Re: Deprecating the crypto/af_alg module?
Collin Funk <[email protected]>
| Newsgroups | gmane.comp.lib.gnulib.bugs |
|---|---|
| Message-ID | <[email protected]> |
Bruno Haible <[email protected]> writes: > Collin Funk wrote: >> A month ago the linux crypto API maintainer pushed a commit deprecating >> af_alg [1]. Any objections to marking the Gnulib module deprecated once >> it gets merged into the main tree? > > No objection. My main trouble with AF_ALG was that it was not consistently > faster than user-space code: it was faster in some cases and slower in some > other cases [1]. Thanks to you, Paul, and Simon for responding. I attached a proposed patch. It deprecates the module, and removes it as a dependency from other modules. It is slightly less disruptive than removing the module, since one can still use: $ gnulib-tool --import crypto/af_alg to get the feature back, though, I am not sure why you would want to. From GitHub code search it seems like some people actually do use --with-linux-crypto, so they will have to modify their invocations eventually [1]. Collin [1] https://github.com/search?q=%22--with-linux-crypto%22&type=code
0001-crypto-af_alg-Deprecate.patch
(text/x-patch, 8.4 KB)
From 16475428de21f3b41264a9f0fbcf683b23df8171 Mon Sep 17 00:00:00 2001 Message-ID: <16475428de21f3b41264a9f0fbcf683b23df8171.1781934850.git.collin.funk1@gmail.com> From: Collin Funk <[email protected]> Date: Fri, 19 Jun 2026 22:38:54 -0700 Subject: [PATCH] crypto/af_alg: Deprecate. * modules/crypto/af_alg (Status, Notice): New sections. (configure.ac): Add a module indicator. * lib/md5-stream.c (md5_stream): Only use the AF_ALG API if the module indicator is defined. * lib/sha1-stream.c (sha1_stream): Likewise. * lib/sha256-stream.c (shaxxx_stream): Likewise. * lib/sha3-stream.c (sha3_xxx_stream): Likewise. * lib/sha512-stream.c (shaxxx_stream): Likewise. * modules/crypto/md5 (Depends-on): Remove crypto/af_alg dependency. * modules/crypto/sha1 (Depends-on): Likewise. * modules/crypto/sha256 (Depends-on): Likewise. * modules/crypto/sha3 (Depends-on): Likewise. * modules/crypto/sha512 (Depends-on): Likewise. * NEWS: Mention the deprecation. --- ChangeLog | 18 ++++++++++++++++++ NEWS | 8 ++++++++ lib/md5-stream.c | 6 +++++- lib/sha1-stream.c | 6 +++++- lib/sha256-stream.c | 6 +++++- lib/sha3-stream.c | 6 +++++- lib/sha512-stream.c | 6 +++++- modules/crypto/af_alg | 7 +++++++ modules/crypto/md5 | 1 - modules/crypto/sha1 | 1 - modules/crypto/sha256 | 1 - modules/crypto/sha3 | 1 - modules/crypto/sha512 | 1 - 13 files changed, 58 insertions(+), 10 deletions(-) diff --git a/ChangeLog b/ChangeLog index 6fd9e8ce38..b41cabd4cc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,21 @@ +2026-06-19 Collin Funk <[email protected]> + + crypto/af_alg: Deprecate. + * modules/crypto/af_alg (Status, Notice): New sections. + (configure.ac): Add a module indicator. + * lib/md5-stream.c (md5_stream): Only use the AF_ALG API if the module + indicator is defined. + * lib/sha1-stream.c (sha1_stream): Likewise. + * lib/sha256-stream.c (shaxxx_stream): Likewise. + * lib/sha3-stream.c (sha3_xxx_stream): Likewise. + * lib/sha512-stream.c (shaxxx_stream): Likewise. + * modules/crypto/md5 (Depends-on): Remove crypto/af_alg dependency. + * modules/crypto/sha1 (Depends-on): Likewise. + * modules/crypto/sha256 (Depends-on): Likewise. + * modules/crypto/sha3 (Depends-on): Likewise. + * modules/crypto/sha512 (Depends-on): Likewise. + * NEWS: Mention the deprecation. + 2026-06-19 Paul Eggert <[email protected]> fstatat: don’t mess with CFLAGS diff --git a/NEWS b/NEWS index 8456732c43..82bd883c65 100644 --- a/NEWS +++ b/NEWS @@ -78,6 +78,14 @@ User visible incompatible changes Date Modules Changes +2026-06-09 crypto/af_alg This module has been deprecated following the + deprecation of the AF_ALG API in Linux 7.2. If your + package requires optimized hash algorithms, place + gl_SET_CRYPTO_CHECK_DEFAULT([auto-gpl-compat]) in + your configure.ac to use OpenSSL when + possible. Alternatively, use 'crypto/gc' which uses + libgcrypt when possible. + 2026-06-08 strerror The return type of the strerror function is now 'const char *' on most platforms. You may need to adjust assignments of the form diff --git a/lib/md5-stream.c b/lib/md5-stream.c index ffe077f52a..a406d17b53 100644 --- a/lib/md5-stream.c +++ b/lib/md5-stream.c @@ -30,7 +30,9 @@ # include "unlocked-io.h" #endif -#include "af_alg.h" +#if GNULIB_AF_ALG +# include "af_alg.h" +#endif #ifdef _LIBC # include <endian.h> @@ -57,11 +59,13 @@ int md5_stream (FILE *stream, void *resblock) { +#if GNULIB_AF_ALG switch (afalg_stream (stream, "md5", resblock, MD5_DIGEST_SIZE)) { case 0: return 0; case -EIO: return 1; } +#endif char *buffer = malloc (BLOCKSIZE); if (!buffer) diff --git a/lib/sha1-stream.c b/lib/sha1-stream.c index c6e2c836e9..3de4a0156a 100644 --- a/lib/sha1-stream.c +++ b/lib/sha1-stream.c @@ -32,7 +32,9 @@ # include "unlocked-io.h" #endif -#include "af_alg.h" +#if GNULIB_AF_ALG +# include "af_alg.h" +#endif #define BLOCKSIZE 32768 #if BLOCKSIZE % 64 != 0 @@ -45,11 +47,13 @@ int sha1_stream (FILE *restrict stream, void *restrict resblock) { +#if GNULIB_AF_ALG switch (afalg_stream (stream, "sha1", resblock, SHA1_DIGEST_SIZE)) { case 0: return 0; case -EIO: return 1; } +#endif char *buffer = malloc (BLOCKSIZE); if (!buffer) diff --git a/lib/sha256-stream.c b/lib/sha256-stream.c index cde823a597..a2c0e20677 100644 --- a/lib/sha256-stream.c +++ b/lib/sha256-stream.c @@ -31,7 +31,9 @@ # include "unlocked-io.h" #endif -#include "af_alg.h" +#if GNULIB_AF_ALG +# include "af_alg.h" +#endif #define BLOCKSIZE 32768 #if BLOCKSIZE % 64 != 0 @@ -49,11 +51,13 @@ shaxxx_stream (FILE *restrict stream, char const *restrict alg, void *(*finish_ctx) (struct sha256_ctx *restrict, void *restrict)) { +#if GNULIB_AF_ALG switch (afalg_stream (stream, alg, resblock, hashlen)) { case 0: return 0; case -EIO: return 1; } +#endif char *buffer = malloc (BLOCKSIZE); if (!buffer) diff --git a/lib/sha3-stream.c b/lib/sha3-stream.c index 7bc3a7d7fe..fcbce936ce 100644 --- a/lib/sha3-stream.c +++ b/lib/sha3-stream.c @@ -27,7 +27,9 @@ # include "unlocked-io.h" #endif -#include "af_alg.h" +#if GNULIB_AF_ALG +# include "af_alg.h" +#endif #define BLOCKSIZE 31824 #if (BLOCKSIZE % 144 != 0 && BLOCKSIZE % 136 != 0 && BLOCKSIZE % 104 != 0 \ @@ -44,11 +46,13 @@ sha3_xxx_stream (FILE *restrict stream, char const *restrict alg, void *restrict resblock, ssize_t hashlen, bool (*init_ctx) (struct sha3_ctx *)) { +#if GNULIB_AF_ALG switch (afalg_stream (stream, alg, resblock, hashlen)) { case 0: return 0; case -EIO: return 1; } +#endif char *buffer = malloc (BLOCKSIZE); if (!buffer) diff --git a/lib/sha512-stream.c b/lib/sha512-stream.c index 8901eb40aa..dfa4a7dcfd 100644 --- a/lib/sha512-stream.c +++ b/lib/sha512-stream.c @@ -31,7 +31,9 @@ # include "unlocked-io.h" #endif -#include "af_alg.h" +#if GNULIB_AF_ALG +# include "af_alg.h" +#endif #define BLOCKSIZE 32768 #if BLOCKSIZE % 128 != 0 @@ -49,11 +51,13 @@ shaxxx_stream (FILE *restrict stream, char const *restrict alg, void *(*finish_ctx) (struct sha512_ctx *restrict, void *restrict)) { +#if GNULIB_AF_ALG switch (afalg_stream (stream, alg, resblock, hashlen)) { case 0: return 0; case -EIO: return 1; } +#endif char *buffer = malloc (BLOCKSIZE); if (!buffer) diff --git a/modules/crypto/af_alg b/modules/crypto/af_alg index 86384c4775..579bae3542 100644 --- a/modules/crypto/af_alg +++ b/modules/crypto/af_alg @@ -1,6 +1,12 @@ Description: Compute message digest using kernel-supported cryptography algorithms. +Status: +deprecated + +Notice: +This module is deprecated because AF_ALG was deprecated in Linux 7.2. + Files: lib/af_alg.h lib/af_alg.c @@ -18,6 +24,7 @@ sys_stat-h configure.ac: gl_AF_ALG +gl_MODULE_INDICATOR([af_alg]) Makefile.am: lib_SOURCES += af_alg.c diff --git a/modules/crypto/md5 b/modules/crypto/md5 index ea9722ed3b..dcc6fb31ea 100644 --- a/modules/crypto/md5 +++ b/modules/crypto/md5 @@ -5,7 +5,6 @@ Files: lib/md5-stream.c Depends-on: -crypto/af_alg crypto/md5-buffer configure.ac: diff --git a/modules/crypto/sha1 b/modules/crypto/sha1 index 96e5c8fe18..0ad4564d59 100644 --- a/modules/crypto/sha1 +++ b/modules/crypto/sha1 @@ -5,7 +5,6 @@ Files: lib/sha1-stream.c Depends-on: -crypto/af_alg crypto/sha1-buffer configure.ac: diff --git a/modules/crypto/sha256 b/modules/crypto/sha256 index 68bc1900e3..8385b49a2c 100644 --- a/modules/crypto/sha256 +++ b/modules/crypto/sha256 @@ -5,7 +5,6 @@ Files: lib/sha256-stream.c Depends-on: -crypto/af_alg crypto/sha256-buffer configure.ac: diff --git a/modules/crypto/sha3 b/modules/crypto/sha3 index 50e2ead34f..a3a4a32aac 100644 --- a/modules/crypto/sha3 +++ b/modules/crypto/sha3 @@ -5,7 +5,6 @@ Files: lib/sha3-stream.c Depends-on: -crypto/af_alg crypto/sha3-buffer free-posix diff --git a/modules/crypto/sha512 b/modules/crypto/sha512 index 37a09e181d..6d51e648ff 100644 --- a/modules/crypto/sha512 +++ b/modules/crypto/sha512 @@ -5,7 +5,6 @@ Files: lib/sha512-stream.c Depends-on: -crypto/af_alg crypto/sha512-buffer configure.ac: -- 2.54.0