Repository navigation
[3.14] gh-161383: Fix inverted FIPS property query in _hashlib - #161385
Closed
prashant1221 wants to merge 1 commit into
Closed
prashant1221 wants to merge 1 commit into
prashant1221 wants to merge 1 commit into
Conversation
In FIPS mode, usedforsecurity worked the wrong way round: usedforsecurity=False MD5 was refused, usedforsecurity=True MD5 was allowed, and hashlib.md5() fell back to the built-in _md5 without any error. disable_fips_property() returns 1 for usedforsecurity=False, but py_digest_by_name() uses 'fips' as "1 = strict FIPS lookup". main inverts the value with "!"; the 3.14 backport of pythongh-149816 (pythonGH-160006) lost it. Invert it after the -1 error check. Tests: - Add a FIPS-only test: MD5 must work with usedforsecurity=False and be refused with usedforsecurity=True. - Copy check_file_digest() from main (pythongh-136547). The 3.14 version checks hashlib.new(name), which works through the built-in MD5, and then also calls _hashlib.openssl_md5, which FIPS refuses. With only the C fix, test_case_md5_* fail in FIPS mode. The main version skips each blocked constructor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
All commit authors signed the Contributor License Agreement. |
Member
|
Thanks for the issue and PR, but please remember to check for duplicates first: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 3.14 backport of gh-149816 (GH-160006) lost the
!frommain'sint fips = !disable_fips_property(py_ht);. As a result,usedforsecurityworks the wrong way round in FIPS mode, andhashlib.md5()falls back to the built-in_md5without any error.Changes:
_hashopenssl.c: invertfipsafter the-1check. (!can't go on the first line as inmain:!-1would hide the error.)test_md5_usedforsecurity_in_fips_mode.check_file_digest()copied frommain(Allow tests to temporarily disable specific hash algorithms #136547). Without it,test_case_md5_*fail in FIPS mode once the C fix is in.Tested with OpenSSL 3.5.8 in FIPS mode (FIPS provider 3.5.4):
3.14: 14test_hashliberrors;test_hashlibandtest_hmacpass;Without FIPS mode, everything passes and the new test is skipped, as it will be in CI.
hashlib:usedforsecurityworks the wrong way round in FIPS mode in 3.14.10 #161383