crypto-ng: use libnettle MD5 algorithm support

Transitional patch detects libnettle when available and uses it without
yet forcing it as a required dependency.

diff --git a/configure.ac b/configure.ac
index 34880eb48b8956416e728c721ad05df60b4dbcac..2ce1b3809b294e5a566c5ab67df20c02d915f237 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1214,6 +1214,30 @@ SQUID_DEFINE_BOOL(USE_HTCP,${enable_htcp:=yes},
 AM_CONDITIONAL(ENABLE_HTCP, [test "x$enable_htcp" = "xyes"])
 AC_MSG_NOTICE([HTCP support enabled: $enable_htcp])
 
+# Cryptograhic libraries
+AC_ARG_WITH(nettle,
+  AS_HELP_STRING([--without-nettle],[Compile without the Nettle crypto library.]),[
+case "$with_nettle" in
+  yes|no)
+    : # Nothing special to do here
+    ;;
+  *)
+    if test ! -d "$withval" ; then
+      AC_MSG_ERROR([--with-nettle path does not point to a directory])
+    fi
+    NETTLELIBDIR="-L$with_nettle/lib"
+    CPPFLAGS="-I$with_nettle/include $CPPFLAGS"
+    with_nettle=yes
+  esac
+])
+if test "x$with_nettle" != "xno" ; then
+  AC_CHECK_LIB(nettle, nettle_md5_init,[
+    NETTLELIB="$NETTLELIBDIR -lnettle"
+    AC_CHECK_HEADERS(nettle/md5.h)
+  ],[with_nettle=no])
+fi
+AC_MSG_NOTICE([Using Nettle cryptographic library: ${with_nettle:=yes}])
+AC_SUBST(NETTLELIB)
 
 # SSL is not enabled by default.
 # Default is to use OpenSSL when available
@@ -1263,11 +1287,9 @@ case "$with_openssl" in
 ])
 SQUID_DEFINE_BOOL(USE_SSL,$enable_ssl,
    [Define this to include code for SSL gatewaying support])
-AC_MSG_NOTICE([Using OpenSSL MD5 implementation: ${with_openssl:=no}])
-SQUID_DEFINE_BOOL(USE_OPENSSL,${with_openssl},
-   [Define this to make use of the OpenSSL libraries for MD5 calculation rather than Squid-supplied MD5 implementation or if building with SSL encryption])
+AC_MSG_NOTICE([Using OpenSSL library: ${with_openssl:=no}])
 if test "x$enable_ssl" = "xyes"; then
-  if test "x$SSLLIB" = "x"; then
+  if test "x$SSLLIB" = "x" -a "x$with_nettle" = "xno"; then
     SSLLIB="-lcrypto" # for MD5 routines
   fi
   # This is a workaround for RedHat 9 brain damage..

diff --git a/helpers/basic_auth/NCSA/Makefile.am b/helpers/basic_auth/NCSA/Makefile.am
index 9586946fd15eb49bf3fff2433c1bbf1b2c78a071..8e00bcae667ae0779799e6cefa0901e53f1051f8 100644 (file)
--- a/helpers/basic_auth/NCSA/Makefile.am
+++ b/helpers/basic_auth/NCSA/Makefile.am
@@ -8,6 +8,7 @@ LDADD = \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(CRYPTLIB) \
        $(SSLLIB) \
        $(XTRA_LIBS)

diff --git a/helpers/basic_auth/RADIUS/Makefile.am b/helpers/basic_auth/RADIUS/Makefile.am
index 1133cafd3194bb0fd4a359305b8e8627a5825d02..db47241e922c2396d983df8738ca9a972601128a 100644 (file)
--- a/helpers/basic_auth/RADIUS/Makefile.am
+++ b/helpers/basic_auth/RADIUS/Makefile.am
@@ -15,5 +15,6 @@ basic_radius_auth_SOURCES = \
 basic_radius_auth_LDADD = \
        $(top_builddir)/lib/libmiscencoding.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(SSLLIB) \
        $(XTRA_LIBS)

diff --git a/helpers/digest_auth/LDAP/Makefile.am b/helpers/digest_auth/LDAP/Makefile.am
index fe746c5b1f361f5152c5b6d002f9037add2a6f78..0288bdfdf8384ac6adeecf9adb863a71adeec548 100644 (file)
--- a/helpers/digest_auth/LDAP/Makefile.am
+++ b/helpers/digest_auth/LDAP/Makefile.am
@@ -14,6 +14,7 @@ digest_ldap_auth_LDADD = \
        $(COMPAT_LIB) \
        $(LDAPLIB) \
        $(LBERLIB) \
+       $(NETTLELIB) \
        $(CRYPTLIB) \
        $(SSLLIB) \
        $(XTRA_LIBS)

diff --git a/helpers/digest_auth/file/Makefile.am b/helpers/digest_auth/file/Makefile.am
index dd12852063de8099e4eca158c95dfb1e76042483..dd379cd5a625d46f73d1b5ccff710280260d9b12 100644 (file)
--- a/helpers/digest_auth/file/Makefile.am
+++ b/helpers/digest_auth/file/Makefile.am
@@ -14,6 +14,7 @@ LDADD = \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(CRYPTLIB) \
        $(SSLLIB) \
        $(XTRA_LIBS)

diff --git a/helpers/negotiate_auth/kerberos/Makefile.am b/helpers/negotiate_auth/kerberos/Makefile.am
index 633803840e4fd97d85d019d73548a50e7719116e..bf7a1f99998957abc029ba06e0f8ec576ae6708c 100644 (file)
--- a/helpers/negotiate_auth/kerberos/Makefile.am
+++ b/helpers/negotiate_auth/kerberos/Makefile.am
@@ -12,6 +12,7 @@ negotiate_kerberos_auth_LDFLAGS =
 negotiate_kerberos_auth_LDADD = \
        $(top_builddir)/lib/libmiscencoding.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(KRB5LIBS) \
        $(XTRA_LIBS)
 
@@ -20,6 +21,7 @@ negotiate_kerberos_auth_test_LDFLAGS =
 negotiate_kerberos_auth_test_LDADD = \
        $(top_builddir)/lib/libmiscencoding.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(KRB5LIBS) \
        $(XTRA_LIBS)
 

diff --git a/helpers/negotiate_auth/wrapper/Makefile.am b/helpers/negotiate_auth/wrapper/Makefile.am
index 870edbe455be257e271b0a9bf26ab2d4dafd1924..cd6666d6fa877e20575ac86199391d13b3edf247 100644 (file)
--- a/helpers/negotiate_auth/wrapper/Makefile.am
+++ b/helpers/negotiate_auth/wrapper/Makefile.am
@@ -8,4 +8,5 @@ negotiate_wrapper_auth_SOURCES = negotiate_wrapper.cc
 negotiate_wrapper_auth_LDADD = \
        $(top_builddir)/lib/libmiscencoding.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(XTRA_LIBS)

diff --git a/helpers/ntlm_auth/fake/Makefile.am b/helpers/ntlm_auth/fake/Makefile.am
index 804e633753703b4e9cab65b87e1b478df711559b..faaa636f39e43a85b82314e4eb1684a33d24c7c6 100644 (file)
--- a/helpers/ntlm_auth/fake/Makefile.am
+++ b/helpers/ntlm_auth/fake/Makefile.am
@@ -7,6 +7,7 @@ ntlm_fake_auth_LDADD = \
        $(top_builddir)/lib/ntlmauth/libntlmauth.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(CRYPTLIB) \
        $(XTRA_LIBS)
 

diff --git a/helpers/ntlm_auth/smb_lm/Makefile.am b/helpers/ntlm_auth/smb_lm/Makefile.am
index dd0b5fccf08ac286b774e13062931d0ca1dea680..5560c49a5fd919180c0bb441f5e95c31ea491e16 100644 (file)
--- a/helpers/ntlm_auth/smb_lm/Makefile.am
+++ b/helpers/ntlm_auth/smb_lm/Makefile.am
@@ -9,6 +9,7 @@ ntlm_smb_lm_auth_LDADD = \
        $(top_builddir)/lib/ntlmauth/libntlmauth.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(CRYPTLIB) \
        $(XTRA_LIBS)
 

diff --git a/include/md5.h b/include/md5.h
index cedcbf1b4318b91890931c42496503bd93c03bab..4bc5e691973e71c64b195059394f339f1c4670f7 100644 (file)
--- a/include/md5.h
+++ b/include/md5.h
@@ -1,6 +1,18 @@
 #ifndef SQUID_MD5_H
 #define SQUID_MD5_H
 
+#if HAVE_NETTLE_MD5_H
+#include <nettle/md5.h>
+
+typedef struct md5_ctx SquidMD5_CTX;
+
+#define SquidMD5Init(c)       md5_init((c))
+#define SquidMD5Update(c,b,l) md5_update((c), (l), (const uint8_t *)(b))
+#define SquidMD5Final(d,c)    md5_digest((c), MD5_DIGEST_SIZE, (uint8_t *)(d))
+
+#define SQUID_MD5_DIGEST_LENGTH MD5_DIGEST_SIZE
+
+#else
 /*
  * This is the header file for the MD5 message-digest algorithm.
  * The algorithm is due to Ron Rivest.  This code was
@@ -45,4 +57,6 @@ SQUIDCEXTERN void SquidMD5Transform(uint32_t buf[4], uint32_t const in[16]);
 
 #define SQUID_MD5_DIGEST_LENGTH         16
 
+#endif /* HAVE_NETTLE_MD5_H */
+
 #endif /* SQUID_MD5_H */

diff --git a/lib/md5.c b/lib/md5.c
index 2985473d81623ed26f7e1a83f995e725ed19f1a3..c89e042571e0713c96ba6f4311694f52cfe37e3e 100644 (file)
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -32,6 +32,8 @@
 #include "squid.h"
 #include "md5.h"
 
+#if !HAVE_NETTLE_MD5_H
+
 #if HAVE_STRING_H
 #include <string.h>            /* for memcpy() */
 #endif
@@ -252,3 +254,4 @@ SquidMD5Transform(uint32_t buf[4], uint32_t const in[16])
 }
 
 #endif /* !ASM_MD5 */
+#endif /* HAVE_ETTLE_MD5_H */

diff --git a/src/Makefile.am b/src/Makefile.am
index c0568c1ead3e3bdedeb7266b439a5a621d8a7f78..8ceb54937ab555c06a72ad3f30d14dffe72078f6 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -639,6 +639,7 @@ squid_LDADD = \
        $(DISK_LINKOBJS) \
        $(REPL_OBJS) \
        $(DISK_OS_LIBS) \
+       $(NETTLELIB) \
        $(CRYPTLIB) \
        $(REGEXLIB) \
        $(ADAPTATION_LIBS) \
@@ -760,6 +761,7 @@ ufsdump_LDADD = \
        mgr/libmgr.la \
        $(XTRA_OBJS) \
        $(REPL_OBJS) \
+       $(NETTLELIB) \
        $(CRYPTLIB) \
        $(REGEXLIB) \
        $(SSLLIB) \
@@ -1209,6 +1211,7 @@ tests_testHttpReply_LDADD=\
        $(top_builddir)/lib/libmiscutil.la \
        $(SQUID_CPPUNIT_LIBS) \
        $(SQUID_CPPUNIT_LA) \
+       $(NETTLELIB) \
        $(SSLLIB) \
        $(COMPAT_LIB) \
        $(XTRA_LIBS)
@@ -1348,6 +1351,7 @@ tests_testACLMaxUserIP_LDADD= \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
        $(DISK_OS_LIBS) \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SSLLIB) \
@@ -1610,6 +1614,7 @@ tests_testCacheManager_LDADD = \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SQUID_CPPUNIT_LA) \
@@ -1791,6 +1796,7 @@ tests_testDiskIO_LDADD = \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SSLLIB) \
@@ -2038,6 +2044,7 @@ tests_testEvent_LDADD = \
        ipc/libipc.la \
        mgr/libmgr.la \
        $(SNMP_LIBS) \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SQUID_CPPUNIT_LA) \
@@ -2285,6 +2292,7 @@ tests_testEventLoop_LDADD = \
        ipc/libipc.la \
        mgr/libmgr.la \
        $(SNMP_LIBS) \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SQUID_CPPUNIT_LA) \
@@ -2525,6 +2533,7 @@ tests_test_http_range_LDADD = \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SQUID_CPPUNIT_LA) \
@@ -2813,6 +2822,7 @@ tests_testHttpRequest_LDADD = \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
        $(DISK_OS_LIBS) \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SQUID_CPPUNIT_LA) \
@@ -2987,6 +2997,7 @@ tests_testStore_LDADD= \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SSLLIB) \
@@ -3225,6 +3236,7 @@ tests_testUfs_LDADD = \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SSLLIB) \
@@ -3403,6 +3415,7 @@ tests_testRock_LDADD = \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
+       $(NETTLELIB) \
        $(REGEXLIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SSLLIB) \
@@ -3648,6 +3661,7 @@ tests_testURL_LDADD = \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
+       $(NETTLELIB) \
        $(COMPAT_LIB) \
        $(SQUID_CPPUNIT_LIBS) \
        $(SQUID_CPPUNIT_LA) \

diff --git a/src/wccp2.cc b/src/wccp2.cc
index c2f9e964194b90f3d4865f90166bd330124b7d24..42854ce8e7d303b1ca92511e40e55fdc120955c4 100644 (file)
--- a/src/wccp2.cc
+++ b/src/wccp2.cc
@@ -67,7 +67,7 @@ static EVH wccp2AssignBuckets;
 #define WCCP2_MASK_ASSIGNMENT          0x01
 
 #define        WCCP2_NONE_SECURITY_LEN 0
-#define        WCCP2_MD5_SECURITY_LEN  16
+#define        WCCP2_MD5_SECURITY_LEN  SQUID_MD5_DIGEST_LENGTH // 16
 
 /* Useful defines */
 #define        WCCP2_NUMPORTS  8
@@ -573,7 +573,7 @@ wccp2_get_service_by_id(int service, int service_id) {
 static char
 wccp2_update_md5_security(char *password, char *ptr, char *packet, int len)
 {
-    uint8_t md5_digest[16];
+    uint8_t md5Digest[SQUID_MD5_DIGEST_LENGTH];
     char pwd[WCCP2_PASSWORD_LEN];
     SquidMD5_CTX M;
 
@@ -601,7 +601,7 @@ wccp2_update_md5_security(char *password, char *ptr, char *packet, int len)
      * including the WCCP message header. The WCCP security implementation
      * area should be zero'ed before calculating the MD5 hash.
      */
-    /* XXX eventually we should be able to kill md5_digest and blit it directly in */
+    /* XXX eventually we should be able to kill md5Digest and blit it directly in */
     memset(ws->security_implementation, 0, sizeof(ws->security_implementation));
 
     SquidMD5Init(&M);
@@ -610,9 +610,9 @@ wccp2_update_md5_security(char *password, char *ptr, char *packet, int len)
 
     SquidMD5Update(&M, packet, len);
 
-    SquidMD5Final(md5_digest, &M);
+    SquidMD5Final(md5Digest, &M);
 
-    memcpy(ws->security_implementation, md5_digest, sizeof(md5_digest));
+    memcpy(ws->security_implementation, md5Digest, sizeof(md5Digest));
 
     /* Finished! */
     return 1;
@@ -627,7 +627,7 @@ wccp2_check_security(struct wccp2_service_list_t *srv, char *security, char *pac
 {
 
     struct wccp2_security_md5_t *ws = (struct wccp2_security_md5_t *) security;
-    uint8_t md5_digest[16], md5_challenge[16];
+    uint8_t md5Digest[SQUID_MD5_DIGEST_LENGTH], md5_challenge[SQUID_MD5_DIGEST_LENGTH];
     char pwd[WCCP2_PASSWORD_LEN];
     SquidMD5_CTX M;
 
@@ -655,7 +655,7 @@ wccp2_check_security(struct wccp2_service_list_t *srv, char *security, char *pac
     pwd[sizeof(pwd) - 1] = '\0';
 
     /* Take a copy of the challenge: we need to NUL it before comparing */
-    memcpy(md5_challenge, ws->security_implementation, 16);
+    memcpy(md5_challenge, ws->security_implementation, sizeof(md5_challenge));
 
     memset(ws->security_implementation, 0, sizeof(ws->security_implementation));
 
@@ -665,9 +665,9 @@ wccp2_check_security(struct wccp2_service_list_t *srv, char *security, char *pac
 
     SquidMD5Update(&M, packet, len);
 
-    SquidMD5Final(md5_digest, &M);
+    SquidMD5Final(md5Digest, &M);
 
-    return (memcmp(md5_digest, md5_challenge, 16) == 0);
+    return (memcmp(md5Digest, md5_challenge, SQUID_MD5_DIGEST_LENGTH) == 0);
 }
 
 void

diff --git a/tools/Makefile.am b/tools/Makefile.am
index 8bdd011065352641891e1b75bff7bbc5cc786909..18da3352135a55030d0978e2364439927a977660 100644 (file)
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -21,6 +21,7 @@ LDADD = \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(KRB5LIBS) \
        $(XTRA_LIBS)
 

diff --git a/tools/squidclient/Makefile.am b/tools/squidclient/Makefile.am
index 2bcfa8ab20ef615453a02d195511fbd9ba7b1847..150613288d62d0c6ba7d67e5b950602d7665fb2d 100644 (file)
--- a/tools/squidclient/Makefile.am
+++ b/tools/squidclient/Makefile.am
@@ -12,6 +12,7 @@ LDADD = \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
        $(COMPAT_LIB) \
+       $(NETTLELIB) \
        $(KRB5LIBS) \
        $(XTRA_LIBS)