Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make "rake debug" protective for a Ruby OpenSSL loading error. #783

Merged
merged 1 commit into from
Jul 26, 2024

Conversation

junaruga
Copy link
Member

@junaruga junaruga commented Jul 25, 2024

This PR is to make "rake debug" enhanced, on the way suggested at #780 (comment). I didn't need to take the rake debug out from Rakefile. Because the ruby code is executed in the child process by the ruby %Q(-I./lib -ropenssl.so -ve'#{ruby_code}') in the Rakefile.


We experienced a FIPS case specific Ruby OpenSSL error in the loading process of Ruby OpenSSL by calling the ruby -ropenssl (require 'openssl') built with OpenSSL master branch which includes the commit openssl/openssl@6d47e81 but doesn't include the commit openssl/openssl@3c6e114 fixing the issue.

The following error happened at lib/openssl.rb:22 calling the lib/openssl/ssl.rb with the OpenSSL commit
<14e46600c68ece74970462a60ad20703221747a1> which is between the above 2 commits.

$ OPENSSL_CONF=/home/jaruga/.local/openssl-3.4.0-dev-fips-debug-14e46600c6/ssl/openssl_fips.cnf \
  bundle exec rake debug
...
ruby 3.4.0dev (2024-07-22T08:33:07Z master 82aee1a946) [x86_64-linux]
/home/jaruga/var/git/ruby/openssl/lib/openssl/pkey.rb:132:in 'OpenSSL::PKey::DH#initialize': could not parse pkey (OpenSSL::PKey::DHError)
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/pkey.rb:132:in 'Class#new'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/pkey.rb:132:in 'OpenSSL::PKey::DH.new'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/ssl.rb:36:in '<class:SSLContext>'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/ssl.rb:23:in '<module:SSL>'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/ssl.rb:22:in '<module:OpenSSL>'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/ssl.rb:21:in '<top (required)>'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl.rb:22:in 'Kernel#require_relative'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl.rb:22:in '<top (required)>'
  from /home/jaruga/.local/ruby-3.4.0dev-debug-82aee1a946/lib/ruby/3.4.0+0/bundled_gems.rb:71:in 'Kernel.require'
  from /home/jaruga/.local/ruby-3.4.0dev-debug-82aee1a946/lib/ruby/3.4.0+0/bundled_gems.rb:71:in 'block (2 levels) in Kernel#replace_require'
rake aborted!

This commit enables the rake debug still to print the debugging values in such cases. In this case, the rake debug prints only the base provider without fips provider. That was a bug of OpenSSL.

$ OPENSSL_CONF=/home/jaruga/.local/openssl-3.4.0-dev-fips-debug-14e46600c6/ssl/openssl_fips.cnf \
  bundle exec rake debug
...
ruby 3.4.0dev (2024-07-22T08:33:07Z master 82aee1a946) [x86_64-linux]
OpenSSL::OPENSSL_VERSION: OpenSSL 3.4.0-dev
OpenSSL::OPENSSL_LIBRARY_VERSION: OpenSSL 3.4.0-dev
OpenSSL::OPENSSL_VERSION_NUMBER: 30400000
OpenSSL::LIBRESSL_VERSION_NUMBER: undefined
FIPS enabled: true
Providers: base

We experienced a FIPS case specific Ruby OpenSSL error in the loading process
of Ruby OpenSSL by calling the `ruby -ropenssl` (`require 'openssl'`) built
with OpenSSL master branch which includes the commit
<openssl/openssl@6d47e81>
but doesn't include the commit
<openssl/openssl@3c6e114>
fixing the issue.

The following error happened at `lib/openssl.rb:22` calling the
`lib/openssl/ssl.rb` with the OpenSSL commit
<14e46600c68ece74970462a60ad20703221747a1> which is between the above 2 commits.

```
$ OPENSSL_CONF=/home/jaruga/.local/openssl-3.4.0-dev-fips-debug-14e46600c6/ssl/openssl_fips.cnf \
  bundle exec rake debug
...
ruby 3.4.0dev (2024-07-22T08:33:07Z master 82aee1a946) [x86_64-linux]
/home/jaruga/var/git/ruby/openssl/lib/openssl/pkey.rb:132:in 'OpenSSL::PKey::DH#initialize': could not parse pkey (OpenSSL::PKey::DHError)
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/pkey.rb:132:in 'Class#new'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/pkey.rb:132:in 'OpenSSL::PKey::DH.new'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/ssl.rb:36:in '<class:SSLContext>'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/ssl.rb:23:in '<module:SSL>'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/ssl.rb:22:in '<module:OpenSSL>'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl/ssl.rb:21:in '<top (required)>'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl.rb:22:in 'Kernel#require_relative'
  from /home/jaruga/var/git/ruby/openssl/lib/openssl.rb:22:in '<top (required)>'
  from /home/jaruga/.local/ruby-3.4.0dev-debug-82aee1a946/lib/ruby/3.4.0+0/bundled_gems.rb:71:in 'Kernel.require'
  from /home/jaruga/.local/ruby-3.4.0dev-debug-82aee1a946/lib/ruby/3.4.0+0/bundled_gems.rb:71:in 'block (2 levels) in Kernel#replace_require'
rake aborted!
```

This commit enables the `rake debug` still to print the debugging values in such
cases. In this case, the `rake debug` prints only the base provider without
fips provider. That was a bug of OpenSSL.

```
$ OPENSSL_CONF=/home/jaruga/.local/openssl-3.4.0-dev-fips-debug-14e46600c6/ssl/openssl_fips.cnf \
  bundle exec rake debug
...
ruby 3.4.0dev (2024-07-22T08:33:07Z master 82aee1a946) [x86_64-linux]
OpenSSL::OPENSSL_VERSION: OpenSSL 3.4.0-dev
OpenSSL::OPENSSL_LIBRARY_VERSION: OpenSSL 3.4.0-dev
OpenSSL::OPENSSL_VERSION_NUMBER: 30400000
OpenSSL::LIBRESSL_VERSION_NUMBER: undefined
FIPS enabled: true
Providers: base
```
@rhenium rhenium merged commit ce2a091 into ruby:master Jul 26, 2024
54 checks passed
@rhenium
Copy link
Member

rhenium commented Jul 26, 2024

I didn't need to take the rake debug out from Rakefile. Because the ruby code is executed in the child process by the ruby %Q(-I./lib -ropenssl.so -ve'#{ruby_code}') in the Rakefile.

You're right.

Seems good to me!

@junaruga junaruga deleted the wip/rake-debug-protective branch July 26, 2024 17:27
@junaruga
Copy link
Member Author

Thanks for your review!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants