Skip to content

bpo-44048: Fix two hashlib test cases under FIPS mode #26470

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 4, 2021
Merged

bpo-44048: Fix two hashlib test cases under FIPS mode #26470

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions Lib/test/test_hashlib.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -909,7 +909,11 @@ def test_disallow_instantiation(self):
continue
# all other types have DISALLOW_INSTANTIATION
for constructor in constructors:
h = constructor()
# In FIPS mode some algorithms are not available raising ValueError
try:
h = constructor()
except ValueError:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe check that the error message contains "unsupported hash type" as well? Ditto for the other test.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ValueError would be in this case: [digital envelope routines: EVP_DigestInit_ex] disabled for FIPS

However this is specific to OpenSSL in RHEL7 and RHEL8 under FIPS mode. I am not entirely sure what other linux distros would be showing with their downstream FIPS patches (although from the 3.0.0 version of OpenSSL, FIPS compatibility is native so it could be more standardized).

continue
with self.subTest(constructor=constructor):
support.check_disallow_instantiation(self, type(h))

Expand All @@ -923,7 +927,11 @@ def test_readonly_types(self):
for algorithm, constructors in self.constructors_to_test.items():
# all other types have DISALLOW_INSTANTIATION
for constructor in constructors:
hash_type = type(constructor())
# In FIPS mode some algorithms are not available raising ValueError
try:
hash_type = type(constructor())
except ValueError:
continue
with self.subTest(hash_type=hash_type):
with self.assertRaisesRegex(TypeError, "immutable type"):
hash_type.value = False
Expand Down