Description of problem:

In FIPS mode, comman "ispec newhostkey" fails during HMAC integrity verification when generating RSA key:

# cat /proc/sys/crypto/fips_enabled 
1
# ipsec newhostkey
FIPS HMAC integrity verification test failed.

Apparently, it tries to verify HMAC integrity for rsasigkey binary:

# strace -f ipsec newhostkey
...
[pid 15129] open("/usr/lib64/fipscheck/rsasigkey.hmac", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 15129] open("/usr/libexec/ipsec/.rsasigkey.hmac", O_RDONLY) = -1 ENOENT (No such file or directory)
...

It is because function rsasigkey() in programs/rsasigkey/rsasigkey.c contains the following code:

#ifdef FIPS_CHECK
	if (PK11_IsFIPS() && !FIPSCHECK_verify(NULL, NULL)) {
		fprintf(stderr,
			"FIPS HMAC integrity verification test failed.\n");
		exit(1);
	}
#endif

Since RHEL-7.5 libreswan ships HMAC only for pluto binary and hence aforementioned code is no longer needed.

Version-Release number of selected component (if applicable):

libreswan-3.23-3.el7

How reproducible:

100% (in FIPS mode)

Steps to Reproduce:

1. Enable FIPS mode
2. ipsec initnss
3. ipsec newhostkey

Actual results:

FIPS HMAC integrity verification test failed.

Expected results:

Generated RSA key pair with CKAID ... was stored in the NSS database

Additional info:

 * When FIPS mode is disabled, RSA key is generated correctly.
 * This is not really a regression, since standard tools for key generation
   work in FIPS mode correctly (openssl, NSS, ...).