Bug 2349935

Summary:	openssl rand freezes in mingw build
Product:	[Fedora] Fedora	Reporter:	Sebastian Marsching <sebastian-rh-bugzilla>
Component:	mingw-openssl	Assignee:	Richard W.M. Jones <rjones>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	41	CC:	cfergeau, dbelyavs, elima, manisandro, marcandre.lureau, rjones
Target Milestone:	---	Keywords:	Regression
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	mingw-openssl-3.2.4-2.fc43 mingw-openssl-3.2.4-2.fc42	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-03-05 13:18:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Sebastian Marsching 2025-03-05 00:00:13 UTC

When using the openssl rand command with the openssl.exe that is provided by the mingw64-openssl package, the command blocks instead of printing random bytes.

This problem first appeared in the mingw64-openssl package for Fedora 41 and is also present in subsequent releases. It is not present in the package for Fedora 40.

This issue does not occur when cross-compiling the vanilla version of OpenSSL 3.2.2 on Fedora 41. I was able to trace this problem back to a single patch in the spec file:

# Downstream only. Reseed DRBG using getrandom(GRND_RANDOM)
# https://bugzilla.redhat.com/show_bug.cgi?id=2102541
Patch76:  0076-FIPS-140-3-DRBG.patch

When building the package with this patch removed, the problem vanishes.

It seems like this patch is not compatible with Windows, so I suggest removing it from the spec file for mingw-openssl.

I suspect that https://bugzilla.redhat.com/show_bug.cgi?id=2333301 and https://bugzilla.redhat.com/show_bug.cgi?id=2341677 might be caused by the same patch, but I have not verified this.

Reproducible: Always

Steps to Reproduce:
1. Install mingw64-openssl
2. Copy /usr/x86_64-w64-mingw32/sys-root/mingw/bin/{openssl.exe,libcrypto-3-x64.dll,libssl-3-x64.dll,zlib1.dll} to a Windows system.
3. Run openssl.exe rand -base64 33
Actual Results:  
OpenSSL freezes and must be terminated manually.

Expected Results:  
OpenSSL should print a random string.

Comment 1 Richard W.M. Jones 2025-03-05 12:42:00 UTC

Thanks, that's interesting new information for bug 2341677

Comment 2 Richard W.M. Jones 2025-03-05 12:46:53 UTC

Dmitry - FYI it's proposed to remove the patch 0076-FIPS-140-3-DRBG.patch
from mingw builds, as apparently it causes Windows openssl rand commands to hang.

Comment 3 Fedora Update System 2025-03-05 13:13:18 UTC

FEDORA-2025-9a6a7e04ac (mingw-openssl-3.2.4-2.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-9a6a7e04ac

Comment 4 Fedora Update System 2025-03-05 13:18:03 UTC

FEDORA-2025-9a6a7e04ac (mingw-openssl-3.2.4-2.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 Sebastian Marsching 2025-03-10 18:18:09 UTC

Thank you very much for fixing this so quickly. I tested the openssl.exe from mingw-openssl-3.2.4-2.fc43 and was able to verify that the bug is fixed in this version.

Is there any chance to get this fix backported to Fedora 42?

Comment 6 Richard W.M. Jones 2025-03-10 18:30:46 UTC

Doing that would mean updating Fedora 42 to 3.2.4 (if we preserved git ffwd).
Sandro what do you think?

Comment 7 Sandro Mani 2025-03-11 07:07:17 UTC

No objections on my part. Thanks.

Comment 8 Richard W.M. Jones 2025-03-11 08:59:38 UTC

https://koji.fedoraproject.org/koji/taskinfo?taskID=130117755

Comment 9 Fedora Update System 2025-03-11 09:43:02 UTC

FEDORA-2025-7ec6fa845b (mingw-openssl-3.2.4-2.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-7ec6fa845b

Comment 10 Fedora Update System 2025-03-12 01:44:52 UTC

FEDORA-2025-7ec6fa845b has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-7ec6fa845b`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-7ec6fa845b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Sebastian Marsching 2025-03-14 11:28:23 UTC

Thank you very much for backporting the fix.

I tested the package from https://bodhi.fedoraproject.org/updates/FEDORA-2025-7ec6fa845b and can confirm that it works fine and fixes the problem.

Comment 12 Fedora Update System 2025-03-20 00:15:59 UTC

FEDORA-2025-7ec6fa845b (mingw-openssl-3.2.4-2.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.