Bug 2152741

Description of problem:

suds Reader.mangle() invokes hashlib.md5. md5 is not FIPS-compliant and is thus disabled when FIPS is enabled.

As a result, the fence_vmware_soap fence agent for High Availability clusters is broken when FIPS is enabled. This is one of our most commonly used fence agents, and it relies on suds. There is no known workaround, as suds does not allow a client to disable mangling or choose a different mangling method. Further, for many users of fence_vmware_soap, there is no other viable fence agent for their environment.

It is crucial that we get a fix for this. Otherwise, it will render High Availability clustering unusable in many VMware environments where FIPS is enabled on the guest OS.


Version-Release number of selected component (if applicable):
Python "suds" module available in "fence-agents-common" for Rhel 9:

# rpm -q fence-agents-common
fence-agents-common-4.10.0-20.el9_0.2.noarch


How reproducible:
1. Enable FIPS mode.
2. Open a python3 interpreter and run:

Steps to Reproduce:
[root@clustera-rhel9 ~]# python3
Python 3.9.10 (main, Feb  9 2022, 00:00:00)
[GCC 11.2.1 20220127 (Red Hat 11.2.1-9)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import sys
>>> sys.path.insert(0, '/usr/lib/fence-agents/support/common')
>>> from suds.options import Options
>>> from suds.wsdl import Definitions
>>> from suds.reader import DefinitionsReader
>>> reader = DefinitionsReader(Options(), Definitions)


Actual results:

>>> reader.open('https://www.example.com')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/fence-agents/support/common/suds/reader.py", line 101, in open
    id = self.mangle(url, "wsdl")
  File "/usr/lib/fence-agents/support/common/suds/reader.py", line 61, in mangle
    h = md5(name.encode()).hexdigest()
ValueError: [digital envelope routines] unsupported


Expected results:

No "disabled for FIPS" exception. There will be a different exception if you use incorrect options like I did, or it should succeed if you use valid options.


Additional info:

This issue was corrected in Rhel 8 with the below bugs:

    1921920 – suds Reader classes break when FIPS is enabled
    https://bugzilla.redhat.com/show_bug.cgi?id=1921920

    2059753 – suds Reader classes break when FIPS is enabled [rhel-8.5.0.z]
    https://bugzilla.redhat.com/show_bug.cgi?id=2059753

    2059752 – suds Reader classes break when FIPS is enabled [rhel-8.4.0.z]
    https://bugzilla.redhat.com/show_bug.cgi?id=2059752

The below fix does not appear to be available in RHEL 9:

  - Use usedforsecurity=False for md5() calls to make suds work on FIPS enabled systems by oalbrigt · Pull Request #72 · suds-community/suds 
    https://github.com/suds-community/suds/pull/72/commits/9bdefdaeb1238f0bbed2a0d36215717990e13949

Do not see that patch in our version of suds:

    # rpm -q fence-agents-common
    fence-agents-common-4.10.0-30.el9_1.1.noarch

    # grep "usedforsecurity" /usr/lib/fence-agents/support/common/suds/reader.py
    # echo $? 
    1

We are running the unpatched version:

    # grep md5 /usr/lib/fence-agents/support/common/suds/reader.py
      from hashlib import md5
      # 'md5' package in older Python versions.
      from md5 import md5
          h = md5(name.encode()).hexdigest()