commit 753e35562fb4f089bf69879691f66ccf0bf881df
parent c46a9ad4311adf87a14fd7accdcf82350b7945df
Author: Evgeny Grin (Karlson2k) <k2k@drgrin.dev>
Date: Mon, 13 Jul 2026 22:51:39 +0200
configure: fixed overcomplicated and broken SHA-512/256 backend selection
Diffstat:
8 files changed, 119 insertions(+), 109 deletions(-)
diff --git a/configure.ac b/configure.ac
@@ -7673,33 +7673,33 @@ AC_MSG_RESULT([[${enable_sha256_MSG}]])
# optional: SHA-512/256 support for Digest Auth. Enabled by default.
AC_ARG_ENABLE([[sha512-256]],
[AS_HELP_STRING([[--enable-sha512-256=TYPE]],
- [enable TYPE of SHA-512/256 hashing code (yes, no, builtin, tlslib) [yes if dauth enabled]])],
+ [enable TYPE of SHA-512/256 hashing code (yes, no, builtin, tlslib, openssl, mbedtls) [yes if dauth enabled]])],
[
- AS_VAR_IF([enable_sha512_256],["internal"],[enable_sha512_256='builtin'])
- AS_VAR_IF([enable_sha512_256],["built-in"],[enable_sha512_256='builtin'])
- AS_VAR_IF([enable_digest_auth],["yes"],[],
+ AS_IF([test "X${enable_digest_auth}" != "Xyes" && test "X${enable_sha512_256}" != "Xno"],
[
- AS_VAR_IF([enable_sha512_256],["no"],[],
- [
- AC_MSG_WARN([The parameter --enable-sha512x256=${enable_sha512x256} is ignored as Digest Authentication is disabled])
- enable_sha512_256='no'
- ]
- )
+ AC_MSG_WARN([The parameter --enable-sha512-256=${enable_sha512_256} is ignored as Digest Authentication is disabled])
+ enable_sha512_256='no'
]
)
+ AS_CASE([$enable_sha512_256],
+ [internal],[enable_sha512_256='builtin'],
+ [built-in],[enable_sha512_256='builtin'],
+ [yes|no|builtin|tlslib|openssl|mbedtls],[:],
+ AC_MSG_ERROR([unrecognized parameter --enable-sha512-256=${enable_sha512_256}])
+ )
], [[enable_sha512_256="${enable_digest_auth}"]]
)
-AS_UNSET([have_sha512_256_openssl])
-AS_UNSET([have_sha512_256_mbedtls])
-# SHA-512/256 external vs internal check
-AS_CASE([${enable_sha512_256}],[yes|tlslib],
+AS_CASE([${enable_sha512_256}],
+ [builtin],[use_sha512_256_backend='builtin'],
+ [no],[use_sha512_256_backend='no'],
+ [AS_UNSET([use_sha512_256_backend])]
+)
+AS_CASE([${enable_sha512_256}],[yes|tlslib|openssl|mbedtls],
[
- found_sha512_256_tls="no"
- AS_IF([test "x$enable_https" = "xyes"],
+ AS_IF([test -z "${use_sha512_256_backend}" && test "X${have_openssl}" = "Xyes"],
[
- # Check OpenSSL
- AS_VAR_IF([have_openssl],["yes"],
+ AS_CASE([${enable_sha512_256}],[yes|tlslib|openssl],
[
AC_CACHE_CHECK([whether OpenSSL supports SHA-512/256 hashing],[mhd_cv_openssl_sha512_256],
[
@@ -7730,40 +7730,47 @@ AS_CASE([${enable_sha512_256}],[yes|tlslib],
[mhd_cv_openssl_sha512_256='yes'],[mhd_cv_openssl_sha512_256='no']
)
LIBS="${save_LIBS}"
- CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
- CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
LDFLAGS="${LDFLAGS_ac} ${user_LDFLAGS}"
+ CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
+ CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
]
)
- AS_VAR_IF([mhd_cv_openssl_sha512_256],["yes"],
- [
- AC_DEFINE([[MHD_SHA512_256_EXTR_OPENSSL]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA-512/256 hashing by OpenSSL.])
- have_sha512_256_openssl="yes"
- found_sha512_256_tls="yes"
- ]
+ AS_VAR_IF([mhd_cv_openssl_sha512_256],["no"],
+ [AC_MSG_WARN([OpenSSL SHA-512/256 implementation is not available])],
+ [use_sha512_256_backend="openssl"]
)
]
)
- # Check mbedTLS - test for SHA-512 support (C code uses SHA-512 implementation)
- AS_VAR_IF([have_mbedtls],["yes"],
+ ]
+ ) # end OpenSSL check
+
+ # Check MbedTLS - the backend uses the SHA-512 implementation (with the
+ # SHA-512/256 initial values) and requires direct access to the internal
+ # state member, so the test checks exactly that.
+ AS_IF([test -z "${use_sha512_256_backend}" && test "X${have_mbedtls}" = "Xyes"],
+ [
+ AS_CASE([${enable_sha512_256}],[yes|tlslib|mbedtls],
[
- AC_CACHE_CHECK([whether mbedTLS supports SHA-512 hashing for SHA-512/256],[mhd_cv_mbedtls_sha512],
+ AC_CACHE_CHECK([whether MbedTLS supports SHA-512 hashing for SHA-512/256],[mhd_cv_mbedtls_sha512],
[
- CPPFLAGS="${CPPFLAGS_ac} ${MBEDTLS_CPPFLAGS} ${user_CPPFLAGS}"
- CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
- LDFLAGS="${LDFLAGS_ac} ${MBEDTLS_LDFLAGS} ${user_LDFLAGS}"
+ CPPFLAGS="${CPPFLAGS_ac} ${MBEDTLS_CRYPTO_CPPFLAGS} ${user_CPPFLAGS}"
+ CFLAGS="${CFLAGS_ac} ${MBEDTLS_CRYPTO_CFLAGS} ${user_CFLAGS}"
+ LDFLAGS="${LDFLAGS_ac} ${MBEDTLS_CRYPTO_LDFLAGS} ${user_LDFLAGS}"
save_LIBS="$LIBS"
- LIBS="${MBEDTLS_LIBS} ${LIBS} -lmbedcrypto"
+ LIBS="${MBEDTLS_CRYPTO_LIBS} ${LIBS}"
AC_LINK_IFELSE(
[
AC_LANG_PROGRAM(
[[
+#define MBEDTLS_ALLOW_PRIVATE_ACCESS 1
#include <mbedtls/sha512.h>
]],
[[
mbedtls_sha512_context ctx;
unsigned char digest[64];
+ /* Check whether the required internal member is really accessible */
+ if (sizeof(ctx.state) != 64u)
+ return 3;
mbedtls_sha512_init(&ctx);
mbedtls_sha512_starts(&ctx, 0);
mbedtls_sha512_update(&ctx, (const unsigned char *)"", 1);
@@ -7775,72 +7782,66 @@ AS_CASE([${enable_sha512_256}],[yes|tlslib],
[mhd_cv_mbedtls_sha512='yes'],[mhd_cv_mbedtls_sha512='no']
)
LIBS="${save_LIBS}"
- CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
- CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
LDFLAGS="${LDFLAGS_ac} ${user_LDFLAGS}"
+ CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
+ CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
]
)
- AS_VAR_IF([mhd_cv_mbedtls_sha512],["yes"],
- [
- AC_DEFINE([[MHD_SHA512_EXTR_MBEDTLS]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA-512 hashing by mbedTLS.])
- have_sha512_256_mbedtls="yes"
- found_sha512_256_tls="yes"
- ]
+ AS_VAR_IF([mhd_cv_mbedtls_sha512],["no"],
+ [AC_MSG_WARN([MbedTLS SHA-512 implementation (for SHA-512/256) is not available])],
+ [use_sha512_256_backend="mbedtls"]
)
]
)
]
- ) # end AS_IF (enable_https)
+ ) # end mbedtls check
- AS_IF([test "x$enable_sha512_256" = "xyes"],
- [AS_VAR_IF([found_sha512_256_tls],["yes"],
- [enable_sha512_256="tlslib"],
- [
- enable_sha512_256="builtin"
- AS_UNSET([have_sha512_256_openssl])
- AS_UNSET([have_sha512_256_mbedtls])
- ]
- )],
- [AS_VAR_IF([found_sha512_256_tls],["yes"],
- [enable_sha256="tlslib"],
- [AC_MSG_ERROR([TLS library support requested for SHA512/256, but no library supports it])]
- )]
+ AS_IF([test -z "${use_sha512_256_backend}"],
+ [
+ AS_CASE([${enable_sha512_256}],[tlslib|openssl|mbedtls],
+ [AC_MSG_ERROR([selected SHA-512/256 backend (${enable_sha512_256}) is not available])]
+ )
+ ]
)
]
-)
+) # end "enable_sha512_256 in yes|tlslib|openssl|mbedtls"
-
-AC_MSG_CHECKING([[whether to support SHA-512/256]])
+AC_MSG_CHECKING([[for SHA-512/256 backend to use]])
AS_UNSET([enable_sha512_256_MSG])
-AS_CASE([${enable_sha512_256}],
- [builtin],[enable_sha512_256_MSG='yes, built-in'],
- [tlslib],[enable_sha512_256_MSG='yes, external (TLS library)'],
- [yes],[AC_MSG_ERROR([configure internal error: unexpected variable value])],
- [no],[enable_sha512_256_MSG='no'],
- [AC_MSG_ERROR([Unrecognized parameter --enable-sha512-256=${enable_sha512_256}])]
-)
-
-AS_IF([test "x${enable_sha512_256}" = "xbuiltin" ||
- test "x${enable_sha512_256}" = "xtlslib" ],
- [
- AC_DEFINE([[MHD_SUPPORT_SHA512_256]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA-512/256 hashing support.])
- ]
+AS_IF([test -z "${use_sha512_256_backend}"],
+ [
+ AS_CASE([${enable_sha512_256}],
+ [yes],[use_sha512_256_backend='builtin'],
+ [AC_MSG_FAILURE([configure internal error: unexpected variable value \$enable_sha512_256=${enable_sha512_256}])]
+ )
+ ]
+)
+AS_IF([test "X${enable_sha512_256}" != "X${use_sha512_256_backend}" && test "X${enable_sha512_256}" != "Xyes" && test "X${enable_sha512_256}" != "Xtlslib"],
+ [AC_MSG_FAILURE([configure internal error: unexpected variables values \$enable_sha512_256=${enable_sha512_256}; \$use_sha512_256_backend=${use_sha512_256_backend}])]
+)
+AS_IF([test "X${use_sha512_256_backend}" != "Xno"],
+ [AC_DEFINE([[MHD_SUPPORT_SHA512_256]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-512/256 hashing support.])])
+AM_CONDITIONAL([MHD_SUPPORT_SHA512_256], [[test "X${use_sha512_256_backend}" != "Xno"]])
+AS_IF([test "X${use_sha512_256_backend}" = "Xbuiltin"],
+ [AC_DEFINE([[MHD_SHA512_256_BUILTIN]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-512/256 hashing by internal code.])])
+AM_CONDITIONAL([MHD_SHA512_256_BUILTIN], [[test "X${use_sha512_256_backend}" = "Xbuiltin"]])
+AS_IF([test "X${use_sha512_256_backend}" = "Xopenssl"],
+ [AC_DEFINE([[MHD_SHA512_256_OPENSSL]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-512/256 hashing by OpenSSL.])])
+AM_CONDITIONAL([MHD_SHA512_256_OPENSSL],[test "X${use_sha512_256_backend}" = "Xopenssl"])
+AS_IF([test "X${use_sha512_256_backend}" = "Xmbedtls"],
+ [AC_DEFINE([[MHD_SHA512_X_MBEDTLS]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-512/256 hashing by MbedTLS (using its SHA-512 implementation).])])
+AM_CONDITIONAL([MHD_SHA512_X_MBEDTLS],[test "X${use_sha512_256_backend}" = "Xmbedtls"])
+AS_CASE([${use_sha512_256_backend}],
+ [no],[enable_sha512_256_MSG="no (disabled)"],
+ [builtin],[enable_sha512_256_MSG='built-in (internal implementation)'],
+ [openssl],[enable_sha512_256_MSG='OpenSSL'],
+ [mbedtls],[enable_sha512_256_MSG='MbedTLS (via SHA-512)'],
+ [AC_MSG_FAILURE([configure internal error: unexpected variable value \$use_sha512_256_backend=${use_sha512_256_backend}])]
)
-
-AS_IF([test "x${enable_sha512_256}" = "xtlslib" ],
- [
- AC_DEFINE([[MHD_SHA512_256_EXTR]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA-512/256 hashing by TLS library.])
- ]
-)
-AM_CONDITIONAL([MHD_SUPPORT_SHA512_256], [[test "x${enable_sha512_256}" = "xbuiltin" || test "x${enable_sha512_256}" = "xtlslib"]])
-AM_CONDITIONAL([MHD_USE_SHA512_256_INTR], [[test "X${enable_sha512_256}" = "Xbuiltin"]])
-AM_CONDITIONAL([MHD_USE_SHA512_256_OPENSSL], [[test "X${have_sha512_256_openssl}" = "Xyes"]])
-AM_CONDITIONAL([MHD_USE_SHA512_256_MBEDTLS], [[test "X${have_sha512_256_mbedtls}" = "Xyes"]])
-
-
AC_MSG_RESULT([[${enable_sha512_256_MSG}]])
diff --git a/src/mhd2/Makefile.am b/src/mhd2/Makefile.am
@@ -209,25 +209,21 @@ sha256_OPTSOURCES = \
endif
-# Note: the current configure may enable several SHA-512/256 TLS-lib
-# conditionals at once, while mhd_sha512_256.h selects the backends in the
-# OpenSSL, MbedTLS order of preference. As the last active assignment wins in
-# make, the blocks below are listed in the reversed order of preference.
-if MHD_USE_SHA512_256_INTR
+if MHD_SHA512_256_BUILTIN
sha512_256_OPTSOURCES = \
sha512_256_builtin.c sha512_256_builtin.h \
mhd_sha512_256.h
endif
-if MHD_USE_SHA512_256_MBEDTLS
+if MHD_SHA512_256_OPENSSL
sha512_256_OPTSOURCES = \
- sha512_256_mbedtls.c sha512_256_mbedtls.h \
+ sha512_256_openssl.c sha512_256_openssl.h \
mhd_sha512_256.h
endif
-if MHD_USE_SHA512_256_OPENSSL
+if MHD_SHA512_X_MBEDTLS
sha512_256_OPTSOURCES = \
- sha512_256_openssl.c sha512_256_openssl.h \
+ sha512_256_mbedtls.c sha512_256_mbedtls.h \
mhd_sha512_256.h
endif
diff --git a/src/mhd2/lib_get_info.c b/src/mhd2/lib_get_info.c
@@ -308,7 +308,7 @@ MHD_lib_get_info_fixed_sz (enum MHD_LibInfoFixed info_type,
#if !defined(MHD_SUPPORT_SHA512_256)
output_buf->v_type_digest_auth_sha512_256_algo_type =
MHD_LIB_INFO_FIXED_DIGEST_ALGO_TYPE_NOT_AVAILABLE;
-#elif !defined(MHD_SHA512_256_EXTR)
+#elif defined(MHD_SHA512_256_BUILTIN)
output_buf->v_type_digest_auth_sha512_256_algo_type =
MHD_LIB_INFO_FIXED_DIGEST_ALGO_TYPE_BUILT_IN;
#elif !defined(mhd_SHA512_256_HAS_EXT_ERROR)
diff --git a/src/mhd2/mhd_sha512_256.h b/src/mhd2/mhd_sha512_256.h
@@ -60,7 +60,7 @@
#include "mhd_macro_concat.h"
-#if defined(MHD_SHA512_256_EXTR_OPENSSL)
+#if defined(MHD_SHA512_256_OPENSSL)
# include "sha512_256_openssl.h"
/**
@@ -76,7 +76,7 @@
*/
# define mhd_SHA512_256_MACRO_NAME_ID OSSL
-#elif defined(MHD_SHA512_256_EXTR_MBEDTLS)
+#elif defined(MHD_SHA512_X_MBEDTLS)
# include "sha512_256_mbedtls.h"
/**
@@ -91,7 +91,7 @@
* The hashing backend identifier for macro names
*/
# define mhd_SHA512_256_MACRO_NAME_ID MTLS
-#elif !defined(MHD_SHA512_256_EXTR)
+#elif defined(MHD_SHA512_256_BUILTIN)
# include "sha512_256_builtin.h"
/**
@@ -162,6 +162,9 @@
* This function must not be called more than once for @a ctx without an
* intervening #mhd_SHA512_256_deinit().
*
+ * Whether or not an error is reported, #mhd_SHA512_256_deinit() must be
+ * called for @a ctx once this function has returned.
+ *
* For backends that track errors (see #mhd_SHA512_256_has_err()), the error
* state is set according to the result: cleared on success, set on failure.
*
diff --git a/src/mhd2/sha512_256_mbedtls.h b/src/mhd2/sha512_256_mbedtls.h
@@ -81,6 +81,9 @@ struct mhd_Sha512_256CtxMtls
* This function must not be called more than once for @a ctx without an
* intervening #mhd_SHA512_256_mtls_deinit().
*
+ * Whether or not an error is reported, #mhd_SHA512_256_mtls_deinit() must be
+ * called for @a ctx once this function has returned.
+ *
* The error state in @a ctx is set according to the result: cleared on
* success, set on failure.
*
diff --git a/src/mhd2/sha512_256_openssl.h b/src/mhd2/sha512_256_openssl.h
@@ -82,6 +82,9 @@ struct mhd_Sha512_256CtxOssl
* This function must not be called more than once for @a ctx without an
* intervening #mhd_SHA512_256_ossl_deinit().
*
+ * Whether or not an error is reported, #mhd_SHA512_256_ossl_deinit() must be
+ * called for @a ctx once this function has returned.
+ *
* The error state in @a ctx is set according to the result: cleared on
* success, set on failure.
*
diff --git a/src/tests/unit/Makefile.am b/src/tests/unit/Makefile.am
@@ -157,17 +157,20 @@ endif
unit_sha512_256_SOURCES = \
unit_sha512_256.c \
- $(srcdir)/../../mhd2/mhd_sha512_256.h \
- $(srcdir)/../../mhd2/sha512_256_builtin.c \
- $(srcdir)/../../mhd2/sha512_256_builtin.h
+ $(srcdir)/../../mhd2/mhd_sha512_256.h
-if MHD_SUPPORT_OPENSSL
+if MHD_SHA512_256_BUILTIN
unit_sha512_256_SOURCES += \
- $(srcdir)/../../mhd2/sha512_256_openssl.c \
- $(srcdir)/../../mhd2/sha512_256_openssl.h
+ $(srcdir)/../../mhd2/sha512_256_builtin.c \
+ $(srcdir)/../../mhd2/sha512_256_builtin.h
endif
-if MHD_SUPPORT_MBEDTLS
+if MHD_SHA512_256_OPENSSL
unit_sha512_256_SOURCES += \
- $(srcdir)/../../mhd2/sha512_256_mbedtls.c \
- $(srcdir)/../../mhd2/sha512_256_mbedtls.h
+ $(srcdir)/../../mhd2/sha512_256_openssl.c \
+ $(srcdir)/../../mhd2/sha512_256_openssl.h
+endif
+if MHD_SHA512_X_MBEDTLS
+ unit_sha512_256_SOURCES += \
+ $(srcdir)/../../mhd2/sha512_256_mbedtls.c \
+ $(srcdir)/../../mhd2/sha512_256_mbedtls.h
endif
diff --git a/src/tests/unit/unit_sha512_256.c b/src/tests/unit/unit_sha512_256.c
@@ -794,6 +794,7 @@ main (int argc,
t->name);
exit (99);
}
+ mhd_SHA512_256_deinit (&ctx);
}
num_failed = total - passed;
