gh-134531: use EVP_MAC API for _hashlib.HMAC
#135235
Conversation
|
!buildbot FIPS |
|
🤖 New build scheduled with the buildbot fleet by @picnixz for commit c444180 🤖 Results will be shown at: https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135235%2Fmerge The command will test the builders whose names match following regular expression: The builders matched are:
|
There was a problem hiding this comment.
Overall, there is also something I wanted to investigate, namely "is it faster to use SN_* names or LN_* names for OpenSSL" and whether it's better to cache the NID (as it's only used in __repr__ or .name) or directly cache a const char *.
I'll need more experiments for this one but this also applies to the existing code where we work with EVP_MD objects instead of caching their properties.
…shlib/evp-mac-134531
…/evp-mac-134531 # Conflicts: # Modules/_hashopenssl.c
…shlib/smart-exceptions-135234
EVP_MAC API for _hashlib.HMAC
|
!buildbot FIPS only |
|
🤖 New build scheduled with the buildbot fleet by @picnixz for commit 2307154 🤖 Results will be shown at: https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135235%2Fmerge The command will test the builders whose names match following regular expression: The builders matched are:
|
| if (digest == NULL) { | ||
| return NULL; | ||
| } | ||
| assert(evp_md_nid != NID_undef); | ||
| EVP_MAC_up_ref(state->evp_hmac); |
There was a problem hiding this comment.
Two thoughts about this call:
- I don't see the corresponding
EVP_MAC_freecall to decrease the reference count in caseEVP_MAC_CTX_newsucceeds, so AFAIUstate->evp_hmacwill leak. - This call is not necessary (nor the
EVP_MAC_freedown below). AEVP_MACobject can be reused by manyEVP_MAC_CTXobjects as it doesn't contain any state, it just carries the "receipt".
Just a draft PR for the CI. I'll split the PR tomorrow. Some parts are part of #135234.
This is based on top of #135250 and #135254 so it's a bit messy.