;\n@@ -877,10 +876,8 @@ static char *cram(const char *challenge_64, const char *user, const char *pass)\n \t\t\t\t (unsigned char *)challenge_64, encoded_len);\n \tif (decoded_len < 0)\n \t\tdie(\"invalid challenge %s\", challenge_64);\n-\tHMAC_Init(&hmac, (unsigned char *)pass, strlen(pass), EVP_md5());\n-\tHMAC_Update(&hmac, (unsigned char *)challenge, decoded_len);\n-\tHMAC_Final(&hmac, hash, NULL);\n-\tHMAC_CTX_cleanup(&hmac);\n+\tif (!HMAC(EVP_md5(), pass, strlen(pass), (unsigned char *)challenge, decoded_len, hash, NULL))\n+\t\tdie(\"HMAC error\");\n \n \thex[32] = 0;\n \tfor (i = 0; i < 16; i++) {\n-- \n2.8.1.104.g0d1aca6\n"},{"id":"282963","messageId":"929766804585e24d7fcdc8acb7dd4835b3069d45.1460130092.git.k@rhe.jp","threadId":"41968","inReplyTo":"cover.1460130092.git.k@rhe.jp","subject":"[PATCH 2/4] imap-send: check NULL return of SSL_CTX_new()","fromName":"Kazuki Yamaguchi","fromEmail":"k@rhe.jp","sentAt":"2016-04-08T16:22:14Z","receivedAt":"2016-04-08T16:22:14Z","isPatch":true,"sender":{"key":"k@rhe.jp","avatar":"https://avatars.githubusercontent.com/u/1033740?v=4"},"body":"SSL_CTX_new() may fail with return value NULL.\n\nSigned-off-by: Kazuki Yamaguchi \n---\n imap-send.c | 4 ++++\n 1 file changed, 4 insertions(+)\n\ndiff --git a/imap-send.c b/imap-send.c\nindex 0364b326e109..c5e24a35491d 100644\n--- a/imap-send.c\n+++ b/imap-send.c\n@@ -298,6 +298,10 @@ static int ssl_socket_connect(struct imap_socket *sock, int use_tls_only, int ve\n \t}\n \n \tctx = SSL_CTX_new(meth);\n+\tif (!ctx) {\n+\t\tssl_socket_perror(\"SSL_CTX_new\");\n+\t\treturn -1;\n+\t}\n \n \tif (verify)\n \t\tSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);\n-- \n2.8.1.104.g0d1aca6\n"},{"id":"282964","messageId":"ecc1d4f5988f6420639f4b7500a9d3782d7c1199.1460130092.git.k@rhe.jp","threadId":"41968","inReplyTo":"cover.1460130092.git.k@rhe.jp","subject":"[PATCH 3/4] imap-send: avoid deprecated TLSv1_method()","fromName":"Kazuki Yamaguchi","fromEmail":"k@rhe.jp","sentAt":"2016-04-08T16:22:15Z","receivedAt":"2016-04-08T16:22:15Z","isPatch":true,"sender":{"key":"k@rhe.jp","avatar":"https://avatars.githubusercontent.com/u/1033740?v=4"},"body":"Use SSLv23_method always and disable SSL if needed.\n\nTLSv1_method() function is deprecated in OpenSSL 1.1.0 and the compiler\nemits a warning.\n\nSSLv23_method() is also deprecated, but the alternative, TLS_method(),\nis new in OpenSSL 1.1.0 so requires checking by configure. Stick to\nSSLv23_method() for now (this is aliased to TLS_method()).\n\nSigned-off-by: Kazuki Yamaguchi \n---\n imap-send.c | 9 ++++-----\n 1 file changed, 4 insertions(+), 5 deletions(-)\n\ndiff --git a/imap-send.c b/imap-send.c\nindex c5e24a35491d..f53380562c4d 100644\n--- a/imap-send.c\n+++ b/imap-send.c\n@@ -287,11 +287,7 @@ static int ssl_socket_connect(struct imap_socket *sock, int use_tls_only, int ve\n \tSSL_library_init();\n \tSSL_load_error_strings();\n \n-\tif (use_tls_only)\n-\t\tmeth = TLSv1_method();\n-\telse\n-\t\tmeth = SSLv23_method();\n-\n+\tmeth = SSLv23_method();\n \tif (!meth) {\n \t\tssl_socket_perror(\"SSLv23_method\");\n \t\treturn -1;\n@@ -303,6 +299,9 @@ static int ssl_socket_connect(struct imap_socket *sock, int use_tls_only, int ve\n \t\treturn -1;\n \t}\n \n+\tif (use_tls_only)\n+\t\tSSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);\n+\n \tif (verify)\n \t\tSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);\n \n-- \n2.8.1.104.g0d1aca6\n"},{"id":"282966","messageId":"ad0647c1b135ce2fb21daae35a45209715d7ebbc.1460130092.git.k@rhe.jp","threadId":"41968","inReplyTo":"cover.1460130092.git.k@rhe.jp","subject":"[PATCH 4/4] configure: remove checking for HMAC_CTX_cleanup","fromName":"Kazuki Yamaguchi","fromEmail":"k@rhe.jp","sentAt":"2016-04-08T16:22:16Z","receivedAt":"2016-04-08T16:22:16Z","isPatch":true,"sender":{"key":"k@rhe.jp","avatar":"https://avatars.githubusercontent.com/u/1033740?v=4"},"body":"We don't need it, as we no longer use HMAC_CTX_cleanup() directly.\n\nSigned-off-by: Kazuki Yamaguchi \n---\n Makefile | 6 ------\n configure.ac | 4 ----\n git-compat-util.h | 3 ---\n 3 files changed, 13 deletions(-)\n\ndiff --git a/Makefile b/Makefile\nindex 2742a6977c6a..47ccb0042591 100644\n--- a/Makefile\n+++ b/Makefile\n@@ -355,9 +355,6 @@ all::\n #\n # Define HAVE_CLOCK_MONOTONIC if your platform has CLOCK_MONOTONIC in librt.\n #\n-# Define NO_HMAC_CTX_CLEANUP if your OpenSSL is version 0.9.6b or earlier to\n-# cleanup the HMAC context with the older HMAC_cleanup function.\n-#\n # Define USE_PARENS_AROUND_GETTEXT_N to \"yes\" if your compiler happily\n # compiles the following initialization:\n #\n@@ -1138,9 +1135,6 @@ ifndef NO_OPENSSL\n \tifdef NEEDS_CRYPTO_WITH_SSL\n \t\tOPENSSL_LIBSSL += -lcrypto\n \tendif\n-\tifdef NO_HMAC_CTX_CLEANUP\n-\t\tBASIC_CFLAGS += -DNO_HMAC_CTX_CLEANUP\n-\tendif\n else\n \tBASIC_CFLAGS += -DNO_OPENSSL\n \tBLK_SHA1 = 1\ndiff --git a/configure.ac b/configure.ac\nindex 0cd9f4680b84..c27902574734 100644\n--- a/configure.ac\n+++ b/configure.ac\n@@ -970,10 +970,6 @@ AC_CHECK_LIB([iconv], [locale_charset],\n [CHARSET_LIB=-lcharset])])\n GIT_CONF_SUBST([CHARSET_LIB])\n #\n-# Define NO_HMAC_CTX_CLEANUP=YesPlease if HMAC_CTX_cleanup is missing.\n-AC_CHECK_LIB([crypto], [HMAC_CTX_cleanup],\n-\t[], [GIT_CONF_SUBST([NO_HMAC_CTX_CLEANUP], [YesPlease])])\n-#\n # Define HAVE_CLOCK_GETTIME=YesPlease if clock_gettime is available.\n GIT_CHECK_FUNC(clock_gettime,\n \t[HAVE_CLOCK_GETTIME=YesPlease],\ndiff --git a/git-compat-util.h b/git-compat-util.h\nindex 474395471f62..1f8b5f3b1f1a 100644\n--- a/git-compat-util.h\n+++ b/git-compat-util.h\n@@ -279,9 +279,6 @@ extern char *gitdirname(char *);\n #endif\n #include \n #include \n-#ifdef NO_HMAC_CTX_CLEANUP\n-#define HMAC_CTX_cleanup HMAC_cleanup\n-#endif\n #endif\n \n /* On most systems would have given us this, but\n-- \n2.8.1.104.g0d1aca6\n"}]}