commit b5992394edc4af93b24bf12e774b8b1344ef9cab
parent bde54f9b76f04b83f70ca14a3bed747bca09d297
Author: Evgeny Grin (Karlson2k) <k2k@drgrin.dev>
Date: Mon, 13 Jul 2026 18:34:40 +0200
configure: fixed overcomplicated and broken SHA-256 backend selection
Diffstat:
5 files changed, 119 insertions(+), 134 deletions(-)
diff --git a/configure.ac b/configure.ac
@@ -7440,38 +7440,37 @@ AC_MSG_RESULT([[${enable_md5_MSG}]])
# optional: SHA-256 support for Digest Auth. Enabled by default.
AC_ARG_ENABLE([[sha256]],
[AS_HELP_STRING([[--enable-sha256=TYPE]],
- [enable TYPE of SHA-256 hashing code (yes, no, builtin, tlslib) [yes if dauth enabled]])],
+ [enable TYPE of SHA-256 hashing code (yes, no, builtin, tlslib, gnutls, openssl, mbedtls) [yes if dauth enabled]])],
[
- AS_VAR_IF([enable_sha256],["internal"],[enable_sha256='builtin'])
- AS_VAR_IF([enable_sha256],["built-in"],[enable_sha256='builtin'])
- AS_VAR_IF([enable_digest_auth],["yes"],[],
+ AS_IF([test "X${enable_digest_auth}" != "Xyes" && test "X${enable_sha256}" != "Xno"],
[
- AS_VAR_IF([enable_sha256],["no"],[],
- [
- AC_MSG_WARN([The parameter --enable-sha256=${enable_sha256} is ignored as Digest Authentication is disabled])
- enable_sha256='no'
- ]
- )
+ AC_MSG_WARN([The parameter --enable-sha256=${enable_sha256} is ignored as Digest Authentication is disabled])
+ enable_sha256='no'
]
)
+ AS_CASE([$enable_sha256],
+ [internal],[enable_sha256='builtin'],
+ [built-in],[enable_sha256='builtin'],
+ [yes|no|builtin|tlslib|gnutls|openssl|mbedtls],[:],
+ AC_MSG_ERROR([unrecognized parameter --enable-sha256=${enable_sha256}])
+ )
], [[enable_sha256="${enable_digest_auth}"]]
)
-AS_UNSET([have_sha256_gnutls])
-AS_UNSET([have_sha256_openssl])
-AS_UNSET([have_sha256_mbedtls])
-# SHA-256 external vs. internal check
-AS_CASE([${enable_sha256}],[yes|tlslib],
+AS_CASE([${enable_sha256}],
+ [builtin],[use_sha256_backend='builtin'],
+ [no],[use_sha256_backend='no'],
+ [AS_UNSET([use_sha256_backend])]
+)
+AS_CASE([${enable_sha256}],[yes|tlslib|gnutls|openssl|mbedtls],
[
- found_sha256_tls="no"
- AS_IF([test "x$enable_https" = "xyes"],
+ AS_IF([test -z "${use_sha256_backend}" && test "X${have_gnutls}" = "Xyes"],
[
- # Check GnuTLS
- AS_VAR_IF([have_gnutls],["yes"],
+ AS_CASE([${enable_sha256}],[yes|tlslib|gnutls],
[
- AC_CACHE_CHECK([whether GnuTLS supports sha256 hashing],[mhd_cv_gnutls_sha256],
+ AC_CACHE_CHECK([whether GnuTLS supports SHA-256 hashing],[mhd_cv_gnutls_sha256],
[
- CPPFLAGS="${CPPFLAGS_ac} ${GNUTLS_LIB_CPPFLAGS} ${user_CPPFLAGS}"
+ CPPFLAGS="${CPPFLAGS_ac} ${GNUTLS_CPPFLAGS} ${user_CPPFLAGS}"
CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
LDFLAGS="${LDFLAGS_ac} ${GNUTLS_LDFLAGS} ${user_LDFLAGS}"
save_LIBS="$LIBS"
@@ -7510,31 +7509,25 @@ AS_CASE([${enable_sha256}],[yes|tlslib],
[mhd_cv_gnutls_sha256='yes'],[mhd_cv_gnutls_sha256='no']
)
LIBS="${save_LIBS}"
+ LDFLAGS="${LDFLAGS_ac} ${user_LDFLAGS}"
CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
- CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
- LDFLAGS="${LDFLAGS_ac} ${user_LDFLAGS}"
]
)
AS_VAR_IF([mhd_cv_gnutls_sha256],["no"],
- [
- AS_VAR_IF([enable_sha256],["tlslib"],
- [AC_MSG_WARN([GnuTLS SHA-256 implementation is not available])]
- )
- ],
- [
- AC_DEFINE([[MHD_SHA256_EXTR_GNUTLS]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing by GnuTLS.])
- have_sha256_gnutls="yes"
- found_sha256_tls="yes"
- ]
+ [AC_MSG_WARN([GnuTLS SHA-256 implementation is not available])],
+ [use_sha256_backend='gnutls']
)
]
- ) # end check GnuTLS
+ )
+ ]
+ ) # end GnuTLS check
- # Check OpenSSL
- AS_VAR_IF([have_openssl],["yes"],
- [
+ # Check OpenSSL
+ AS_IF([test -z "${use_sha256_backend}" && test "X${have_openssl}" = "Xyes"],
+ [
+ AS_CASE([${enable_sha256}],[yes|tlslib|openssl],
+ [
AC_CACHE_CHECK([whether OpenSSL supports SHA-256 hashing],[mhd_cv_openssl_sha256],
[
CPPFLAGS="${CPPFLAGS_ac} ${OPENSSL_CPPFLAGS} ${user_CPPFLAGS}"
@@ -7564,31 +7557,26 @@ AS_CASE([${enable_sha256}],[yes|tlslib],
[mhd_cv_openssl_sha256='yes'],[mhd_cv_openssl_sha256='no']
)
LIBS="${save_LIBS}"
- CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
- CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
LDFLAGS="${LDFLAGS_ac} ${user_LDFLAGS}"
+ CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
+ CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
]
)
AS_VAR_IF([mhd_cv_openssl_sha256],["no"],
- [
- AS_VAR_IF([enable_sha256],["tlslib"],
- [AC_MSG_WARN([OpenSSL SHA-256 implementation is not available])]
- )
- ],
- [
- AC_DEFINE([[MHD_SHA256_EXTR_OPENSSL]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing by OpenSSL.])
- have_sha256_openssl="yes"
- found_sha256_tls="yes"
- ]
+ [AC_MSG_WARN([OpenSSL SHA-256 implementation is not available])],
+ [use_sha256_backend="openssl"]
)
]
- ) # end check OpenSSL
+ )
+ ]
+ ) # end OpenSSL check
- # Check MbedTLS
- AS_VAR_IF([have_mbedtls],["yes"],
+ # Check MbedTLS
+ AS_IF([test -z "${use_sha256_backend}" && test "X${have_mbedtls}" = "Xyes"],
+ [
+ AS_CASE([${enable_sha256}],[yes|tlslib|mbedtls],
[
- AC_CACHE_CHECK([whether MbedTLS supports SHA256 hashing],[mhd_cv_mbedtls_sha256],
+ AC_CACHE_CHECK([whether MbedTLS supports SHA-256 hashing],[mhd_cv_mbedtls_sha256],
[
CPPFLAGS="${CPPFLAGS_ac} ${MBEDTLS_CRYPTO_CPPFLAGS} ${user_CPPFLAGS}"
CFLAGS="${CFLAGS_ac} ${MBEDTLS_CRYPTO_CFLAGS} ${user_CFLAGS}"
@@ -7603,7 +7591,7 @@ AS_CASE([${enable_sha256}],[yes|tlslib],
]],
[[
mbedtls_sha256_context ctx;
- unsigned char digest[16];
+ unsigned char digest[32];
mbedtls_sha256_init(&ctx);
mbedtls_sha256_starts(&ctx, 0);
mbedtls_sha256_update(&ctx, (const unsigned char *)"", 1);
@@ -7615,73 +7603,71 @@ AS_CASE([${enable_sha256}],[yes|tlslib],
[mhd_cv_mbedtls_sha256='yes'],[mhd_cv_mbedtls_sha256='no']
)
LIBS="${save_LIBS}"
- CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
- CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
LDFLAGS="${LDFLAGS_ac} ${user_LDFLAGS}"
+ CFLAGS="${CFLAGS_ac} ${user_CFLAGS}"
+ CPPFLAGS="${CPPFLAGS_ac} ${user_CPPFLAGS}"
]
)
AS_VAR_IF([mhd_cv_mbedtls_sha256],["no"],
- [
- AS_VAR_IF([enable_sha256],["tlslib"],
- [AC_MSG_WARN([MbedTLS SHA256 implementation is not available])]
- )
- ],
- [
- AC_DEFINE([[MHD_SHA256_EXTR_MBEDTLS]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA256 hashing by MbedTLS.])
- have_sha256_mbedtls="yes"
- found_sha256_tls="yes"
- ]
+ [AC_MSG_WARN([MbedTLS SHA-256 implementation is not available])],
+ [use_sha256_backend="mbedtls"]
)
]
- ) # end mbedtls check
+ )
]
- ) # end AS_IF (enable_https)
+ ) # end mbedtls check
- AS_IF([test "x$enable_sha256" = "xyes"],
- [AS_VAR_IF([found_sha256_tls],["yes"],
- [enable_sha256="tlslib"],
- [
- enable_sha256="builtin"
- AS_UNSET([have_sha256_gnutls])
- AS_UNSET([have_sha256_openssl])
- AS_UNSET([have_sha256_mbedtls])
- ]
- )],
- [AS_VAR_IF([found_sha256_tls],["yes"],
- [enable_sha256="tlslib"],
- [AC_MSG_ERROR([TLS library support requested for SHA256, but no library supports it])]
- )]
+ AS_IF([test -z "${use_sha256_backend}"],
+ [
+ AS_CASE([${enable_sha256}],[tlslib|gnutls|openssl|mbedtls],
+ [AC_MSG_ERROR([selected SHA-256 backend (${enable_sha256}) is not available])]
+ )
+ ]
)
]
-)
-AC_MSG_CHECKING([[whether to support SHA-256]])
+) # end "enable_sha256 in yes|tlslib|gnutls|openssl|mbedtls"
+
+AC_MSG_CHECKING([[for SHA-256 backend to use]])
AS_UNSET([enable_sha256_MSG])
-AS_CASE([${enable_sha256}],
- [builtin],[enable_sha256_MSG='yes, built-in'],
- [tlslib],[enable_sha256_MSG='yes, external (TLS library)'],
- [no],[enable_sha256_MSG='no'],
- [yes],[AC_MSG_ERROR([configure internal error: unexpected variable value])],
- [AC_MSG_ERROR([Unrecognized parameter --enable-sha256=${enable_sha256}])]
-)
-AS_IF([test "x${enable_sha256}" = "xbuiltin" ||
- test "x${enable_sha256}" = "xtlslib" ],
- [
- AC_DEFINE([[MHD_SUPPORT_SHA256]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing support.])
- ]
-)
-AS_IF([test "x${enable_sha256}" = "xtlslib" ],
- [
- AC_DEFINE([[MHD_SHA256_EXTR]],[[1]],
- [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing by TLS library.])
- ]
+AS_IF([test -z "${use_sha256_backend}"],
+ [
+ AS_CASE([${enable_sha256}],
+ [yes],[use_sha256_backend='builtin'],
+ [AC_MSG_FAILURE([configure internal error: unexpected variable value \$enable_sha256=${enable_sha256}])]
+ )
+ ]
+)
+AS_IF([test "X${enable_sha256}" != "X${use_sha256_backend}" && test "X${enable_sha256}" != "Xyes" && test "X${enable_sha256}" != "Xtlslib"],
+ [AC_MSG_FAILURE([configure internal error: unexpected variables values \$enable_sha256=${enable_sha256}; \$use_sha256_backend=${use_sha256_backend}])]
+)
+AS_IF([test "X${use_sha256_backend}" != "Xno"],
+ [AC_DEFINE([[MHD_SUPPORT_SHA256]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing support.])])
+AM_CONDITIONAL([MHD_SUPPORT_SHA256], [[test "X${use_sha256_backend}" != "Xno"]])
+AS_IF([test "X${use_sha256_backend}" = "Xbuiltin"],
+ [AC_DEFINE([[MHD_SHA256_BUILTIN]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing by internal code.])])
+AM_CONDITIONAL([MHD_SHA256_BUILTIN], [[test "X${use_sha256_backend}" = "Xbuiltin"]])
+AS_IF([test "X${use_sha256_backend}" = "Xgnutls"],
+ [AC_DEFINE([[MHD_SHA256_GNUTLS]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing by GnuTLS.])])
+AM_CONDITIONAL([MHD_SHA256_GNUTLS],[test "X${use_sha256_backend}" = "Xgnutls"])
+AS_IF([test "X${use_sha256_backend}" = "Xopenssl"],
+ [AC_DEFINE([[MHD_SHA256_OPENSSL]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing by OpenSSL.])])
+AM_CONDITIONAL([MHD_SHA256_OPENSSL],[test "X${use_sha256_backend}" = "Xopenssl"])
+AS_IF([test "X${use_sha256_backend}" = "Xmbedtls"],
+ [AC_DEFINE([[MHD_SHA256_MBEDTLS]],[[1]],
+ [Define to 1 if libmicrohttpd is compiled with SHA-256 hashing by MbedTLS.])])
+AM_CONDITIONAL([MHD_SHA256_MBEDTLS],[test "X${use_sha256_backend}" = "Xmbedtls"])
+AS_CASE([${use_sha256_backend}],
+ [no],[enable_sha256_MSG="no (disabled)"],
+ [builtin],[enable_sha256_MSG='built-in (internal implementation)'],
+ [gnutls],[enable_sha256_MSG='GnuTLS'],
+ [openssl],[enable_sha256_MSG='OpenSSL'],
+ [mbedtls],[enable_sha256_MSG='MbedTLS'],
+ [AC_MSG_FAILURE([configure internal error: unexpected variable value \$use_sha256_backend=${use_sha256_backend}])]
)
-AM_CONDITIONAL([MHD_SUPPORT_SHA256], [[test "x${enable_sha256}" = "xbuiltin" || test "x${enable_sha256}" = "xtlslib" ]])
-AM_CONDITIONAL([MHD_USE_SHA256_INTR], [[test "X${enable_sha256}" = "Xbuiltin"]])
-AM_CONDITIONAL([MHD_USE_SHA256_GNUTLS], [[test "X${have_sha256_gnutls}" = "Xyes"]])
-AM_CONDITIONAL([MHD_USE_SHA256_OPENSSL], [[test "X${have_sha256_openssl}" = "Xyes"]])
-AM_CONDITIONAL([MHD_USE_SHA256_MBEDTLS], [[test "X${have_sha256_mbedtls}" = "Xyes"]])
AC_MSG_RESULT([[${enable_sha256_MSG}]])
# optional: SHA-512/256 support for Digest Auth. Enabled by default.
diff --git a/src/mhd2/Makefile.am b/src/mhd2/Makefile.am
@@ -184,31 +184,27 @@ md5_OPTSOURCES = \
endif
-# Note: the current configure may enable several SHA-256 TLS-lib conditionals
-# at once, while mhd_sha256.h selects the backends in the GnuTLS, OpenSSL,
-# MbedTLS order of preference. As the last active assignment wins in make,
-# the blocks below are listed in the reversed order of preference.
-if MHD_USE_SHA256_INTR
+if MHD_SHA256_BUILTIN
sha256_OPTSOURCES = \
sha256_builtin.c sha256_builtin.h \
mhd_sha256.h
endif
-if MHD_USE_SHA256_MBEDTLS
+if MHD_SHA256_GNUTLS
sha256_OPTSOURCES = \
- sha256_mbedtls.c sha256_mbedtls.h \
+ sha256_gnutls.c sha256_gnutls.h \
mhd_sha256.h
endif
-if MHD_USE_SHA256_OPENSSL
+if MHD_SHA256_OPENSSL
sha256_OPTSOURCES = \
sha256_openssl.c sha256_openssl.h \
mhd_sha256.h
endif
-if MHD_USE_SHA256_GNUTLS
+if MHD_SHA256_MBEDTLS
sha256_OPTSOURCES = \
- sha256_gnutls.c sha256_gnutls.h \
+ sha256_mbedtls.c sha256_mbedtls.h \
mhd_sha256.h
endif
diff --git a/src/mhd2/lib_get_info.c b/src/mhd2/lib_get_info.c
@@ -290,7 +290,7 @@ MHD_lib_get_info_fixed_sz (enum MHD_LibInfoFixed info_type,
#if !defined(MHD_SUPPORT_SHA256)
output_buf->v_type_digest_auth_sha256_algo_type =
MHD_LIB_INFO_FIXED_DIGEST_ALGO_TYPE_NOT_AVAILABLE;
-#elif !defined(MHD_SHA256_EXTR)
+#elif defined(MHD_SHA256_BUILTIN)
output_buf->v_type_digest_auth_sha256_algo_type =
MHD_LIB_INFO_FIXED_DIGEST_ALGO_TYPE_BUILT_IN;
#elif !defined(mhd_SHA256_HAS_EXT_ERROR)
diff --git a/src/mhd2/mhd_sha256.h b/src/mhd2/mhd_sha256.h
@@ -60,7 +60,7 @@
#include "mhd_macro_concat.h"
-#if defined(MHD_SHA256_EXTR_GNUTLS)
+#if defined(MHD_SHA256_GNUTLS)
# include "sha256_gnutls.h"
/**
@@ -76,7 +76,7 @@
*/
# define mhd_SHA256_MACRO_NAME_ID GTLS
-#elif defined(MHD_SHA256_EXTR_OPENSSL)
+#elif defined(MHD_SHA256_OPENSSL)
# include "sha256_openssl.h"
/**
@@ -92,7 +92,7 @@
*/
# define mhd_SHA256_MACRO_NAME_ID OSSL
-#elif defined(MHD_SHA256_EXTR_MBEDTLS)
+#elif defined(MHD_SHA256_MBEDTLS)
# include "sha256_mbedtls.h"
/**
@@ -107,7 +107,7 @@
* The hashing backend identifier for macro names
*/
# define mhd_SHA256_MACRO_NAME_ID MTLS
-#elif !defined(MHD_SHA256_EXTR)
+#elif defined(MHD_SHA256_BUILTIN)
# include "sha256_builtin.h"
/**
diff --git a/src/tests/unit/Makefile.am b/src/tests/unit/Makefile.am
@@ -136,20 +136,23 @@ endif
unit_sha256_SOURCES = \
unit_sha256.c \
- $(srcdir)/../../mhd2/mhd_sha256.h \
- $(srcdir)/../../mhd2/sha256_builtin.c $(srcdir)/../../mhd2/sha256_builtin.h
+ $(srcdir)/../../mhd2/mhd_sha256.h
-if MHD_SUPPORT_GNUTLS
+if MHD_SHA256_BUILTIN
unit_sha256_SOURCES += \
- $(srcdir)/../../mhd2/sha256_gnutls.c $(srcdir)/../../mhd2/sha256_gnutls.h
+ $(srcdir)/../../mhd2/sha256_builtin.c $(srcdir)/../../mhd2/sha256_builtin.h
endif
-if MHD_SUPPORT_OPENSSL
+if MHD_SHA256_GNUTLS
unit_sha256_SOURCES += \
- $(srcdir)/../../mhd2/sha256_openssl.c $(srcdir)/../../mhd2/sha256_openssl.h
+ $(srcdir)/../../mhd2/sha256_gnutls.c $(srcdir)/../../mhd2/sha256_gnutls.h
endif
-if MHD_SUPPORT_MBEDTLS
+if MHD_SHA256_OPENSSL
unit_sha256_SOURCES += \
- $(srcdir)/../../mhd2/sha256_mbedtls.c $(srcdir)/../../mhd2/sha256_mbedtls.h
+ $(srcdir)/../../mhd2/sha256_openssl.c $(srcdir)/../../mhd2/sha256_openssl.h
+endif
+if MHD_SHA256_MBEDTLS
+ unit_sha256_SOURCES += \
+ $(srcdir)/../../mhd2/sha256_mbedtls.c $(srcdir)/../../mhd2/sha256_mbedtls.h
endif
unit_sha512_256_SOURCES = unit_sha512_256.c
