Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode #109423

Merged
merged 1 commit into from
Sep 14, 2023

Conversation

vstinner
Copy link
Member

@vstinner vstinner commented Sep 14, 2023

Use a longer key: FIPS mode requires at least of at least 112 bits. The previous key was only 32 bits.

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
@vstinner
Copy link
Member Author

I tested manually that the change fix test_socket on the affected RHEL8 FIPS buildbot:

[vstinner@python-builder-rhel8-fips cpython]$ cat /proc/sys/crypto/fips_enabled
1

[vstinner@python-builder-rhel8-fips cpython]$ ./python -m test test_socket -v -m test_hmac_sha1
== CPython 3.13.0a0 (heads/main:d7dc3d9, Sep 14 2023, 16:42:17) [GCC 8.5.0 20210514 (Red Hat 8.5.0-18)]
== Linux-4.18.0-477.21.1.el8_8.x86_64-x86_64-with-glibc2.28 little-endian
(...)
Total tests: run=1 (filtered)
Total test files: run=1/1 (filtered)
Result: SUCCESS

@vstinner
Copy link
Member Author

By the way, this buildbot is running:

[vstinner@python-builder-rhel8-fips cpython]$ uname -r
4.18.0-477.21.1.el8_8.x86_64

[vstinner@python-builder-rhel8-fips cpython]$ cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.8 (Ootpa)

@vstinner vstinner added needs backport to 3.11 only security fixes needs backport to 3.12 bug and security fixes labels Sep 14, 2023
@vstinner vstinner enabled auto-merge (squash) September 14, 2023 21:01
@vstinner vstinner merged commit e091b9f into python:main Sep 14, 2023
@vstinner vstinner deleted the fips_hmac_sha1 branch September 14, 2023 21:24
@miss-islington
Copy link
Contributor

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 14, 2023
…nGH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

Co-authored-by: Victor Stinner <vstinner@python.org>
@bedevere-app
Copy link

bedevere-app bot commented Sep 14, 2023

GH-109426 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 bug and security fixes label Sep 14, 2023
@bedevere-app
Copy link

bedevere-app bot commented Sep 14, 2023

GH-109427 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Sep 14, 2023
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 14, 2023
…nGH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

Co-authored-by: Victor Stinner <vstinner@python.org>
@bedevere-bot
Copy link

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot s390x RHEL7 LTO 3.x has failed when building commit e091b9f.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/402/builds/5396) and take a look at the build logs.
  4. Check if the failure is related to this commit (e091b9f) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/all/#builders/402/builds/5396

Failed tests:

  • test.test_asyncio.test_subprocess

Failed subtests:

  • test_subprocess_consistent_callbacks - test.test_asyncio.test_subprocess.SubprocessThreadedWatcherTests.test_subprocess_consistent_callbacks

Summary of the results of the build (if available):

==

Click to see traceback logs
Traceback (most recent call last):
  File "/home/dje/cpython-buildarea/3.x.edelsohn-rhel-z.lto/build/Lib/test/test_asyncio/test_subprocess.py", line 788, in test_subprocess_consistent_callbacks
    self.loop.run_until_complete(main())
  File "/home/dje/cpython-buildarea/3.x.edelsohn-rhel-z.lto/build/Lib/asyncio/base_events.py", line 664, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/home/dje/cpython-buildarea/3.x.edelsohn-rhel-z.lto/build/Lib/test/test_asyncio/test_subprocess.py", line 780, in main
    self.assertEqual(events, [
AssertionError: Lists differ: ['process_exited', ('pipe_data_received', 1, b'stdout')] != [('pipe_data_received', 1, b'stdout'), ('p[95 chars]ted']

Yhg1s pushed a commit that referenced this pull request Sep 14, 2023
…09423) (#109426)

gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

Co-authored-by: Victor Stinner <vstinner@python.org>
@vstinner
Copy link
Member Author

The affected buildbot turned green (success): https://buildbot.python.org/all/#/builders/469/builds/6002 :-) It is the first time that it becomes green for a long time. It was failing for at least 3 weeks, but it's likely that it was never green.

vstinner added a commit that referenced this pull request Sep 14, 2023
…09423) (#109427)

gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

Co-authored-by: Victor Stinner <vstinner@python.org>
miss-islington added a commit to miss-islington/cpython that referenced this pull request Oct 8, 2024
…pythonGH-109423) (pythonGH-109427)

pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (pythonGH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

(cherry picked from commit f7bfac4)

Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
miss-islington added a commit to miss-islington/cpython that referenced this pull request Oct 8, 2024
…pythonGH-109423) (pythonGH-109427)

pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (pythonGH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

(cherry picked from commit f7bfac4)

Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
@bedevere-app
Copy link

bedevere-app bot commented Oct 8, 2024

GH-125106 is a backport of this pull request to the 3.10 branch.

@bedevere-app
Copy link

bedevere-app bot commented Oct 8, 2024

GH-125107 is a backport of this pull request to the 3.9 branch.

pablogsal pushed a commit that referenced this pull request Oct 22, 2024
…09423) (#125106)

[3.11] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) (GH-109427)

gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.
(cherry picked from commit e091b9f)

(cherry picked from commit f7bfac4)

Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
ambv pushed a commit that referenced this pull request Nov 4, 2024
…9423) (GH-125107)

Use a longer key: FIPS mode requires at least of at least 112 bits.
The previous key was only 32 bits.

(cherry picked from commit e091b9f)
(cherry picked from commit f7bfac4)

Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
tests Tests in the Lib/test dir
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants