Repository navigation
test_socket.LinuxKernelCryptoAPI.test_hmac_sha1() fails on "AMD64 RHEL8 FIPS Only Blake2 Builtin Hash 3.x" buildbot #109396
Description
Bug report
When FIPS is enabled in Linux, LinuxKernelCryptoAPI.test_hmac_sha1() fails with OSError: [Errno 22] Invalid argument.
test.pythoninfo:
fips.linux_crypto_fips_enabled: 1
fips.openssl_fips_mode: 1
Error:
ERROR: test_hmac_sha1 (test.test_socket.LinuxKernelCryptoAPI.test_hmac_sha1)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/buildbot/buildarea/3.x.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/test/test_socket.py", line 6479, in test_hmac_sha1
algo.setsockopt(socket.SOL_ALG, socket.ALG_SET_KEY, b"Jefe")
OSError: [Errno 22] Invalid argument
build: https://buildbot.python.org/all/#/builders/469/builds/5995
Linked PRs
- gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode #109423
- [3.12] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) #109426
- [3.11] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) #109427
- [3.10] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) #125106
- [3.9] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) #125107
Activity
vstinner commentedon Sep 14, 2023
cc @stratakis
vstinner commentedon Sep 14, 2023
It seems like hmac in FIPS mode requires a key of at least 112 bits (14 bytes), whereas the test uses a key of 32 bits (4 bytes). See
hmac_setkey()in the master branch of the Linux kernel:https://github.com/torvalds/linux/blob/9fdfb15a3dbf818e06be514f4abbfc071004cbe7/crypto/hmac.c#L55-L56
pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode
pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode
gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (#109423)
pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (pytho…
pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (pytho…
[3.12] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-1…
[3.11] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-1…
[3.11] pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (…
[3.11] pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (…
encukou commentedon Oct 8, 2024
This fails on 3.10 & 3.9 buildbots, so let's backport there too.
[3.10] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-1…
[3.9] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-10…
[3.9] pythongh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (p…