Bug 2490607
| Summary: | httpd gets stuck during FreeIPA replica enrolment with OpenSSL 4 | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Adam Williamson (Red Hat non-Fedora) <awilliam> |
| Component: | httpd | Assignee: | Luboš Uhliarik <luhliari> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 45 | CC: | abokovoy, adelton, anon.amish, bnater, dbelyavs, ftrivino, icesalov, jorton, luhliari, mfargett, mturk, psklenar, rcritten, rhbz, robatino, ssorce, yselkowi |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | openqa AcceptedBlocker | ||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-09-05 16:17:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2406952 | ||
|
Description
Adam Williamson (Red Hat non-Fedora)
2026-06-18 22:47:58 UTC
Not sure if an instance of the same problem, but another broken thing about FreeIPA in rawhide is simple
# dnf install -y --setopt=install_weak_deps=False freeipa-server
# ipa-server-install -U -r EXAMPLE.TEST -n example.test -p Secret123 -a Secret123
# ipa-kra-install -p Secret123 -U
This will yield a 99+ % CPU looping of a java process:
Tasks: 183 total, 2 running, 181 sleep, 0 d-sleep, 0 stopped, 0 zombie
%Cpu(s): 44.1 us, 6.0 sy, 0.0 ni, 49.7 id, 0.0 wa, 0.2 hi, 0.0 si, 0.0 st
MiB Mem : 2822.3 total, 615.9 free, 1550.7 used, 993.5 buff/cache
MiB Swap: 2822.0 total, 2822.0 free, 0.0 used. 1271.5 avail Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
10151 root 20 0 2820520 125232 33328 S 99.7 4.3 4:54.15 java
7424 pkiuser 20 0 2935480 253684 39352 S 0.3 8.8 0:22.95 java
1 root 20 0 44144 25032 12812 S 0.0 0.9 0:12.15 systemd
2 root 20 0 0 0 0 S 0.0 0.0 0:00.01 kthreadd
until I killed it.
Observed in the FreeIPA containerization CI: https://github.com/freeipa/freeipa-container/issues/745.
From the Slack discussion, this looked like a Post-Handshake Auth issue. I was unable to reproduce any PHA issue with simple testing against a Rawhide container, using a standard mod_ssl configuration requiring per-location client certificates. +3 in https://forge.fedoraproject.org/quality/blocker-review/issues/2137 , marking accepted blocker. This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45. I've been told https://github.com/dogtagpki/jss/pull/1116 is the currently-proposed fix for this, or at least part of it, so linking that. A reminder that we don't have long before Beta release now. Beta freeze is tomorrow and Go/No-Go is scheduled for Sept 10, which means we really need a candidate compose by Sept 7. Does it look like we will be able to address this by then? Hey, Adam, the JSS fix addresses the OpenSSL 4 issue in IPA, which is the current blocker. There is a subsequent fix needed for mod_ssl due to a missing timeout, but that will be handled separately and later. I’ll prioritize the JSS review and build so we can get this moving, and we should be able to have this addressed in time. FEDORA-2026-23de7c02f9 (jss-5.10.1-2.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-23de7c02f9 FEDORA-2026-23de7c02f9 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-23de7c02f9` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-23de7c02f9 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. I confirm that the jss-5.10.1-2.fc46 build (of https://bodhi.fedoraproject.org/updates/FEDORA-2026-7add23556a) fixes the problem for the FreeIPA containerization on Fedora rawhide. openQA tests also verified the fix. FEDORA-2026-23de7c02f9 (jss-5.10.1-2.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report. I looked at the mod_ssl issue. In the pcap, mod_ssl sends the CertificateRequest message for PHA. TLS/1.3 §4.7.2 https://www.rfc-editor.org/info/rfc9846/#section-4.7.2 requires SOME response to that. mod_ssl waits for that, 60 seconds expire (default I/O timeout), nothing comes, and then it aborts the connection (unclean shutdown, TCP FIN). Apparently because the client is spinning it ignores that. I'm not seeing a mod_ssl bug that we could/should test for - the I/O timeout was applied as expected by the server. |