Hi all,
As many have already seen, a number of changes have been merged in OpenStack as part of the effort to allow OpenStack to run on FIPS enabled systems. This effort has been captured in a proposed community goal. [1].
One of the requirements for this effort is that md5sum() not be used in a security related context. In fact, python 3.9 has been modified to raise an exception of hashlib.md5sum() is called on a FIPS enabled system, unless it is explicitly annotated with a usedforsecurity=False attribute [2]. We added a wrapper for md5sum in oslo.config to take advantage of this attribute. [3,4,5]
Where we have less control is in libraries used by Openstack - and in particular, paramiko. Paramiko fails on FIPS enabled systems
because of a call to md5sum() in get_fingerprint(). A patch has been
submitted to fix this problem. [6]. Unfortunately, it takes a very long time for paramiko to fix issues.
In
order for us to make progress on FIPS testing, a small monkey-patch for
paramiko was checked into tempest. [7]. Because this change was made to a test tool, this patch was relatively uncontroversial.
A
similar change has been found to be needed for manila [8]. I would
expect that a similar change will be needed in other components that use paramiko to SSH to other systems (eg. cinder, neutron?) I suspect that the only reason this has not been detected in FIPS testing more widely yet is because the components that use paramiko for SSH are being tested in third party tests that do not, as yet, test FIPS.
At the request of the manila team, I am bringing this monkey-patch to the attention of the wider OpenStack community to get feedback on the pros and cons of applying this monkey-patch.
A couple things to note:
1. This monkey patch is quite small in scope and only needed until paramiko fixes the issue.
2.
paramiko is not FIPS compliant, and so we will ultimately need to fix
paramiko or replace it with a different library on FIPS enabled systems. When we do this, we would remove the monkey patch.
Thanks,
Ade Lee