churchyard / rpms / python3

Forked from rpms/python3 6 years ago
Clone

Blame 00146-hashlib-fips.patch

6cd1c5f
diff --git a/Lib/hashlib.py b/Lib/hashlib.py
6cd1c5f
index 316cece..b7ad879 100644
6cd1c5f
--- a/Lib/hashlib.py
6cd1c5f
+++ b/Lib/hashlib.py
6cd1c5f
@@ -23,6 +23,16 @@ the zlib module.
b8f92b4
 Choose your hash function wisely.  Some have known collision weaknesses.
b8f92b4
 sha384 and sha512 will be slow on 32 bit platforms.
b8f92b4
 
b8f92b4
+If the underlying implementation supports "FIPS mode", and this is enabled, it
b8f92b4
+may restrict the available hashes to only those that are compliant with FIPS
b8f92b4
+regulations.  For example, it may deny the use of MD5, on the grounds that this
b8f92b4
+is not secure for uses such as authentication, system integrity checking, or
b8f92b4
+digital signatures.   If you need to use such a hash for non-security purposes
b8f92b4
+(such as indexing into a data structure for speed), you can override the keyword
b8f92b4
+argument "usedforsecurity" from True to False to signify that your code is not
b8f92b4
+relying on the hash for security purposes, and this will allow the hash to be
b8f92b4
+usable even in FIPS mode.
b8f92b4
+
b8f92b4
 Hash objects have these methods:
b8f92b4
  - update(arg): Update the hash object with the bytes in arg. Repeated calls
b8f92b4
                 are equivalent to a single call with the concatenation of all
6cd1c5f
@@ -62,6 +72,18 @@ algorithms_available = set(__always_supported)
aa3d055
 __all__ = __always_supported + ('new', 'algorithms_guaranteed',
aa3d055
                                 'algorithms_available', 'pbkdf2_hmac')
aa3d055
 
aa3d055
+import functools
aa3d055
+def __ignore_usedforsecurity(func):
aa3d055
+    """Used for sha3_* functions. Until OpenSSL implements them, we want
aa3d055
+    to use them from Python _sha3 module, but we want them to accept
aa3d055
+    usedforsecurity argument too."""
aa3d055
+    # TODO: remove this function when OpenSSL implements sha3
aa3d055
+    @functools.wraps(func)
aa3d055
+    def inner(*args, **kwargs):
aa3d055
+        if 'usedforsecurity' in kwargs:
aa3d055
+            kwargs.pop('usedforsecurity')
aa3d055
+        return func(*args, **kwargs)
aa3d055
+    return inner
aa3d055
 
aa3d055
 __builtin_constructor_cache = {}
aa3d055
 
6cd1c5f
@@ -100,31 +122,39 @@ def __get_openssl_constructor(name):
b8f92b4
         f = getattr(_hashlib, 'openssl_' + name)
b8f92b4
         # Allow the C module to raise ValueError.  The function will be
b8f92b4
         # defined but the hash not actually available thanks to OpenSSL.
b8f92b4
-        f()
b8f92b4
+        # We pass "usedforsecurity=False" to disable FIPS-based restrictions:
b8f92b4
+        # at this stage we're merely seeing if the function is callable,
b8f92b4
+        # rather than using it for actual work.
b8f92b4
+        f(usedforsecurity=False)
b8f92b4
         # Use the C function directly (very fast)
b8f92b4
         return f
b8f92b4
     except (AttributeError, ValueError):
f0b0ffc
+        # TODO: We want to just raise here when OpenSSL implements sha3
f0b0ffc
+        # because we want to make sure that Fedora uses everything from OpenSSL
f0b0ffc
         return __get_builtin_constructor(name)
b8f92b4
 
b8f92b4
 
b8f92b4
-def __py_new(name, data=b''):
b8f92b4
-    """new(name, data=b'') - Return a new hashing object using the named algorithm;
b8f92b4
-    optionally initialized with data (which must be bytes).
f0b0ffc
+def __py_new(name, data=b'', usedforsecurity=True):
f0b0ffc
+    """new(name, data=b'', usedforsecurity=True) - Return a new hashing object using
f0b0ffc
+    the named algorithm; optionally initialized with data (which must be bytes).
b8f92b4
+    The 'usedforsecurity' keyword argument does nothing, and is for compatibilty
b8f92b4
+    with the OpenSSL implementation
b8f92b4
     """
b8f92b4
     return __get_builtin_constructor(name)(data)
b8f92b4
 
b8f92b4
 
b8f92b4
-def __hash_new(name, data=b''):
b8f92b4
-    """new(name, data=b'') - Return a new hashing object using the named algorithm;
b8f92b4
-    optionally initialized with data (which must be bytes).
b8f92b4
+def __hash_new(name, data=b'', usedforsecurity=True):
b8f92b4
+    """new(name, data=b'', usedforsecurity=True) - Return a new hashing object using
b8f92b4
+    the named algorithm; optionally initialized with data (which must be bytes).
b8f92b4
+    
b8f92b4
+    Override 'usedforsecurity' to False when using for non-security purposes in
b8f92b4
+    a FIPS environment
b8f92b4
     """
b8f92b4
     try:
b8f92b4
-        return _hashlib.new(name, data)
b8f92b4
+        return _hashlib.new(name, data, usedforsecurity)
b8f92b4
     except ValueError:
b8f92b4
-        # If the _hashlib module (OpenSSL) doesn't support the named
b8f92b4
-        # hash, try using our builtin implementations.
b8f92b4
-        # This allows for SHA224/256 and SHA384/512 support even though
b8f92b4
-        # the OpenSSL library prior to 0.9.8 doesn't provide them.
f0b0ffc
+        # TODO: We want to just raise here when OpenSSL implements sha3
f0b0ffc
+        # because we want to make sure that Fedora uses everything from OpenSSL
f0b0ffc
         return __get_builtin_constructor(name)(data)
b8f92b4
 
6cd1c5f
 
6cd1c5f
@@ -207,7 +237,10 @@ for __func_name in __always_supported:
f0b0ffc
     # try them all, some may not work due to the OpenSSL
f0b0ffc
     # version not supporting that algorithm.
f0b0ffc
     try:
f0b0ffc
-        globals()[__func_name] = __get_hash(__func_name)
f0b0ffc
+        func = __get_hash(__func_name)
f0b0ffc
+        if 'sha3_' in __func_name:
f0b0ffc
+            func = __ignore_usedforsecurity(func)
f0b0ffc
+        globals()[__func_name] = func
f0b0ffc
     except ValueError:
f0b0ffc
         import logging
f0b0ffc
         logging.exception('code for hash %s was not found.', __func_name)
6cd1c5f
@@ -215,3 +248,4 @@ for __func_name in __always_supported:
f0b0ffc
 # Cleanup locals()
f0b0ffc
 del __always_supported, __func_name, __get_hash
f0b0ffc
 del __py_new, __hash_new, __get_openssl_constructor
f0b0ffc
+del __ignore_usedforsecurity
6cd1c5f
\ No newline at end of file
6cd1c5f
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
6cd1c5f
index c9b113e..60e2392 100644
6cd1c5f
--- a/Lib/test/test_hashlib.py
6cd1c5f
+++ b/Lib/test/test_hashlib.py
6cd1c5f
@@ -24,7 +24,22 @@ from test.support import _4G, bigmemtest, import_fresh_module
8fffc96
 COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount')
b8f92b4
 
8fffc96
 c_hashlib = import_fresh_module('hashlib', fresh=['_hashlib'])
8fffc96
-py_hashlib = import_fresh_module('hashlib', blocked=['_hashlib'])
8fffc96
+# skipped on Fedora, since we always use OpenSSL implementation
8fffc96
+# py_hashlib = import_fresh_module('hashlib', blocked=['_hashlib'])
8fffc96
+
b8f92b4
+def openssl_enforces_fips():
b8f92b4
+    # Use the "openssl" command (if present) to try to determine if the local
b8f92b4
+    # OpenSSL is configured to enforce FIPS
b8f92b4
+    from subprocess import Popen, PIPE
b8f92b4
+    try:
b8f92b4
+        p = Popen(['openssl', 'md5'],
b8f92b4
+                  stdin=PIPE, stdout=PIPE, stderr=PIPE)
b8f92b4
+    except OSError:
b8f92b4
+        # "openssl" command not found
b8f92b4
+        return False
b8f92b4
+    stdout, stderr = p.communicate(input=b'abc')
b8f92b4
+    return b'unknown cipher' in stderr
b8f92b4
+OPENSSL_ENFORCES_FIPS = openssl_enforces_fips()
8fffc96
 
b8f92b4
 def hexstr(s):
b8f92b4
     assert isinstance(s, bytes), repr(s)
6cd1c5f
@@ -34,6 +49,16 @@ def hexstr(s):
b8f92b4
         r += h[(i >> 4) & 0xF] + h[i & 0xF]
b8f92b4
     return r
b8f92b4
 
b8f92b4
+# hashlib and _hashlib-based functions support a "usedforsecurity" keyword
b8f92b4
+# argument, and FIPS mode requires that it be used overridden with a False
b8f92b4
+# value for these selftests to work.  Other cryptographic code within Python
b8f92b4
+# doesn't support this keyword.
b8f92b4
+# Modify a function to one in which "usedforsecurity=False" is added to the
b8f92b4
+# keyword arguments:
b8f92b4
+def suppress_fips(f):
b8f92b4
+    def g(*args, **kwargs):
b8f92b4
+        return f(*args, usedforsecurity=False, **kwargs)
b8f92b4
+    return g
b8f92b4
 
b8f92b4
 class HashLibTestCase(unittest.TestCase):
b8f92b4
     supported_hash_names = ( 'md5', 'MD5', 'sha1', 'SHA1',
6cd1c5f
@@ -63,11 +88,11 @@ class HashLibTestCase(unittest.TestCase):
b8f92b4
         # For each algorithm, test the direct constructor and the use
b8f92b4
         # of hashlib.new given the algorithm name.
b8f92b4
         for algorithm, constructors in self.constructors_to_test.items():
b8f92b4
-            constructors.add(getattr(hashlib, algorithm))
b8f92b4
+            constructors.add(suppress_fips(getattr(hashlib, algorithm)))
b8f92b4
             def _test_algorithm_via_hashlib_new(data=None, _alg=algorithm):
b8f92b4
                 if data is None:
b8f92b4
-                    return hashlib.new(_alg)
b8f92b4
-                return hashlib.new(_alg, data)
b8f92b4
+                    return suppress_fips(hashlib.new)(_alg)
b8f92b4
+                return suppress_fips(hashlib.new)(_alg, data)
b8f92b4
             constructors.add(_test_algorithm_via_hashlib_new)
b8f92b4
 
b8f92b4
         _hashlib = self._conditional_import_module('_hashlib')
6cd1c5f
@@ -79,27 +104,12 @@ class HashLibTestCase(unittest.TestCase):
b8f92b4
             for algorithm, constructors in self.constructors_to_test.items():
b8f92b4
                 constructor = getattr(_hashlib, 'openssl_'+algorithm, None)
b8f92b4
                 if constructor:
b8f92b4
-                    constructors.add(constructor)
f0b0ffc
+                    constructors.add(suppress_fips(constructor))
f0b0ffc
 
bf35167
         def add_builtin_constructor(name):
bf35167
             constructor = getattr(hashlib, "__get_builtin_constructor")(name)
bf35167
             self.constructors_to_test[name].add(constructor)
bf35167
 
b8f92b4
-        _md5 = self._conditional_import_module('_md5')
b8f92b4
-        if _md5:
bf35167
-            add_builtin_constructor('md5')
b8f92b4
-        _sha1 = self._conditional_import_module('_sha1')
b8f92b4
-        if _sha1:
bf35167
-            add_builtin_constructor('sha1')
b8f92b4
-        _sha256 = self._conditional_import_module('_sha256')
b8f92b4
-        if _sha256:
bf35167
-            add_builtin_constructor('sha224')
bf35167
-            add_builtin_constructor('sha256')
b8f92b4
-        _sha512 = self._conditional_import_module('_sha512')
b8f92b4
-        if _sha512:
bf35167
-            add_builtin_constructor('sha384')
bf35167
-            add_builtin_constructor('sha512')
6cd1c5f
-
61fd48d
         super(HashLibTestCase, self).__init__(*args, **kwargs)
61fd48d
 
6cd1c5f
     @property
6cd1c5f
@@ -148,9 +158,6 @@ class HashLibTestCase(unittest.TestCase):
8fffc96
             else:
8fffc96
                 del sys.modules['_md5']
8fffc96
         self.assertRaises(TypeError, get_builtin_constructor, 3)
8fffc96
-        constructor = get_builtin_constructor('md5')
8fffc96
-        self.assertIs(constructor, _md5.md5)
8fffc96
-        self.assertEqual(sorted(builtin_constructor_cache), ['MD5', 'md5'])
8fffc96
 
8fffc96
     def test_hexdigest(self):
8fffc96
         for cons in self.hash_constructors:
6cd1c5f
@@ -433,6 +440,64 @@ class HashLibTestCase(unittest.TestCase):
b8f92b4
 
b8f92b4
         self.assertEqual(expected_hash, hasher.hexdigest())
b8f92b4
 
b8f92b4
+    def test_issue9146(self):
b8f92b4
+        # Ensure that various ways to use "MD5" from "hashlib" don't segfault:
b8f92b4
+        m = hashlib.md5(usedforsecurity=False)
b8f92b4
+        m.update(b'abc\n')
b8f92b4
+        self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1")
b8f92b4
+        
b8f92b4
+        m = hashlib.new('md5', usedforsecurity=False)
b8f92b4
+        m.update(b'abc\n')
b8f92b4
+        self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1")
b8f92b4
+        
b8f92b4
+        m = hashlib.md5(b'abc\n', usedforsecurity=False)
b8f92b4
+        self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1")
b8f92b4
+        
b8f92b4
+        m = hashlib.new('md5', b'abc\n', usedforsecurity=False)
b8f92b4
+        self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1")
b8f92b4
+
b8f92b4
+    @unittest.skipUnless(OPENSSL_ENFORCES_FIPS,
b8f92b4
+                         'FIPS enforcement required for this test.')
b8f92b4
+    def test_hashlib_fips_mode(self):        
b8f92b4
+        # Ensure that we raise a ValueError on vanilla attempts to use MD5
b8f92b4
+        # in hashlib in a FIPS-enforced setting:
b8f92b4
+        with self.assertRaisesRegexp(ValueError, '.*unknown cipher'):
b8f92b4
+            m = hashlib.md5()
b8f92b4
+            
b8f92b4
+        if not self._conditional_import_module('_md5'):
b8f92b4
+            with self.assertRaisesRegexp(ValueError, '.*unknown cipher'):
b8f92b4
+                m = hashlib.new('md5')
b8f92b4
+
b8f92b4
+    @unittest.skipUnless(OPENSSL_ENFORCES_FIPS,
b8f92b4
+                         'FIPS enforcement required for this test.')
b8f92b4
+    def test_hashopenssl_fips_mode(self):
b8f92b4
+        # Verify the _hashlib module's handling of md5:
b8f92b4
+        _hashlib = self._conditional_import_module('_hashlib')
b8f92b4
+        if _hashlib:
b8f92b4
+            assert hasattr(_hashlib, 'openssl_md5')
b8f92b4
+
b8f92b4
+            # Ensure that _hashlib raises a ValueError on vanilla attempts to
b8f92b4
+            # use MD5 in a FIPS-enforced setting:
b8f92b4
+            with self.assertRaisesRegexp(ValueError, '.*unknown cipher'):
b8f92b4
+                m = _hashlib.openssl_md5()
b8f92b4
+            with self.assertRaisesRegexp(ValueError, '.*unknown cipher'):
b8f92b4
+                m = _hashlib.new('md5')
b8f92b4
+
b8f92b4
+            # Ensure that in such a setting we can whitelist a callsite with
b8f92b4
+            # usedforsecurity=False and have it succeed:
b8f92b4
+            m = _hashlib.openssl_md5(usedforsecurity=False)
b8f92b4
+            m.update(b'abc\n')
b8f92b4
+            self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1")
b8f92b4
+        
b8f92b4
+            m = _hashlib.new('md5', usedforsecurity=False)
b8f92b4
+            m.update(b'abc\n')
b8f92b4
+            self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1")
f0b0ffc
+       
b8f92b4
+            m = _hashlib.openssl_md5(b'abc\n', usedforsecurity=False)
b8f92b4
+            self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1")
b8f92b4
+        
b8f92b4
+            m = _hashlib.new('md5', b'abc\n', usedforsecurity=False)
b8f92b4
+            self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1")
b8f92b4
 
f0b0ffc
 class KDFTests(unittest.TestCase):
f0b0ffc
 
6cd1c5f
@@ -516,7 +581,7 @@ class KDFTests(unittest.TestCase):
6cd1c5f
         out = pbkdf2(hash_name='sha1', password=b'password', salt=b'salt',
6cd1c5f
             iterations=1, dklen=None)
6cd1c5f
         self.assertEqual(out, self.pbkdf2_results['sha1'][0][0])
6cd1c5f
-
f0b0ffc
+    @unittest.skip('skipped on Fedora, as we always use OpenSSL pbkdf2_hmac')
f0b0ffc
     def test_pbkdf2_hmac_py(self):
f0b0ffc
         self._test_pbkdf2_hmac(py_hashlib.pbkdf2_hmac)
f0b0ffc
 
6cd1c5f
diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c
6cd1c5f
index 44765ac..b8cf490 100644
6cd1c5f
--- a/Modules/_hashopenssl.c
6cd1c5f
+++ b/Modules/_hashopenssl.c
6cd1c5f
@@ -20,6 +20,8 @@
f0b0ffc
 
b8f92b4
 
b8f92b4
 /* EVP is the preferred interface to hashing in OpenSSL */
b8f92b4
+#include <openssl/ssl.h>
b8f92b4
+#include <openssl/err.h>
b8f92b4
 #include <openssl/evp.h>
f0b0ffc
 #include <openssl/hmac.h>
b8f92b4
 /* We use the object interface to discover what hashes OpenSSL supports. */
6cd1c5f
@@ -45,11 +47,19 @@ typedef struct {
b8f92b4
 
b8f92b4
 static PyTypeObject EVPtype;
b8f92b4
 
b8f92b4
+/* Struct to hold all the cached information we need on a specific algorithm.
b8f92b4
+   We have one of these per algorithm */
b8f92b4
+typedef struct {
b8f92b4
+    PyObject *name_obj;
b8f92b4
+    EVP_MD_CTX ctxs[2];
b8f92b4
+    /* ctx_ptrs will point to ctxs unless an error occurred, when it will
b8f92b4
+       be NULL: */
b8f92b4
+    EVP_MD_CTX *ctx_ptrs[2];
b8f92b4
+    PyObject *error_msgs[2];
b8f92b4
+} EVPCachedInfo;
b8f92b4
 
b8f92b4
-#define DEFINE_CONSTS_FOR_NEW(Name)  \
58f477b
-    static PyObject *CONST_ ## Name ## _name_obj = NULL; \
b8f92b4
-    static EVP_MD_CTX CONST_new_ ## Name ## _ctx; \
b8f92b4
-    static EVP_MD_CTX *CONST_new_ ## Name ## _ctx_p = NULL;
b8f92b4
+#define DEFINE_CONSTS_FOR_NEW(Name) \
b8f92b4
+    static EVPCachedInfo cached_info_ ##Name;
b8f92b4
 
b8f92b4
 DEFINE_CONSTS_FOR_NEW(md5)
b8f92b4
 DEFINE_CONSTS_FOR_NEW(sha1)
6cd1c5f
@@ -92,6 +102,48 @@ EVP_hash(EVPobject *self, const void *vp, Py_ssize_t len)
b8f92b4
     }
b8f92b4
 }
b8f92b4
 
b8f92b4
+static void
b8f92b4
+mc_ctx_init(EVP_MD_CTX *ctx, int usedforsecurity)
b8f92b4
+{
b8f92b4
+    EVP_MD_CTX_init(ctx);
b8f92b4
+
b8f92b4
+    /*
b8f92b4
+      If the user has declared that this digest is being used in a
b8f92b4
+      non-security role (e.g. indexing into a data structure), set
b8f92b4
+      the exception flag for openssl to allow it
b8f92b4
+    */
b8f92b4
+    if (!usedforsecurity) {
b8f92b4
+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
b8f92b4
+        EVP_MD_CTX_set_flags(ctx,
b8f92b4
+                             EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
b8f92b4
+#endif
b8f92b4
+    }
b8f92b4
+}
b8f92b4
+
b8f92b4
+/* Get an error msg for the last error as a PyObject */
b8f92b4
+static PyObject *
b8f92b4
+error_msg_for_last_error(void)
b8f92b4
+{
b8f92b4
+    char *errstr;
b8f92b4
+
b8f92b4
+    errstr = ERR_error_string(ERR_peek_last_error(), NULL);
b8f92b4
+    ERR_clear_error();
b8f92b4
+
b8f92b4
+    return PyUnicode_FromString(errstr); /* Can be NULL */
b8f92b4
+}
b8f92b4
+
b8f92b4
+static void
b8f92b4
+set_evp_exception(void)
b8f92b4
+{
b8f92b4
+    char *errstr;
b8f92b4
+
b8f92b4
+    errstr = ERR_error_string(ERR_peek_last_error(), NULL);
b8f92b4
+    ERR_clear_error();
b8f92b4
+
b8f92b4
+    PyErr_SetString(PyExc_ValueError, errstr);
b8f92b4
+}
b8f92b4
+
b8f92b4
+
b8f92b4
 /* Internal methods for a hash object */
b8f92b4
 
b8f92b4
 static void
6cd1c5f
@@ -259,15 +311,16 @@ EVP_repr(EVPobject *self)
b8f92b4
 static int
b8f92b4
 EVP_tp_init(EVPobject *self, PyObject *args, PyObject *kwds)
b8f92b4
 {
b8f92b4
-    static char *kwlist[] = {"name", "string", NULL};
b8f92b4
+    static char *kwlist[] = {"name", "string", "usedforsecurity", NULL};
b8f92b4
     PyObject *name_obj = NULL;
b8f92b4
     PyObject *data_obj = NULL;
b8f92b4
+    int usedforsecurity = 1;
b8f92b4
     Py_buffer view;
b8f92b4
     char *nameStr;
b8f92b4
     const EVP_MD *digest;
b8f92b4
 
b8f92b4
-    if (!PyArg_ParseTupleAndKeywords(args, kwds, "O|O:HASH", kwlist,
b8f92b4
-                                     &name_obj, &data_obj)) {
b8f92b4
+    if (!PyArg_ParseTupleAndKeywords(args, kwds, "O|Oi:HASH", kwlist,
b8f92b4
+                                     &name_obj, &data_obj, &usedforsecurity)) {
b8f92b4
         return -1;
b8f92b4
     }
b8f92b4
 
6cd1c5f
@@ -288,7 +341,12 @@ EVP_tp_init(EVPobject *self, PyObject *args, PyObject *kwds)
b8f92b4
             PyBuffer_Release(&view);
b8f92b4
         return -1;
b8f92b4
     }
b8f92b4
-    EVP_DigestInit(&self->ctx, digest);
b8f92b4
+    mc_ctx_init(&self->ctx, usedforsecurity);
b8f92b4
+    if (!EVP_DigestInit_ex(&self->ctx, digest, NULL)) {
b8f92b4
+        set_evp_exception();
b8f92b4
+        PyBuffer_Release(&view);
b8f92b4
+        return -1;
b8f92b4
+    }
b8f92b4
 
b8f92b4
     self->name = name_obj;
b8f92b4
     Py_INCREF(self->name);
6cd1c5f
@@ -372,7 +430,8 @@ static PyTypeObject EVPtype = {
b8f92b4
 static PyObject *
b8f92b4
 EVPnew(PyObject *name_obj,
b8f92b4
        const EVP_MD *digest, const EVP_MD_CTX *initial_ctx,
b8f92b4
-       const unsigned char *cp, Py_ssize_t len)
b8f92b4
+       const unsigned char *cp, Py_ssize_t len,
b8f92b4
+       int usedforsecurity)
b8f92b4
 {
b8f92b4
     EVPobject *self;
b8f92b4
 
6cd1c5f
@@ -387,7 +446,12 @@ EVPnew(PyObject *name_obj,
b8f92b4
     if (initial_ctx) {
b8f92b4
         EVP_MD_CTX_copy(&self->ctx, initial_ctx);
b8f92b4
     } else {
b8f92b4
-        EVP_DigestInit(&self->ctx, digest);
b8f92b4
+        mc_ctx_init(&self->ctx, usedforsecurity);
b8f92b4
+        if (!EVP_DigestInit_ex(&self->ctx, digest, NULL)) {
b8f92b4
+            set_evp_exception();
b8f92b4
+            Py_DECREF(self);
b8f92b4
+            return NULL;
b8f92b4
+        }
b8f92b4
     }
b8f92b4
 
b8f92b4
     if (cp && len) {
6cd1c5f
@@ -411,21 +475,29 @@ PyDoc_STRVAR(EVP_new__doc__,
b8f92b4
 An optional string argument may be provided and will be\n\
b8f92b4
 automatically hashed.\n\
b8f92b4
 \n\
b8f92b4
-The MD5 and SHA1 algorithms are always supported.\n");
b8f92b4
+The MD5 and SHA1 algorithms are always supported.\n\
b8f92b4
+\n\
b8f92b4
+An optional \"usedforsecurity=True\" keyword argument is provided for use in\n\
b8f92b4
+environments that enforce FIPS-based restrictions.  Some implementations of\n\
b8f92b4
+OpenSSL can be configured to prevent the usage of non-secure algorithms (such\n\
b8f92b4
+as MD5).  If you have a non-security use for these algorithms (e.g. a hash\n\
b8f92b4
+table), you can override this argument by marking the callsite as\n\
b8f92b4
+\"usedforsecurity=False\".");
b8f92b4
 
b8f92b4
 static PyObject *
b8f92b4
 EVP_new(PyObject *self, PyObject *args, PyObject *kwdict)
b8f92b4
 {
b8f92b4
-    static char *kwlist[] = {"name", "string", NULL};
b8f92b4
+    static char *kwlist[] = {"name", "string", "usedforsecurity", NULL};
b8f92b4
     PyObject *name_obj = NULL;
b8f92b4
     PyObject *data_obj = NULL;
b8f92b4
+    int usedforsecurity = 1;
b8f92b4
     Py_buffer view = { 0 };
b8f92b4
     PyObject *ret_obj;
b8f92b4
     char *name;
b8f92b4
     const EVP_MD *digest;
b8f92b4
 
b8f92b4
-    if (!PyArg_ParseTupleAndKeywords(args, kwdict, "O|O:new", kwlist,
b8f92b4
-                                     &name_obj, &data_obj)) {
b8f92b4
+    if (!PyArg_ParseTupleAndKeywords(args, kwdict, "O|Oi:new", kwlist,
b8f92b4
+                                     &name_obj, &data_obj, &usedforsecurity)) {
b8f92b4
         return NULL;
b8f92b4
     }
b8f92b4
 
6cd1c5f
@@ -439,7 +511,8 @@ EVP_new(PyObject *self, PyObject *args, PyObject *kwdict)
b8f92b4
 
b8f92b4
     digest = EVP_get_digestbyname(name);
b8f92b4
 
b8f92b4
-    ret_obj = EVPnew(name_obj, digest, NULL, (unsigned char*)view.buf, view.len);
b8f92b4
+    ret_obj = EVPnew(name_obj, digest, NULL, (unsigned char*)view.buf, view.len,
6cd1c5f
+                    usedforsecurity);
b8f92b4
 
b8f92b4
     if (data_obj)
b8f92b4
         PyBuffer_Release(&view);
6cd1c5f
@@ -722,57 +795,114 @@ generate_hash_name_list(void)
b8f92b4
 
b8f92b4
 
b8f92b4
 /*
b8f92b4
- *  This macro generates constructor function definitions for specific
b8f92b4
- *  hash algorithms.  These constructors are much faster than calling
b8f92b4
- *  the generic one passing it a python string and are noticably
b8f92b4
- *  faster than calling a python new() wrapper.  Thats important for
b8f92b4
+ *  This macro and function generates a family of constructor function
b8f92b4
+ *  definitions for specific hash algorithms.  These constructors are much
b8f92b4
+ *  faster than calling the generic one passing it a python string and are
b8f92b4
+ *  noticably faster than calling a python new() wrapper.  That's important for
b8f92b4
  *  code that wants to make hashes of a bunch of small strings.
b8f92b4
  */
b8f92b4
 #define GEN_CONSTRUCTOR(NAME)  \
b8f92b4
     static PyObject * \
b8f92b4
-    EVP_new_ ## NAME (PyObject *self, PyObject *args) \
f0b0ffc
+    EVP_new_ ## NAME (PyObject *self, PyObject *args, PyObject *kwdict)        \
b8f92b4
     { \
b8f92b4
-        PyObject *data_obj = NULL; \
b8f92b4
-        Py_buffer view = { 0 }; \
b8f92b4
-        PyObject *ret_obj; \
b8f92b4
-     \
b8f92b4
-        if (!PyArg_ParseTuple(args, "|O:" #NAME , &data_obj)) { \
b8f92b4
-            return NULL; \
b8f92b4
-        } \
b8f92b4
-     \
b8f92b4
-        if (data_obj) \
b8f92b4
-            GET_BUFFER_VIEW_OR_ERROUT(data_obj, &view); \
b8f92b4
-     \
b8f92b4
-        ret_obj = EVPnew( \
b8f92b4
-                    CONST_ ## NAME ## _name_obj, \
b8f92b4
-                    NULL, \
b8f92b4
-                    CONST_new_ ## NAME ## _ctx_p, \
b8f92b4
-                    (unsigned char*)view.buf, \
b8f92b4
-                    view.len); \
b8f92b4
-     \
b8f92b4
-        if (data_obj) \
b8f92b4
-            PyBuffer_Release(&view); \
b8f92b4
-        return ret_obj; \
b8f92b4
+       return implement_specific_EVP_new(self, args, kwdict,      \
b8f92b4
+                                         "|Oi:" #NAME,            \
b8f92b4
+                                         &cached_info_ ## NAME ); \
6cd1c5f
     }
6cd1c5f
 
b8f92b4
+static PyObject *
b8f92b4
+implement_specific_EVP_new(PyObject *self, PyObject *args, PyObject *kwdict,
b8f92b4
+                           const char *format,
b8f92b4
+                           EVPCachedInfo *cached_info)
b8f92b4
+{
b8f92b4
+    static char *kwlist[] = {"string", "usedforsecurity", NULL}; 
b8f92b4
+    PyObject *data_obj = NULL;
b8f92b4
+    Py_buffer view = { 0 };
b8f92b4
+    int usedforsecurity = 1;
b8f92b4
+    int idx;
b8f92b4
+    PyObject *ret_obj = NULL;
b8f92b4
+
b8f92b4
+    assert(cached_info);
b8f92b4
+
b8f92b4
+    if (!PyArg_ParseTupleAndKeywords(args, kwdict, format, kwlist,
b8f92b4
+                                     &data_obj, &usedforsecurity)) {
b8f92b4
+        return NULL;
b8f92b4
+    }
b8f92b4
+
b8f92b4
+    if (data_obj)
b8f92b4
+       GET_BUFFER_VIEW_OR_ERROUT(data_obj, &view);
b8f92b4
+
b8f92b4
+    idx = usedforsecurity ? 1 : 0;
b8f92b4
+
b8f92b4
+    /*
b8f92b4
+     * If an error occurred during creation of the global content, the ctx_ptr
b8f92b4
+     * will be NULL, and the error_msg will hopefully be non-NULL:
b8f92b4
+     */
b8f92b4
+    if (cached_info->ctx_ptrs[idx]) {
b8f92b4
+        /* We successfully initialized this context; copy it: */
b8f92b4
+        ret_obj = EVPnew(cached_info->name_obj,
b8f92b4
+                         NULL,
b8f92b4
+                         cached_info->ctx_ptrs[idx],
b8f92b4
+                         (unsigned char*)view.buf, view.len,
b8f92b4
+                         usedforsecurity);
b8f92b4
+    } else {
b8f92b4
+        /* Some kind of error happened initializing the global context for
b8f92b4
+           this (digest, usedforsecurity) pair.
b8f92b4
+           Raise an exception with the saved error message: */
b8f92b4
+        if (cached_info->error_msgs[idx]) {
b8f92b4
+            PyErr_SetObject(PyExc_ValueError, cached_info->error_msgs[idx]);
b8f92b4
+        } else {
b8f92b4
+            PyErr_SetString(PyExc_ValueError, "Error initializing hash");
b8f92b4
+        }
6cd1c5f
+     }
6cd1c5f
+ 
b8f92b4
+    if (data_obj)
b8f92b4
+        PyBuffer_Release(&view);
b8f92b4
+
b8f92b4
+    return ret_obj;
b8f92b4
+}
b8f92b4
+
b8f92b4
 /* a PyMethodDef structure for the constructor */
b8f92b4
 #define CONSTRUCTOR_METH_DEF(NAME)  \
b8f92b4
-    {"openssl_" #NAME, (PyCFunction)EVP_new_ ## NAME, METH_VARARGS, \
b8f92b4
+    {"openssl_" #NAME, (PyCFunction)EVP_new_ ## NAME, \
b8f92b4
+        METH_VARARGS|METH_KEYWORDS, \
b8f92b4
         PyDoc_STR("Returns a " #NAME \
b8f92b4
                   " hash object; optionally initialized with a string") \
b8f92b4
     }
b8f92b4
 
58f477b
-/* used in the init function to setup a constructor: initialize OpenSSL
58f477b
-   constructor constants if they haven't been initialized already.  */
b8f92b4
-#define INIT_CONSTRUCTOR_CONSTANTS(NAME)  do { \
58f477b
-    if (CONST_ ## NAME ## _name_obj == NULL) { \
58f477b
-        CONST_ ## NAME ## _name_obj = PyUnicode_FromString(#NAME); \
58f477b
-        if (EVP_get_digestbyname(#NAME)) { \
58f477b
-            CONST_new_ ## NAME ## _ctx_p = &CONST_new_ ## NAME ## _ctx; \
58f477b
-            EVP_DigestInit(CONST_new_ ## NAME ## _ctx_p, EVP_get_digestbyname(#NAME)); \
58f477b
-        } \
b8f92b4
-    } \
b8f92b4
+/*
b8f92b4
+  Macro/function pair to set up the constructors.
f0b0ffc
+
b8f92b4
+  Try to initialize a context for each hash twice, once with
b8f92b4
+  EVP_MD_CTX_FLAG_NON_FIPS_ALLOW and once without.
b8f92b4
+  
b8f92b4
+  Any that have errors during initialization will end up with a NULL ctx_ptrs
b8f92b4
+  entry, and err_msgs will be set (unless we're very low on memory)
b8f92b4
+*/
b8f92b4
+#define INIT_CONSTRUCTOR_CONSTANTS(NAME)  do {    \
b8f92b4
+    init_constructor_constant(&cached_info_ ## NAME, #NAME); \
f0b0ffc
 } while (0);
b8f92b4
+static void
b8f92b4
+init_constructor_constant(EVPCachedInfo *cached_info, const char *name)
b8f92b4
+{
b8f92b4
+    assert(cached_info);
b8f92b4
+    cached_info->name_obj = PyUnicode_FromString(name);
b8f92b4
+    if (EVP_get_digestbyname(name)) {
b8f92b4
+        int i;
b8f92b4
+        for (i=0; i<2; i++) {
b8f92b4
+            mc_ctx_init(&cached_info->ctxs[i], i);
b8f92b4
+            if (EVP_DigestInit_ex(&cached_info->ctxs[i],
b8f92b4
+                                  EVP_get_digestbyname(name), NULL)) {
b8f92b4
+                /* Success: */
b8f92b4
+                cached_info->ctx_ptrs[i] = &cached_info->ctxs[i];
b8f92b4
+            } else {
b8f92b4
+                /* Failure: */
b8f92b4
+              cached_info->ctx_ptrs[i] = NULL;
b8f92b4
+              cached_info->error_msgs[i] = error_msg_for_last_error();
b8f92b4
+            }
b8f92b4
+        }
b8f92b4
+    }
b8f92b4
+}
f0b0ffc
 
b8f92b4
 GEN_CONSTRUCTOR(md5)
b8f92b4
 GEN_CONSTRUCTOR(sha1)
6cd1c5f
@@ -819,13 +949,10 @@ PyInit__hashlib(void)
b8f92b4
 {
b8f92b4
     PyObject *m, *openssl_md_meth_names;
b8f92b4
 
b8f92b4
-    OpenSSL_add_all_digests();
bf35167
-    ERR_load_crypto_strings();
b8f92b4
+    SSL_load_error_strings();
b8f92b4
+    SSL_library_init();
b8f92b4
 
b8f92b4
-    /* TODO build EVP_functions openssl_* entries dynamically based
b8f92b4
-     * on what hashes are supported rather than listing many
b8f92b4
-     * but having some be unsupported.  Only init appropriate
b8f92b4
-     * constants. */
b8f92b4
+    OpenSSL_add_all_digests();
b8f92b4
 
b8f92b4
     Py_TYPE(&EVPtype) = &PyType_Type;
b8f92b4
     if (PyType_Ready(&EVPtype) < 0)