8000 bpo-45847: Port _ssl and _hashlib to PY_STDLIB_MOD (GH-29727) · python/cpython@b9e9292 · GitHub
[go: up one dir, main page]
Skip to content
Sign in

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit b9e9292

Browse files
tirantiran
authored
bpo-45847: Port _ssl and _hashlib to PY_STDLIB_MOD (GH-29727)
1 parent 095bc8f commit b9e9292

File tree

4 files changed

+348
-157
lines changed

4 files changed

+348
-157
lines changed

‎Modules/Setup.stdlib.in

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,11 @@
123123
#
124124
@MODULE__SQLITE3_TRUE@_sqlite3 _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c
125125

126+
# needs -lssl and -lcrypt
127+
@MODULE__SSL_TRUE@_ssl _ssl.c
128+
# needs -lcrypt
129+
@MODULE__HASHLIB_TRUE@_hashlib _hashopenssl.c
130+
126131

127132
############################################################################
128133
# macOS specific modules

‎configure

Lines changed: 243 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -642,6 +642,10 @@ MODULE__TESTINTERNALCAPI_FALSE
642642
MODULE__TESTINTERNALCAPI_TRUE
643643
MODULE__TESTCAPI_FALSE
644644
MODULE__TESTCAPI_TRUE
645+
MODULE__HASHLIB_FALSE
646+
MODULE__HASHLIB_TRUE
647+
MODULE__SSL_FALSE
648+
MODULE__SSL_TRUE
645649
MODULE__LZMA_FALSE
646650
MODULE__LZMA_TRUE
647651
MODULE__BZ2_FALSE
@@ -20297,6 +20301,16 @@ rm -f core conftest.err conftest.$ac_objext \
2029720301

2029820302

2029920303
# rpath to libssl and libcrypto
20304+
if test "x$GNULD" = xyes; then :
20305+
20306+
rpath_arg="-Wl,--enable-new-dtags,-rpath="
20307+
20308+
else
20309+
20310+
rpath_arg="-Wl,-rpath="
20311+
20312+
fi
20313+
2030020314
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for --with-openssl-rpath" >&5
2030120315
$as_echo_n "checking for --with-openssl-rpath... " >&6; }
2030220316

@@ -20310,12 +20324,26 @@ fi
2031020324

2031120325
case $with_openssl_rpath in #(
2031220326
auto|yes) :
20313-
OPENSSL_RPATH=auto ;; #(
20327+
20328+
OPENSSL_RPATH=auto
20329+
for arg in "$OPENSSL_LDFLAGS"; do
20330+
case $arg in #(
20331+
-L*) :
20332+
OPENSSL_LDFLAGS_RPATH="$OPENSSL_LDFLAGS_RPATH ${rpath_arg}$(echo $arg | cut -c3-)"
20333+
;; #(
20334+
*) :
20335+
;;
20336+
esac
20337+
done
20338+
;; #(
2031420339
no) :
2031520340
OPENSSL_RPATH= ;; #(
2031620341
*) :
2031720342
if test -d "$with_openssl_rpath"; then :
20318-
OPENSSL_RPATH="$with_openssl_rpath"
20343+
20344+
OPENSSL_RPATH="$with_openssl_rpath"
20345+
OPENSSL_LDFLAGS_RPATH="${rpath_arg}$with_openssl_rpath"
20346+
2031920347
else
2032020348
as_fn_error $? "--with-openssl-rpath \"$with_openssl_rpath\" is not a directory" "$LINENO" 5
2032120349
fi
@@ -20326,71 +20354,163 @@ esac
2032620354
$as_echo "$OPENSSL_RPATH" >&6; }
2032720355

2032820356

20357+
# This static linking is NOT OFFICIALLY SUPPORTED and not advertised.
20358+
# Requires static OpenSSL build with position-independent code. Some features
20359+
# like DSO engines or external OSSL providers don't work. Only tested with GCC
20360+
# and clang on X86_64.
20361+
if test "x$PY_UNSUPPORTED_OPENSSL_BUILD" = xstatic; then :
20362+
20363+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for unsupported static openssl build" >&5
20364+
$as_echo_n "checking for unsupported static openssl build... " >&6; }
20365+
new_OPENSSL_LIBS=
20366+
for arg in $OPENSSL_LIBS; do
20367+
case $arg in #(
20368+
-l*) :
20369+
20370+
libname=$(echo $arg | cut -c3-)
20371+
new_OPENSSL_LIBS="$new_OPENSSL_LIBS -l:lib${libname}.a -Wl,--exclude-libs,lib${libname}.a"
20372+
;; #(
20373+
*) :
20374+
new_OPENSSL_LIBS="$new_OPENSSL_LIBS $arg"
20375+
;;
20376+
esac
20377+
done
20378+
OPENSSL_LIBS="$new_OPENSSL_LIBS $ZLIB_LIBS"
20379+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $OPENSSL_LIBS" >&5
20380+
$as_echo "$OPENSSL_LIBS" >&6; }
20381+
20382+
fi
20383+
20384+
LIBCRYPTO_LIBS=
20385+
for arg in $OPENSSL_LIBS; do
20386+
case $arg in #(
20387+
-l*ssl*|-Wl*ssl*) :
20388+
;; #(
20389+
*) :
20390+
LIBCRYPTO_LIBS="$LIBCRYPTO_LIBS $arg"
20391+
;;
20392+
esac
20393+
done
20394+
2032920395
# check if OpenSSL libraries work as expected
20330-
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL provides required APIs" >&5
20331-
$as_echo_n "checking whether OpenSSL provides required APIs... " >&6; }
20332-
if ${ac_cv_working_openssl+:} false; then :
20396+
save_CFLAGS=$CFLAGS
20397+
save_CPPFLAGS=$CPPFLAGS
20398+
save_LDFLAGS=$LDFLAGS
20399+
save_LIBS=$LIBS
20400+
20401+
20402+
LIBS="$LIBS $OPENSSL_LIBS"
20403+
CFLAGS="$CFLAGS $OPENSSL_INCLUDES"
20404+
LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS $OPENSSL_LDFLAGS_RPATH"
20405+
20406+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL provides required ssl module APIs" >&5
20407+
$as_echo_n "checking whether OpenSSL provides required ssl module APIs... " >&6; }
20408+
if ${ac_cv_working_openssl_ssl+:} false; then :
2033320409
$as_echo_n "(cached) " >&6
2033420410
else
2033520411

20336-
save_LIBS="$LIBS"
20337-
save_CFLAGS="$CFLAGS"
20338-
save_LDFLAGS="$LDFLAGS"
20339-
LIBS="$LIBS $OPENSSL_LIBS"
20340-
CFLAGS="$CFLAGS_NODIST $OPENSSL_INCLUDES"
20341-
LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS"
20342-
20343-
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
20412+
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
2034420413
/* end confdefs.h. */
2034520414

20346-
#include <openssl/opensslv.h>
20347-
#include <openssl/evp.h>
20348-
#include <openssl/ssl.h>
20415+
#include <openssl/opensslv.h>
20416+
#include <openssl/ssl.h>
20417+
#if OPENSSL_VERSION_NUMBER < 0x10101000L
20418+
#error "OpenSSL >= 1.1.1 is required"
20419+
#endif
20420+
static void keylog_cb(const SSL *ssl, const char *line) {}
2034920421

20350-
#if OPENSSL_VERSION_NUMBER < 0x10101000L
20351-
#error "OpenSSL >= 1.1.1 is required"
20352-
#endif
20422+
int
20423+
main ()
20424+
{
20425+
20426+
SSL_CTX *ctx = SSL_CTX_new(TLS_client_method());
20427+
SSL_CTX_set_keylog_callback(ctx, keylog_cb);
20428+
SSL *ssl = SSL_new(ctx);
20429+
X509_VERIFY_PARAM *param = SSL_get0_param(ssl);
20430+
X509_VERIFY_PARAM_set1_host(param, "python.org", 0);
20431+
SSL_free(ssl);
20432+
SSL_CTX_free(ctx);
20433+
20434+
;
20435+
return 0;
20436+
}
20437+
_ACEOF
20438+
if ac_fn_c_try_link "$LINENO"; then :
20439+
ac_cv_working_openssl_ssl=yes
20440+
else
20441+
ac_cv_working_openssl_ssl=no
20442+
fi
20443+
rm -f core conftest.err conftest.$ac_objext \
20444+
conftest$ac_exeext conftest.$ac_ext
20445+
20446+
fi
20447+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_working_openssl_ssl" >&5
20448+
$as_echo "$ac_cv_working_openssl_ssl" >&6; }
20449+
20450+
CFLAGS=$save_CFLAGS
20451+
CPPFLAGS=$save_CPPFLAGS
20452+
LDFLAGS=$save_LDFLAGS
20453+
LIBS=$save_LIBS
20454+
20455+
20456+
20457+
save_CFLAGS=$CFLAGS
20458+
save_CPPFLAGS=$CPPFLAGS
20459+
save_LDFLAGS=$LDFLAGS
20460+
save_LIBS=$LIBS
20461+
20462+
20463+
LIBS="$LIBS $LIBCRYPTO_LIBS"
20464+
CFLAGS="$CFLAGS $OPENSSL_INCLUDES"
20465+
LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS $OPENSSL_LDFLAGS_RPATH"
20466+
20467+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL provides required hashlib module APIs" >&5
20468+
$as_echo_n "checking whether OpenSSL provides required hashlib module APIs... " >&6; }
20469+
if ${ac_cv_working_openssl_hashlib+:} false; then :
20470+
$as_echo_n "(cached) " >&6
20471+
else
20472+
20473+
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
20474+
/* end confdefs.h. */
2035320475

20354-
static void keylog_cb(const SSL *ssl, const char *line) {}
20476+
#include <openssl/opensslv.h>
20477+
#include <openssl/evp.h>
20478+
#if OPENSSL_VERSION_NUMBER < 0x10101000L
20479+
#error "OpenSSL >= 1.1.1 is required"
20480+
#endif
2035520481

2035620482
int
2035720483
main ()
2035820484
{
2035920485

20360-
/* SSL APIs */
20361-
SSL_CTX *ctx = SSL_CTX_new(TLS_client_method());
20362-
SSL_CTX_set_keylog_callback(ctx, keylog_cb);
20363-
SSL *ssl = SSL_new(ctx);
20364-
X509_VERIFY_PARAM *param = SSL_get0_param(ssl);
20365-
X509_VERIFY_PARAM_set1_host(param, "python.org", 0);
20366-
SSL_free(ssl);
20367-
SSL_CTX_free(ctx);
20368-
20369-
/* hashlib APIs */
20370-
OBJ_nid2sn(NID_md5);
20371-
OBJ_nid2sn(NID_sha1);
20372-
OBJ_nid2sn(NID_sha3_512);
20373-
OBJ_nid2sn(NID_blake2b512);
20374-
EVP_PBE_scrypt(NULL, 0, NULL, 0, 2, 8, 1, 0, NULL, 0);
20486+
OBJ_nid2sn(NID_md5);
20487+
OBJ_nid2sn(NID_sha1);
20488+
OBJ_nid2sn(NID_sha3_512);
20489+
OBJ_nid2sn(NID_blake2b512);
20490+
EVP_PBE_scrypt(NULL, 0, NULL, 0, 2, 8, 1, 0, NULL, 0);
2037520491

2037620492
;
2037720493
return 0;
2037820494
}
2037920495
_ACEOF
2038020496
if ac_fn_c_try_link "$LINENO"; then :
20381-
ac_cv_working_openssl=yes
20497+
ac_cv_working_openssl_hashlib=yes
2038220498
else
20383-
ac_cv_working_openssl=no
20499+
ac_cv_working_openssl_hashlib=no
2038420500
fi
2038520501
rm -f core conftest.err conftest.$ac_objext \
2038620502
conftest$ac_exeext conftest.$ac_ext
20387-
LIBS="$save_LIBS"
20388-
CFLAGS="$save_CFLAGS"
20389-
LDFLAGS="$save_LDFLAGS"
2039020503

2039120504
fi
20392-
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_working_openssl" >&5
20393-
$as_echo "$ac_cv_working_openssl" >&6; }
20505+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_working_openssl_hashlib" >&5
20506+
$as_echo "$ac_cv_working_openssl_hashlib" >&6; }
20507+
20508+
CFLAGS=$save_CFLAGS
20509+
CPPFLAGS=$save_CPPFLAGS
20510+
LDFLAGS=$save_LDFLAGS
20511+
LIBS=$save_LIBS
20512+
20513+
2039420514

2039520515
# ssl module default cipher suite string
2039620516

@@ -21800,6 +21920,79 @@ $as_echo "$py_cv_module__lzma" >&6; }
2180021920

2180121921

2180221922

21923+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for stdlib extension module _ssl" >&5
21924+
$as_echo_n "checking for stdlib extension module _ssl... " >&6; }
21925+
case $py_stdlib_not_available in #(
21926+
*_ssl*) :
21927+
py_cv_module__ssl=n/a ;; #(
21928+
*) :
21929+
if true; then :
21930+
if test "$ac_cv_working_openssl_ssl" = yes; then :
21931+
py_cv_module__ssl=yes
21932+
else
21933+
py_cv_module__ssl=missing
21934+
fi
21935+
else
21936+
py_cv_module__ssl=disabled
21937+
fi
21938+
;;
21939+
esac
21940+
as_fn_append MODULE_BLOCK "MODULE__SSL=$py_cv_module__ssl$as_nl"
21941+
if test "x$py_cv_module__ssl" = xyes; then :
21942+
21943+
as_fn_append MODULE_BLOCK "MODULE__SSL_CFLAGS=$OPENSSL_INCLUDES$as_nl"
21944+
as_fn_append MODULE_BLOCK "MODULE__SSL_LDFLAGS=$OPENSSL_LDFLAGS $OPENSSL_LDFLAGS_RPATH $OPENSSL_LIBS$as_nl"
21945+
21946+
fi
21947+
if test "$py_cv_module__ssl" = yes; then
21948+
MODULE__SSL_TRUE=
21949+
MODULE__SSL_FALSE='#'
21950+
else
21951+
MODULE__SSL_TRUE='#'
21952+
MODULE__SSL_FALSE=
21953+
fi
21954+
21955+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $py_cv_module__ssl" >&5
21956+
$as_echo "$py_cv_module__ssl" >&6; }
21957+
21958+
21959+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for stdlib extension module _hashlib" >&5
21960+
$as_echo_n "checking for stdlib extension module _hashlib... " >&6; }
21961+
case $py_stdlib_not_available in #(
21962+
*_hashlib*) :
21963+
py_cv_module__hashlib=n/a ;; #(
21964+
*) :
21965+
if true; then :
21966+
if test "$ac_cv_working_openssl_hashlib" = yes; then :
21967+
py_cv_module__hashlib=yes
21968+
else
21969+
py_cv_module__hashlib=missing
21970+
fi
21971+
else
21972+
py_cv_module__hashlib=disabled
21973+
fi
21974+
;;
21975+
esac
21976+
as_fn_append MODULE_BLOCK "MODULE__HASHLIB=$py_cv_module__hashlib$as_nl"
21977+
if test "x$py_cv_module__hashlib" = xyes; then :
21978+
21979+
as_fn_append MODULE_BLOCK "MODULE__HASHLIB_CFLAGS=$OPENSSL_INCLUDES$as_nl"
21980+
as_fn_append MODULE_BLOCK "MODULE__HASHLIB_LDFLAGS=$OPENSSL_LDFLAGS $OPENSSL_LDFLAGS_RPATH $LIBCRYPTO_LIBS$as_nl"
21981+
21982+
fi
21983+
if test "$py_cv_module__hashlib" = yes; then
21984+
MODULE__HASHLIB_TRUE=
21985+
MODULE__HASHLIB_FALSE='#'
21986+
else
21987+
MODULE__HASHLIB_TRUE='#'
21988+
MODULE__HASHLIB_FALSE=
21989+
fi
21990+
21991+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $py_cv_module__hashlib" >&5
21992+
$as_echo "$py_cv_module__hashlib" >&6; }
21993+
21994+
21995+
2180321996
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for stdlib extension module _testcapi" >&5
2180421997
$as_echo_n "checking for stdlib extension module _testcapi... " >&6; }
2180521998
case $py_stdlib_not_available in #(
@@ -22481,6 +22674,14 @@ if test -z "${MODULE__LZMA_TRUE}" && test -z "${MODULE__LZMA_FALSE}"; then
2248122674
as_fn_error $? "conditional \"MODULE__LZMA\" was never defined.
2248222675
Usually this means the macro was only invoked conditionally." "$LINENO" 5
2248322676
fi
22677+
if test -z "${MODULE__SSL_TRUE}" && test -z "${MODULE__SSL_FALSE}"; then
22678+
as_fn_error $? "conditional \"MODULE__SSL\" was never defined.
22679+
Usually this means the macro was only invoked conditionally." "$LINENO" 5
22680+
fi
22681+
if test -z "${MODULE__HASHLIB_TRUE}" && test -z "${MODULE__HASHLIB_FALSE}"; then
22682+
as_fn_error $? "conditional \"MODULE__HASHLIB\" was never defined.
22683+
Usually this means the macro was only invoked conditionally." "$LINENO" 5
22684+
fi
2248422685
if test -z "${MODULE__TESTCAPI_TRUE}" && test -z "${MODULE__TESTCAPI_FALSE}"; then
2248522686
as_fn_error $? "conditional \"MODULE__TESTCAPI\" was never defined.
2248622687
Usually this means the macro was only invoked conditionally." "$LINENO" 5

0 commit comments

Comments
 (0)
0