GeezerVison is showing github.com — [3.14] gh-161383: Fix inverted FIPS property query in _hashlib by prashant1221 · Pull Request #161385 · python/cpython
Conversation
prashant1221
commented
Nov 5, 2026
•
edited by bedevere-app
Bot
Loading
Uh oh!
There was an error while loading. Please reload this page.
The 3.14 backport of gh-149816 (GH-160006) lost the ! from main's int fips = !disable_fips_property(py_ht);. As a result, usedforsecurity works the wrong way round in FIPS mode, and hashlib.md5() falls back to the built-in _md5 without any error.
Changes:
_hashopenssl.c: invert fips after the -1 check. (! can't go on the first line as in main: !-1 would hide the error.)- New FIPS-only test
test_md5_usedforsecurity_in_fips_mode.
check_file_digest() copied from main (Allow tests to temporarily disable specific hash algorithms #136547). Without it, test_case_md5_* fail in FIPS mode once the C fix is in.
Tested with OpenSSL 3.5.8 in FIPS mode (FIPS provider 3.5.4):
- current
3.14: 14 test_hashlib errors;
- this PR:
test_hashlib and test_hmac pass;
- C fix reverted: the new test fails.
Without FIPS mode, everything passes and the new test is skipped, as it will be in CI.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
In FIPS mode, usedforsecurity worked the wrong way round:
usedforsecurity=False MD5 was refused, usedforsecurity=True MD5 was
allowed, and hashlib.md5() fell back to the built-in _md5 without any
error.
disable_fips_property() returns 1 for usedforsecurity=False, but
py_digest_by_name() uses 'fips' as "1 = strict FIPS lookup". main
inverts the value with "!"; the 3.14 backport of pythongh-149816 (pythonGH-160006)
lost it. Invert it after the -1 error check.
Tests:
- Add a FIPS-only test: MD5 must work with usedforsecurity=False and be
refused with usedforsecurity=True.
- Copy check_file_digest() from main (pythongh-136547). The 3.14 version
checks hashlib.new(name), which works through the built-in MD5, and
then also calls _hashlib.openssl_md5, which FIPS refuses. With only
the C fix, test_case_md5_* fail in FIPS mode. The main version skips
each blocked constructor.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
|
All commit authors signed the Contributor License Agreement.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
Thanks for the issue and PR, but please remember to check for duplicates first:
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Reviewers
gpshead
Awaiting requested review from gpshead
gpshead is a code owner
picnixz
Awaiting requested review from picnixz
picnixz is a code owner
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.