Description of problem:

suds Reader.mangle() invokes hashlib.md5. md5 is not FIPS-compliant and is thus disabled when FIPS is enabled.

As a result, the fence_vmware_soap fence agent for High Availability clusters is broken when FIPS is enabled. This is one of our most commonly used fence agents, and it relies on suds. There is no known workaround, as suds does not allow a client to disable mangling or choose a different mangling method. Further, for many users of fence_vmware_soap, there is no other viable fence agent for their environment.

It is crucial that we get a fix for this. Otherwise, it will render High Availability clustering unusable in many VMware environments where FIPS is enabled on the guest OS.


Below is a fence_vmware_soap demo with FIPS enabled and a traceback.print_exc() call added. These are invalid credentials and address so no need to hide them.

[root@fastvm-rhel-8-0-23 ~]# fence_vmware_soap -v -a 1.2.3.4 -l login -p password --ssl-insecure -n asdf
Traceback (most recent call last):
  File "/usr/sbin/fence_vmware_soap", line 60, in soap_login
    conn = Client(url + "/vimService.wsdl", location=url, transport=RequestsTransport(verify=verify), headers=headers)
  File "/usr/lib/python3.6/site-packages/suds/client.py", line 120, in __init__
    self.wsdl = reader.open(url)
  File "/usr/lib/python3.6/site-packages/suds/reader.py", line 101, in open
    id = self.mangle(url, "wsdl")
  File "/usr/lib/python3.6/site-packages/suds/reader.py", line 61, in mangle
    h = md5(name.encode()).hexdigest()
ValueError: [digital envelope routines: EVP_DigestInit_ex] disabled for FIPS
2021-01-28 11:43:07,219 ERROR: Unable to connect/login to fencing device

-----

Version-Release number of selected component (if applicable):

python3-suds-0.7-0.8.94664ddd46a6.el8.noarch

-----

How reproducible:

Always

-----

Steps to Reproduce:
1. Enable FIPS mode.
2. Open a python3 interpreter and run:

>>> from suds.options import Options
>>> from suds.reader import DefinitionsReader
>>> from suds.wsdl import Definitions
>>> reader = DefinitionsReader(Options(), Definitions)
>>> reader.open('https://www.example.com')

-----

Actual results:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.6/site-packages/suds/reader.py", line 102, in open
    id = self.mangle(url, "wsdl")
  File "/usr/lib/python3.6/site-packages/suds/reader.py", line 61, in mangle
    h = md5(name.encode()).hexdigest()
ValueError: [digital envelope routines: EVP_DigestInit_ex] disabled for FIPS

-----

Expected results:

No "disabled for FIPS" exception. There will be a different exception if you use incorrect options like I did, or it should succeed if you use valid options.