Clicking on the Admin Users link generates "error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips"

[adrya.stembridge@…]

I recently upgraded our server from EL6 to EL7, however the major change is that this system is now running in FIPS mode. When systems are running in FIPS mode, MD5 hashing is not available.

Trac works OK, except when I go to Admin - Users (​https://example.com/trac/admin/accounts/users). The following error appears instead of the Users page:

Trac detected an internal error: 
"ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips"

Trac maintainers are addressing a similar error with notification.py by adding a configuration item allowing admins to select MD5 (default) or SHA1 for the digest algorithm. Previously, MD5 was hard coded into the python scripts.

​trac:#12562

Python Traceback

Most recent call last:
    File "/usr/lib/python2.7/site-packages/trac/web/main.py", line 554, in _dispatch_request
    File "/usr/lib/python2.7/site-packages/trac/web/main.py", line 247, in dispatch
    File "/usr/lib/python2.7/site-packages/trac/admin/web_ui.py", line 119, in process_request
    File "/usr/lib/python2.7/site-packages/acct_mgr/admin.py", line 204, in render_admin_panel
    File "/usr/lib/python2.7/site-packages/acct_mgr/admin.py", line 449, in _do_users
    File "/usr/lib/python2.7/site-packages/acct_mgr/admin.py", line 73, in fetch_user_data
    File "/usr/lib/python2.7/site-packages/acct_mgr/model.py", line 140, in get_user_attribute 

System Information:

Trac 	1.0.10
Babel 	0.9.6
Genshi 	0.7 (with speedups)
mod_wsgi 	3.4 (WSGIProcessGroup WSGIApplicationGroup %{GLOBAL})
pysqlite 	2.6.0
Python 	2.7.5 (default, Aug 9 2016, 05:27:46) [GCC 4.8.5 20150623 (Red Hat 4.8.5-4)]
setuptools 	0.9.8
SQLite 	3.7.17
jQuery	1.7.2
jQuery UI	1.8.21
jQuery Timepicker	1.0.1

Enabled Plugins:
CKIntegration 	1.1dev 	/usr/lib/python2.7/site-packages
TracAccountManager 	0.4.4 	/usr/lib/python2.7/site-packages

[adrya.stembridge@…]

Apologies for the formatting in the submitted bug report. I am unable to edit.

[Ryan J Ollos]

There are 3 uses of hashlib.md5 in accountmanagerplugin/trunk/acct_mgr/model.py@15717:475,493,499#L465​. I'll need to study the code to see if it's a simple matter of replacing the md5 hash method with another hash method.

[adrya.stembridge@…]

I noticed that as well. Could hash type be set as a config option rather than hard coding?

[adrya.stembridge@…]

The attached model.py works fine. I replaced md5 with sha1.

Note that my trac.ini [account-manager] section also contains htpasswd_hash_type = sha1

[adrya.stembridge@…]

changed md5 to sha1

[Jun Omae]

Could you please post patch as unified diff format rather than modified file? See ​trac:wiki:TracDev/SubmittingPatches.

[adrya.stembridge@…]

Yes, I'll work on this ASAP. Will be out of town this weekend, look for it next week. This would be my very first submitted patch to anything. :D

[adrya.stembridge@…]

Realized that I never attached the patch file. Just attached to this ticket.

[anonymous]

diff -Uaur ORIG_model.py NEW_model.py > patch.txt

[adrya.stembridge@…]

The updated file works fine - this issue could be marked closed, or once verified perhaps rolled into production?

[Jun Omae]

I noticed an issue about the hexdigest while refactoring the patch. Same hexdigest can be generated because account, authenticated and name are simply concatenated.

account	authenticated	name	concatenated string
foo	1	b0ah	foo1b0ah
foo1b	0	ah	foo1b0ah

Work around is to pad null byte between values:

accountmanagerplugin/trunk/acct_mgr/model.py

@@ -441 +441 @@
         """ % (sel_stmt, where_stmt)
     sql_args = tuple(constraints)
 
+    def unique_id(*values):
+        # Generate sha1 digest from NUL value1 NUL value2 NUL value3 NUL
+        m = hashlib.sha1()
+        m.update('\0')
+        for value in values:
+            if isinstance(value, unicode):
+                value = value.encode('utf-8')
+            elif not isinstance(value, str):
+                value = str(value)
+            m.update(value)
+            m.update('\0')
+        return m.hexdigest()
+
     res = {}
     for row in env.db_query(sql, sql_args):
         if sel_stmt == 'COUNT(*)':
@@ -452 +465 @@
         account = res_row.pop('sid')
         authenticated = res_row.pop('authenticated')
         # Create single unique attribute ID.
-        m = hashlib.md5()
-        m.update(''.join([account, str(authenticated),
-                          res_row.get('name')]).encode('utf-8'))
-        row_id = m.hexdigest()
+        row_id = unique_id(account, authenticated, res_row.get('name'))
         if account in res:
             if authenticated in res[account]:
                 res[account][authenticated].update({
@@ -470 +480 @@
                     'id': {res_row['name']: row_id}
                 }
                 # Create account ID for additional authentication state.
-                m = hashlib.md5()
-                m.update(''.join([account,
-                                  str(authenticated)]).encode('utf-8'))
-                res[account]['id'][authenticated] = m.hexdigest()
+                res[account]['id'][authenticated] = unique_id(account,
+                                                              authenticated)
         else:
             # Create account ID for authentication state.
-            m = hashlib.md5()
-            m.update(''.join([account, str(authenticated)]).encode('utf-8'))
             res[account] = {
                 authenticated: {
                     res_row['name']: res_row['value'],
                     'id': {res_row['name']: row_id}
                 },
-                'id': {authenticated: m.hexdigest()}
+                'id': {authenticated: unique_id(account, authenticated)}
             }
     return res
 

[Ryan J Ollos]

comment:12 change looks good to me. Please go ahead and commit that and any other changes you like.

[Jun Omae]

In 17222:

TracAccountManager: use sha1 rather than md5 which is not available with FIPS mode (closes #12854)

Initial patch by adrya.stembridge@…