From 9eace7e7317502720b4290ec39933220ef95fa6f Mon Sep 17 00:00:00 2001 From: Seth Michael Larson Date: Tue, 3 Nov 2026 13:10:45 -0600 Subject: [PATCH 1/2] gh-161263: Skip MD5 algorithm challenge tests on FIPS --- Lib/test/test_urllib2.py | 13 +++++++------ .../2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst | 2 ++ 2 files changed, 9 insertions(+), 6 deletions(-) create mode 100644 Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py index 52f77eaf85e589b..3606c7d9dc66a65 100644 --- a/Lib/test/test_urllib2.py +++ b/Lib/test/test_urllib2.py @@ -30,6 +30,11 @@ support.requires_working_socket(module=True) +skip_libssl_fips_mode = unittest.skipIf( + support.is_libssl_fips_mode(), + "conservative skip due to OpenSSL FIPS mode possible algorithm nerfing", +) + # XXX # Request # CacheFTPHandler (hard to write) @@ -1782,6 +1787,7 @@ def test_proxy_basic_auth(self): "proxy.example.com:3128", ) + @skip_libssl_fips_mode # Uses MD5 algorithm in challenge def test_proxy_digest_auth(self): # gh-60299: ProxyDigestAuthHandler must look up credentials using # the proxy's authority @@ -1845,6 +1851,7 @@ def test_proxy_digest_auth_uri(self): auth = http_handler.requests[1].get_header("Proxy-authorization") self.assertIn('uri="%s"' % request_url, auth) + @skip_libssl_fips_mode # Uses MD5 algorithm in challenge def test_digest_auth_uses_full_url(self): # The non-proxy case must keep using the full request URL (not # just the host) for the password lookup, so that sub-URI realm @@ -2355,12 +2362,6 @@ def test_parse_proxy(self): self.assertRaises(ValueError, _parse_proxy, 'file:/ftp.example.com'), -skip_libssl_fips_mode = unittest.skipIf( - support.is_libssl_fips_mode(), - "conservative skip due to OpenSSL FIPS mode possible algorithm nerfing", -) - - class TestDigestAuthAlgorithms(unittest.TestCase): def setUp(self): self.handler = AbstractDigestAuthHandler() diff --git a/Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst b/Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst new file mode 100644 index 000000000000000..98c631cc2f663a3 --- /dev/null +++ b/Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst @@ -0,0 +1,2 @@ +Skip tests which use MD5 algorithm for WWW-Authenticate challenges when +libssl is in FIPS mode. From 2428022d3aa47e409394fe5d70677c0ecd30061a Mon Sep 17 00:00:00 2001 From: Seth Michael Larson Date: Wed, 4 Nov 2026 08:58:32 -0600 Subject: [PATCH 2/2] Need to skip a few more --- Lib/lib2to3/Grammar3.11.18.final.0.pickle | Bin 0 -> 15313 bytes .../PatternGrammar3.11.18.final.0.pickle | Bin 0 -> 1225 bytes Lib/test/test_urllib2.py | 2 ++ 3 files changed, 2 insertions(+) create mode 100644 Lib/lib2to3/Grammar3.11.18.final.0.pickle create mode 100644 Lib/lib2to3/PatternGrammar3.11.18.final.0.pickle diff --git a/Lib/lib2to3/Grammar3.11.18.final.0.pickle b/Lib/lib2to3/Grammar3.11.18.final.0.pickle new file mode 100644 index 0000000000000000000000000000000000000000..c3acebc758875b5438cfebaab64116d80c0d1c9b GIT binary patch literal 15313 zcmc&*X>eS}amL^xKoGp|`{wcjK=8irbNG1Q7qkQxoE-uS2)iIf%aSG8y6m+qTPt6Z zY|FAK*%l?+KV110SEZ6v@-L}Mf|#SSUqR zs@Raub#-K(>K`aY%9je6JnE`du`!*?rStjhtz0RpQN=Oofm=OU*42`7;MQPoCWlg; zDvnJLWDCagsaM4&G|LPWI`V~H5R6g9=5+pEuCt?iFxT0Y=`KYLY$GT~(x{5H=|W#` zDH_Xu2XBRbn?QJTAd|lBd5uHYojs@(Hq9*c_4apk_d$X2kWorm^e_Q@T%iEfqluxe zufG&c0#nvO>UOBKg=^%cOXBc1QarF%1_XtpX&sKkNM z9GKH19o1ZjmdSPYb!Bt6I?!cLDVm4QGk4NGVPNNzc*rRA`1Ji03&@~xh} zn-IuZGlkl0w=b-O=2;jU{t;`w3Yu5qp!sUB@yPB0`o@|v!kJ=i8R0r=K}S95-kahb ztq_=Mc#F58UpDKadL7Qo*FlL~U%{8!!LF~Tt0U&H9@RuR;tgO9g?&8k?}-*=ZIy@iwm*<6?oTTvcJXY;|YwxQR7Okr>!=i6=vLEdD$3w}cF z06`vxz{GW0?u0kxG5Y11ybGe`d$OGwy7z9j?@jjv>+gYR`9gZYv)hZIcYOA-V(@0Z zb0FJ~dAc876Bph1AAlP9!E6BzbP&y;Du&^ZJTVX)hJ9!bM|=eALTOzoItq57*l`O+ zFGa_asC>E`Y_%#*j;Rt-9*5@@y8C4yBWQ1R(*fd1-$}}R}nz0D5rYUMvW*h>lX^xtd86S;PWas&>uB3h!Ma=+M_mQ)<^4<*$}lWvoTt)%%*6A zGMl4~%51@;Gh3t0%51|VGuxxB%It`?DYG-$uFS4zhcdgPoyzQqb}6$L)57eF_9(MI z+N;cgXrD3%;qvBCbU>NIaBp)2o^6i8sm-zIh%y=;Y>vZcO$0ABC!*uZoQxu6PDLk_ zIUSu;<_x^foQ+N^a}Mrh&PQjJxe%RG=3;bSnM=_HWiCe-mAL{(F;}C@%3On2nCsD1 zWp2O)OhBYoh0^s>%Kg_$tCvc;T2}$q5N58IbQO_lJb_BDk^-Lf zYN3+KjIUf1SFRmi+2Sj8tF8t=vS`ya=%|WicGRkCr2-f}c&6)OrtKtj;;>Fjjc@LV zQ@W1Sdc8pD$T3Dg(&GlHXcM@xviB+$L#LZaAuZ}flQF~f8Rtn7`m|Sa99f@bq1|S0 z2d6>kIaH_g7ExEI^wwY_F_x!I=~_{wK?ui6=S?)7UZU#&SLk}cl)#mGj2Jnkw@G=s zZb01*LRzRnH+p?{O7$*1)>Z7*O}=7}RP5E`TtyX&Vj*D-C0qxNKPte}QD|XFOjE!J zuULzHqQ!oJ2Lv7zcu3%3fky-$6?jab7I<7B<_okrK}c;XJhquw_FjPRReI$qR22zOB`FA2OX&|$8~^HqV@1fCIi zU3_ac`zte}#IvP3p1VRFB)-8q(W_(Fyh-UNq-9#*O@UhkZWh=nuuEV@;8wzN=S~wn zfmmn!vVOYTV^jK;2%Z)wbI5UE=8*gm&K zO}BQS`HC<_l8&rN8N%z$(Q;p<6=v+)C%ZFn@1z=Fd zhuZ>UzYi7zU1H6e?3utq9AmaVGjhAKP2C8=5;t+L5sO}1UO5i<#Umyfq*KHWpII70;N-Rwa_WIca_jGXXr-h!#u2~&c3;ji!OU(C-*jc(Dr+EAl>xJ)KmdIGmX`I?0G^e@_bl+!^XpJH2et7@SW)wf`yW^ zI;FoX#`y{%xk=~=qdPMew1tiJi(b$;9Kt=^G)BAfEKliYh3U{)5%!g?D^hVHT7hxg zaFNc16*rYY6xNE?SfC9eP#h>_VStSw2i?!<9@gTQNK56`l%=KE-a-%6^1SGTb`R0= zWzq5#!eOR+HJ0?N!{btIT)9ou_*$^58yfT|_#ogMPhK%NDZQL%T@1>}gSg3hveRD| z*0Eg&gEGmH(sN@;UK4V$qw9w%g&?uZ5O>)uS z7Wf^3-xc^hf!`PSmcX|KzC&2<)!U_xSc(vqV%RU)%Nx>mh{UdK3NwNtg!jml{()FP z+y!i0cY!K)!Sd90{BI@(r&gB^gyHhV$1M$kiI^}jnP6eT=qDzaLEf{;=V#h>ssUMBJ2?nhM^Dh25=b!CN6`>_f@vE3q1{?DR=FNf1@GNx(VD zNQ5$<`@r&-^~hS%Mg$hy`7{yoqH*9l9dmNsPG3AN)&bx_P%UDVw2tXqR|}~)!Tfm z4~^D~)$UUOXOIM|5UkmjB8MGkr2y~AdzOd+3iJUE7^xt?ld6p`S!F$|$PacR=kZd3 zcQxO$TYLOTO;||SQ3jwZ#do0AWmRdc|NZ3O0Mxj zj%cqm4#5!b6^>?=9)}C3r5b0WJYM5lug0;J#%Tr*FEzx~cx&a`DBjkT#v6sk`zwzE zH8$_uWovA5HMXLR{2W!@mf^yVUjE<<+!*47TIrQq4Zg&00!(iZH7RBg zF|Z*EHcvFg?^F5Fno`P9n&X$Pd(UvVRUUHSC$1L*Gn#BYu94)S2_C^1Ka{=pIkCde zZEpuwBS|xgdias@1xp_!*+gYmCCKQRo^+D3ZNBCru$ORM#&rc3PPz3pTsX7V*KuJ0 z$$YZ1`+W<}luu~jDas!8tvRPShd6&IJf%v`2QT4NWiLnzPBtntP1&ms0S-h=SGKDH zF+fJ|EK~nSJ^+VK+IG2Pb(1f zmHkUWIEh9w>toEK1bJYX)-$@(`2}i0SCdm0cke^iG;? zg|a&x0xnBLO4*a12LnEWJlm~Q_L3v>vu~BMw;jT}$7=Xz1!9e|&pHGa4{~0sY{?<8 zf)LT7>|26J$@&5;yJ}VTT}KArAX%HT4?NjuR(%XlS_h9!a2my`bh3Kcgf`*)9E`51z2RQ4Yq!Q~NxZBq7MonWvuZNFLB|8xkf@uNYDxJe+3ZOSfi2skGZ+m&s12y7pS*rDt;K|DNej4}&$D!Vt)`eE}qYTVVTg|%QudvM6iLejcN%3jA6EALN3?znn;ud2H=mu$QDuMo*|{83_RkVr9yThE zp_NwlZxftGvg~7UIj-zKCAfSBc_L;1J;4d_h70-$W&e9P_N21awX!Vu4a6yB#|gp( zeZR7h!D(!394WTaj0k6x-IXAv#N6rn{?01<>ceZ#Df>5xTHofpvVT7udqLTM5iD7= zRS2c+x6ogrb!kOY$e!2Am*&*Qw;!i zP<))i$98#C#TukvuyqrWhXpyEk9G1mj`T|jwi7v?NPMG8xI*A^ftLw&1JTC>aa|B& ziD(nVQ9;ZhVwOCvWQ$b5U@Fi2Jek1;*(^;MuE)&rwLps@U*~-0%r(p z5I9%hbb)&b$rh(>U^QEiM?A9LWk;~$s-PybyW>JrBd|%}7J*9zjuSXl;5LEV1>PV; zN41z-8FJhth|T1NZ{38{-r4uo1V87uIV zR4pN*ULF_oagRJU^Kpuh?G!jh;7oxF1uho2Okhf2i@?nSw+h@Xa6h50Bd8~sNid0^ z4FGS5geL`_5EuzOKnT&tbZ2u&N#JzCm*S*7C-8#6^8zmkRD^mFNv`oRQ*5}Mxp%j3 zpi7QVZC!m8emb&acx$$eyp6X_yiKspyiK$dc$;J=@iy5`;cbeY#@kdogSTmR7H`w- z9NuQwdA!ZE3wWDl7x6aRF5zvCUB=s7yMniQb|r7~?P}f@*tNVZw5_}?vg>$TYL2x+)E{E|=_YrV8s@LMs zumy*P>v3qf28V{LacDSCU&I-~C7dr`#%tsioJC*7x!N_HPxtH1`WZ;{8qS(u$ARLv zAo-6V`MX%kevB8p_aMnna2EZmK_s%c95q>-Bt^|7r|6oBBpAIak*K5BFck$k9lEtx zPDIn|63JkCqt8~+o63nvdUGOWNpJC)9FlLLw+>BK(c3E$H1v*SGLhbuOm)$_hh%r@ zz2$5N`yGOJ?-xyA_F8`l-r1EPXFH zfb)X#}L z*YwNfOf~%q<_Pi{-Gq5{Xj+v1n$Nt{#d0#0{yN;LoYJYkQISxlzd1BrQom7|p{7ff zDWLkzL^7oQb}|!De}|=zeyG2j%rVs8tIQ+R-;b^0hUBee&Yga{BF|30Q%;G~KS(CJ z=^vJp1ocltHkrO(PBPQ)$H`~J#QL85WT%`Fkp-UTeecAxgtv8I!&acnw%9yNs)r$2%8)-hKRdM@m41-lB{ZOmgbJ-b z7LDrKlsC2j&WwCzfE;BA+A;!N8H1us5Lu>qEXr1+;;IH)r6)QwUlJr9burQ8lWz~6 zIY{e4Dch;V$f|vrJfpRq)OJJ}osfr+17pV-kN3-i)Y=2Xl%>^f3u%bOno#@#?^O4eJw_*D72)x(u~$6Ny!;2V#C%Zz literal 0 HcmV?d00001 diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py index 3606c7d9dc66a65..a5b5a3d706dd409 100644 --- a/Lib/test/test_urllib2.py +++ b/Lib/test/test_urllib2.py @@ -1974,6 +1974,7 @@ def check_digest_auth(self, headers, realm): self.assertIn('nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093"', auth) self.assertIn('opaque="5ccc069c403ebaf9f0171e9517f40e41"', auth) + @skip_libssl_fips_mode def test_digest_auth_multiple_challenges(self): realm = "digest@example.com" digest = (f'Digest realm="{realm}", ' @@ -2039,6 +2040,7 @@ def test_digest_auth_parse_challenges(self): [('Negotiate', 'Negotiate'), ('Bearer', 'Bearer abc=='), ('Digest', 'Digest realm="a"')]) + @skip_libssl_fips_mode def test_proxy_digest_auth_multiple_challenges(self): realm = "digest@example.com" digest = (f'Digest realm="{realm}", '