<!-- 
RSS generated by JIRA (8.20.10#820010-sha1:ace47f9899e9ee25d7157d59aa17ab06aee30d3d) at Wed Feb 07 20:15:04 UTC 2024

It is possible to restrict the fields that are returned in this document by specifying the 'field' parameter in your request.
For example, to request only the issue key and summary append 'field=key&field=summary' to the URL of your request.
-->
<rss version="0.92" >
<channel>
    <title>OpenDaylight JIRA</title>
    <link>https://jira.opendaylight.org</link>
    <description>This file is an XML representation of an issue</description>
    <language>en-us</language>    <build-info>
        <version>8.20.10</version>
        <build-number>820010</build-number>
        <build-date>22-06-2022</build-date>
    </build-info>


<item>
            <title>[NETCONF-450] Failed to decrypt encoded data while mounting NETCONF</title>
                <link>https://jira.opendaylight.org/browse/NETCONF-450</link>
                <project id="10142" key="NETCONF">netconf</project>
                    <description>&lt;p&gt;I am using TCP&lt;img class=&quot;emoticon&quot; src=&quot;https://jira.opendaylight.org/images/icons/emoticons/warning.png&quot; height=&quot;16&quot; width=&quot;16&quot; align=&quot;absmiddle&quot; alt=&quot;&quot; border=&quot;0&quot;/&gt; to mount Honeycomb:&lt;/p&gt;

&lt;p&gt;feature:install odl-netconf-topology odl-restconf-all&lt;/p&gt;

&lt;p&gt;then&lt;/p&gt;

&lt;p&gt;PUT &lt;a href=&quot;http://localhost:8181/restconf/config/network-topology:network-topology/topology/topology-netconf/node/vpp&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;http://localhost:8181/restconf/config/network-topology:network-topology/topology/topology-netconf/node/vpp&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;{&lt;br/&gt;
    &quot;node&quot;: &lt;/p&gt;
{
        &quot;node-id&quot;: &quot;vpp&quot;,
        &quot;host&quot;: &quot;127.0.0.1&quot;,
        &quot;port&quot;: 7777,
        &quot;username&quot;: &quot;admin&quot;,
        &quot;password&quot;: &quot;admin&quot;,
        &quot;tcp-only&quot;: true,
        &quot;keepalive-delay&quot;: 0
    }
&lt;p&gt;}&lt;/p&gt;

&lt;p&gt;Mount itself works fine, but following error is dsplayed:&lt;/p&gt;

&lt;p&gt;2017-08-10 06:29:47,848 | ERROR | on-dispatcher-43 | AAAEncryptionServiceImpl         | 223 - org.opendaylight.aaa.encrypt-service - 0.6.0.SNAPSHOT | Failed to decrypt encoded data&lt;br/&gt;
javax.crypto.IllegalBlockSizeException: Input length must be multiple of 16 when decrypting with padded cipher&lt;br/&gt;
        at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:934)&lt;span class=&quot;error&quot;&gt;&amp;#91;sunjce_provider.jar:1.8.0_131&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:845)&lt;span class=&quot;error&quot;&gt;&amp;#91;sunjce_provider.jar:1.8.0_131&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:446)&lt;span class=&quot;error&quot;&gt;&amp;#91;sunjce_provider.jar:1.8.0_131&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at javax.crypto.Cipher.doFinal(Cipher.java:2165)&lt;span class=&quot;error&quot;&gt;&amp;#91;:1.8.0_131&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.aaa.encrypt.AAAEncryptionServiceImpl.decrypt(AAAEncryptionServiceImpl.java:162)&lt;span class=&quot;error&quot;&gt;&amp;#91;223:org.opendaylight.aaa.encrypt-service:0.6.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at Proxy344e8f08_8699_442e_8cbc_385cb6efd93a.decrypt(Unknown Source)&lt;span class=&quot;error&quot;&gt;&amp;#91;:&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at Proxya43816b6_ceab_487d_8d0b_01d8b0a3ec86.decrypt(Unknown Source)&lt;span class=&quot;error&quot;&gt;&amp;#91;:&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.netconf.sal.connect.util.AuthEncryptor.encryptIfNeeded(AuthEncryptor.java:44)&lt;span class=&quot;error&quot;&gt;&amp;#91;302:org.opendaylight.netconf.sal-netconf-connector:1.6.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.netconf.topology.AbstractNetconfTopology.setupConnection(AbstractNetconfTopology.java:224)&lt;span class=&quot;error&quot;&gt;&amp;#91;165:netconf-topology-config:1.3.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.netconf.topology.AbstractNetconfTopology.connectNode(AbstractNetconfTopology.java:202)&lt;span class=&quot;error&quot;&gt;&amp;#91;165:netconf-topology-config:1.3.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.netconf.topology.impl.NetconfTopologyImpl.onDataTreeChanged(NetconfTopologyImpl.java:127)&lt;span class=&quot;error&quot;&gt;&amp;#91;165:netconf-topology-config:1.3.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.controller.md.sal.binding.impl.BindingDOMDataTreeChangeListenerAdapter.onDataTreeChanged(BindingDOMDataTreeChangeListenerAdapter.java:41)&lt;span class=&quot;error&quot;&gt;&amp;#91;246:org.opendaylight.controller.sal-binding-broker-impl:1.6.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.controller.cluster.datastore.DataTreeChangeListenerActor.dataChanged(DataTreeChangeListenerActor.java:59)&lt;span class=&quot;error&quot;&gt;&amp;#91;259:org.opendaylight.controller.sal-distributed-datastore:1.6.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.controller.cluster.datastore.DataTreeChangeListenerActor.handleReceive(DataTreeChangeListenerActor.java:38)&lt;span class=&quot;error&quot;&gt;&amp;#91;259:org.opendaylight.controller.sal-distributed-datastore:1.6.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at org.opendaylight.controller.cluster.common.actor.AbstractUntypedActor.onReceive(AbstractUntypedActor.java:28)&lt;span class=&quot;error&quot;&gt;&amp;#91;252:org.opendaylight.controller.sal-clustering-commons:1.6.0.SNAPSHOT&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at akka.actor.UntypedActor$$anonfun$receive$1.applyOrElse(UntypedActor.scala:165)&lt;span class=&quot;error&quot;&gt;&amp;#91;141:com.typesafe.akka.actor:2.4.18&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at akka.actor.Actor$class.aroundReceive(Actor.scala:502)&lt;span class=&quot;error&quot;&gt;&amp;#91;141:com.typesafe.akka.actor:2.4.18&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at akka.actor.UntypedActor.aroundReceive(UntypedActor.scala:95)&lt;span class=&quot;error&quot;&gt;&amp;#91;141:com.typesafe.akka.actor:2.4.18&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at akka.actor.ActorCell.receiveMessage(ActorCell.scala:526)&lt;span class=&quot;error&quot;&gt;&amp;#91;141:com.typesafe.akka.actor:2.4.18&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at akka.actor.ActorCell.invoke(ActorCell.scala:495)&lt;span class=&quot;error&quot;&gt;&amp;#91;141:com.typesafe.akka.actor:2.4.18&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:257)&lt;span class=&quot;error&quot;&gt;&amp;#91;141:com.typesafe.akka.actor:2.4.18&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at akka.dispatch.Mailbox.run(Mailbox.scala:224)&lt;span class=&quot;error&quot;&gt;&amp;#91;141:com.typesafe.akka.actor:2.4.18&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at akka.dispatch.Mailbox.exec(Mailbox.scala:234)&lt;span class=&quot;error&quot;&gt;&amp;#91;141:com.typesafe.akka.actor:2.4.18&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at scala.concurrent.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)&lt;span class=&quot;error&quot;&gt;&amp;#91;321:org.scala-lang.scala-library:2.11.11.v20170413-090219-8a413ba7cc&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at scala.concurrent.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)&lt;span class=&quot;error&quot;&gt;&amp;#91;321:org.scala-lang.scala-library:2.11.11.v20170413-090219-8a413ba7cc&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at scala.concurrent.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)&lt;span class=&quot;error&quot;&gt;&amp;#91;321:org.scala-lang.scala-library:2.11.11.v20170413-090219-8a413ba7cc&amp;#93;&lt;/span&gt;&lt;br/&gt;
        at scala.concurrent.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)&lt;span class=&quot;error&quot;&gt;&amp;#91;321:org.scala-lang.scala-library:2.11.11.v20170413-090219-8a413ba7cc&amp;#93;&lt;/span&gt;&lt;br/&gt;
2017-08-10 06:29:47,856 | INFO  | on-dispatcher-43 | AuthEncryptor                    | 302 - org.opendaylight.netconf.sal-netconf-connector - 1.6.0.SNAPSHOT | Encrypting the provided credentials&lt;br/&gt;
2017-08-10 06:29:47,993 | INFO  | CommitFutures-1  | AuthEncryptor                    | 302 - org.opendaylight.netconf.sal-netconf-connector - 1.6.0.SNAPSHOT | Encrypted netconf username/password successfully&lt;/p&gt;</description>
                <environment>&lt;p&gt;Operating System: All&lt;br/&gt;
Platform: All&lt;/p&gt;</environment>
        <key id="21463">NETCONF-450</key>
            <summary>Failed to decrypt encoded data while mounting NETCONF</summary>
                <type id="10104" iconUrl="https://jira.opendaylight.org/secure/viewavatar?size=xsmall&amp;avatarId=10303&amp;avatarType=issuetype">Bug</type>
                                                <status id="5" iconUrl="https://jira.opendaylight.org/images/icons/statuses/resolved.png" description="A resolution has been taken, and it is awaiting verification by reporter. From here issues are either reopened, or are closed.">Resolved</status>
                    <statusCategory id="3" key="done" colorName="green"/>
                                    <resolution id="10001">Won&apos;t Do</resolution>
                                        <assignee username="-1">Unassigned</assignee>
                                    <reporter username="mgradzki">Marek Gradzki</reporter>
                        <labels>
                    </labels>
                <created>Thu, 10 Aug 2017 04:39:42 +0000</created>
                <updated>Fri, 15 Mar 2019 22:22:43 +0000</updated>
                            <resolved>Thu, 12 Oct 2017 14:04:16 +0000</resolved>
                                                                    <component>netconf</component>
                        <due></due>
                            <votes>0</votes>
                                    <watches>3</watches>
                                                                                                                <comments>
                            <comment id="40139" author="mgradzki@cisco.com" created="Thu, 10 Aug 2017 04:48:25 +0000"  >&lt;p&gt;Same issue occurs when SSH is used&lt;/p&gt;</comment>
                            <comment id="40140" author="jmorvay@cisco.com" created="Thu, 10 Aug 2017 08:03:11 +0000"  >&lt;p&gt;Well, this is related to mountpoint&apos;s credentials encryption and not to the actual encryption of netconf session, so it does not really matter whether you are using SSH or TCP.&lt;/p&gt;

&lt;p&gt;I can confirm that this error is being emitted, but otherwise mountpoint seems to work.&lt;/p&gt;</comment>
                            <comment id="40141" author="mgradzki@cisco.com" created="Thu, 10 Aug 2017 08:06:47 +0000"  >&lt;p&gt;Right. Thanks for investigation!&lt;/p&gt;</comment>
                            <comment id="40142" author="jmorvay@cisco.com" created="Thu, 10 Aug 2017 09:26:56 +0000"  >&lt;p&gt;After brief investigation, it turns out, that the password encryption logic during mountpoint initialization goes as follows:&lt;/p&gt;

&lt;p&gt;1) netconf node&apos;s password is tried to be decrypted with help of AAA AAAEncryptionService&apos;s decrypt method. If the password cannot be decrypted, method returns password unchanged and logs the above mentioned error. Our implementation depends on the fact that unencrypted password is returned unchanged (this is not even documented in the netconf code nor in the AAA&apos;s AAAEncryptionService API). If the password is already encrypted (thus can be decrypted), we are not doing anything. I guess this wants to solve the problems with reconnects after ODL restart and similar cases (we don&apos;t want to encrypt already encrypted password in DS).&lt;/p&gt;

&lt;p&gt;2) password is actually encrypted and stored in DS.&lt;/p&gt;

&lt;p&gt;I think this is not the best solution, since the error log is being emitted and this can confuse users. But also this can cause problems if someone specifies plaintext password that actually can be decrypted (although this is very unlikely scenario). ODL will then try to use decrypted plaintext password during session negotiation with device and not the actual password.&lt;/p&gt;</comment>
                            <comment id="40143" author="tcere" created="Thu, 12 Oct 2017 14:04:16 +0000"  >&lt;p&gt;Jakub is correct that this is harmlessly coming from AAA when you have unencrypted password stored, best way to get rid of this and attempting to decrypt unencrypted passwords is to just change to model for credentials like I proposed in &lt;a href=&quot;https://bugs.opendaylight.org/show_bug.cgi?id=9261&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://bugs.opendaylight.org/show_bug.cgi?id=9261&lt;/a&gt; and only run encryption/decryption in the cases that need it.&lt;br/&gt;
This log is harmless so closing this, the model change will be handled as a part of 9261&lt;/p&gt;</comment>
                    </comments>
                    <attachments>
                    </attachments>
                <subtasks>
                    </subtasks>
                <customfields>
                                                                            <customfield id="customfield_11400" key="com.atlassian.jira.plugins.jira-development-integration-plugin:devsummary">
                        <customfieldname>Development</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                                                                                                        <customfield id="customfield_10208" key="com.atlassian.jira.plugin.system.customfieldtypes:textfield">
                        <customfieldname>External issue ID</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>8971</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10201" key="com.atlassian.jira.plugin.system.customfieldtypes:url">
                        <customfieldname>External issue URL</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue><![CDATA[https://bugs.opendaylight.org/show_bug.cgi?id=8971]]></customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                <customfield id="customfield_10000" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>0|i01ym7:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                </customfields>
    </item>
</channel>
</rss>