* [Buildroot] [PATCH 1/1] package/cups: fix build without gnutls
@ 2024-01-05 12:35 Fabrice Fontaine
2024-01-05 12:46 ` Thomas Petazzoni via buildroot
0 siblings, 1 reply; 2+ messages in thread
From: Fabrice Fontaine @ 2024-01-05 12:35 UTC (permalink / raw)
To: buildroot; +Cc: Olivier Schonken, Angelo Compagnucci, Fabrice Fontaine
Fix the following build failure without gnutls raised since bump to
version 2.4.7 in commit 55c80fdfb379c74c7f7e8c260dea02e0150d7614 and
https://github.com/OpenPrinting/cups/commit/b5b1418da7bfb9f81384c7c47cc59890b4d3ff5d
hash.c:16:12: fatal error: gnutls/crypto.h: No such file or directory
16 | # include <gnutls/crypto.h>
| ^~~~~~~~~~~~~~~~~
Fixes:
- http://autobuild.buildroot.org/results/888e9e252821bda1e051400d4aa850cd082e8e76
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
...-support-for-MacOS-Win-SSL-libs-back.patch | 379 ++++++++++++++++++
1 file changed, 379 insertions(+)
create mode 100644 package/cups/0005-cups-hash.c-Put-support-for-MacOS-Win-SSL-libs-back.patch
diff --git a/package/cups/0005-cups-hash.c-Put-support-for-MacOS-Win-SSL-libs-back.patch b/package/cups/0005-cups-hash.c-Put-support-for-MacOS-Win-SSL-libs-back.patch
new file mode 100644
index 0000000000..70e6975caa
--- /dev/null
+++ b/package/cups/0005-cups-hash.c-Put-support-for-MacOS-Win-SSL-libs-back.patch
@@ -0,0 +1,379 @@
+From c6cd5e9c10edc68caf6936a3d3274f758e9cd03d Mon Sep 17 00:00:00 2001
+From: Zdenek Dohnal <zdohnal@redhat.com>
+Date: Tue, 3 Oct 2023 13:59:40 +0200
+Subject: [PATCH 1/2] cups/hash.c: Put support for MacOS/Win SSL libs back
+
+- I mustn't remove their support in patch release - this should happen in
+2.5 only.
+- I have put back support for several hashes as well - they
+should be removed in 2.5.
+- restrict usage of second block hashing only if OpenSSL/LibreSSL/GnuTLS
+ is available
+
+Upstream: https://github.com/OpenPrinting/cups/commit/43ceb50ad92236bda3de168a19765f371812a1ea
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ cups/hash.c | 271 +++++++++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 260 insertions(+), 11 deletions(-)
+
+diff --git a/cups/hash.c b/cups/hash.c
+index 93ca552c8..c447bab4e 100644
+--- a/cups/hash.c
++++ b/cups/hash.c
+@@ -12,8 +12,13 @@
+ #include "md5-internal.h"
+ #ifdef HAVE_OPENSSL
+ # include <openssl/evp.h>
+-#else // HAVE_GNUTLS
++#elif defined(HAVE_GNUTLS)
+ # include <gnutls/crypto.h>
++#elif __APPLE__
++# include <CommonCrypto/CommonDigest.h>
++#elif _WIN32
++# include <windows.h>
++# include <bcrypt.h>
+ #endif // HAVE_OPENSSL
+
+
+@@ -193,17 +198,18 @@ hash_data(const char *algorithm, // I - Algorithm
+ const void *b, // I - Second block or `NULL` for none
+ size_t blen) // I - Length of second block or `0` for none
+ {
++#if defined(HAVE_OPENSSL) || defined(HAVE_GNUTLS)
+ unsigned hashlen; // Length of hash
+ unsigned char hashtemp[64]; // Temporary hash buffer
+-#ifdef HAVE_OPENSSL
+- const EVP_MD *md = NULL; // Message digest implementation
+- EVP_MD_CTX *ctx; // Context
+-#else // HAVE_GNUTLS
+- gnutls_digest_algorithm_t alg = GNUTLS_DIG_UNKNOWN;
+- // Algorithm
+- gnutls_hash_hd_t ctx; // Context
+-#endif // HAVE_OPENSSL
++#else
++ if (strcmp(algorithm, "md5") && (b || blen != 0))
++ {
++ // Second block hashing is not supported without OpenSSL or GnuTLS
++ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unsupported without GnuTLS or OpenSSL/LibreSSL."), 1);
+
++ return (-1);
++ }
++#endif
+
+ if (!strcmp(algorithm, "md5"))
+ {
+@@ -223,6 +229,10 @@ hash_data(const char *algorithm, // I - Algorithm
+ }
+
+ #ifdef HAVE_OPENSSL
++ const EVP_MD *md = NULL; // Message digest implementation
++ EVP_MD_CTX *ctx; // Context
++
++
+ if (!strcmp(algorithm, "sha"))
+ {
+ // SHA-1
+@@ -244,6 +254,14 @@ hash_data(const char *algorithm, // I - Algorithm
+ {
+ md = EVP_sha512();
+ }
++ else if (!strcmp(algorithm, "sha2-512_224"))
++ {
++ md = EVP_sha512_224();
++ }
++ else if (!strcmp(algorithm, "sha2-512_256"))
++ {
++ md = EVP_sha512_256();
++ }
+
+ if (md)
+ {
+@@ -262,7 +280,13 @@ hash_data(const char *algorithm, // I - Algorithm
+ return ((ssize_t)hashlen);
+ }
+
+-#else // HAVE_GNUTLS
++#elif defined(HAVE_GNUTLS)
++ gnutls_digest_algorithm_t alg = GNUTLS_DIG_UNKNOWN; // Algorithm
++ gnutls_hash_hd_t ctx; // Context
++ unsigned char temp[64]; // Temporary hash buffer
++ size_t tempsize = 0; // Truncate to this size?
++
++
+ if (!strcmp(algorithm, "sha"))
+ {
+ // SHA-1
+@@ -284,9 +308,32 @@ hash_data(const char *algorithm, // I - Algorithm
+ {
+ alg = GNUTLS_DIG_SHA512;
+ }
++ else if (!strcmp(algorithm, "sha2-512_224"))
++ {
++ alg = GNUTLS_DIG_SHA512;
++ tempsize = 28;
++ }
++ else if (!strcmp(algorithm, "sha2-512_256"))
++ {
++ alg = GNUTLS_DIG_SHA512;
++ tempsize = 32;
++ }
+
+ if (alg != GNUTLS_DIG_UNKNOWN)
+ {
++ if (tempsize > 0)
++ {
++ // Truncate result to tempsize bytes...
++
++ if (hashsize < tempsize)
++ goto too_small;
++
++ gnutls_hash_fast(alg, a, alen, temp);
++ memcpy(hash, temp, tempsize);
++
++ return ((ssize_t)tempsize);
++ }
++
+ hashlen = gnutls_hash_get_len(alg);
+
+ if (hashlen > hashsize)
+@@ -302,7 +349,209 @@ hash_data(const char *algorithm, // I - Algorithm
+
+ return ((ssize_t)hashlen);
+ }
+-#endif // HAVE_OPENSSL
++
++#elif __APPLE__
++ if (!strcmp(algorithm, "sha"))
++ {
++ // SHA-1...
++
++ CC_SHA1_CTX ctx; // SHA-1 context
++
++ if (hashsize < CC_SHA1_DIGEST_LENGTH)
++ goto too_small;
++
++ CC_SHA1_Init(&ctx);
++ CC_SHA1_Update(&ctx, a, (CC_LONG)alen);
++ CC_SHA1_Final(hash, &ctx);
++
++ return (CC_SHA1_DIGEST_LENGTH);
++ }
++# ifdef CC_SHA224_DIGEST_LENGTH
++ else if (!strcmp(algorithm, "sha2-224"))
++ {
++ CC_SHA256_CTX ctx; // SHA-224 context
++
++ if (hashsize < CC_SHA224_DIGEST_LENGTH)
++ goto too_small;
++
++ CC_SHA224_Init(&ctx);
++ CC_SHA224_Update(&ctx, a, (CC_LONG)alen);
++ CC_SHA224_Final(hash, &ctx);
++
++ return (CC_SHA224_DIGEST_LENGTH);
++ }
++# endif /* CC_SHA224_DIGEST_LENGTH */
++ else if (!strcmp(algorithm, "sha2-256"))
++ {
++ CC_SHA256_CTX ctx; // SHA-256 context
++
++ if (hashsize < CC_SHA256_DIGEST_LENGTH)
++ goto too_small;
++
++ CC_SHA256_Init(&ctx);
++ CC_SHA256_Update(&ctx, a, (CC_LONG)alen);
++ CC_SHA256_Final(hash, &ctx);
++
++ return (CC_SHA256_DIGEST_LENGTH);
++ }
++ else if (!strcmp(algorithm, "sha2-384"))
++ {
++ CC_SHA512_CTX ctx; // SHA-384 context
++
++ if (hashsize < CC_SHA384_DIGEST_LENGTH)
++ goto too_small;
++
++ CC_SHA384_Init(&ctx);
++ CC_SHA384_Update(&ctx, a, (CC_LONG)alen);
++ CC_SHA384_Final(hash, &ctx);
++
++ return (CC_SHA384_DIGEST_LENGTH);
++ }
++ else if (!strcmp(algorithm, "sha2-512"))
++ {
++ CC_SHA512_CTX ctx; // SHA-512 context
++
++ if (hashsize < CC_SHA512_DIGEST_LENGTH)
++ goto too_small;
++
++ CC_SHA512_Init(&ctx);
++ CC_SHA512_Update(&ctx, a, (CC_LONG)alen);
++ CC_SHA512_Final(hash, &ctx);
++
++ return (CC_SHA512_DIGEST_LENGTH);
++ }
++# ifdef CC_SHA224_DIGEST_LENGTH
++ else if (!strcmp(algorithm, "sha2-512_224"))
++ {
++ CC_SHA512_CTX ctx; // SHA-512 context
++ unsigned char temp[CC_SHA512_DIGEST_LENGTH];
++ // SHA-512 hash
++
++ // SHA2-512 truncated to 224 bits (28 bytes)...
++
++ if (hashsize < CC_SHA224_DIGEST_LENGTH)
++ goto too_small;
++
++ CC_SHA512_Init(&ctx);
++ CC_SHA512_Update(&ctx, a, (CC_LONG)alen);
++ CC_SHA512_Final(temp, &ctx);
++
++ memcpy(hash, temp, CC_SHA224_DIGEST_LENGTH);
++
++ return (CC_SHA224_DIGEST_LENGTH);
++ }
++# endif // CC_SHA224_DIGEST_LENGTH
++ else if (!strcmp(algorithm, "sha2-512_256"))
++ {
++ CC_SHA512_CTX ctx; // SHA-512 context
++ unsigned char temp[CC_SHA512_DIGEST_LENGTH];
++ // SHA-512 hash
++
++ // SHA2-512 truncated to 256 bits (32 bytes)...
++
++ if (hashsize < CC_SHA256_DIGEST_LENGTH)
++ goto too_small;
++
++ CC_SHA512_Init(&ctx);
++ CC_SHA512_Update(&ctx, a, (CC_LONG)alen);
++ CC_SHA512_Final(temp, &ctx);
++
++ memcpy(hash, temp, CC_SHA256_DIGEST_LENGTH);
++
++ return (CC_SHA256_DIGEST_LENGTH);
++ }
++
++#elif _WIN32
++ // Use Windows CNG APIs to perform hashing...
++ BCRYPT_ALG_HANDLE alg; // Algorithm handle
++ LPCWSTR algid = NULL; // Algorithm ID
++ ssize_t hashlen; // Hash length
++ NTSTATUS status; // Status of hash
++ unsigned char temp[64]; // Temporary hash buffer
++ size_t tempsize = 0; // Truncate to this size?
++
++
++ if (!strcmp(algorithm, "sha"))
++ {
++ algid = BCRYPT_SHA1_ALGORITHM;
++ hashlen = 20;
++ }
++ else if (!strcmp(algorithm, "sha2-256"))
++ {
++ algid = BCRYPT_SHA256_ALGORITHM;
++ hashlen = 32;
++ }
++ else if (!strcmp(algorithm, "sha2-384"))
++ {
++ algid = BCRYPT_SHA384_ALGORITHM;
++ hashlen = 48;
++ }
++ else if (!strcmp(algorithm, "sha2-512"))
++ {
++ algid = BCRYPT_SHA512_ALGORITHM;
++ hashlen = 64;
++ }
++ else if (!strcmp(algorithm, "sha2-512_224"))
++ {
++ algid = BCRYPT_SHA512_ALGORITHM;
++ hashlen = tempsize = 28;
++ }
++ else if (!strcmp(algorithm, "sha2-512_256"))
++ {
++ algid = BCRYPT_SHA512_ALGORITHM;
++ hashlen = tempsize = 32;
++ }
++
++ if (algid)
++ {
++ if (hashsize < (size_t)hashlen)
++ goto too_small;
++
++ if ((status = BCryptOpenAlgorithmProvider(&alg, algid, NULL, 0)) < 0)
++ {
++ DEBUG_printf(("2cupsHashData: BCryptOpenAlgorithmProvider returned %d.", status));
++
++ if (status == STATUS_INVALID_PARAMETER)
++ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad algorithm parameter."), 1);
++ else
++ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to access cryptographic provider."), 1);
++
++ return (-1);
++ }
++
++ if (tempsize > 0)
++ {
++ // Do a truncated SHA2-512 hash...
++ status = BCryptHash(alg, NULL, 0, (PUCHAR)a, (ULONG)alen, temp, sizeof(temp));
++ memcpy(hash, temp, hashlen);
++ }
++ else
++ {
++ // Hash directly to buffer...
++ status = BCryptHash(alg, NULL, 0, (PUCHAR)a, (ULONG)alen, hash, (ULONG)hashlen);
++ }
++
++ BCryptCloseAlgorithmProvider(alg, 0);
++
++ if (status < 0)
++ {
++ DEBUG_printf(("2cupsHashData: BCryptHash returned %d.", status));
++
++ if (status == STATUS_INVALID_PARAMETER)
++ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad hashing parameter."), 1);
++ else
++ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Hashing failed."), 1);
++
++ return (-1);
++ }
++
++ return (hashlen);
++ }
++
++#else
++ if (hashsize < 64)
++ goto too_small;
++#endif // __APPLE__
+
+ // Unknown hash algorithm...
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unknown hash algorithm."), 1);
+
+From 0dd97fcaeeb16ed836e8542d75e2396fb1d129d9 Mon Sep 17 00:00:00 2001
+From: Zdenek Dohnal <zdohnal@redhat.com>
+Date: Tue, 3 Oct 2023 14:39:33 +0200
+Subject: [PATCH 2/2] cups/hash.c: LibreSSL version does not support several
+ hashes
+
+---
+ cups/hash.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/cups/hash.c b/cups/hash.c
+index c447bab4e..5eefa1010 100644
+--- a/cups/hash.c
++++ b/cups/hash.c
+@@ -254,14 +254,6 @@ hash_data(const char *algorithm, // I - Algorithm
+ {
+ md = EVP_sha512();
+ }
+- else if (!strcmp(algorithm, "sha2-512_224"))
+- {
+- md = EVP_sha512_224();
+- }
+- else if (!strcmp(algorithm, "sha2-512_256"))
+- {
+- md = EVP_sha512_256();
+- }
+
+ if (md)
+ {
--
2.43.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [Buildroot] [PATCH 1/1] package/cups: fix build without gnutls
2024-01-05 12:35 [Buildroot] [PATCH 1/1] package/cups: fix build without gnutls Fabrice Fontaine
@ 2024-01-05 12:46 ` Thomas Petazzoni via buildroot
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Petazzoni via buildroot @ 2024-01-05 12:46 UTC (permalink / raw)
To: Fabrice Fontaine; +Cc: Olivier Schonken, Angelo Compagnucci, buildroot
Hello Fabrice,
On Fri, 5 Jan 2024 13:35:19 +0100
Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote:
> Fix the following build failure without gnutls raised since bump to
> version 2.4.7 in commit 55c80fdfb379c74c7f7e8c260dea02e0150d7614 and
> https://github.com/OpenPrinting/cups/commit/b5b1418da7bfb9f81384c7c47cc59890b4d3ff5d
>
> hash.c:16:12: fatal error: gnutls/crypto.h: No such file or directory
> 16 | # include <gnutls/crypto.h>
> | ^~~~~~~~~~~~~~~~~
>
> Fixes:
> - http://autobuild.buildroot.org/results/888e9e252821bda1e051400d4aa850cd082e8e76
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Thanks for working on this!
I don't immediately see the relationship between the failure without
gnutls and the patches, which are about "put support for MacOS/Win SSL
libs back".
> diff --git a/package/cups/0005-cups-hash.c-Put-support-for-MacOS-Win-SSL-libs-back.patch b/package/cups/0005-cups-hash.c-Put-support-for-MacOS-Win-SSL-libs-back.patch
> new file mode 100644
> index 0000000000..70e6975caa
> --- /dev/null
> +++ b/package/cups/0005-cups-hash.c-Put-support-for-MacOS-Win-SSL-libs-back.patch
> @@ -0,0 +1,379 @@
> +From c6cd5e9c10edc68caf6936a3d3274f758e9cd03d Mon Sep 17 00:00:00 2001
> +From: Zdenek Dohnal <zdohnal@redhat.com>
> +Date: Tue, 3 Oct 2023 13:59:40 +0200
> +Subject: [PATCH 1/2] cups/hash.c: Put support for MacOS/Win SSL libs back
Patches should be generated with git format-patch -N.
> +From 0dd97fcaeeb16ed836e8542d75e2396fb1d129d9 Mon Sep 17 00:00:00 2001
> +From: Zdenek Dohnal <zdohnal@redhat.com>
> +Date: Tue, 3 Oct 2023 14:39:33 +0200
> +Subject: [PATCH 2/2] cups/hash.c: LibreSSL version does not support several
> + hashes
Huh, there is a second patch in the same patch? Is it related to our
issue? If so, how?
Thanks!
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-01-05 12:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-01-05 12:35 [Buildroot] [PATCH 1/1] package/cups: fix build without gnutls Fabrice Fontaine
2024-01-05 12:46 ` Thomas Petazzoni via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox