Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix 'OpenSSL::Digest.{digest,hexdigest,base64digest} algorithm, data' #1889

Merged
merged 2 commits into from
Jan 23, 2020

Conversation

bdewater
Copy link
Contributor

I ran into digest not working while testing webauthn-ruby at 9b08086b. The test suite failed with examples such as:

  1) WebAuthn::AuthenticatorAttestationResponse when TPM attestation verifies
     Failure/Error: OpenSSL::Digest.digest(cose_algorithm.hash_function, att_to_be_signed)
     
     ArgumentError:
       wrong number of arguments (given 2, expected 1)
     # /Users/chrisseaton/src/github.com/Shopify/graal-shopify/sdk/mxbuild/darwin-amd64/GRAALVM_UNKNOWN_JAVA8_STAGE1/graalvm-unknown-java8-20.0.0-dev/Contents/Home/jre/languages/ruby/lib/truffle/digest.rb:139:in `digest'
     # /Users/chrisseaton/src/github.com/Shopify/graal-shopify/sdk/mxbuild/darwin-amd64/GRAALVM_UNKNOWN_JAVA8_STAGE1/graalvm-unknown-java8-20.0.0-dev/Contents/Home/jre/languages/ruby/lib/mri/openssl/digest.rb:35:in `digest'
     # ./lib/webauthn/attestation_statement/tpm.rb:27:in `valid?'
     # ./lib/webauthn/attestation.rb:35:in `valid_attestation_statement?'

While fixing this particular error I also noticed hexdigest and base64digest not working as expected, so I fixed these as well. More details are in the commit messages.

Shopify#1

Bart de Water and others added 2 commits January 21, 2020 22:17
It was not consistent with hashing Contents or converting Digest to hexadecimal
Digest and hexdigest were not implemented correctly, leading to an error:
`ArgumentError (wrong number of arguments (given 2, expected 1))`
Base64digest was missing.

The order of arguments for Digest::Class.digest is different than
hexdigest and base64digest on purpose, matching the C implementation
in MRI. In lib/mri/openssl/digest.rb the arguments are reversed for this
in the Ruby method signature.

Co-authored-by: Chris Seaton <chris.seaton@shopify.com>
@graalvmbot
Copy link
Collaborator

Hello Bart de Water, thanks for contributing a PR to our project!

We use the Oracle Contributor Agreement to make the copyright of contributions clear. We don't have a record of you having signed this yet, based on your email address bart -(dot)- dewater -(at)- shopify -(dot)- com. You can sign it at that link.

If you think you've already signed it, please comment below and we'll check.

@graalvmbot
Copy link
Collaborator

Bart de Water has signed the Oracle Contributor Agreement (based on email address bart -(dot)- dewater -(at)- shopify -(dot)- com) so can contribute to this repository.

Copy link
Member

@eregon eregon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great, thank you for the fix, I'll integrate it.

@eregon eregon self-assigned this Jan 22, 2020
def self.hexdigest(message)
digest = new
def self.hexdigest(*parameters, message)
digest = new(*parameters)
digest.update message
digest.hexdigest
end
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Digest.hexdigest seems defined as Digest.hexencode(Digest::Class.digest(*args)) in MRI:
https://github.com/ruby/ruby/blob/37c2cd3fa47c709570e22ec4dac723ca211f423a/ext/digest/digest.c#L478-L490

And then

def self.digest(name, data)
super(data, name)
end
is what, very confusingly, swaps the arguments.

I'll add a commit to do that.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes this definitely was a brainbender 😅 also had a fun time with how Digest::Class and Digest::Instance are used depending on using the stdlib Digest or the OpenSSL algorithm modules:

OpenSSL::Digest::SHA256.ancestors
=> [OpenSSL::Digest::SHA256, OpenSSL::Digest, Digest::Class, Digest::Instance, Object, Kernel, BasicObject]

Digest::SHA256.ancestors
=> [Digest::SHA256, Digest::Base, Digest::Class, Digest::Instance, Object, Kernel, BasicObject]

Digest::SHA256.ancestors - OpenSSL::Digest::SHA256.ancestors
=> [Digest::SHA256, Digest::Base]

digest = new(*parameters)
digest.update message
digest.base64digest
end
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a note: this was already defined at line 29 above:
https://github.com/oracle/truffleruby/pull/1889/files#diff-048c3691437021dc9c9997d1a3aa7792R29

This file is pretty hard to follow due to reopening classes and part of the code from MRI.
Maybe I should try to convince MRI devs to define more of Digest in Ruby :)

@eregon eregon added the in-ci The PR is being tested in CI. Do not push new commits. label Jan 22, 2020
@eregon eregon added this to the 20.1.0 milestone Jan 22, 2020
graalvmbot pushed a commit that referenced this pull request Jan 23, 2020
…dle 2 arguments (#1889).

PullRequest: truffleruby/1295
@graalvmbot graalvmbot merged commit 51d876e into oracle:master Jan 23, 2020
@eregon
Copy link
Member

eregon commented Jan 23, 2020

Merged in 619ad90, thank you!

@chrisseaton chrisseaton deleted the fix-openssl-digest-methods branch February 3, 2020 14:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in-ci The PR is being tested in CI. Do not push new commits. oca-signed shopify
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants