Skip to content

Commit a011912

Browse files
cardosocardoso
committed
fix(ddp-streamer): remove flaky check
1 parent ae94b93 commit a011912

1 file changed

Lines changed: 111 additions & 116 deletions

File tree

‎ee/apps/ddp-streamer/src/fips.ts‎

Lines changed: 111 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -26,122 +26,117 @@ console.log('=========================================');
2626
console.log('FIPS COMPLIANCE CHECK: YES');
2727
console.log('=========================================');
2828

29-
try {
30-
crypto.createHash('sha1').update('test').digest('hex');
31-
console.log('🔓 Native SHA-1 allowed. Skipping FIPS WebSocket patch.');
32-
} catch (err) {
33-
console.log('🔒 FIPS 140-3 mode detected. Applying WebSocket Handshake Patch...');
34-
35-
const blocks = new Uint32Array(32);
36-
const w = new Uint32Array(80);
37-
const hashBuffer = Buffer.alloc(20);
38-
39-
const generateWebSocketAccept = (message: string): string => {
40-
if (message.length !== 60) {
41-
throw new Error(`Expected 60-byte input for WS Accept, got ${message.length}`);
29+
console.log('🔒 FIPS 140-3 mode detected. Applying WebSocket Handshake Patch...');
30+
31+
const blocks = new Uint32Array(32);
32+
const w = new Uint32Array(80);
33+
const hashBuffer = Buffer.alloc(20);
34+
35+
const generateWebSocketAccept = (message: string): string => {
36+
if (message.length !== 60) {
37+
throw new Error(`Expected 60-byte input for WS Accept, got ${message.length}`);
38+
}
39+
40+
blocks.fill(0);
41+
42+
let h0 = 0x67452301;
43+
let h1 = 0xefcdab89;
44+
let h2 = 0x98badcfe;
45+
let h3 = 0x10325476;
46+
let h4 = 0xc3d2e1f0;
47+
48+
for (let i = 0; i < 60; i++) blocks[i >> 2] |= message.charCodeAt(i) << (24 - (i % 4) * 8);
49+
blocks[15] = 0x80000000;
50+
blocks[31] = 480;
51+
52+
const rotl = (n: number, b: number) => (n << b) | (n >>> (32 - b));
53+
54+
for (let chunk = 0; chunk < 2; chunk++) {
55+
const offset = chunk * 16;
56+
for (let i = 0; i < 16; i++) w[i] = blocks[offset + i];
57+
for (let i = 16; i < 80; i++) w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
58+
59+
let a = h0;
60+
let b = h1;
61+
let c = h2;
62+
let d = h3;
63+
let e = h4;
64+
let temp;
65+
66+
for (let i = 0; i < 20; i++) {
67+
temp = (rotl(a, 5) + (d ^ (b & (c ^ d))) + e + 0x5a827999 + w[i]) >>> 0;
68+
e = d;
69+
d = c;
70+
c = rotl(b, 30);
71+
b = a;
72+
a = temp;
4273
}
43-
44-
blocks.fill(0);
45-
46-
let h0 = 0x67452301;
47-
let h1 = 0xefcdab89;
48-
let h2 = 0x98badcfe;
49-
let h3 = 0x10325476;
50-
let h4 = 0xc3d2e1f0;
51-
52-
for (let i = 0; i < 60; i++) blocks[i >> 2] |= message.charCodeAt(i) << (24 - (i % 4) * 8);
53-
blocks[15] = 0x80000000;
54-
blocks[31] = 480;
55-
56-
const rotl = (n: number, b: number) => (n << b) | (n >>> (32 - b));
57-
58-
for (let chunk = 0; chunk < 2; chunk++) {
59-
const offset = chunk * 16;
60-
for (let i = 0; i < 16; i++) w[i] = blocks[offset + i];
61-
for (let i = 16; i < 80; i++) w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
62-
63-
let a = h0;
64-
let b = h1;
65-
let c = h2;
66-
let d = h3;
67-
let e = h4;
68-
let temp;
69-
70-
for (let i = 0; i < 20; i++) {
71-
temp = (rotl(a, 5) + (d ^ (b & (c ^ d))) + e + 0x5a827999 + w[i]) >>> 0;
72-
e = d;
73-
d = c;
74-
c = rotl(b, 30);
75-
b = a;
76-
a = temp;
77-
}
78-
for (let i = 20; i < 40; i++) {
79-
temp = (rotl(a, 5) + (b ^ c ^ d) + e + 0x6ed9eba1 + w[i]) >>> 0;
80-
e = d;
81-
d = c;
82-
c = rotl(b, 30);
83-
b = a;
84-
a = temp;
85-
}
86-
for (let i = 40; i < 60; i++) {
87-
temp = (rotl(a, 5) + ((b & c) | (b & d) | (c & d)) + e + 0x8f1bbcdc + w[i]) >>> 0;
88-
e = d;
89-
d = c;
90-
c = rotl(b, 30);
91-
b = a;
92-
a = temp;
93-
}
94-
for (let i = 60; i < 80; i++) {
95-
temp = (rotl(a, 5) + (b ^ c ^ d) + e + 0xca62c1d6 + w[i]) >>> 0;
96-
e = d;
97-
d = c;
98-
c = rotl(b, 30);
99-
b = a;
100-
a = temp;
101-
}
102-
103-
h0 = (h0 + a) >>> 0;
104-
h1 = (h1 + b) >>> 0;
105-
h2 = (h2 + c) >>> 0;
106-
h3 = (h3 + d) >>> 0;
107-
h4 = (h4 + e) >>> 0;
74+
for (let i = 20; i < 40; i++) {
75+
temp = (rotl(a, 5) + (b ^ c ^ d) + e + 0x6ed9eba1 + w[i]) >>> 0;
76+
e = d;
77+
d = c;
78+
c = rotl(b, 30);
79+
b = a;
80+
a = temp;
10881
}
109-
110-
hashBuffer.writeUInt32BE(h0, 0);
111-
hashBuffer.writeUInt32BE(h1, 4);
112-
hashBuffer.writeUInt32BE(h2, 8);
113-
hashBuffer.writeUInt32BE(h3, 12);
114-
hashBuffer.writeUInt32BE(h4, 16);
115-
116-
return hashBuffer.toString('base64');
117-
};
118-
119-
const originalCreateHash = crypto.createHash;
120-
121-
crypto.createHash = function (algorithm: string, options?: crypto.HashOptions) {
122-
if (algorithm.toLowerCase() === 'sha1') {
123-
let inputData = '';
124-
125-
return {
126-
update(data) {
127-
if (typeof data === 'string') {
128-
inputData += data;
129-
} else if (Buffer.isBuffer(data)) {
130-
inputData += data.toString('utf8');
131-
} else {
132-
inputData += Buffer.from(data.buffer, data.byteOffset, data.byteLength).toString('utf8');
133-
}
134-
return this;
135-
},
136-
digest(encoding) {
137-
if (encoding === 'base64' && inputData.length === 60) {
138-
return generateWebSocketAccept(inputData);
139-
}
140-
// If it's not the exact WS handshake, pass it back to native (which will throw FIPS error)
141-
return originalCreateHash(algorithm, options).update(inputData).digest(encoding);
142-
},
143-
} as crypto.Hash;
82+
for (let i = 40; i < 60; i++) {
83+
temp = (rotl(a, 5) + ((b & c) | (b & d) | (c & d)) + e + 0x8f1bbcdc + w[i]) >>> 0;
84+
e = d;
85+
d = c;
86+
c = rotl(b, 30);
87+
b = a;
88+
a = temp;
14489
}
145-
return originalCreateHash(algorithm, options);
146-
};
147-
}
90+
for (let i = 60; i < 80; i++) {
91+
temp = (rotl(a, 5) + (b ^ c ^ d) + e + 0xca62c1d6 + w[i]) >>> 0;
92+
e = d;
93+
d = c;
94+
c = rotl(b, 30);
95+
b = a;
96+
a = temp;
97+
}
98+
99+
h0 = (h0 + a) >>> 0;
100+
h1 = (h1 + b) >>> 0;
101+
h2 = (h2 + c) >>> 0;
102+
h3 = (h3 + d) >>> 0;
103+
h4 = (h4 + e) >>> 0;
104+
}
105+
106+
hashBuffer.writeUInt32BE(h0, 0);
107+
hashBuffer.writeUInt32BE(h1, 4);
108+
hashBuffer.writeUInt32BE(h2, 8);
109+
hashBuffer.writeUInt32BE(h3, 12);
110+
hashBuffer.writeUInt32BE(h4, 16);
111+
112+
return hashBuffer.toString('base64');
113+
};
114+
115+
const originalCreateHash = crypto.createHash;
116+
117+
crypto.createHash = function (algorithm: string, options?: crypto.HashOptions) {
118+
if (algorithm.toLowerCase() === 'sha1') {
119+
let inputData = '';
120+
121+
return {
122+
update(data) {
123+
if (typeof data === 'string') {
124+
inputData += data;
125+
} else if (Buffer.isBuffer(data)) {
126+
inputData += data.toString('utf8');
127+
} else {
128+
inputData += Buffer.from(data.buffer, data.byteOffset, data.byteLength).toString('utf8');
129+
}
130+
return this;
131+
},
132+
digest(encoding) {
133+
if (encoding === 'base64' && inputData.length === 60) {
134+
return generateWebSocketAccept(inputData);
135+
}
136+
// If it's not the exact WS handshake, pass it back to native (which will throw FIPS error)
137+
return originalCreateHash(algorithm, options).update(inputData).digest(encoding);
138+
},
139+
} as crypto.Hash;
140+
}
141+
return originalCreateHash(algorithm, options);
142+
};

0 commit comments

Comments
 (0)