fix: pin sha2 and hex-encode digests

src/rust/Cargo.lock

@@ -14,7 +14,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "generic-array",
 ]
 
@@ -380,7 +380,7 @@ version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
 dependencies = [
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -392,15 +392,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-buffer"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -556,7 +547,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "inout",
  "zeroize",
 ]
@@ -674,12 +665,6 @@ dependencies = [
  "static_assertions",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -884,15 +869,6 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "crypto-common"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "csv"
 version = "1.4.0"
@@ -1106,22 +1082,11 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer 0.10.4",
- "crypto-common 0.1.7",
+ "block-buffer",
+ "crypto-common",
  "subtle",
 ]
 
-[[package]]
-name = "digest"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
-dependencies = [
- "block-buffer 0.12.0",
- "const-oid",
- "crypto-common 0.2.1",
-]
-
 [[package]]
 name = "dispatch2"
 version = "0.3.1"
@@ -1171,7 +1136,7 @@ dependencies = [
  "rand_core 0.6.4",
  "salsa20",
  "serde",
- "sha2 0.10.9",
+ "sha2",
  "subtle",
  "winapi",
  "zeroize",
@@ -1561,7 +1526,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -1615,15 +1580,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
-[[package]]
-name = "hybrid-array"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "hyper"
 version = "1.9.0"
@@ -2166,7 +2122,7 @@ dependencies = [
  "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2 0.11.0",
+ "sha2",
  "thiserror",
  "toml",
  "toml_edit 0.25.11+spec-1.1.0",
@@ -2484,7 +2440,7 @@ dependencies = [
  "serde",
  "serde_cbor",
  "serde_json",
- "sha2 0.11.0",
+ "sha2",
  "sha256",
  "signal-hook",
  "smallvec",
@@ -3780,7 +3736,7 @@ checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -3791,18 +3747,7 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.2",
+ "digest",
 ]
 
 [[package]]
@@ -3814,7 +3759,7 @@ dependencies = [
  "async-trait",
  "bytes",
  "hex",
- "sha2 0.10.9",
+ "sha2",
  "tokio",
 ]
 
@@ -4573,7 +4518,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "subtle",
 ]
 

src/rust/Cargo.toml

@@ -66,7 +66,7 @@ serde_json = "1"
 csv = "1"
 ip_network_table = "0"
 ip_network = "0"
-sha2 = "0"
+sha2 = "0.10"
 hmac = "0.12"
 base64 = "0.22"
 argon2 = "0.5"

src/rust/lqos_config/src/authentication.rs

@@ -285,7 +285,7 @@ impl WebUsers {
         let salted = format!("!x{password}{LEGACY_PASSWORD_PEPPER}");
         let mut sha256 = Sha256::new();
         sha256.update(salted);
-        format!("{:X}", sha256.finalize())
+        crate::hex_encoding::encode_hex_upper(sha256.finalize())
     }
 
     fn verify_password(

src/rust/lqos_config/src/etc/etclqos_migration.rs

@@ -243,8 +243,9 @@ fn check_config(cfg_doc: &mut DocumentMut, cfg: &mut EtcLqos) {
         && let Ok(machine_id) = std::fs::read_to_string("/etc/machine-id")
     {
         let hash = sha2::Sha256::new().chain(machine_id).finalize();
-        cfg.node_id = Some(format!("{:x}", hash));
-        cfg_doc["node_id"] = value(format!("{:x}", hash));
+        let node_id = crate::hex_encoding::encode_hex_lower(hash);
+        cfg.node_id = Some(node_id.clone());
+        cfg_doc["node_id"] = value(node_id);
         println!("Updating");
         if let Err(e) = cfg.save(cfg_doc) {
             error!("Unable to save /etc/lqos.conf");

src/rust/lqos_config/src/etc/v15/top_config.rs

@@ -207,7 +207,7 @@ impl Config {
     pub fn calculate_node_id() -> String {
         if let Ok(machine_id) = std::fs::read_to_string("/etc/machine-id") {
             let hash = sha2::Sha256::new().chain(machine_id).finalize();
-            format!("{:x}", hash)
+            crate::hex_encoding::encode_hex_lower(hash)
         } else {
             Uuid::new_v4().to_string()
         }

src/rust/lqos_config/src/hex_encoding.rs

@@ -0,0 +1,19 @@
+const HEX_LOWER: &[u8; 16] = b"0123456789abcdef";
+const HEX_UPPER: &[u8; 16] = b"0123456789ABCDEF";
+
+pub(crate) fn encode_hex_lower(bytes: impl AsRef<[u8]>) -> String {
+    encode_hex(bytes.as_ref(), HEX_LOWER)
+}
+
+pub(crate) fn encode_hex_upper(bytes: impl AsRef<[u8]>) -> String {
+    encode_hex(bytes.as_ref(), HEX_UPPER)
+}
+
+fn encode_hex(bytes: &[u8], table: &[u8; 16]) -> String {
+    let mut encoded = String::with_capacity(bytes.len().saturating_mul(2));
+    for &byte in bytes {
+        encoded.push(table[(byte >> 4) as usize] as char);
+        encoded.push(table[(byte & 0x0f) as usize] as char);
+    }
+    encoded
+}

src/rust/lqos_config/src/lib.rs

@@ -15,6 +15,7 @@ mod circuit_ethernet_metadata;
 mod cpu_topology;
 mod etc;
 mod ethernet_port_limits;
+mod hex_encoding;
 mod mikrotik_ipv6_credentials;
 mod network_json;
 mod planner;

src/rust/lqos_config/src/topology_canonical_state.rs

@@ -221,7 +221,7 @@ where
         hasher.update([0]);
         hasher.update(identifier.as_bytes());
     }
-    Some(format!("{:x}", hasher.finalize()))
+    Some(crate::hex_encoding::encode_hex_lower(hasher.finalize()))
 }
 
 /// Returns a stable identity hash for imported topology facts and compile mode selection.
@@ -246,7 +246,7 @@ where
         hasher.update([0]);
         hasher.update(identifier.as_bytes());
     }
-    Some(format!("{:x}", hasher.finalize()))
+    Some(crate::hex_encoding::encode_hex_lower(hasher.finalize()))
 }
 
 fn collect_network_json_ingress_tokens(map: &Map<String, Value>, out: &mut Vec<String>) {

src/rust/lqos_config/src/topology_runtime_state.rs

@@ -582,7 +582,7 @@ pub fn compute_topology_source_generation(
         hash_file_state(&mut hasher, TOPOLOGY_EDITOR_STATE_FILENAME, &editor_path)?;
     }
 
-    Ok(format!("{:x}", hasher.finalize()))
+    Ok(crate::hex_encoding::encode_hex_lower(hasher.finalize()))
 }
 
 impl TopologyAttachmentHealthStateFile {
@@ -667,7 +667,7 @@ impl TopologyShapingInputsFile {
         hasher.update(b"topology-runtime-shaping-generation");
         hasher.update([0xff]);
         hasher.update(payload);
-        Ok(format!("{:x}", hasher.finalize()))
+        Ok(crate::hex_encoding::encode_hex_lower(hasher.finalize()))
     }
 }
 
@@ -702,7 +702,7 @@ pub fn compute_effective_network_generation(
     hasher.update(b"topology-runtime-effective-generation");
     hasher.update([0xff]);
     hasher.update(payload);
-    Ok(format!("{:x}", hasher.finalize()))
+    Ok(crate::hex_encoding::encode_hex_lower(hasher.finalize()))
 }
 
 impl TopologyRuntimeStatusFile {