threads / patch / 33860

v7, 3 partsMakefile: add support for Apple CommonCrypto facility

Subject: [PATCH v7 1/3] Makefile: add support for Apple CommonCrypto facility

## tl;dr

5 messages between May 18, 2013 and May 18, 2013. Diffs are folded; open one to read it.

replies: 4people: 2as markdown or json

Eric Sunshine· May 18, 2013, 00:32 UTC · lore

[PATCH v7 0/3] Begin replacing OpenSSL with CommonCrypto

This is a re-roll of David Aguilar's patch series which eliminates some of the OpenSSL deprecation warnings on Mac OS X.

Patch 1 is new. It extracts the CommonCrypto-related Makefile boilerplate, from his SHA-1-related patch, into a distinct introductory patch which can then be referenced by subsequent patches.

Patch 2, SHA-1 warning elimination, is effectively unchanged.

Patch 3, HMAC warning elimination, no longer abuses COMMON_DIGEST_FOR_OPENSSL, which is an implementation detail of patch 2. Instead, it checks for NO_APPLE_COMMON_CRYPTO introduced in patch 1.

David Aguilar (3):
  Makefile: add support for Apple CommonCrypto facility
  cache.h: eliminate SHA-1 deprecation warnings on Mac OS X
  imap-send: eliminate HMAC deprecation warnings on Mac OS X

 Makefile    | 15 +++++++++++++++
 imap-send.c | 10 ++++++++++
 2 files changed, 25 insertions(+)

-- 
1.8.2.3

Eric Sunshine· May 18, 2013, 00:32 UTC · re: Eric Sunshine · lore

From: David Aguilar <davvid@gmail.com>

As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to OpenSSL ABI instability, thus leading to build warnings. As a replacement, Apple encourages developers to migrate to its own (stable) CommonCrypto facility.

Introduce boilerplate which controls whether Apple's CommonCrypto facility is employed (enabled by default). Also add a NO_APPLE_COMMON_CRYPTO flag which the user can tweak to override the default if OpenSSL is instead preferred.

[es: extracted CommonCrypto-related Makefile boilerplate into separate introductory patch]

Signed-off-by: David Aguilar <davvid@gmail.com>
Signed-off-by: Eric Sunshine <sunshine@sunshineco.com>
---
 Makefile | 9 +++++++++
 1 file changed, 9 insertions(+)

Show changes to Makefile +9 −0

diff --git a/Makefile b/Makefile
index f698c1a..2178c2c 100644
--- a/Makefile
+++ b/Makefile
@@ -137,6 +137,10 @@ all::
 # specify your own (or DarwinPort's) include directories and
 # library directories by defining CFLAGS and LDFLAGS appropriately.
 #
+# Define NO_APPLE_COMMON_CRYPTO if you are building on Darwin/Mac OS X
+# and do not want to use Apple's CommonCrypto library.  This allows you
+# to provide your own OpenSSL library, for example from MacPorts.
+#
 # Define BLK_SHA1 environment variable to make use of the bundled
 # optimized C SHA1 routine.
 #
@@ -1054,6 +1058,11 @@ ifeq ($(uname_S),Darwin)
 			BASIC_LDFLAGS += -L/opt/local/lib
 		endif
 	endif
+	ifndef NO_APPLE_COMMON_CRYPTO
+		APPLE_COMMON_CRYPTO = YesPlease
+	else
+		COMPAT_CFLAGS += -DNO_APPLE_COMMON_CRYPTO
+	endif
 	NO_REGEX = YesPlease
 	PTHREAD_LIBS =
 endif

-- 
1.8.2.3

Eric Sunshine· May 18, 2013, 00:32 UTC · re: Eric Sunshine · lore

[PATCH v7 2/3] cache.h: eliminate SHA-1 deprecation warnings on Mac OS X

From: David Aguilar <davvid@gmail.com>

As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to OpenSSL ABI instability, thus leading to build diagnostics such as:

	warning: 'SHA1_Init' is deprecated
	(declared at /usr/include/openssl/sha.h:121)

Silence the warnings by using Apple's CommonCrypto SHA-1 replacement functions for SHA1_Init(), SHA1_Update(), and SHA1_Final().

COMMON_DIGEST_FOR_OPENSSL is defined to instruct <CommonCrypto/CommonDigest.h> to provide compatibility macros associating OpenSSL SHA-1 functions with their CommonCrypto counterparts.

[es: reworded commit message]

Signed-off-by: David Aguilar <davvid@gmail.com>
Signed-off-by: Eric Sunshine <sunshine@sunshineco.com>
---
 Makefile | 6 ++++++
 1 file changed, 6 insertions(+)

Show changes to Makefile +6 −0

diff --git a/Makefile b/Makefile
index 2178c2c..7a03fe9 100644
--- a/Makefile
+++ b/Makefile
@@ -1398,10 +1398,16 @@ ifdef PPC_SHA1
 	LIB_OBJS += ppc/sha1.o ppc/sha1ppc.o
 	LIB_H += ppc/sha1.h
 else
+ifdef APPLE_COMMON_CRYPTO
+	COMPAT_CFLAGS += -DCOMMON_DIGEST_FOR_OPENSSL
+	SHA1_HEADER = <CommonCrypto/CommonDigest.h>
+else
 	SHA1_HEADER = <openssl/sha.h>
 	EXTLIBS += $(LIB_4_CRYPTO)
 endif
 endif
+endif
+
 ifdef NO_PERL_MAKEMAKER
 	export NO_PERL_MAKEMAKER
 endif

-- 
1.8.2.3

Eric Sunshine· May 18, 2013, 00:32 UTC · re: Eric Sunshine · lore

[PATCH v7 3/3] imap-send: eliminate HMAC deprecation warnings on Mac OS X

From: David Aguilar <davvid@gmail.com>

As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to OpenSSL ABI instability. Silence the warnings by using Apple's CommonCrypto HMAC replacement functions.

[es: reworded commit message; eliminated abuse of COMMON_DIGEST_FOR_OPENSSL by checking NO_APPLE_COMMON_CRYPTO instead]

Signed-off-by: David Aguilar <davvid@gmail.com>
Signed-off-by: Eric Sunshine <sunshine@sunshineco.com>
---
 imap-send.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

Show changes to imap-send.c +10 −0

diff --git a/imap-send.c b/imap-send.c
index d9bcfb4..642448c 100644
--- a/imap-send.c
+++ b/imap-send.c
@@ -29,8 +29,18 @@
 #ifdef NO_OPENSSL
 typedef void *SSL;
 #else
+#ifndef NO_APPLE_COMMON_CRYPTO
+#include <CommonCrypto/CommonHMAC.h>
+#define HMAC_CTX CCHmacContext
+#define HMAC_Init(hmac, key, len, algo) CCHmacInit(hmac, algo, key, len)
+#define HMAC_Update CCHmacUpdate
+#define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash)
+#define HMAC_CTX_cleanup
+#define EVP_md5() kCCHmacAlgMD5
+#else
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
+#endif
 #include <openssl/x509v3.h>
 #endif

-- 
1.8.2.3

Junio C Hamano· May 18, 2013, 01:58 UTC · re: Eric Sunshine · lore

Re: [PATCH v7 3/3] imap-send: eliminate HMAC deprecation warnings on Mac OS X

Eric Sunshine <sunshine@sunshineco.com> writes:

Show 35 quoted lines

> From: David Aguilar <davvid@gmail.com>
>
> As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to
> OpenSSL ABI instability.  Silence the warnings by using Apple's
> CommonCrypto HMAC replacement functions.
>
> [es: reworded commit message; eliminated abuse of
> COMMON_DIGEST_FOR_OPENSSL by checking NO_APPLE_COMMON_CRYPTO instead]
>
> Signed-off-by: David Aguilar <davvid@gmail.com>
> Signed-off-by: Eric Sunshine <sunshine@sunshineco.com>
> ---
>  imap-send.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/imap-send.c b/imap-send.c
> index d9bcfb4..642448c 100644
> --- a/imap-send.c
> +++ b/imap-send.c
> @@ -29,8 +29,18 @@
>  #ifdef NO_OPENSSL
>  typedef void *SSL;
>  #else
> +#ifndef NO_APPLE_COMMON_CRYPTO
> +#include <CommonCrypto/CommonHMAC.h>
> +#define HMAC_CTX CCHmacContext
> +#define HMAC_Init(hmac, key, len, algo) CCHmacInit(hmac, algo, key, len)
> +#define HMAC_Update CCHmacUpdate
> +#define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash)
> +#define HMAC_CTX_cleanup
> +#define EVP_md5() kCCHmacAlgMD5
> +#else
>  #include <openssl/evp.h>
>  #include <openssl/hmac.h>
> +#endif

Doesn't this mean people on platforms that do not care what Apple does have to define NO_APPLE_COMMON_CRYPTO?

How about stopping this double-negation and do it more like this?

 * In Makefile (1/3), in uname_S == Darwin section, define
   COMPAT_CFLAGS += DAPPLE_COMMON_CRYPTO by default, unless the
   builder declines it with "make NO_APPLE_COMMON_CRYPTO=NoThanks"

 * Express this part as

    #ifdef APPLE_COMMON_CRYPTO
    ... do the common crypto thing ...
    #else
    ... everybody else ...
    #endif

>  #include <openssl/x509v3.h>
>  #endif