python · picnixz · Jun 10, 2025 · Jun 10, 2025 · Jul 14, 2025 · Jul 14, 2025
@@ -227,6 +227,7 @@ ENSUREPIP=      @ENSUREPIP@
 # Internal static libraries
 LIBMPDEC_A= Modules/_decimal/libmpdec/libmpdec.a
 LIBEXPAT_A= Modules/expat/libexpat.a
+LIBHASHLIB_INTERNAL_A=Modules/_hashlib/libhashlib.a
 
 # HACL* build configuration
 LIBHACL_CFLAGS=@LIBHACL_CFLAGS@
@@ -761,6 +762,18 @@ LIBHACL_HMAC_HEADERS= \
 		$(LIBHACL_BLAKE2_HEADERS) \
 		$(LIBHACL_HEADERS)
 
+##########################################################################
+# Internal library for cryptographic primitives
+
+LIBHASHLIB_INTERNAL_OBJS= \
+		Modules/_hashlib/hashlib_buffer.o \
+		Modules/_hashlib/hashlib_fetch.o
+
+LIBHASHLIB_INTERNAL_HEADERS= \
+		Modules/_hashlib/hashlib_buffer.h \
+		Modules/_hashlib/hashlib_fetch.h \
+		Modules/_hashlib/hashlib_mutex.h
+
 #########################################################################
 # Rules
 
@@ -1481,6 +1494,20 @@ $(LIBEXPAT_A): $(LIBEXPAT_OBJS)
 	-rm -f $@
 	$(AR) $(ARFLAGS) $@ $(LIBEXPAT_OBJS)
 
+##########################################################################
+# '_hashlib', '_hmac' and HACL*-based modules helpers
+LIBHASHLIB_INTERNAL_CFLAGS=@LIBHASHLIB_INTERNAL_CFLAGS@ $(PY_STDMODULE_CFLAGS) $(CCSHARED)
+
+Modules/_hashlib/hashlib_buffer.o: Modules/_hashlib/hashlib_buffer.c $(LIBHASHLIB_INTERNAL_HEADERS) $(PYTHON_HEADERS)
+	$(CC) -I$(srcdir)/Modules/_hashlib -c $(LIBHASHLIB_INTERNAL_CFLAGS) -o $@ $(srcdir)/Modules/_hashlib/hashlib_buffer.c
+
+Modules/_hashlib/hashlib_fetch.o: Modules/_hashlib/hashlib_fetch.c $(LIBHASHLIB_INTERNAL_HEADERS) $(PYTHON_HEADERS)
+	$(CC) -I$(srcdir)/Modules/_hashlib -c $(LIBHASHLIB_INTERNAL_CFLAGS) -o $@ $(srcdir)/Modules/_hashlib/hashlib_fetch.c
+
+$(LIBHASHLIB_INTERNAL_A): $(LIBHASHLIB_INTERNAL_OBJS)
+	-rm -f $@
+	$(AR) $(ARFLAGS) $@ $(LIBHASHLIB_INTERNAL_OBJS)
+
 ##########################################################################
 # HACL* library build
 #
@@ -3323,21 +3350,21 @@ MODULE__CTYPES_TEST_DEPS=$(srcdir)/Modules/_ctypes/_ctypes_test_generated.c.h
 MODULE__CTYPES_MALLOC_CLOSURE=@MODULE__CTYPES_MALLOC_CLOSURE@
 MODULE__DECIMAL_DEPS=$(srcdir)/Modules/_decimal/docstrings.h @LIBMPDEC_INTERNAL@
 MODULE__ELEMENTTREE_DEPS=$(srcdir)/Modules/pyexpat.c @LIBEXPAT_INTERNAL@
-MODULE__HASHLIB_DEPS=$(srcdir)/Modules/hashlib.h
+MODULE__HASHLIB_DEPS=@LIBHASHLIB_INTERNAL@
 MODULE__IO_DEPS=$(srcdir)/Modules/_io/_iomodule.h
 
 # HACL*-based cryptographic primitives
-MODULE__MD5_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_MD5_HEADERS) $(LIBHACL_MD5_LIB_@LIBHACL_LDEPS_LIBTYPE@)
+MODULE__MD5_DEPS=$(MODULE__HASHLIB_DEPS) $(LIBHACL_MD5_HEADERS) $(LIBHACL_MD5_LIB_@LIBHACL_LDEPS_LIBTYPE@)
 MODULE__MD5_LDEPS=$(LIBHACL_MD5_LIB_@LIBHACL_LDEPS_LIBTYPE@)
-MODULE__SHA1_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_SHA1_HEADERS) $(LIBHACL_SHA1_LIB_@LIBHACL_LDEPS_LIBTYPE@)
+MODULE__SHA1_DEPS=$(MODULE__HASHLIB_DEPS) $(LIBHACL_SHA1_HEADERS) $(LIBHACL_SHA1_LIB_@LIBHACL_LDEPS_LIBTYPE@)
 MODULE__SHA1_LDEPS=$(LIBHACL_SHA1_LIB_@LIBHACL_LDEPS_LIBTYPE@)
-MODULE__SHA2_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_SHA2_HEADERS) $(LIBHACL_SHA2_LIB_@LIBHACL_LDEPS_LIBTYPE@)
+MODULE__SHA2_DEPS=$(MODULE__HASHLIB_DEPS) $(LIBHACL_SHA2_HEADERS) $(LIBHACL_SHA2_LIB_@LIBHACL_LDEPS_LIBTYPE@)
 MODULE__SHA2_LDEPS=$(LIBHACL_SHA2_LIB_@LIBHACL_LDEPS_LIBTYPE@)
-MODULE__SHA3_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_SHA3_HEADERS) $(LIBHACL_SHA3_LIB_@LIBHACL_LDEPS_LIBTYPE@)
+MODULE__SHA3_DEPS=$(MODULE__HASHLIB_DEPS) $(LIBHACL_SHA3_HEADERS) $(LIBHACL_SHA3_LIB_@LIBHACL_LDEPS_LIBTYPE@)
 MODULE__SHA3_LDEPS=$(LIBHACL_SHA3_LIB_@LIBHACL_LDEPS_LIBTYPE@)
-MODULE__BLAKE2_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_BLAKE2_HEADERS) $(LIBHACL_BLAKE2_LIB_@LIBHACL_LDEPS_LIBTYPE@)
+MODULE__BLAKE2_DEPS=$(MODULE__HASHLIB_DEPS) $(LIBHACL_BLAKE2_HEADERS) $(LIBHACL_BLAKE2_LIB_@LIBHACL_LDEPS_LIBTYPE@)
 MODULE__BLAKE2_LDEPS=$(LIBHACL_BLAKE2_LIB_@LIBHACL_LDEPS_LIBTYPE@)
-MODULE__HMAC_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_HMAC_HEADERS) $(LIBHACL_HMAC_LIB_@LIBHACL_LDEPS_LIBTYPE@)
+MODULE__HMAC_DEPS=$(MODULE__HASHLIB_DEPS) $(LIBHACL_HMAC_HEADERS) $(LIBHACL_HMAC_LIB_@LIBHACL_LDEPS_LIBTYPE@)
 MODULE__HMAC_LDEPS=$(LIBHACL_HMAC_LIB_@LIBHACL_LDEPS_LIBTYPE@)
 
 MODULE__SOCKET_DEPS=$(srcdir)/Modules/socketmodule.h $(srcdir)/Modules/addrinfo.h $(srcdir)/Modules/getaddrinfo.c $(srcdir)/Modules/getnameinfo.c

@@ -0,0 +1,40 @@
+#include "hashlib_buffer.h"
+
+int
+_Py_hashlib_data_argument(PyObject **res, PyObject *data, PyObject *string)
+{
+    if (data != NULL && string == NULL) {
+        // called as H(data) or H(data=...)
+        *res = data;
+        return 1;
+    }
+    else if (data == NULL && string != NULL) {
+        // called as H(string=...)
+        if (PyErr_WarnEx(PyExc_DeprecationWarning,
+                         "the 'string' keyword parameter is deprecated since "
+                         "Python 3.15 and slated for removal in Python 3.19; "
+                         "use the 'data' keyword parameter or pass the data "
+                         "to hash as a positional argument instead", 1) < 0)
+        {
+            *res = NULL;
+            return -1;
+        }
+        *res = string;
+        return 1;
+    }
+    else if (data == NULL && string == NULL) {
+        // fast path when no data is given
+        assert(!PyErr_Occurred());
+        *res = NULL;
+        return 0;
+    }
+    else {
+        // called as H(data=..., string)
+        *res = NULL;
+        PyErr_SetString(PyExc_TypeError,
+                        "'data' and 'string' are mutually exclusive "
+                        "and support for 'string' keyword parameter "
+                        "is slated for removal in a future version.");
+        return -1;
+    }
+}
@@ -0,0 +1,60 @@
+#ifndef _HASHLIB_HASHLIB_BUFFER_H
+#define _HASHLIB_HASHLIB_BUFFER_H
+
+#include "Python.h"
+
+/*
+ * Given an buffer-like OBJ, fill in the buffer VIEW with the result
+ * of PyObject_GetBuffer.
+ *
+ * On error, set an exception and execute the ERRACTION statements,
+ * e.g. 'return NULL' or 'goto error'.
+ *
+ * Parameters
+ *
+ *      OBJ         An object supporting the buffer API.
+ *      VIEW        A Py_buffer pointer to fill.
+ *      ERRACTION   The statements to execute on error.
+ */
+#define GET_BUFFER_VIEW_OR_ERROR(OBJ, VIEW, ERRACTION)                      \
+    do {                                                                    \
+        if (PyUnicode_Check((OBJ))) {                                       \
+            PyErr_SetString(PyExc_TypeError,                                \
+                            "strings must be encoded before hashing");      \
+            ERRACTION;                                                      \
+        }                                                                   \
+        if (!PyObject_CheckBuffer((OBJ))) {                                 \
+            PyErr_SetString(PyExc_TypeError,                                \
+                            "object supporting the buffer API required");   \
+            ERRACTION;                                                      \
+        }                                                                   \
+        if (PyObject_GetBuffer((OBJ), (VIEW), PyBUF_SIMPLE) == -1) {        \
+            ERRACTION;                                                      \
+        }                                                                   \
+        if ((VIEW)->ndim > 1) {                                             \
+            PyErr_SetString(PyExc_BufferError,                              \
+                            "buffer must be one-dimensional");              \
+            PyBuffer_Release((VIEW));                                       \
+            ERRACTION;                                                      \
+        }                                                                   \
+    } while(0)
+
+/* Specialization of GET_BUFFER_VIEW_OR_ERROR() returning NULL on error. */
+#define GET_BUFFER_VIEW_OR_ERROUT(OBJ, VIEW) \
+    GET_BUFFER_VIEW_OR_ERROR(OBJ, VIEW, return NULL)
+
+/*
+ * Allow to use the 'data' or 'string' keyword in hashlib.new()
+ * and other hash functions named constructors.
+ *
+ * - If 'data' and 'string' are both non-NULL, set an exception and return -1.
+ * - If 'data' and 'string' are both NULL, set '*res' to NULL and return 0.
+ * - Otherwise, set '*res' to 'data' or 'string' and return 1. A deprecation
+ *   warning is set when 'string' is specified.
+ *
+ * The symbol is exported for '_hashlib' and HACL*-based extension modules.
+ */
+PyAPI_FUNC(int)
+_Py_hashlib_data_argument(PyObject **res, PyObject *data, PyObject *string);
+
+#endif // !_HASHLIB_HASHLIB_BUFFER_H
@@ -0,0 +1 @@
+#include "hashlib_fetch.h"
@@ -0,0 +1,140 @@
+/*
+ * Interface for fetching a message digest from a digest-like identifier.
+ *
+ * The following table summaries the possible algorthms:
+ *
+ * +----------+--------------+--------------+---------------------------------+
+ * | Family   | Algorithm    | Python Name  | Notes                           |
+ * +==========+==============+==============+=================================+
+ * | MD                                     @                                 |
+ * |          +--------------+--------------+---------------------------------+
+ * |          | MD5          | "md5"        |                                 |
+ * +----------+--------------+--------------+---------------------------------+
+ * | SHA1                                   @                                 |
+ * |          +--------------+--------------+---------------------------------+
+ * |          | SHA1-160     | "sha1"       |                                 |
+ * +----------+--------------+--------------+---------------------------------+
+ * | SHA2                                   @                                 |
+ * |          +--------------+--------------+---------------------------------+
+ * |          | SHA2-224     | "sha224"     |                                 |
+ * |          | SHA2-256     | "sha256"     |                                 |
+ * |          | SHA2-384     | "sha384"     |                                 |
+ * |          | SHA2-512     | "sha512"     |                                 |
+ * +----------+--------------+--------------+---------------------------------+
+ * | SHA2t                                  @ Truncated SHA2-512              |
+ * |          +--------------+--------------+---------------------------------+
+ * |          | SHA2-512/224 | "sha512_224" |                                 |
+ * |          | SHA2-512/256 | "sha512_256" |                                 |
+ * +----------+--------------+--------------+---------------------------------+
+ * | SHA3                                   @                                 |
+ * |          +--------------+--------------+---------------------------------+
+ * |          | SHA3-224     | "sha3_224"   |                                 |
+ * |          | SHA3-256     | "sha3_256"   |                                 |
+ * |          | SHA3-384     | "sha3_384"   |                                 |
+ * |          | SHA3-512     | "sha3_512"   |                                 |
+ * +----------+--------------+--------------+---------------------------------+
+ * | SHA3-XOF                               @ Extensible Output Functions     |
+ * |          +--------------+--------------+---------------------------------+
+ * |          | SHAKE-128    | "shake_128"  |                                 |
+ * |          | SHAKE-256    | "shake_256"  |                                 |
+ * +----------+--------------+--------------+---------------------------------+
+ * | BLAKE2                                 @                                 |
+ * |          +--------------+--------------+---------------------------------+
+ * |          | BLAKE2b      | "blake2b"    |                                 |
+ * |          | BLAKE2s      | "blake2s"    |                                 |
+ * +----------+--------------+--------------+---------------------------------+
+ */
+
+#ifndef _HASHLIB_HASHLIB_FETCH_H
+#define _HASHLIB_HASHLIB_FETCH_H
+
+#include "Python.h"
+
+/*
+ * Internal error messages used for reporting an unsupported hash algorithm.
+ * The algorithm can be given by its name, a callable or a PEP-247 module.
+ * The same message is raised by Lib/hashlib.py::__get_builtin_constructor()
+ * and _hmacmodule.c::find_hash_info().
+ */
+#define _Py_HASHLIB_UNSUPPORTED_ALGORITHM       "unsupported hash algorithm %S"
+#define _Py_HASHLIB_UNSUPPORTED_STR_ALGORITHM   "unsupported hash algorithm %s"
+
+#define _Py_HASHLIB_MD_NAMESPACE(NAME)  _Py_hashlib_message_digest_ ## NAME
+#define _Py_HASHLIB_MD_FAMILY(ID)       _Py_HASHLIB_MD_NAMESPACE(family_ ## ID)
+#define _Py_HASHLIB_MD_MEMBER(ID)       _Py_HASHLIB_MD_NAMESPACE(member_ ## ID)
+
+#define _Py_HASHLIB_MD_NAMES            _Py_HASHLIB_MD_NAMESPACE(NAMES)
+#define _Py_HASHLIB_MD_COUNT            Py_ARRAY_LENGTH(_Py_HASHLIB_MD_NAMES)
+#define _Py_HASHLIB_MD_NAME(MEMBER_ID)                                      \
+    (                                                                       \
+        assert(_Py_HASHLIB_MD_MEMBER(MEMBER_ID) >= 0),                      \
+        assert(_Py_HASHLIB_MD_MEMBER(MEMBER_ID) < _Py_HASHLIB_MD_COUNT),    \
+        _Py_HASHLIB_MD_NAMES[_Py_HASHLIB_MD_MEMBER(MEMBER_ID)]              \
+    )
+
+typedef enum {
+    _Py_HASHLIB_MD_FAMILY(MD) = 0,
+    _Py_HASHLIB_MD_FAMILY(SHA1),
+    _Py_HASHLIB_MD_FAMILY(SHA2),
+    _Py_HASHLIB_MD_FAMILY(SHA2t),
+    _Py_HASHLIB_MD_FAMILY(SHA3),
+    _Py_HASHLIB_MD_FAMILY(SHA3_XOF),
+    _Py_HASHLIB_MD_FAMILY(BLAKE2),
+} _Py_HASHLIB_MD_NAMESPACE(family);
+
+typedef enum {
+    /* MD-family */
+    _Py_HASHLIB_MD_MEMBER(md5) = 0,
+    /* SHA-1 family */
+    _Py_HASHLIB_MD_MEMBER(sha1),
+    /* SHA-2 family */
+    _Py_HASHLIB_MD_MEMBER(sha224),
+    _Py_HASHLIB_MD_MEMBER(sha256),
+    _Py_HASHLIB_MD_MEMBER(sha384),
+    _Py_HASHLIB_MD_MEMBER(sha512),
+    /* Truncated SHA-2 family */
+    _Py_HASHLIB_MD_MEMBER(sha512_224),
+    _Py_HASHLIB_MD_MEMBER(sha512_256),
+    /* SHA-3 family */
+    _Py_HASHLIB_MD_MEMBER(sha3_224),
+    _Py_HASHLIB_MD_MEMBER(sha3_256),
+    _Py_HASHLIB_MD_MEMBER(sha3_384),
+    _Py_HASHLIB_MD_MEMBER(sha3_512),
+    /* SHA-3 XOF SHAKE family */
+    _Py_HASHLIB_MD_MEMBER(shake_128),
+    _Py_HASHLIB_MD_MEMBER(shake_256),
+    /* BLAKE-2 family */
+    _Py_HASHLIB_MD_MEMBER(blake2b),
+    _Py_HASHLIB_MD_MEMBER(blake2s),
+} _Py_HASHLIB_MD_NAMESPACE(member);
+
+static const char *_Py_HASHLIB_MD_NAMES[] = {
+#define DECL_MESSAGE_DIGEST_NAME(ID)  [_Py_HASHLIB_MD_MEMBER(ID)] = #ID
+    /* MD-family */
+    DECL_MESSAGE_DIGEST_NAME(md5),
+    /* SHA-1 family */
+    DECL_MESSAGE_DIGEST_NAME(sha1),
+    /* SHA-2 family */
+    DECL_MESSAGE_DIGEST_NAME(sha224),
+    DECL_MESSAGE_DIGEST_NAME(sha256),
+    DECL_MESSAGE_DIGEST_NAME(sha384),
+    DECL_MESSAGE_DIGEST_NAME(sha512),
+    /* Truncated SHA-2 family */
+    DECL_MESSAGE_DIGEST_NAME(sha512_224),
+    DECL_MESSAGE_DIGEST_NAME(sha512_256),
+    /* SHA-3 family */
+    DECL_MESSAGE_DIGEST_NAME(sha3_224),
+    DECL_MESSAGE_DIGEST_NAME(sha3_256),
+    DECL_MESSAGE_DIGEST_NAME(sha3_384),
+    DECL_MESSAGE_DIGEST_NAME(sha3_512),
+    /* SHA-3 XOF SHAKE family */
+    DECL_MESSAGE_DIGEST_NAME(shake_128),
+    DECL_MESSAGE_DIGEST_NAME(shake_256),
+    /* BLAKE-2 family */
+    DECL_MESSAGE_DIGEST_NAME(blake2b),
+    DECL_MESSAGE_DIGEST_NAME(blake2s),
+#undef DECL_MESSAGE_DIGEST_NAME
+    NULL /* sentinel */
+};
+
+#endif // !_HASHLIB_HASHLIB_FETCH_H