RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1668682 - libisc doesn't initialize entropy pool for ssl context
Summary: libisc doesn't initialize entropy pool for ssl context
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: bind
Version: 8.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Petr Menšík
QA Contact: Petr Sklenar
URL:
Whiteboard:
Depends On: 1622060
Blocks: 1660865
TreeView+ depends on / blocked
 
Reported: 2019-01-23 10:30 UTC by Pavel Zhukov
Modified: 2020-11-14 07:51 UTC (History)
3 users (show)

Fixed In Version: bind-9.11.4-25.P2.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1685940 (view as bug list)
Environment:
Last Closed: 2019-11-05 22:13:07 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
additional patch to disable entropy check on startup (638 bytes, patch)
2019-01-23 18:21 UTC, Petr Menšík 		no flags Details | Diff
Alternative patch for current RHEL8, just disable custom entropy (3.75 KB, patch)
2019-01-23 19:31 UTC, Petr Menšík 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3552 0 None None None 2019-11-05 22:13:28 UTC

Description Pavel Zhukov 2019-01-23 10:30:42 UTC 
Description of problem:


Version-Release number of selected component (if applicable):
bind-export-libs-9.11.4-15.P2.el8.x86_64


How reproducible:
100%

Steps to Reproduce:
1. configure dhcpd to use ldaps
2. try to connect to any ssl server


Actual results:
Error: Cannot login into ldap server 127.0.0.1:636: Can't contact LDAP server

# openssl s_server -accept 636 -CAfile ca/ca.crt -key server/server.key  -cert server/server.crt  -debug
Using default temp DH parameters
ACCEPT
yuread from 0x564b3cafc0b0 [0x564b3cb0ac43] (5 bytes => 0 (0x0))
ERROR
shutting down SSL
CONNECTION CLOSED


Expected results:
SSL connection successfully established

Additional info:
Breakpoint 4, dst__entropy_getdata (buf=0x5555558f6cd0, len=16, pseudo=pseudo@entry=isc_boolean_false) at ../../../lib/dns/dst_api.c:1985
1985	dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
(gdb) list
1980			return (ISC_R_NOSPACE);
1981		return (ISC_R_SUCCESS);
1982	}
1983	
1984	isc_result_t
1985	dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
1986		unsigned int flags = dst_entropy_flags;
1987	
1988		if (dst_entropy_pool == NULL)
1989			return (ISC_R_FAILURE);
(gdb) n
1988		if (dst_entropy_pool == NULL)
(gdb) p dst_entropy_pool
$3 = (isc_entropy_t *) 0x0
Comment 1 Petr Menšík 2019-01-23 15:32:53 UTC 
This issue was fixed already in Fedora, when backported patch prepared to solve bug #1622060. It includes also entropy pool creation , which is feeded into initialized dst_lib_init.

Base reason for this behaviour is bind library overrides random generator in OpenSSL with its own entropy generator. It does however also in case dst__openssl_init() called from dns_lib_init() call, which is called from dhcp. In this case, it does not create and initialize entropy pool, but resets OpenSSL random generator to wrappers around internal entropy pool. That returns error if random data are requested. Which is not usually true in DHCP, it never calls RAND_bytes() directly or by wrapper function from ISC library. But it is called from SSL setup in OpenLDAP linked to the same binary.

Fix of bug #1622060 skips resetting OpenSSL random generator with custom one from BIND library, which also prevents this issue. Random data are always provided by default RAND_OpenSSL() implementation.
Comment 2 Petr Menšík 2019-01-23 16:30:02 UTC 
Disadvantage of current patch triggered another error in Fedora, in bug #1663318. It checks whether there is enough entropy on startup. This can prevent dhclient to initialize soon after installation, where not enough entropy was gathered. I solved that by disabling OpenSSL random generator for DHCP. That might be unwanted for TLS contexts created by LDAP. I could not find any call to random data from DHCP itself. TLS data used by LDAP might not be generated with true random data.

I think check for enough random entropy should be disabled when initialized from DHCP, but not API is prepared for it now. Could reuse eflags for entropy flags for such indication.
Comment 3 Petr Menšík 2019-01-23 18:21:54 UTC 
Created attachment 1522771 [details]
additional patch to disable entropy check on startup

I think more simple solution should be used. With addition to ISC_PLATFORM_CRYPTORANDOM support patch, RAND_status check just should be disabled when built without threads for DHCP.

Alternative solution is to replace #ifndef ISC_PLATFORM_CRYPTORANDOM with #ifndef ISC_PLATFORM_USETHREADS in lib/dns/openssl_link.c, skipping OpenSSL random numbers reset. Other parts would not be touched.
Comment 4 Petr Menšík 2019-01-23 19:31:44 UTC 
Created attachment 1522844 [details]
Alternative patch for current RHEL8, just disable custom entropy
Comment 13 errata-xmlrpc 2019-11-05 22:13:07 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3552
Note You need to log in before you can comment on or make changes to this bug.