#28401: django doesn't work with FIPS kernels
-----------------------------------------+---------------------------
Reporter: Andrew | Owner: nobody
Type: Bug | Status: new
Component: Uncategorized | Version: master
Severity: Normal | Keywords: FIPS, md5
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+---------------------------
Specifically, every use of hashlib.md5() is an issue for FIPS kernels
which lack openssl support for md5. However, at least on RHEL and Centos,
hashlib.new() supports the usedforsecurity=False flag that allows you to
bypass the FIPS prohibition on md5. Many of the cases in which the md5
function is used qualify as non-security uses since it is used to mainly
truncate values. Of course the md5 auth backends would constitute a
security usages and should not include the usedforsecurity=False and thus
should fail on FIPS systems.
Therefore i propose that we add the usedforsecurity=False flag where
warranted and handling in case some versions of python do not support this
flag. (I tested python 2.7 on OSX and it errors when the usedforsecurity
flag is set). If everyone this this is a good plan I will go ahead and
make a PR.
list of all useages of hashlib.md5
[https://github.com/django/django/search?q=hashlib.md5&type=Code&utf8=%E2%9C%93]
django-developers thread
[https://groups.google.com/forum/#!msg/django-
developers/dlUIPzQgnpM/Mtl7CQbPAQAJ]
django-users thread
[https://groups.google.com/forum/#!topic/django-users/THJdhaKo-ng]
Example stack trace:
{{{
Operations to perform:
Apply all migrations: admin, auth, contenttypes, dashboard,
kombu_transport_django, sessions
Running migrations:
Applying contenttypes.0001_initial...Traceback (most recent call last):
File "manage.py", line 10, in <module>
execute_from_command_line(sys.argv)
File "/usr/lib64/python2.7/site-
packages/django/core/management/__init__.py", line 367, in
execute_from_command_line
utility.execute()
File "/usr/lib64/python2.7/site-
packages/django/core/management/__init__.py", line 359, in execute
self.fetch_command(subcommand).run_from_argv(self.argv)
File "/usr/lib64/python2.7/site-
packages/django/core/management/base.py", line 294, in run_from_argv
self.execute(*args, **cmd_options)
File "/usr/lib64/python2.7/site-
packages/django/core/management/base.py", line 345, in execute
output = self.handle(*args, **options)
File "/usr/lib64/python2.7/site-
packages/django/core/management/commands/migrate.py", line 204, in handle
fake_initial=fake_initial,
File "/usr/lib64/python2.7/site-
packages/django/db/migrations/executor.py", line 115, in migrate
state = self._migrate_all_forwards(state, plan, full_plan, fake=fake,
fake_initial=fake_initial)
File "/usr/lib64/python2.7/site-
packages/django/db/migrations/executor.py", line 145, in
_migrate_all_forwards
state = self.apply_migration(state, migration, fake=fake,
fake_initial=fake_initial)
File "/usr/lib64/python2.7/site-
packages/django/db/migrations/executor.py", line 244, in apply_migration
state = migration.apply(state, schema_editor)
File "/usr/lib64/python2.7/site-
packages/django/db/migrations/migration.py", line 129, in apply
operation.database_forwards(self.app_label, schema_editor, old_state,
project_state)
File "/usr/lib64/python2.7/site-
packages/django/db/migrations/operations/models.py", line 532, in
database_forwards
getattr(new_model._meta, self.option_name, set()),
File "/usr/lib64/python2.7/site-
packages/django/db/backends/base/schema.py", line 333, in
alter_unique_together
self.execute(self._create_unique_sql(model, columns))
File "/usr/lib64/python2.7/site-
packages/django/db/backends/base/schema.py", line 913, in
_create_unique_sql
"name": self.quote_name(self._create_index_name(model, columns,
suffix="_uniq")),
File "/usr/lib64/python2.7/site-
packages/django/db/backends/base/schema.py", line 819, in
_create_index_name
index_unique_name = '_%s' % self._digest(table_name, *column_names)
File "/usr/lib64/python2.7/site-
packages/django/db/backends/base/schema.py", line 123, in _digest
h = hashlib.md5()
ValueError: error:060800A3:digital envelope
routines:EVP_DigestInit_ex:disabled for fips
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28401>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/049.8a56263c25fe91fa0a5a3779941cb508%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
