Bug 2054785

Summary:	python-cryptography does not detect fips mode
Product:	Red Hat Enterprise Linux 9	Reporter:	Ade Lee <alee>
Component:	python-cryptography	Assignee:	Christian Heimes <cheimes>
Status:	CLOSED ERRATA	QA Contact:	Kaleem <ksiddiqu>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	CentOS Stream	CC:	bstinson, cheimes, jwboyer, lmiksik, myusuf, ssidhaye, sumenon
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	python-cryptography-36.0.1-1.el9_0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2062814 (view as bug list)		Environment:
Last Closed:	2022-05-17 13:45:50 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2059630
Bug Blocks:	2055209, 2062814

Description Ade Lee 2022-02-15 17:11:17 UTC

Description of problem:

The code that is python-cryptography in version 3.4.7-6 does not detect fips mode on rhel 9 because it has not been updated for OpenSSL 3.0.

https://github.com/pyca/cryptography/blob/3.4.x/src/cryptography/hazmat/backends/openssl/backend.py#L243-L249 

It needs to be updated to something that looks like :

https://github.com/pyca/cryptography/blob/main/src/cryptography/hazmat/backends/openssl/backend.py#L211-L222

Note: this is blocking OpenStack testing of FIPS mode in centos/rhel9.

Version-Release number of selected component (if applicable):


How reproducible:

Always

Steps to Reproduce:
1. On a FIPS mode Centos-9 machine

cheimes> >>> from cryptography.hazmat.backends.openssl import backend
<cheimes> >>> backend._is_fips_enabled()
<cheimes> False
<cheimes> $ cat /proc/sys/crypto/fips_enabled 
<cheimes> 1

Actual results:


Expected results:


Additional info:

Comment 1 Christian Heimes 2022-02-15 17:19:30 UTC

OpenSSL 3.0.0 FIPS fixes were added in upstream PR https://github.com/pyca/cryptography/pull/6012.

Comment 12 Sumedh Sidhaye 2022-03-14 07:50:54 UTC

Verifying using the latest RHEL 9.0 nightly repos

[root@ci-vm-10-0-137-195 ~]# rpm -qa python3-cryptography
python3-cryptography-36.0.1-1.el9_0.x86_64
[root@ci-vm-10-0-137-195 ~]# python3
Python 3.9.10 (main, Feb  9 2022, 00:00:00) 
[GCC 11.2.1 20220127 (Red Hat 11.2.1-9)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from cryptography.hazmat.backends.openssl import backend
>>> backend._is_fips_enabled()
True
>>> from cryptography.hazmat.primitives.ciphers import algorithms, modes
>>> backend.cipher_supported(algorithms.TripleDES(b"\x00" * 8), modes.CBC(b"\x00" * 8))
False
>>> 
[root@ci-vm-10-0-137-195 ~]# sysctl crypto.fips_enabled
crypto.fips_enabled = 1
[root@ci-vm-10-0-137-195 ~]# 

Based on above results marking bugzilla verified.

Comment 15 errata-xmlrpc 2022-05-17 13:45:50 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: python-cryptography), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2580