<div dir="ltr">Thanks Michael,<div><br></div><div> I saw a lot of discussion for this issue on,</div><div> </div><div> <a href="https://mta.openssl.org/pipermail/openssl-dev/2015-July/002210.html">https://mta.openssl.org/pipermail/openssl-dev/2015-July/002210.html</a></div><div><br></div><div> Not sure if openSSL has a workaround or a patch ?<br></div><div><br></div><div><br></div><div>It hangs on : </div><div><br></div><div><b>libeay32.dll!RAND_poll() Line <font color="#990000">523 </font> </b><br><div><br></div><div><div><span style="white-space:pre"> </span>if (<b>heap_first</b>(&hentry,</div><div><span style="white-space:pre"> </span> hlist.th32ProcessID,</div><div><span style="white-space:pre"> </span> hlist.th32HeapID))</div></div></div><div><br></div><div><br></div><div><br></div><div>Jason</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 5, 2017 at 11:59 AM, Michael Wojcik <span dir="ltr"><<a href="mailto:Michael.Wojcik@microfocus.com" target="_blank">Michael.Wojcik@microfocus.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_280168001000228331WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">As I speculated, it appears you're hanging in random-number generation, probably due to a blocking CPRNG that can't get the entropy it needs.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">This is an operating-system issue, and needs to be referred to your OS administrator.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:black">Michael Wojcik</span><span style="font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1f497d">
<br>
</span><span style="font-size:9.0pt;font-family:"Courier New";color:black">Distinguished Engineer</span><span style="font-size:9.0pt;font-family:"Courier New";color:black">, Micro Focus</span><span style="font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1f497d">
</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Jason Qian [mailto:<a href="mailto:jqian@tibco.com" target="_blank">jqian@tibco.com</a>]
<br>
<b>Sent:</b> Thursday, October 05, 2017 08:44<br>
<b>To:</b> Michael Wojcik<br>
<b>Cc:</b> <a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
<b>Subject:</b> Re: [openssl-users] DH_generate_key Hangs<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Here is the stack trace :<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> libeay32.dll!RAND_poll Normal<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> [External Code] <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> libeay32.dll!RAND_poll() Line 523 <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> libeay32.dll!ssleay_rand_<wbr>bytes(unsigned char * buf, int num, int pseudo) Line 395 <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> libeay32.dll!ssleay_rand_<wbr>nopseudo_bytes(unsigned char * buf, int num) Line 536 <u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Jason<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Wed, Sep 27, 2017 at 2:02 PM, Michael Wojcik <<a href="mailto:Michael.Wojcik@microfocus.com" target="_blank">Michael.Wojcik@microfocus.com</a><wbr>> wrote:<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">> From: openssl-users [mailto:<a href="mailto:openssl-users-bounces@openssl.org" target="_blank">openssl-users-bounces@<wbr>openssl.org</a>] On Behalf Of Jason Qian via openssl-users<br>
> Sent: Wednesday, September 27, 2017 07:00<br>
> To: <a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
> Subject: [openssl-users] DH_generate_key Hangs<br>
<br>
> Need some help, one of our application that hangs when calling<br>
> DH_generate_key (openssl-0.9.8y). This occurs randomly under loaded condition. <br>
> Not sure, if anyone know this issue ?<br>
<br>
The issue is running OpenSSL 0.9.8, which has not been supported since 2015.<br>
<br>
DH_generate_key can use an engine (at least in supported versions of OpenSSL - I no longer have any 0.9.8 code around to check), so we really can't say what it might be doing in your application. But if it's using the default OpenSSL implementation, then if
your DH parameters don't already include a private key, you'll end up generating random numbers. That can hang, if OpenSSL is using a blocking CPRNG source such as /dev/random.<br>
<br>
But you haven't provided nearly enough information to do more than speculate.<br>
<br>
What you need to do:<br>
<br>
1. Upgrade to OpenSSL 1.0.2 (or possibly 1.1.0, but that has API changes and isn't an LTS release). There's really no point in proceeding unless you do so. Your application is broken if it's using 0.9.8.<br>
<br>
2. If the problem still occurs, debug a hanging instance and find out where *exactly* it's hung.<br>
<span style="color:#888888"><br>
<span class="m_280168001000228331hoenzb">--</span><br>
<span class="m_280168001000228331hoenzb">Michael Wojcik</span><br>
<span class="m_280168001000228331hoenzb">Distinguished Engineer, Micro Focus</span><br>
<br>
<br>
</span><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</blockquote></div><br></div>