From 481ca5869e7ded9587be808aa5338cabb7ede5ad Mon Sep 17 00:00:00 2001 From: Prashant S Chauhan Date: Fri, 8 Sep 2023 05:06:43 +0000 Subject: [PATCH] multiprocessing library use HMAC-SHA256 in FIPS mode --- Lib/multiprocessing/connection.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py index b08144f7a1..457d7320c1 100644 --- a/Lib/multiprocessing/connection.py +++ b/Lib/multiprocessing/connection.py @@ -735,7 +735,11 @@ def deliver_challenge(connection, authkey): "Authkey must be bytes, not {0!s}".format(type(authkey))) message = os.urandom(MESSAGE_LENGTH) connection.send_bytes(CHALLENGE + message) - digest = hmac.new(authkey, message, 'md5').digest() + try: + digest = hmac.new(authkey, message, 'md5').digest() + except ValueError: + # If FIPS mode i.e MD5 is not supported use SHA-256 protocol + digest = hmac.new(authkey, message, 'sha256').digest() response = connection.recv_bytes(256) # reject large message if response == digest: connection.send_bytes(WELCOME) @@ -751,7 +755,11 @@ def answer_challenge(connection, authkey): message = connection.recv_bytes(256) # reject large message assert message[:len(CHALLENGE)] == CHALLENGE, 'message = %r' % message message = message[len(CHALLENGE):] - digest = hmac.new(authkey, message, 'md5').digest() + try: + digest = hmac.new(authkey, message, 'md5').digest() + except ValueError: + # If FIPS mode i.e MD5 is not supported use SHA-256 protocol + digest = hmac.new(authkey, message, 'sha256').digest() connection.send_bytes(digest) response = connection.recv_bytes(256) # reject large message if response != WELCOME: -- 2.35.6