Skip to content

Commit 3d26828

Browse files
ethomsonethomson
committed
sha: support FIPS-compliant OpenSSL for SHA1
1 parent 7f7dfe7 commit 3d26828

File tree

6 files changed

+101
-14
lines changed

6 files changed

+101
-14
lines changed

‎cmake/SelectHashes.cmake‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ if(USE_SHA1 STREQUAL "CollisionDetection")
2828
set(GIT_SHA1_COLLISIONDETECT 1)
2929
elseif(USE_SHA1 STREQUAL "OpenSSL")
3030
set(GIT_SHA1_OPENSSL 1)
31+
elseif(USE_SHA1 STREQUAL "OpenSSL-FIPS")
32+
set(GIT_SHA1_OPENSSL_FIPS 1)
3133
elseif(USE_SHA1 STREQUAL "OpenSSL-Dynamic")
3234
set(GIT_SHA1_OPENSSL 1)
3335
set(GIT_SHA1_OPENSSL_DYNAMIC 1)
@@ -66,12 +68,12 @@ if(USE_SHA256 STREQUAL "Builtin")
6668
set(GIT_SHA256_BUILTIN 1)
6769
elseif(USE_SHA256 STREQUAL "OpenSSL")
6870
set(GIT_SHA256_OPENSSL 1)
71+
elseif(USE_SHA256 STREQUAL "OpenSSL-FIPS")
72+
set(GIT_SHA256_OPENSSL_FIPS 1)
6973
elseif(USE_SHA256 STREQUAL "OpenSSL-Dynamic")
7074
set(GIT_SHA256_OPENSSL 1)
7175
set(GIT_SHA256_OPENSSL_DYNAMIC 1)
7276
list(APPEND LIBGIT2_SYSTEM_LIBS dl)
73-
elseif(USE_SHA256 STREQUAL "OpenSSL-FIPS")
74-
set(GIT_SHA256_OPENSSL_FIPS 1)
7577
elseif(USE_SHA256 STREQUAL "CommonCrypto")
7678
set(GIT_SHA256_COMMON_CRYPTO 1)
7779
elseif(USE_SHA256 STREQUAL "mbedTLS")
@@ -83,7 +85,8 @@ else()
8385
endif()
8486

8587
# add library requirements
86-
if(USE_SHA1 STREQUAL "OpenSSL" OR USE_SHA256 STREQUAL "OpenSSL")
88+
if(USE_SHA1 STREQUAL "OpenSSL" OR USE_SHA256 STREQUAL "OpenSSL" OR
89+
USE_SHA1 STREQUAL "OpenSSL-FIPS" OR USE_SHA256 STREQUAL "OpenSSL-FIPS")
8790
if(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
8891
list(APPEND LIBGIT2_PC_LIBS "-lssl")
8992
else()

‎src/util/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ if(USE_SHA1 STREQUAL "CollisionDetection")
3636
target_compile_definitions(util PRIVATE SHA1DC_NO_STANDARD_INCLUDES=1)
3737
target_compile_definitions(util PRIVATE SHA1DC_CUSTOM_INCLUDE_SHA1_C=\"git2_util.h\")
3838
target_compile_definitions(util PRIVATE SHA1DC_CUSTOM_INCLUDE_UBC_CHECK_C=\"git2_util.h\")
39-
elseif(USE_SHA1 STREQUAL "OpenSSL" OR USE_SHA1 STREQUAL "OpenSSL-Dynamic")
39+
elseif(USE_SHA1 STREQUAL "OpenSSL" OR USE_SHA1 STREQUAL "OpenSSL-Dynamic" OR USE_SHA1 STREQUAL "OpenSSL-FIPS")
4040
add_definitions(-DOPENSSL_API_COMPAT=0x10100000L)
4141
file(GLOB UTIL_SRC_SHA1 hash/openssl.*)
4242
elseif(USE_SHA1 STREQUAL "CommonCrypto")

‎src/util/git2_features.h.in‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,15 +54,16 @@
5454
#cmakedefine GIT_SHA1_WIN32 1
5555
#cmakedefine GIT_SHA1_COMMON_CRYPTO 1
5656
#cmakedefine GIT_SHA1_OPENSSL 1
57+
#cmakedefine GIT_SHA1_OPENSSL_FIPS 1
5758
#cmakedefine GIT_SHA1_OPENSSL_DYNAMIC 1
5859
#cmakedefine GIT_SHA1_MBEDTLS 1
5960

6061
#cmakedefine GIT_SHA256_BUILTIN 1
6162
#cmakedefine GIT_SHA256_WIN32 1
6263
#cmakedefine GIT_SHA256_COMMON_CRYPTO 1
6364
#cmakedefine GIT_SHA256_OPENSSL 1
64-
#cmakedefine GIT_SHA256_OPENSSL_DYNAMIC 1
6565
#cmakedefine GIT_SHA256_OPENSSL_FIPS 1
66+
#cmakedefine GIT_SHA256_OPENSSL_DYNAMIC 1
6667
#cmakedefine GIT_SHA256_MBEDTLS 1
6768

6869
#cmakedefine GIT_RAND_GETENTROPY 1

‎src/util/hash/openssl.c‎

Lines changed: 77 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,79 @@ int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *ctx)
120120

121121
#endif
122122

123+
#ifdef GIT_SHA1_OPENSSL_FIPS
124+
125+
static const EVP_MD *SHA1_ENGINE_DIGEST_TYPE = NULL;
126+
127+
int git_hash_sha1_global_init(void)
128+
{
129+
SHA1_ENGINE_DIGEST_TYPE = EVP_sha1();
130+
return SHA1_ENGINE_DIGEST_TYPE != NULL ? 0 : -1;
131+
}
132+
133+
int git_hash_sha1_ctx_init(git_hash_sha1_ctx *ctx)
134+
{
135+
return git_hash_sha1_init(ctx);
136+
}
137+
138+
void git_hash_sha1_ctx_cleanup(git_hash_sha1_ctx *ctx)
139+
{
140+
#if OPENSSL_VERSION_NUMBER < 0x10100000L
141+
EVP_MD_CTX_destroy(ctx->c);
142+
#else
143+
EVP_MD_CTX_free(ctx->c);
144+
#endif
145+
}
146+
147+
int git_hash_sha1_init(git_hash_sha1_ctx *ctx)
148+
{
149+
GIT_ASSERT_ARG(ctx);
150+
GIT_ASSERT(SHA1_ENGINE_DIGEST_TYPE);
151+
152+
#if OPENSSL_VERSION_NUMBER < 0x10100000L
153+
ctx->c = EVP_MD_CTX_create();
154+
#else
155+
ctx->c = EVP_MD_CTX_new();
156+
#endif
157+
158+
GIT_ASSERT(ctx->c);
159+
160+
if (EVP_DigestInit_ex(ctx->c, SHA1_ENGINE_DIGEST_TYPE, NULL) != 1) {
161+
git_hash_sha1_ctx_cleanup(ctx);
162+
git_error_set(GIT_ERROR_SHA, "failed to initialize sha1 context");
163+
return -1;
164+
}
165+
166+
return 0;
167+
}
168+
169+
int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
170+
{
171+
GIT_ASSERT_ARG(ctx);
172+
173+
if (EVP_DigestUpdate(ctx->c, data, len) != 1) {
174+
git_error_set(GIT_ERROR_SHA, "failed to update sha1");
175+
return -1;
176+
}
177+
178+
return 0;
179+
}
180+
181+
int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *ctx)
182+
{
183+
unsigned int len = 0;
184+
GIT_ASSERT_ARG(ctx);
185+
186+
if (EVP_DigestFinal(ctx->c, out, &len) != 1) {
187+
git_error_set(GIT_ERROR_SHA, "failed to finalize sha1");
188+
return -1;
189+
}
190+
191+
return 0;
192+
}
193+
194+
#endif
195+
123196
#ifdef GIT_SHA256_OPENSSL
124197

125198
# ifdef GIT_OPENSSL_DYNAMIC
@@ -196,7 +269,7 @@ int git_hash_sha256_final(unsigned char *out, git_hash_sha256_ctx *ctx)
196269

197270
#ifdef GIT_SHA256_OPENSSL_FIPS
198271

199-
static const EVP_MD* SHA256_ENGINE_DIGEST_TYPE = NULL;
272+
static const EVP_MD *SHA256_ENGINE_DIGEST_TYPE = NULL;
200273

201274
int git_hash_sha256_global_init(void)
202275
{
@@ -221,13 +294,14 @@ void git_hash_sha256_ctx_cleanup(git_hash_sha256_ctx *ctx)
221294
int git_hash_sha256_init(git_hash_sha256_ctx *ctx)
222295
{
223296
GIT_ASSERT_ARG(ctx);
224-
225297
GIT_ASSERT(SHA256_ENGINE_DIGEST_TYPE);
298+
226299
#if OPENSSL_VERSION_NUMBER < 0x10100000L
227300
ctx->c = EVP_MD_CTX_create();
228301
#else
229302
ctx->c = EVP_MD_CTX_new();
230303
#endif
304+
231305
GIT_ASSERT(ctx->c);
232306

233307
if (EVP_DigestInit_ex(ctx->c, SHA256_ENGINE_DIGEST_TYPE, NULL) != 1) {
@@ -264,4 +338,4 @@ int git_hash_sha256_final(unsigned char *out, git_hash_sha256_ctx *ctx)
264338
return 0;
265339
}
266340

267-
#endif
341+
#endif

‎src/util/hash/openssl.h‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@
1111
#include "hash/sha.h"
1212

1313
#ifndef GIT_OPENSSL_DYNAMIC
14-
#ifdef GIT_SHA256_OPENSSL_FIPS
15-
#include <openssl/evp.h>
16-
#else
17-
#include <openssl/sha.h>
18-
#endif
14+
# if defined(GIT_SHA1_OPENSSL_FIPS) || defined(GIT_SHA256_OPENSSL_FIPS)
15+
# include <openssl/evp.h>
16+
# else
17+
# include <openssl/sha.h>
18+
# endif
1919
#else
2020

2121
typedef struct {
@@ -40,6 +40,12 @@ struct git_hash_sha1_ctx {
4040
};
4141
#endif
4242

43+
#ifdef GIT_SHA1_OPENSSL_FIPS
44+
struct git_hash_sha1_ctx {
45+
EVP_MD_CTX* c;
46+
};
47+
#endif
48+
4349
#ifdef GIT_SHA256_OPENSSL
4450
struct git_hash_sha256_ctx {
4551
SHA256_CTX c;

‎src/util/hash/sha.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,10 @@ typedef struct git_hash_sha256_ctx git_hash_sha256_ctx;
1717
# include "common_crypto.h"
1818
#endif
1919

20-
#if defined(GIT_SHA1_OPENSSL) || defined(GIT_SHA256_OPENSSL) || defined(GIT_SHA256_OPENSSL_FIPS)
20+
#if defined(GIT_SHA1_OPENSSL) || \
21+
defined(GIT_SHA1_OPENSSL_FIPS) || \
22+
defined(GIT_SHA256_OPENSSL) || \
23+
defined(GIT_SHA256_OPENSSL_FIPS)
2124
# include "openssl.h"
2225
#endif
2326

0 commit comments

Comments
 (0)