Skip to content

Commit 9b60e55

Browse files
tirantiran
authored
bpo-40637: Add option to disable builtin hashes (GH-20121)
Signed-off-by: Christian Heimes <christian@python.org> Automerge-Triggered-By: @tiran
1 parent a2b3cdd commit 9b60e55

File tree

6 files changed

+158
-30
lines changed

6 files changed

+158
-30
lines changed

‎Doc/whatsnew/3.9.rst

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,6 +314,15 @@ Added a new function :func:`gc.is_finalized` to check if an object has been
314314
finalized by the garbage collector. (Contributed by Pablo Galindo in
315315
:issue:`39322`.)
316316

317+
hashlib
318+
-------
319+
320+
Builtin hash modules can now be disabled with
321+
``./configure --without-builtin-hashlib-hashes`` or selectively enabled with
322+
e.g. ``./configure --with-builtin-hashlib-hashes=sha3,blake2`` to force use
323+
of OpenSSL based implementation.
324+
(Contributed by Christian Heimes in :issue:`40479`)
325+
317326
http
318327
----
319328

‎Misc/NEWS.d/next/Library/2020-05-15-21-57-10.bpo-40637.lb3Bnp.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Builtin hash modules can now be disabled or selectively enabled with
2+
``configure --with-builtin-hashlib-hashes=sha3,blake1`` or ``--without-builtin-hashlib-hashes``.

‎configure

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -845,6 +845,7 @@ with_computed_gotos
845845
with_ensurepip
846846
with_openssl
847847
with_ssl_default_suites
848+
with_builtin_hashlib_hashes
848849
with_experimental_isolated_subinterpreters
849850
'
850851
ac_precious_vars='build_alias
@@ -1576,6 +1577,9 @@ Optional Packages:
15761577
leave OpenSSL's defaults untouched, STRING: use a
15771578
custom string, PROTOCOL_SSLv2 ignores the setting,
15781579
see Doc/library/ssl.rst
1580+
--with-builtin-hashlib-hashes=md5,sha1,sha256,sha512,sha3,blake2
1581+
builtin hash modules, md5, sha1, sha256, sha512,
1582+
sha3 (with shake), blake2
15791583
--with-experimental-isolated-subinterpreters
15801584
better isolate subinterpreters, experimental build
15811585
mode (default is no)
@@ -17493,6 +17497,44 @@ $as_echo "#define PY_SSL_DEFAULT_CIPHERS 1" >>confdefs.h
1749317497
fi
1749417498

1749517499

17500+
# builtin hash modules
17501+
default_hashlib_hashes="md5,sha1,sha256,sha512,sha3,blake2"
17502+
17503+
$as_echo "#define PY_BUILTIN_HASHLIB_HASHES /**/" >>confdefs.h
17504+
17505+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for --with-builtin-hashlib-hashes" >&5
17506+
$as_echo_n "checking for --with-builtin-hashlib-hashes... " >&6; }
17507+
17508+
# Check whether --with-builtin-hashlib-hashes was given.
17509+
if test "${with_builtin_hashlib_hashes+set}" = set; then :
17510+
withval=$with_builtin_hashlib_hashes;
17511+
case "$withval" in
17512+
yes)
17513+
withval=$default_hashlib_hashes
17514+
;;
17515+
no)
17516+
withval=""
17517+
;;
17518+
esac
17519+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $withval" >&5
17520+
$as_echo "$withval" >&6; }
17521+
cat >>confdefs.h <<_ACEOF
17522+
#define PY_BUILTIN_HASHLIB_HASHES "$withval"
17523+
_ACEOF
17524+
17525+
17526+
else
17527+
17528+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $default_hashlib_hashes" >&5
17529+
$as_echo "$default_hashlib_hashes" >&6; };
17530+
cat >>confdefs.h <<_ACEOF
17531+
#define PY_BUILTIN_HASHLIB_HASHES "$default_hashlib_hashes"
17532+
_ACEOF
17533+
17534+
17535+
fi
17536+
17537+
1749617538
# --with-experimental-isolated-subinterpreters
1749717539

1749817540
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for --with-experimental-isolated-subinterpreters" >&5

‎configure.ac

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5717,6 +5717,32 @@ AC_MSG_RESULT(python)
57175717
AC_DEFINE(PY_SSL_DEFAULT_CIPHERS, 1)
57185718
])
57195719

5720+
# builtin hash modules
5721+
default_hashlib_hashes="md5,sha1,sha256,sha512,sha3,blake2"
5722+
AC_DEFINE([PY_BUILTIN_HASHLIB_HASHES], [], [enabled builtin hash modules]
5723+
)
5724+
AC_MSG_CHECKING(for --with-builtin-hashlib-hashes)
5725+
AC_ARG_WITH(builtin-hashlib-hashes,
5726+
AS_HELP_STRING([--with-builtin-hashlib-hashes=md5,sha1,sha256,sha512,sha3,blake2],
5727+
[builtin hash modules,
5728+
md5, sha1, sha256, sha512, sha3 (with shake), blake2]),
5729+
[
5730+
case "$withval" in
5731+
yes)
5732+
withval=$default_hashlib_hashes
5733+
;;
5734+
no)
5735+
withval=""
5736+
;;
5737+
esac
5738+
AC_MSG_RESULT($withval)
5739+
AC_DEFINE_UNQUOTED(PY_BUILTIN_HASHLIB_HASHES, "$withval")
5740+
],
5741+
[
5742+
AC_MSG_RESULT($default_hashlib_hashes);
5743+
AC_DEFINE_UNQUOTED(PY_BUILTIN_HASHLIB_HASHES, "$default_hashlib_hashes")
5744+
])
5745+
57205746
# --with-experimental-isolated-subinterpreters
57215747
AH_TEMPLATE(EXPERIMENTAL_ISOLATED_SUBINTERPRETERS,
57225748
[Better isolate subinterpreters, experimental build mode.])

‎pyconfig.h.in

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1385,6 +1385,9 @@
13851385
/* Define as the preferred size in bits of long digits */
13861386
#undef PYLONG_BITS_IN_DIGIT
13871387

1388+
/* enabled builtin hash modules */
1389+
#undef PY_BUILTIN_HASHLIB_HASHES
1390+
13881391
/* Define if you want to coerce the C locale to a UTF-8 based locale */
13891392
#undef PY_COERCE_C_LOCALE
13901393

‎setup.py

Lines changed: 76 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -327,6 +327,7 @@ def __init__(self, dist):
327327
self.failed = []
328328
self.failed_on_import = []
329329
self.missing = []
330+
self.disabled_configure = []
330331
if '-j' in os.environ.get('MAKEFLAGS', ''):
331332
self.parallel = True
332333

@@ -483,6 +484,14 @@ def print_three_column(lst):
483484
print_three_column([ext.name for ext in mods_disabled])
484485
print()
485486

487+
if self.disabled_configure:
488+
print()
489+
print("The following modules found by detect_modules() in"
490+
" setup.py have not")
491+
print("been built, they are *disabled* by configure:")
492+
print_three_column(self.disabled_configure)
493+
print()
494+
486495
if self.failed:
487496
failed = self.failed[:]
488497
print()
@@ -2295,36 +2304,73 @@ def split_var(name, sep):
22952304
libraries=openssl_libs))
22962305

22972306
def detect_hash_builtins(self):
2298-
# We always compile these even when OpenSSL is available (issue #14693).
2299-
# It's harmless and the object code is tiny (40-50 KiB per module,
2300-
# only loaded when actually used).
2301-
self.add(Extension('_sha256', ['sha256module.c'],
2302-
extra_compile_args=['-DPy_BUILD_CORE_MODULE'],
2303-
depends=['hashlib.h']))
2304-
self.add(Extension('_sha512', ['sha512module.c'],
2305-
extra_compile_args=['-DPy_BUILD_CORE_MODULE'],
2306-
depends=['hashlib.h']))
2307-
self.add(Extension('_md5', ['md5module.c'],
2308-
depends=['hashlib.h']))
2309-
self.add(Extension('_sha1', ['sha1module.c'],
2310-
depends=['hashlib.h']))
2311-
2312-
blake2_deps = glob(os.path.join(self.srcdir,
2313-
'Modules/_blake2/impl/*'))
2314-
blake2_deps.append('hashlib.h')
2315-
2316-
self.add(Extension('_blake2',
2317-
['_blake2/blake2module.c',
2318-
'_blake2/blake2b_impl.c',
2319-
'_blake2/blake2s_impl.c'],
2320-
depends=blake2_deps))
2321-
2322-
sha3_deps = glob(os.path.join(self.srcdir,
2323-
'Modules/_sha3/kcp/*'))
2324-
sha3_deps.append('hashlib.h')
2325-
self.add(Extension('_sha3',
2326-
['_sha3/sha3module.c'],
2327-
depends=sha3_deps))
2307+
# By default we always compile these even when OpenSSL is available
2308+
# (issue #14693). It's harmless and the object code is tiny
2309+
# (40-50 KiB per module, only loaded when actually used). Modules can
2310+
# be disabled via the --with-builtin-hashlib-hashes configure flag.
2311+
supported = {"md5", "sha1", "sha256", "sha512", "sha3", "blake2"}
2312+
2313+
configured = sysconfig.get_config_var("PY_BUILTIN_HASHLIB_HASHES")
2314+
configured = configured.strip('"').lower()
2315+
configured = {
2316+
m.strip() for m in configured.split(",")
2317+
}
2318+
2319+
self.disabled_configure.extend(
2320+
sorted(supported.difference(configured))
2321+
)
2322+
2323+
if "sha256" in configured:
2324+
self.add(Extension(
2325+
'_sha256', ['sha256module.c'],
2326+
extra_compile_args=['-DPy_BUILD_CORE_MODULE'],
2327+
depends=['hashlib.h']
2328+
))
2329+
2330+
if "sha512" in configured:
2331+
self.add(Extension(
2332+
'_sha512', ['sha512module.c'],
2333+
extra_compile_args=['-DPy_BUILD_CORE_MODULE'],
2334+
depends=['hashlib.h']
2335+
))
2336+
2337+
if "md5" in configured:
2338+
self.add(Extension(
2339+
'_md5', ['md5module.c'],
2340+
depends=['hashlib.h']
2341+
))
2342+
2343+
if "sha1" in configured:
2344+
self.add(Extension(
2345+
'_sha1', ['sha1module.c'],
2346+
depends=['hashlib.h']
2347+
))
2348+
2349+
if "blake2" in configured:
2350+
blake2_deps = glob(
2351+
os.path.join(self.srcdir, 'Modules/_blake2/impl/*')
2352+
)
2353+
blake2_deps.append('hashlib.h')
2354+
self.add(Extension(
2355+
'_blake2',
2356+
[
2357+
'_blake2/blake2module.c',
2358+
'_blake2/blake2b_impl.c',
2359+
'_blake2/blake2s_impl.c'
2360+
],
2361+
depends=blake2_deps
2362+
))
2363+
2364+
if "sha3" in configured:
2365+
sha3_deps = glob(
2366+
os.path.join(self.srcdir, 'Modules/_sha3/kcp/*')
2367+
)
2368+
sha3_deps.append('hashlib.h')
2369+
self.add(Extension(
2370+
'_sha3',
2371+
['_sha3/sha3module.c'],
2372+
depends=sha3_deps
2373+
))
23282374

23292375
def detect_nis(self):
23302376
if MS_WINDOWS or CYGWIN or HOST_PLATFORM == 'qnx6':

0 commit comments

Comments
 (0)