[NETCONF-450] Failed to decrypt encoded data while mounting NETCONF Created: 10/Aug/17  Updated: 15/Mar/19  Resolved: 12/Oct/17

Status: Resolved
Project: netconf
Component/s: netconf
Affects Version/s: None
Fix Version/s: None

Type: Bug
Reporter: Marek Gradzki Assignee: Unassigned
Resolution: Won't Do Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Operating System: All
Platform: All

External issue ID: 8971

 Description   

I am using TCP to mount Honeycomb:

feature:install odl-netconf-topology odl-restconf-all

then

PUT http://localhost:8181/restconf/config/network-topology:network-topology/topology/topology-netconf/node/vpp

{
"node":

{ "node-id": "vpp", "host": "127.0.0.1", "port": 7777, "username": "admin", "password": "admin", "tcp-only": true, "keepalive-delay": 0 }

}

Mount itself works fine, but following error is dsplayed:

2017-08-10 06:29:47,848 | ERROR | on-dispatcher-43 | AAAEncryptionServiceImpl | 223 - org.opendaylight.aaa.encrypt-service - 0.6.0.SNAPSHOT | Failed to decrypt encoded data
javax.crypto.IllegalBlockSizeException: Input length must be multiple of 16 when decrypting with padded cipher
at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:934)[sunjce_provider.jar:1.8.0_131]
at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:845)[sunjce_provider.jar:1.8.0_131]
at com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:446)[sunjce_provider.jar:1.8.0_131]
at javax.crypto.Cipher.doFinal(Cipher.java:2165)[:1.8.0_131]
at org.opendaylight.aaa.encrypt.AAAEncryptionServiceImpl.decrypt(AAAEncryptionServiceImpl.java:162)[223:org.opendaylight.aaa.encrypt-service:0.6.0.SNAPSHOT]
at Proxy344e8f08_8699_442e_8cbc_385cb6efd93a.decrypt(Unknown Source)[:]
at Proxya43816b6_ceab_487d_8d0b_01d8b0a3ec86.decrypt(Unknown Source)[:]
at org.opendaylight.netconf.sal.connect.util.AuthEncryptor.encryptIfNeeded(AuthEncryptor.java:44)[302:org.opendaylight.netconf.sal-netconf-connector:1.6.0.SNAPSHOT]
at org.opendaylight.netconf.topology.AbstractNetconfTopology.setupConnection(AbstractNetconfTopology.java:224)[165:netconf-topology-config:1.3.0.SNAPSHOT]
at org.opendaylight.netconf.topology.AbstractNetconfTopology.connectNode(AbstractNetconfTopology.java:202)[165:netconf-topology-config:1.3.0.SNAPSHOT]
at org.opendaylight.netconf.topology.impl.NetconfTopologyImpl.onDataTreeChanged(NetconfTopologyImpl.java:127)[165:netconf-topology-config:1.3.0.SNAPSHOT]
at org.opendaylight.controller.md.sal.binding.impl.BindingDOMDataTreeChangeListenerAdapter.onDataTreeChanged(BindingDOMDataTreeChangeListenerAdapter.java:41)[246:org.opendaylight.controller.sal-binding-broker-impl:1.6.0.SNAPSHOT]
at org.opendaylight.controller.cluster.datastore.DataTreeChangeListenerActor.dataChanged(DataTreeChangeListenerActor.java:59)[259:org.opendaylight.controller.sal-distributed-datastore:1.6.0.SNAPSHOT]
at org.opendaylight.controller.cluster.datastore.DataTreeChangeListenerActor.handleReceive(DataTreeChangeListenerActor.java:38)[259:org.opendaylight.controller.sal-distributed-datastore:1.6.0.SNAPSHOT]
at org.opendaylight.controller.cluster.common.actor.AbstractUntypedActor.onReceive(AbstractUntypedActor.java:28)[252:org.opendaylight.controller.sal-clustering-commons:1.6.0.SNAPSHOT]
at akka.actor.UntypedActor$$anonfun$receive$1.applyOrElse(UntypedActor.scala:165)[141:com.typesafe.akka.actor:2.4.18]
at akka.actor.Actor$class.aroundReceive(Actor.scala:502)[141:com.typesafe.akka.actor:2.4.18]
at akka.actor.UntypedActor.aroundReceive(UntypedActor.scala:95)[141:com.typesafe.akka.actor:2.4.18]
at akka.actor.ActorCell.receiveMessage(ActorCell.scala:526)[141:com.typesafe.akka.actor:2.4.18]
at akka.actor.ActorCell.invoke(ActorCell.scala:495)[141:com.typesafe.akka.actor:2.4.18]
at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:257)[141:com.typesafe.akka.actor:2.4.18]
at akka.dispatch.Mailbox.run(Mailbox.scala:224)[141:com.typesafe.akka.actor:2.4.18]
at akka.dispatch.Mailbox.exec(Mailbox.scala:234)[141:com.typesafe.akka.actor:2.4.18]
at scala.concurrent.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)[321:org.scala-lang.scala-library:2.11.11.v20170413-090219-8a413ba7cc]
at scala.concurrent.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)[321:org.scala-lang.scala-library:2.11.11.v20170413-090219-8a413ba7cc]
at scala.concurrent.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)[321:org.scala-lang.scala-library:2.11.11.v20170413-090219-8a413ba7cc]
at scala.concurrent.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)[321:org.scala-lang.scala-library:2.11.11.v20170413-090219-8a413ba7cc]
2017-08-10 06:29:47,856 | INFO | on-dispatcher-43 | AuthEncryptor | 302 - org.opendaylight.netconf.sal-netconf-connector - 1.6.0.SNAPSHOT | Encrypting the provided credentials
2017-08-10 06:29:47,993 | INFO | CommitFutures-1 | AuthEncryptor | 302 - org.opendaylight.netconf.sal-netconf-connector - 1.6.0.SNAPSHOT | Encrypted netconf username/password successfully

 Comments   
Comment by Marek Gradzki [ 10/Aug/17 ]

Same issue occurs when SSH is used

Comment by Jakub Morvay [ 10/Aug/17 ]

Well, this is related to mountpoint's credentials encryption and not to the actual encryption of netconf session, so it does not really matter whether you are using SSH or TCP.

I can confirm that this error is being emitted, but otherwise mountpoint seems to work.

Comment by Marek Gradzki [ 10/Aug/17 ]

Right. Thanks for investigation!

Comment by Jakub Morvay [ 10/Aug/17 ]

After brief investigation, it turns out, that the password encryption logic during mountpoint initialization goes as follows:

1) netconf node's password is tried to be decrypted with help of AAA AAAEncryptionService's decrypt method. If the password cannot be decrypted, method returns password unchanged and logs the above mentioned error. Our implementation depends on the fact that unencrypted password is returned unchanged (this is not even documented in the netconf code nor in the AAA's AAAEncryptionService API). If the password is already encrypted (thus can be decrypted), we are not doing anything. I guess this wants to solve the problems with reconnects after ODL restart and similar cases (we don't want to encrypt already encrypted password in DS).

2) password is actually encrypted and stored in DS.

I think this is not the best solution, since the error log is being emitted and this can confuse users. But also this can cause problems if someone specifies plaintext password that actually can be decrypted (although this is very unlikely scenario). ODL will then try to use decrypted plaintext password during session negotiation with device and not the actual password.

Comment by Tomas Cere [ 12/Oct/17 ]

Jakub is correct that this is harmlessly coming from AAA when you have unencrypted password stored, best way to get rid of this and attempting to decrypt unencrypted passwords is to just change to model for credentials like I proposed in https://bugs.opendaylight.org/show_bug.cgi?id=9261 and only run encryption/decryption in the cases that need it.
This log is harmless so closing this, the model change will be handled as a part of 9261

Generated at Wed Feb 07 20:15:04 UTC 2024 using Jira 8.20.10#820010-sha1:ace47f9899e9ee25d7157d59aa17ab06aee30d3d.