test_socket.LinuxKernelCryptoAPI.test_hmac_sha1() fails on "AMD64 RHEL8 FIPS Only Blake2 Builtin Hash 3.x" buildbot

[vstinner]

Bug report

When FIPS is enabled in Linux, LinuxKernelCryptoAPI.test_hmac_sha1() fails with OSError: [Errno 22] Invalid argument.

test.pythoninfo:

fips.linux_crypto_fips_enabled: 1
fips.openssl_fips_mode: 1

Error:

ERROR: test_hmac_sha1 (test.test_socket.LinuxKernelCryptoAPI.test_hmac_sha1)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/buildbot/buildarea/3.x.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/test/test_socket.py", line 6479, in test_hmac_sha1
    algo.setsockopt(socket.SOL_ALG, socket.ALG_SET_KEY, b"Jefe")
OSError: [Errno 22] Invalid argument

build: https://buildbot.python.org/all/#/builders/469/builds/5995

Linked PRs

• gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode #109423
• [3.12] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) #109426
• [3.11] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) #109427
• [3.10] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) #125106
• [3.9] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) #125107

[vstinner]

cc @stratakis

[vstinner]

It seems like hmac in FIPS mode requires a key of at least 112 bits (14 bytes), whereas the test uses a key of 32 bits (4 bytes). See hmac_setkey() in the master branch of the Linux kernel:

	if (fips_enabled && (keylen < 112 / 8))
		return -EINVAL;

https://github.com/torvalds/linux/blob/9fdfb15a3dbf818e06be514f4abbfc071004cbe7/crypto/hmac.c#L55-L56