Skip to content

Unable to read the blob object data on FIPS enabled environment due to MD5 is restricted and missing API to enable/disable MD5 Content hash #6474

Open
@csi-amolpawar

Description

@csi-amolpawar

Describe the bug
Unable to read the blob object data on FIPS enabled environment

[user1@kk60-fips bin]$ fips-mode-setup --check
FIPS mode is enabled.
[user1@kk60-fips bin]$ ./blob-reader testcontainer testblob.txt 
error: Crypto error while init Md5Hash.

due to MD5 is restricted and missing API to enable/disable the MD5 content hash

Please refer this migration guide which clearly specify the missing MD5 configuration in version 12, was provided in the previous version 7.5
https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/storage/MigrationGuide.md#blob-content-md5

To Reproduce
Steps to reproduce the behavior:
The issue is easily reproducible with below code

#include <iostream>
#include <string>
#include <sstream>
#include <memory>
#include <stdexcept>
#include <azure/storage/blobs.hpp>                       // For azure blob
#include <azure/storage/common/storage_exception.hpp>    // For azure exceptions

using namespace Azure::Storage;
using namespace Azure::Storage::Blobs;

int main(int argc, char** argv) try
{
  if(argc == 3)
  {
    std::string container(argv[1]), blob(argv[2]);
    std::string accountname("testaccount");
    std::string accountkey("accountkey");

    std::ostringstream url;
    url << "https://" << accountname << ".blob.core.windows.net/"
        << container <<  '/' << blob;

    auto credential = std::make_shared<StorageSharedKeyCredential>(
      accountname, accountkey);

    auto blob_client = std::make_unique<BlobClient>(url.str(), credential);
    auto blobsize = blob_client->GetProperties().Value.BlobSize;

    DownloadBlobOptions download_options;
    download_options.Range = { 0, blobsize };

    auto response = blob_client->Download(download_options).Value;
    auto contenthash = response.Details.HttpHeaders.ContentHash.Value;

    Azure::Core::Cryptography::Md5Hash md5hash;
    
    const auto BUFFER_SIZE = 4 * 1'024 * 1'024;
    std::array<char, BUFFER_SIZE> outbuf;
    auto stream = std::move(response.BodyStream);
    for (int64_t offset = 0; offset != blobsize; )
    {
      auto readsize = stream->Read((uint8_t*)outbuf.data(), BUFFER_SIZE);
      md5hash.Append((const uint8_t*)outbuf.data(), readsize);
      offset += readsize;
    }

    if(md5hash.Final() != contenthash)
    {
      std::ostringstream oss; oss << ": Download blob failed: "
        << "Bad Hash(md5/crc64)";
      throw std::runtime_error(oss.str());
    }
    std::cout << "The md4 hash is successful for az://" << argv[1] << "/" << argv[2] << std::endl;
  }
  else
  {
    std::cout << argv[0] << " <container> <blob>" << std::endl;
  }
  return 0;
}
catch(const std::exception& e)
{
  std::cout << "error: " << e.what() << std::endl;
}

Expected behavior
The program should able to read blob irrespective of its environment i.e on FIPS enabled by configuring the MD5 content hash flag as ON/OFF

Setup (please complete the following information):

  • OS: Rocky Linux 9.5 (Blue Onyx)
  • Version of the Library used : 12.10.0
  • C++ Version: g++ (GCC) 11.5.0

Additional context
This should work as usual like Non FIPS environment

[user2@8e3dcaf8d95e azure]# fips-mode-setup --check
Installation of FIPS modules is not completed.
cat: /proc/sys/crypto/fips_enabled: No such file or directory
FIPS mode is .
[user2@8e3dcaf8d95e azure]# ./blob-reader testcontainer testblob.txt 
The md4 hash is successful for az://testcontainer/testblob.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    ClientThis issue points to a problem in the data-plane of the library.Service AttentionWorkflow: This issue is responsible by Azure service team.StorageStorage Service (Queues, Blobs, Files)customer-reportedIssues that are reported by GitHub users external to the Azure organization.needs-team-attentionWorkflow: This issue needs attention from Azure service team or SDK teamquestionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions