mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
2e601c284c
The OpenSSL engine of Digest uses the low-level API of OpenSSL, whose use has been discouraged for years for multiple reasons. A long-standing issue on a FIPS-enabled system is that using ::Digest results in crashing the Ruby process, because the low-level API lacks the mechanism to report an error (the policy violation) and thus kills the process as a last resort[1][2]. Also, the upcoming OpenSSL 3.0 will deprecate it for future removal[3]. Compiling with -Wdeprecated-declarations will start to emit warnings. A proper fix for this is to make it use the EVP API instead. This is a non-trivial work as it requires backwards-incompatible changes to the framework interface of Digest::Base and rb_digest_metadata_t. It is more than 15 years ago that the openssl library became part of the standard library. It has implemented the exactly same functionality as OpenSSL::Digest, in fact, as a subclass of Digest::Class. There is not much point in having an identical code in the digest library. Let's just get rid of OpenSSL within digest. This leaves the C implementations and the CommonCrypto engine for Apple systems. A patch is being prepared for the openssl library to provide ::Digest constants for better performance[4]. [1] https://bugs.ruby-lang.org/issues/6946 [2] https://bugs.ruby-lang.org/issues/13681 [3] https://www.openssl.org/docs/OpenSSL300Design.html [4] https://github.com/ruby/openssl/pull/377
55 lines
1.5 KiB
C
55 lines
1.5 KiB
C
/* $RoughId: sha2init.c,v 1.3 2001/07/13 20:00:43 knu Exp $ */
|
|
/* $Id$ */
|
|
|
|
#include <ruby/ruby.h>
|
|
#include "../digest.h"
|
|
#if defined(SHA2_USE_COMMONDIGEST)
|
|
#include "sha2cc.h"
|
|
#else
|
|
#include "sha2.h"
|
|
#endif
|
|
|
|
#define FOREACH_BITLEN(func) func(256) func(384) func(512)
|
|
|
|
#define DEFINE_ALGO_METADATA(bitlen) \
|
|
static const rb_digest_metadata_t sha##bitlen = { \
|
|
RUBY_DIGEST_API_VERSION, \
|
|
SHA##bitlen##_DIGEST_LENGTH, \
|
|
SHA##bitlen##_BLOCK_LENGTH, \
|
|
sizeof(SHA##bitlen##_CTX), \
|
|
(rb_digest_hash_init_func_t)SHA##bitlen##_Init, \
|
|
(rb_digest_hash_update_func_t)SHA##bitlen##_Update, \
|
|
(rb_digest_hash_finish_func_t)SHA##bitlen##_Finish, \
|
|
};
|
|
|
|
FOREACH_BITLEN(DEFINE_ALGO_METADATA)
|
|
|
|
/*
|
|
* Classes for calculating message digests using the SHA-256/384/512
|
|
* Secure Hash Algorithm(s) by NIST (the US' National Institute of
|
|
* Standards and Technology), described in FIPS PUB 180-2.
|
|
*/
|
|
void
|
|
Init_sha2(void)
|
|
{
|
|
VALUE mDigest, cDigest_Base;
|
|
ID id_metadata = rb_id_metadata();
|
|
|
|
#define DECLARE_ALGO_CLASS(bitlen) \
|
|
VALUE cDigest_SHA##bitlen;
|
|
|
|
FOREACH_BITLEN(DECLARE_ALGO_CLASS)
|
|
|
|
mDigest = rb_digest_namespace();
|
|
cDigest_Base = rb_path2class("Digest::Base");
|
|
|
|
#define DEFINE_ALGO_CLASS(bitlen) \
|
|
cDigest_SHA##bitlen = rb_define_class_under(mDigest, "SHA" #bitlen, cDigest_Base); \
|
|
\
|
|
rb_ivar_set(cDigest_SHA##bitlen, id_metadata, \
|
|
Data_Wrap_Struct(0, 0, 0, (void *)&sha##bitlen));
|
|
|
|
#undef RUBY_UNTYPED_DATA_WARNING
|
|
#define RUBY_UNTYPED_DATA_WARNING 0
|
|
FOREACH_BITLEN(DEFINE_ALGO_CLASS)
|
|
}
|