GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-118224: Load default OpenSSL provider for nonsecurity algorithms by xnox · Pull Request #118236 · python/cpython

gh-118224: Load default OpenSSL provider for nonsecurity algorithms #118236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

xnox wants to merge 2 commits into python:main from xnox:fix-nodefault-md5

Uh oh!

There was an error while loading. Please reload this page.

Closed

gh-118224: Load default OpenSSL provider for nonsecurity algorithms #118236

Show file tree

Hide file tree

Changes from all commits

Commits

Show all changes

2 commits

Select commit Hold shift + click to select a range

c8adf9e

gh-118224: Load default OpenSSL provider for nonsecurity algorithms

File filter

Filter by extension .c (1) .rst (1) All 2 file types selected

Viewed files

Clear filters

Conversations

Failed to load comments.

Uh oh!

There was an error while loading. Please reload this page.

Jump to

Jump to file

Failed to load files.

Uh oh!

There was an error while loading. Please reload this page.

Diff view

Unified

Split

Hide whitespace

Diff view

Unified

Split

Hide whitespace

There are no files selected for viewing

1 change: 1 addition & 0 deletions 1 Misc/NEWS.d/next/Build/2024-04-24-16-58-45.gh-issue-118224.wnjFHn.rst

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Hashlib now supports using default OpenSSL provider instead of builtin fallback for nonsecurity hashes on hosts otherwise only using base and fips providers. This makes build configuration ``--with-builtin-hashlib-hashes=blake2`` fully supported on OpenSSL FIPS hosts.

14 changes: 14 additions & 0 deletions 14 Modules/_hashopenssl.c

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -56,6 +56,7 @@
		#endif

		#if OPENSSL_VERSION_NUMBER >= 0x30000000L
		#include <openssl/provider.h>
		#define PY_EVP_MD EVP_MD
		#define PY_EVP_MD_fetch(algorithm, properties) EVP_MD_fetch(NULL, algorithm, properties)
		#define PY_EVP_MD_up_ref(md) EVP_MD_up_ref(md)
Expand Down Expand Up		@@ -265,6 +266,17 @@ typedef struct {
		_Py_hashtable_t *hashtable;
		} _hashlibstate;

		static void try_load_default_provider(void) {
		#if OPENSSL_VERSION_NUMBER >= 0x30000000L
		/* Load the default config file, and expected providers */
		OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL);
		if (!OSSL_PROVIDER_available(NULL, "default")) {
		/* System is configured without the default provider */
		OSSL_PROVIDER_load(NULL, "default");
		}
		#endif
		}

		static inline _hashlibstate*
		get_hashlib_state(PyObject *module)
		{
Expand Down Expand Up		@@ -386,6 +398,7 @@ py_digest_by_name(PyObject module, const char name, enum Py_hash_type py_ht)
		break;
		case Py_ht_evp_nosecurity:
		if (entry->evp_nosecurity == NULL) {
		try_load_default_provider();
		entry->evp_nosecurity = PY_EVP_MD_fetch(entry->ossl_name, "-fips");
		}
		digest = entry->evp_nosecurity;
Expand All		@@ -403,6 +416,7 @@ py_digest_by_name(PyObject module, const char name, enum Py_hash_type py_ht)
		digest = PY_EVP_MD_fetch(name, NULL);
		break;
		case Py_ht_evp_nosecurity:
		try_load_default_provider();
		digest = PY_EVP_MD_fetch(name, "-fips");
		break;
		}
Expand Down

Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.