Makefile: allow specifying a SHA-1 for non-cryptographic uses
Introduce _UNSAFE variants of the OPENSSL_SHA1, BLK_SHA1, and APPLE_COMMON_CRYPTO_SHA1 compile-time knobs which indicate which SHA-1 implementation is to be used for non-cryptographic uses. There are a couple of small implementation notes worth mentioning: - There is no way to select the collision detecting SHA-1 as the "fast" fallback, since the fast fallback is only for non-cryptographic uses, and is meant to be faster than our collision-detecting implementation. - There are no similar knobs for SHA-256, since no collision attacks are presently known and thus no collision-detecting implementations actually exist. Signed-off-by: Taylor Blau <me@ttaylorr.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Taylor Blau committed
Sep 26, 2024 at 11:22 UTC
06c92dafb86fd390285e20b743f5a61b45055546
2 files changed
+55
Makefile
+25
@@ -521,6 +521,10 @@ include shared.mak
521
# Define APPLE_COMMON_CRYPTO_SHA1 to use Apple's CommonCrypto for
522
# SHA-1.
523
#
524
+# Define the same Makefile knobs as above, but suffixed with _UNSAFE to
525
+# use the corresponding implementations for unsafe SHA-1 hashing for
526
+# non-cryptographic purposes.
527
+#
528
# If don't enable any of the *_SHA1 settings in this section, Git will
529
# default to its built-in sha1collisiondetection library, which is a
530
# collision-detecting sha1 This is slower, but may detect attempted
@@ -1987,6 +1991,27 @@ endif
1991
endif
1992
endif
1993
1994
+ifdef OPENSSL_SHA1_UNSAFE
1995
+ifndef OPENSSL_SHA1
1996
+ EXTLIBS += $(LIB_4_CRYPTO)
1997
+ BASIC_CFLAGS += -DSHA1_OPENSSL_UNSAFE
1998
+endif
1999
+else
2000
+ifdef BLK_SHA1_UNSAFE
2001
+ifndef BLK_SHA1
2002
+ LIB_OBJS += block-sha1/sha1.o
2003
+ BASIC_CFLAGS += -DSHA1_BLK_UNSAFE
2004
+endif
2005
+else
2006
+ifdef APPLE_COMMON_CRYPTO_SHA1_UNSAFE
2007
+ifndef APPLE_COMMON_CRYPTO_SHA1
2008
+ COMPAT_CFLAGS += -DCOMMON_DIGEST_FOR_OPENSSL
2009
+ BASIC_CFLAGS += -DSHA1_APPLE_UNSAFE
2010
+endif
2011
+endif
2012
+endif
2013
+endif
2014
+
2015
ifdef OPENSSL_SHA256
2016
EXTLIBS += $(LIB_4_CRYPTO)
2017
BASIC_CFLAGS += -DSHA256_OPENSSL
hash.h
+30
@@ -15,6 +15,36 @@
15
#include "block-sha1/sha1.h"
16
#endif
17
18
+#if defined(SHA1_APPLE_UNSAFE)
19
+# include <CommonCrypto/CommonDigest.h>
20
+# define platform_SHA_CTX_unsafe CC_SHA1_CTX
21
+# define platform_SHA1_Init_unsafe CC_SHA1_Init
22
+# define platform_SHA1_Update_unsafe CC_SHA1_Update
23
+# define platform_SHA1_Final_unsafe CC_SHA1_Final
24
+#elif defined(SHA1_OPENSSL_UNSAFE)
25
+# include <openssl/sha.h>
26
+# if defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL >= 3
27
+# define SHA1_NEEDS_CLONE_HELPER_UNSAFE
28
+# include "sha1/openssl.h"
29
+# define platform_SHA_CTX_unsafe openssl_SHA1_CTX
30
+# define platform_SHA1_Init_unsafe openssl_SHA1_Init
31
+# define platform_SHA1_Clone_unsafe openssl_SHA1_Clone
32
+# define platform_SHA1_Update_unsafe openssl_SHA1_Update
33
+# define platform_SHA1_Final_unsafe openssl_SHA1_Final
34
+# else
35
+# define platform_SHA_CTX_unsafe SHA_CTX
36
+# define platform_SHA1_Init_unsafe SHA1_Init
37
+# define platform_SHA1_Update_unsafe SHA1_Update
38
+# define platform_SHA1_Final_unsafe SHA1_Final
39
+# endif
40
+#elif defined(SHA1_BLK_UNSAFE)
41
+# include "block-sha1/sha1.h"
42
+# define platform_SHA_CTX_unsafe blk_SHA_CTX
43
+# define platform_SHA1_Init_unsafe blk_SHA1_Init
44
+# define platform_SHA1_Update_unsafe blk_SHA1_Update
45
+# define platform_SHA1_Final_unsafe blk_SHA1_Final
46
+#endif
47
+
48
#if defined(SHA256_NETTLE)
49
#include "sha256/nettle.h"
50
#elif defined(SHA256_GCRYPT)