Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Page MenuHomePhabricator
Create Task
Maniphest T230487

Argon2PasswordTest failing on PHP 7.2.21+ (works upto PHP 7.2.16)
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Description

As of about 24 hours ago, the Travis CI builds for PHP 7.2 and PHP 7.3 are failing.

There was 1 failure:
1) Argon2PasswordTest::testPartialConfig
Options not set for a password should fall back to defaults
Failed asserting that true is false.
/home/travis/build/wikimedia/mediawiki/tests/phpunit/includes/password/Argon2PasswordTest.php:102

Last passing:

First failing:

Given no seemingly related changes to the failure between these commits, and WMF CI still passing, I'm guessing it's due to the implicit PHP upgrade that happened due to the upstream release.

Screenshot 2019-08-14 at 16.36.26.png (956×2 px, 158 KB)

Details

SubjectRepoBranchLines +/-
Handle changed defaults in Argon2PasswordTest::testPartialConfig()mediawiki/coreREL1_33+12 -1
Handle changed defaults in Argon2PasswordTest::testPartialConfig()mediawiki/coremaster+12 -1
Customize query in gerrit

Related Objects

Event Timeline

Krinkle created this task.Aug 14 2019, 2:41 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 14 2019, 2:41 PM
Krinkle updated the task description. (Show Details)Aug 14 2019, 2:41 PM
Jdforrester-WMF renamed this task from Argon2PasswordTest failing on PHP 7.7.21+ (works upto PHP 7.2.16) to Argon2PasswordTest failing on PHP 7.2.21+ (works upto PHP 7.2.16).Aug 14 2019, 2:45 PM
RazeSoldier subscribed.Aug 14 2019, 3:00 PM

I see it in https://www.php.net/ChangeLog-7.php#7.3.8

Fixed bug [[ http://bugs.php.net/78269 | #78269 ]] (password_hash uses weak options for argon2).
Anomie moved this task from Inbox to Triage Meeting Inbox on the Platform Engineering board.Aug 14 2019, 4:27 PM
Anomie subscribed.Aug 14 2019, 4:38 PM
In T230487#5414118, @RazeSoldier wrote:

I see it in https://www.php.net/ChangeLog-7.php#7.3.8

Fixed bug [[ http://bugs.php.net/78269 | #78269 ]] (password_hash uses weak options for argon2).

Seems pretty likely. At Argon2PasswordTest.php lines 30–32 we have

				'memory_cost' => 1024,
				'time_cost' => 2,
				'threads' => 2,

while in the patch related to that upstream change I see

-#define PHP_PASSWORD_ARGON2_MEMORY_COST 1<<10
-#define PHP_PASSWORD_ARGON2_TIME_COST 2
-#define PHP_PASSWORD_ARGON2_THREADS 2
+#define PHP_PASSWORD_ARGON2_MEMORY_COST (64 << 10)
+#define PHP_PASSWORD_ARGON2_TIME_COST 4
+#define PHP_PASSWORD_ARGON2_THREADS 1

It doesn't look like we can directly access those C defines in PHP code, but we may be able to get them indirectly. On my local system,

$ php -r 'var_dump( PHP_VERSION, password_get_info( password_hash( "", PASSWORD_ARGON2I ) ) );'
string(8) "7.2.11-3"
array(3) {
  ["algo"]=>
  int(2)
  ["algoName"]=>
  string(7) "argon2i"
  ["options"]=>
  array(3) {
    ["memory_cost"]=>
    int(1024)
    ["time_cost"]=>
    int(2)
    ["threads"]=>
    int(2)
  }
}

$ php7.3 -r 'var_dump( PHP_VERSION, password_get_info( password_hash( "", PASSWORD_ARGON2I ) ) );'
string(7) "7.3.8-1"
array(3) {
  ["algo"]=>
  int(2)
  ["algoName"]=>
  string(7) "argon2i"
  ["options"]=>
  array(3) {
    ["memory_cost"]=>
    int(65536)
    ["time_cost"]=>
    int(4)
    ["threads"]=>
    int(1)
  }
}
Krinkle moved this task from Untriaged to In progress on the Wikimedia-production-error (ARCHIVED -- Shared Build Failure) board.Aug 15 2019, 4:09 PM
Anomie edited projects, added Platform Team Workboards (Clinic Duty Team); removed Platform Engineering.Aug 16 2019, 6:47 PM
gerritbot added a comment.Aug 16 2019, 6:47 PM

Change 530624 had a related patch set uploaded (by Anomie; owner: Anomie):
[mediawiki/core@master] Handle changed defaults in Argon2PasswordTest::testPartialConfig()

https://gerrit.wikimedia.org/r/530624

gerritbot added a project: Patch-For-Review.Aug 16 2019, 6:47 PM
Anomie moved this task from Inbox to Waiting for Review on the Platform Team Workboards (Clinic Duty Team) board.Aug 16 2019, 6:47 PM
• Pchelolo moved this task from Waiting for Review to Done on the Platform Team Workboards (Clinic Duty Team) board.Aug 16 2019, 11:08 PM
• Pchelolo moved this task from Done to Waiting for Review on the Platform Team Workboards (Clinic Duty Team) board.
gerritbot added a comment.Aug 17 2019, 2:07 AM

Change 530624 merged by jenkins-bot:
[mediawiki/core@master] Handle changed defaults in Argon2PasswordTest::testPartialConfig()

https://gerrit.wikimedia.org/r/530624

Maintenance_bot removed a project: Patch-For-Review.Aug 17 2019, 2:10 AM
Krinkle closed this task as Resolved.Aug 17 2019, 3:19 PM
Krinkle assigned this task to Anomie.

capture.png (1×1 px, 125 KB)

Anomie moved this task from Waiting for Review to Done on the Platform Team Workboards (Clinic Duty Team) board.Aug 20 2019, 4:25 PM
ReleaseTaggerBot added a project: MW-1.34-notes (1.34.0-wmf.20; 2019-08-27).Aug 20 2019, 10:01 PM
• mmodell changed the subtype of this task from "Task" to "Production Error".Aug 28 2019, 11:05 PM
gerritbot added a comment.Sep 17 2019, 8:53 PM

Change 537548 had a related patch set uploaded (by Reedy; owner: Anomie):
[mediawiki/core@REL1_33] Handle changed defaults in Argon2PasswordTest::testPartialConfig()

https://gerrit.wikimedia.org/r/537548

gerritbot added a project: Patch-For-Review.Sep 17 2019, 8:53 PM
gerritbot added a comment.Sep 17 2019, 9:02 PM

Change 537548 merged by jenkins-bot:
[mediawiki/core@REL1_33] Handle changed defaults in Argon2PasswordTest::testPartialConfig()

https://gerrit.wikimedia.org/r/537548

Maintenance_bot removed a project: Patch-For-Review.Sep 17 2019, 9:10 PM
ReleaseTaggerBot added a project: MW-1.33-notes.Sep 17 2019, 10:00 PM
Aklapper removed a subscriber: Anomie.Oct 16 2020, 5:38 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits