Skip to content

Conversation

@vstinner
Copy link
Member

@vstinner vstinner commented Sep 14, 2023

Use a longer key: FIPS mode requires at least of at least 112 bits. The previous key was only 32 bits.

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
@vstinner
Copy link
Member Author

I tested manually that the change fix test_socket on the affected RHEL8 FIPS buildbot:

[vstinner@python-builder-rhel8-fips cpython]$ cat /proc/sys/crypto/fips_enabled
1

[vstinner@python-builder-rhel8-fips cpython]$ ./python -m test test_socket -v -m test_hmac_sha1
== CPython 3.13.0a0 (heads/main:d7dc3d9, Sep 14 2023, 16:42:17) [GCC 8.5.0 20210514 (Red Hat 8.5.0-18)]
== Linux-4.18.0-477.21.1.el8_8.x86_64-x86_64-with-glibc2.28 little-endian
(...)
Total tests: run=1 (filtered)
Total test files: run=1/1 (filtered)
Result: SUCCESS

@vstinner
Copy link
Member Author

By the way, this buildbot is running:

[vstinner@python-builder-rhel8-fips cpython]$ uname -r
4.18.0-477.21.1.el8_8.x86_64

[vstinner@python-builder-rhel8-fips cpython]$ cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.8 (Ootpa)

@vstinner vstinner added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Sep 14, 2023
@vstinner vstinner enabled auto-merge (squash) September 14, 2023 21:01
@vstinner vstinner merged commit e091b9f into python:main Sep 14, 2023
@vstinner vstinner deleted the fips_hmac_sha1 branch September 14, 2023 21:24
@miss-islington
Copy link
Contributor

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 14, 2023
…nGH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

Co-authored-by: Victor Stinner <[email protected]>
@bedevere-app
Copy link

bedevere-app bot commented Sep 14, 2023

GH-109426 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Sep 14, 2023
@bedevere-app
Copy link

bedevere-app bot commented Sep 14, 2023

GH-109427 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Sep 14, 2023
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 14, 2023
…nGH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

Co-authored-by: Victor Stinner <[email protected]>
@bedevere-bot
Copy link

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot s390x RHEL7 LTO 3.x has failed when building commit e091b9f.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/402/builds/5396) and take a look at the build logs.
  4. Check if the failure is related to this commit (e091b9f) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/all/#builders/402/builds/5396

Failed tests:

  • test.test_asyncio.test_subprocess

Failed subtests:

  • test_subprocess_consistent_callbacks - test.test_asyncio.test_subprocess.SubprocessThreadedWatcherTests.test_subprocess_consistent_callbacks

Summary of the results of the build (if available):

==

Click to see traceback logs
Traceback (most recent call last):
  File "/home/dje/cpython-buildarea/3.x.edelsohn-rhel-z.lto/build/Lib/test/test_asyncio/test_subprocess.py", line 788, in test_subprocess_consistent_callbacks
    self.loop.run_until_complete(main())
  File "/home/dje/cpython-buildarea/3.x.edelsohn-rhel-z.lto/build/Lib/asyncio/base_events.py", line 664, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/home/dje/cpython-buildarea/3.x.edelsohn-rhel-z.lto/build/Lib/test/test_asyncio/test_subprocess.py", line 780, in main
    self.assertEqual(events, [
AssertionError: Lists differ: ['process_exited', ('pipe_data_received', 1, b'stdout')] != [('pipe_data_received', 1, b'stdout'), ('p[95 chars]ted']

Yhg1s pushed a commit that referenced this pull request Sep 14, 2023
…09423) (#109426)

gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

Co-authored-by: Victor Stinner <[email protected]>
@vstinner
Copy link
Member Author

The affected buildbot turned green (success): https://buildbot.python.org/all/#/builders/469/builds/6002 :-) It is the first time that it becomes green for a long time. It was failing for at least 3 weeks, but it's likely that it was never green.

vstinner added a commit that referenced this pull request Sep 14, 2023
…09423) (#109427)

gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

Co-authored-by: Victor Stinner <[email protected]>
miss-islington added a commit to miss-islington/cpython that referenced this pull request Oct 8, 2024
…pythonGH-109423) (pythonGH-109427)

pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (pythonGH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

(cherry picked from commit f7bfac4)

Co-authored-by: Miss Islington (bot) <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
miss-islington added a commit to miss-islington/cpython that referenced this pull request Oct 8, 2024
…pythonGH-109423) (pythonGH-109427)

pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (pythonGH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

(cherry picked from commit f7bfac4)

Co-authored-by: Miss Islington (bot) <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
@bedevere-app
Copy link

bedevere-app bot commented Oct 8, 2024

GH-125106 is a backport of this pull request to the 3.10 branch.

@bedevere-app
Copy link

bedevere-app bot commented Oct 8, 2024

GH-125107 is a backport of this pull request to the 3.9 branch.

pablogsal pushed a commit that referenced this pull request Oct 22, 2024
…09423) (#125106)

[3.11] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) (GH-109427)

gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

(cherry picked from commit f7bfac4)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
ambv pushed a commit that referenced this pull request Nov 4, 2024
…9423) (GH-125107)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.

(cherry picked from commit e091b9f)
(cherry picked from commit f7bfac4)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Apr 9, 2025
…ythonGH-109423) (pythonGH-125107)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.

(cherry picked from commit e091b9f)
(cherry picked from commit f7bfac4)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

tests Tests in the Lib/test dir

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants