[PATCH v7 0/3] Begin replacing OpenSSL with CommonCrypto

This is a re-roll of David Aguilar's patch series which eliminates some
of the OpenSSL deprecation warnings on Mac OS X.

Patch 1 is new. It extracts the CommonCrypto-related Makefile
boilerplate, from his SHA-1-related patch, into a distinct introductory
patch which can then be referenced by subsequent patches.

Patch 2, SHA-1 warning elimination, is effectively unchanged.

Patch 3, HMAC warning elimination, no longer abuses
COMMON_DIGEST_FOR_OPENSSL, which is an implementation detail of
patch 2. Instead, it checks for NO_APPLE_COMMON_CRYPTO introduced in
patch 1.

David Aguilar (3):
  Makefile: add support for Apple CommonCrypto facility
  cache.h: eliminate SHA-1 deprecation warnings on Mac OS X
  imap-send: eliminate HMAC deprecation warnings on Mac OS X

 Makefile    | 15 +++++++++++++++
 imap-send.c | 10 ++++++++++
 2 files changed, 25 insertions(+)

-- 
1.8.2.3

From: David Aguilar <redacted>

As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to
OpenSSL ABI instability, thus leading to build warnings.  As a
replacement, Apple encourages developers to migrate to its own (stable)
CommonCrypto facility.

Introduce boilerplate which controls whether Apple's CommonCrypto
facility is employed (enabled by default).  Also add a
NO_APPLE_COMMON_CRYPTO flag which the user can tweak to override the
default if OpenSSL is instead preferred.

[es: extracted CommonCrypto-related Makefile boilerplate into separate
introductory patch]

Signed-off-by: David Aguilar <redacted>
Signed-off-by: Eric Sunshine <redacted>
---
 Makefile | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Makefile b/Makefile
index f698c1a..2178c2c 100644
--- a/Makefile
+++ b/Makefile

@@ -137,6 +137,10 @@ all::
 # specify your own (or DarwinPort's) include directories and
 # library directories by defining CFLAGS and LDFLAGS appropriately.
 #
+# Define NO_APPLE_COMMON_CRYPTO if you are building on Darwin/Mac OS X
+# and do not want to use Apple's CommonCrypto library.  This allows you
+# to provide your own OpenSSL library, for example from MacPorts.
+#
 # Define BLK_SHA1 environment variable to make use of the bundled
 # optimized C SHA1 routine.
 #

@@ -1054,6 +1058,11 @@ ifeq ($(uname_S),Darwin)
 			BASIC_LDFLAGS += -L/opt/local/lib
 		endif
 	endif
+	ifndef NO_APPLE_COMMON_CRYPTO
+		APPLE_COMMON_CRYPTO = YesPlease
+	else
+		COMPAT_CFLAGS += -DNO_APPLE_COMMON_CRYPTO
+	endif
 	NO_REGEX = YesPlease
 	PTHREAD_LIBS =
 endif

-- 
1.8.2.3

From: David Aguilar <redacted>

As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to
OpenSSL ABI instability, thus leading to build diagnostics such as:

	warning: 'SHA1_Init' is deprecated
	(declared at /usr/include/openssl/sha.h:121)

Silence the warnings by using Apple's CommonCrypto SHA-1 replacement
functions for SHA1_Init(), SHA1_Update(), and SHA1_Final().

COMMON_DIGEST_FOR_OPENSSL is defined to instruct
<CommonCrypto/CommonDigest.h> to provide compatibility macros
associating OpenSSL SHA-1 functions with their CommonCrypto
counterparts.

[es: reworded commit message]

Signed-off-by: David Aguilar <redacted>
Signed-off-by: Eric Sunshine <redacted>
---
 Makefile | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Makefile b/Makefile
index 2178c2c..7a03fe9 100644
--- a/Makefile
+++ b/Makefile

@@ -1398,10 +1398,16 @@ ifdef PPC_SHA1
 	LIB_OBJS += ppc/sha1.o ppc/sha1ppc.o
 	LIB_H += ppc/sha1.h
 else
+ifdef APPLE_COMMON_CRYPTO
+	COMPAT_CFLAGS += -DCOMMON_DIGEST_FOR_OPENSSL
+	SHA1_HEADER = <CommonCrypto/CommonDigest.h>
+else
 	SHA1_HEADER = <openssl/sha.h>
 	EXTLIBS += $(LIB_4_CRYPTO)
 endif
 endif
+endif
+
 ifdef NO_PERL_MAKEMAKER
 	export NO_PERL_MAKEMAKER
 endif

-- 
1.8.2.3

From: David Aguilar <redacted>

As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to
OpenSSL ABI instability.  Silence the warnings by using Apple's
CommonCrypto HMAC replacement functions.

[es: reworded commit message; eliminated abuse of
COMMON_DIGEST_FOR_OPENSSL by checking NO_APPLE_COMMON_CRYPTO instead]

Signed-off-by: David Aguilar <redacted>
Signed-off-by: Eric Sunshine <redacted>
---
 imap-send.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/imap-send.c b/imap-send.c
index d9bcfb4..642448c 100644
--- a/imap-send.c
+++ b/imap-send.c

@@ -29,8 +29,18 @@
 #ifdef NO_OPENSSL
 typedef void *SSL;
 #else
+#ifndef NO_APPLE_COMMON_CRYPTO
+#include <CommonCrypto/CommonHMAC.h>
+#define HMAC_CTX CCHmacContext
+#define HMAC_Init(hmac, key, len, algo) CCHmacInit(hmac, algo, key, len)
+#define HMAC_Update CCHmacUpdate
+#define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash)
+#define HMAC_CTX_cleanup
+#define EVP_md5() kCCHmacAlgMD5
+#else
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
+#endif
 #include <openssl/x509v3.h>
 #endif
 

-- 
1.8.2.3