Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1942384

Summary:	virt-who dies when attempting to start with FIPS active due to md5 hashlib [rhel8.4]
Product:	Red Hat Enterprise Linux 8	Reporter:	Kunxin Huang <kuhuang>
Component:	virt-who	Assignee:	candlepin-bugs
Status:	CLOSED CURRENTRELEASE	QA Contact:	Eko <hsun>
Severity:	high	Docs Contact:
Priority:	high
Version:	8.4	CC:	abkulkar, hsun, jgoodwan, redakkan, sghai, wpoteat, yuefliu
Target Milestone:	rc	Keywords:	TestOnly, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-11 13:32:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1921920
Bug Blocks:

Description Kunxin Huang 2021-03-24 10:01:46 UTC

Description of problem:

When starting virt-who, we receive a traceback of proccess failing to start due to md5 hashlib in a FIPS enabled environment [rhsm.log]:

2021-03-24 17:45:04,490 [virtwho.main DEBUG] MainProcess(1721):Thread-2 @virt.py:run:407 - Thread 'virtwho-config' started
2021-03-24 17:45:04,490 [virtwho.main DEBUG] MainProcess(1721):Thread-2 @esx.py:_prepare:136 - Log into ESX
2021-03-24 17:45:04,495 [virtwho.destination_8660975658016899216 DEBUG] MainProcess(1721):Thread-3 @virt.py:run:407 - Thread 'destination_8660975658016899216' started
2021-03-24 17:45:04,494 [virtwho.main ERROR] MainProcess(1721):Thread-2 @virt.py:run:421 - Thread 'virtwho-config' fails with exception:
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/virtwho/virt/virt.py", line 412, in run
    self._run()
  File "/usr/lib/python3.6/site-packages/virtwho/virt/esx/esx.py", line 149, in _run
    self._prepare()
  File "/usr/lib/python3.6/site-packages/virtwho/virt/esx/esx.py", line 137, in _prepare
    self.login()
  File "/usr/lib/python3.6/site-packages/virtwho/virt/esx/esx.py", line 365, in login
    self.client = suds.client.Client(wsdl, location="%s/sdk" % self.url, **kwargs)
  File "/usr/lib/python3.6/site-packages/suds/client.py", line 120, in __init__
    self.wsdl = reader.open(url)
  File "/usr/lib/python3.6/site-packages/suds/reader.py", line 101, in open
    id = self.mangle(url, "wsdl")
  File "/usr/lib/python3.6/site-packages/suds/reader.py", line 61, in mangle
    h = md5(name.encode()).hexdigest()
ValueError: [digital envelope routines: EVP_DigestInit_ex] disabled for FIPS
2021-03-24 17:45:04,501 [virtwho.main INFO] MainProcess(1721):Thread-2 @virt.py:_send_data:980 - Report for config "virtwho-config" gathered, placing in datastore
2021-03-24 17:45:04,501 [virtwho.main INFO] MainProcess(1721):Thread-2 @virt.py:run:440 - Waiting 60 seconds before performing action again 'virtwho-config'
2021-03-24 17:45:05,497 [virtwho.destination_8660975658016899216 DEBUG] MainProcess(1721):Thread-3 @subscriptionmanager.py:_connect:152 - Authenticating with certificate: /etc/pki/consumer/cert.pem



Version-Release number of selected component (if applicable):
virt-who-1.30.5-1.el8.noarch


How reproducible:
100%

Steps to Reproduce:
1. Build a fips enabled host (Or enable fips on a host)
[root@bootp-73-5-204 virt-who.d]# fips-mode-setup --enable
Kernel initramdisks are being regenerated. This might take some time.
Setting system policy to FIPS
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies
to fully take place.
FIPS mode will be enabled.
Please reboot the system for the setting to take effect.
[root@bootp-73-5-204 virt-who.d]# reboot

[root@bootp-73-5-204 ~]# cat /proc/sys/crypto/fips_enabled
1

2. Install virt-who (latest for RHEL 8.4)
3. service virt-who start

Actual results:
Traceback seen above

Expected results:
virt-who running and in reporting state.


Additional info:
Same error see: https://bugzilla.redhat.com/show_bug.cgi?id=1349640

Comment 1 Kunxin Huang 2021-03-24 10:04:30 UTC

RHEL compose for the virt-who host:
RHEL-8.4.0-20210309.1

Comment 2 Rehana 2021-03-26 13:13:33 UTC

Hi ,

Can you please confirm if this is a regression from RHEL 8.3 ? 

thanks,
Rehana

Comment 3 William Poteat 2021-03-26 13:34:31 UTC

Here is the bug that is causing this issue:

https://bugzilla.redhat.com/show_bug.cgi?id=1921920

Comment 4 Kunxin Huang 2021-03-29 04:05:41 UTC

Hey Rehana,

Can also see this error for RHEL8.3.


package:
virt-who-0.29.3-1.el8.noarch

Comment 5 Rehana 2021-04-01 15:19:56 UTC

Hi Kunxin, 

Please retest this bug once the original bug is resolved Bug 1942384. There is no update needed from virt-who. 

thanks,
Rehana

Comment 6 Kunxin Huang 2021-04-02 02:30:31 UTC

Hi Rehana,
which bug is the original bug? Seems you put the wrong bug id :)

Comment 7 Kunxin Huang 2021-04-02 02:32:58 UTC

And even for Bug 1921920, it is still NEW

Comment 8 Kunxin Huang 2021-04-02 07:00:55 UTC

Rehana, I Got it, thanks :)

Comment 9 Rehana 2021-04-06 10:27:47 UTC

Converting this bug as test only bug. Please retest the observation once the related Bug 1921920 is resolved. 

Requesting needinfo from QE, please clear the need info flag once the observation is retested.

Comment 10 Rehana 2022-02-21 10:17:21 UTC

*** Bug 2051883 has been marked as a duplicate of this bug. ***