Skip to content

Commit 56276d2

Browse files
nornagoncodebytere
nornagon
authored and
codebytere
committed
fix: expose ripemd160 hash from boringssl (electron#16454) (electron#16574)
Ref electron#16195
1 parent 9040725 commit 56276d2

File tree

4 files changed

+118
-5
lines changed

4 files changed

+118
-5
lines changed

‎patches/common/boringssl/.patches‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
implement_ssl_get_tlsext_status_type.patch
2+
expose_ripemd160.patch

‎patches/common/boringssl/expose_ripemd160.patch‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+
From: Jeremy Apthorp <nornagon@nornagon.net>
3+
Date: Fri, 18 Jan 2019 13:56:52 -0800
4+
Subject: expose ripemd160
5+
6+
This adds references to the decrepit/ module from non-decrepit source,
7+
which is not allowed in upstream. Until upstream has a way to interface
8+
with node.js that allows exposing additional digests without patching,
9+
this patch is required to provide ripemd160 support in the nodejs crypto
10+
module.
11+
12+
diff --git a/crypto/digest_extra/digest_extra.c b/crypto/digest_extra/digest_extra.c
13+
index 4b4bb38135e6089eaf6f47afda0199567a2397ef..43b7eca808b82a032055f56ce726ce4f38c5f2c5 100644
14+
--- a/crypto/digest_extra/digest_extra.c
15+
+++ b/crypto/digest_extra/digest_extra.c
16+
@@ -81,6 +81,7 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
17+
{NID_sha384, EVP_sha384, SN_sha384, LN_sha384},
18+
{NID_sha512, EVP_sha512, SN_sha512, LN_sha512},
19+
{NID_md5_sha1, EVP_md5_sha1, SN_md5_sha1, LN_md5_sha1},
20+
+ {NID_ripemd160, EVP_ripemd160, SN_ripemd160, LN_ripemd160},
21+
// As a remnant of signing |EVP_MD|s, OpenSSL returned the corresponding
22+
// hash function when given a signature OID. To avoid unintended lax parsing
23+
// of hash OIDs, this is no longer supported for lookup by OID or NID.
24+
diff --git a/crypto/fipsmodule/digest/digests.c b/crypto/fipsmodule/digest/digests.c
25+
index f2fa349c2b32ae88766624af3109ece4b1d69909..bcaed59c5401bef071acba9b9919d9069e3ccd4d 100644
26+
--- a/crypto/fipsmodule/digest/digests.c
27+
+++ b/crypto/fipsmodule/digest/digests.c
28+
@@ -63,6 +63,7 @@
29+
#include <openssl/md5.h>
30+
#include <openssl/nid.h>
31+
#include <openssl/sha.h>
32+
+#include <openssl/ripemd.h>
33+
34+
#include "internal.h"
35+
#include "../delocate.h"
36+
@@ -277,4 +278,27 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_md5_sha1) {
37+
out->ctx_size = sizeof(MD5_SHA1_CTX);
38+
}
39+
40+
+static void ripemd160_init(EVP_MD_CTX *ctx) {
41+
+ CHECK(RIPEMD160_Init(ctx->md_data));
42+
+}
43+
+
44+
+static void ripemd160_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
45+
+ CHECK(RIPEMD160_Update(ctx->md_data, data, count));
46+
+}
47+
+
48+
+static void ripemd160_final(EVP_MD_CTX *ctx, uint8_t *md) {
49+
+ CHECK(RIPEMD160_Final(md, ctx->md_data));
50+
+}
51+
+
52+
+DEFINE_METHOD_FUNCTION(EVP_MD, EVP_ripemd160) {
53+
+ out->type = NID_ripemd160;
54+
+ out->md_size = RIPEMD160_DIGEST_LENGTH;
55+
+ out->flags = 0;
56+
+ out->init = ripemd160_init;
57+
+ out->update = ripemd160_update;
58+
+ out->final = ripemd160_final;
59+
+ out->block_size = 64;
60+
+ out->ctx_size = sizeof(RIPEMD160_CTX);
61+
+}
62+
+
63+
#undef CHECK
64+
diff --git a/decrepit/evp/evp_do_all.c b/decrepit/evp/evp_do_all.c
65+
index 38b8f9f78f76050174096740596ac59a0fe18757..acc4719b7e9c4c4461fc6142f2ae9156b407915b 100644
66+
--- a/decrepit/evp/evp_do_all.c
67+
+++ b/decrepit/evp/evp_do_all.c
68+
@@ -66,6 +66,7 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *cipher,
69+
callback(EVP_sha256(), "SHA256", NULL, arg);
70+
callback(EVP_sha384(), "SHA384", NULL, arg);
71+
callback(EVP_sha512(), "SHA512", NULL, arg);
72+
+ callback(EVP_ripemd160(), "RIPEMD160", NULL, arg);
73+
74+
callback(EVP_md4(), "md4", NULL, arg);
75+
callback(EVP_md5(), "md5", NULL, arg);
76+
@@ -74,4 +75,5 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *cipher,
77+
callback(EVP_sha256(), "sha256", NULL, arg);
78+
callback(EVP_sha384(), "sha384", NULL, arg);
79+
callback(EVP_sha512(), "sha512", NULL, arg);
80+
+ callback(EVP_ripemd160(), "ripemd160", NULL, arg);
81+
}
82+
diff --git a/include/openssl/digest.h b/include/openssl/digest.h
83+
index 1a1ca29732afae317c8e8740c629e8922fc83093..48ebdd1eb93b3febecddbc2545b7aae583f21525 100644
84+
--- a/include/openssl/digest.h
85+
+++ b/include/openssl/digest.h
86+
@@ -88,6 +88,9 @@ OPENSSL_EXPORT const EVP_MD *EVP_sha512(void);
87+
// MD5 and SHA-1, as used in TLS 1.1 and below.
88+
OPENSSL_EXPORT const EVP_MD *EVP_md5_sha1(void);
89+
90+
+// EVP_ripemd160 is in decrepit and not available by default.
91+
+OPENSSL_EXPORT const EVP_MD *EVP_ripemd160(void);
92+
+
93+
// EVP_get_digestbynid returns an |EVP_MD| for the given NID, or NULL if no
94+
// such digest is known.
95+
OPENSSL_EXPORT const EVP_MD *EVP_get_digestbynid(int nid);

‎patches/common/chromium/boringssl_build_gn.patch‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,15 @@
11
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
22
From: Jeremy Apthorp <nornagon@nornagon.net>
33
Date: Thu, 20 Sep 2018 17:48:05 -0700
4-
Subject: boringssl_build_gn.patch
4+
Subject: boringssl BUILD.gn
55

6-
Build BoringSSL with some extra functions that nodejs needs. Only affects
7-
the GN build; with the GYP build, nodejs is still built with OpenSSL.
6+
Build BoringSSL with some extra functions that nodejs needs.
87

98
diff --git a/third_party/boringssl/BUILD.gn b/third_party/boringssl/BUILD.gn
10-
index d31a9f29fa9c12e753708b2a1e75c33b70924300..dea5a6403f4c32f94bb58198c467bc7cc87a8217 100644
9+
index d31a9f29fa9c12e753708b2a1e75c33b70924300..fd45cfcb50fb659ff8d5a07b06aeecc8f0ecd3ee 100644
1110
--- a/third_party/boringssl/BUILD.gn
1211
+++ b/third_party/boringssl/BUILD.gn
13-
@@ -46,6 +46,13 @@ config("no_asm_config") {
12+
@@ -45,6 +45,19 @@ config("no_asm_config") {
1413

1514
all_sources = crypto_sources + ssl_sources
1615
all_headers = crypto_headers + ssl_headers
@@ -20,6 +19,12 @@ index d31a9f29fa9c12e753708b2a1e75c33b70924300..dea5a6403f4c32f94bb58198c467bc7c
2019
+ "src/decrepit/evp/evp_do_all.c",
2120
+ "src/decrepit/xts/xts.c",
2221
+ ]
22+
+
23+
+ all_sources += [
24+
+ "src/decrepit/ripemd/internal.h",
25+
+ "src/decrepit/ripemd/ripemd.c",
26+
+ "src/decrepit/cfb/cfb.c",
27+
+ ]
2328
+}
2429

2530
# Windows' assembly is built with Yasm. The other platforms use the platform

‎spec/node-spec.js‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -420,6 +420,18 @@ describe('node feature', () => {
420420
})
421421
})
422422

423+
describe('crypto', () => {
424+
it('should list the ripemd160 hash in getHashes', () => {
425+
expect(require('crypto').getHashes()).to.include('ripemd160')
426+
})
427+
428+
it('should be able to create a ripemd160 hash and use it', () => {
429+
const hash = require('crypto').createHash('ripemd160')
430+
hash.update('electron-ripemd160')
431+
expect(hash.digest('hex')).to.equal('fa7fec13c624009ab126ebb99eda6525583395fe')
432+
})
433+
})
434+
423435
it('includes the electron version in process.versions', () => {
424436
expect(process.versions)
425437
.to.have.own.property('electron')

0 commit comments

Comments
 (0)