Bug 1362312
| Summary: | ipa vault-retrieve internal error when using the wrong public key | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Scott Poore <spoore> | ||||
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Kaleem <ksiddiqu> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.3 | CC: | dkupka, pvoborni, rcritten | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | ipa-4.4.0-5.el7 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-11-04 05:59:51 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 1186578 [details]
debug output for vault-retrieve with incorrect private-key-file
Upstream ticket: https://fedorahosted.org/freeipa/ticket/6160 Fixed upstream master: https://fedorahosted.org/freeipa/changeset/8ab0ad5b9ef59eca7b25a150baeb4a9bf8faa582 Verified. Version :: ipa-server-4.4.0-5.el7.x86_64 Results :: [root@rhel7-5 ~]# openssl genrsa -out /tmp/key1.prv 2048 Generating RSA private key, 2048 bit long modulus ..................+++ ............+++ e is 65537 (0x10001) [root@rhel7-5 ~]# openssl rsa -in /tmp/key1.prv -out /tmp/key1.pub -pubout writing RSA key [root@rhel7-5 ~]# openssl genrsa -out /tmp/key2.prv 2048 Generating RSA private key, 2048 bit long modulus ................+++ ....................+++ e is 65537 (0x10001) [root@rhel7-5 ~]# openssl rsa -in /tmp/key2.prv -out /tmp/key2.pub -pubout writing RSA key [root@rhel7-5 ~]# ipa vault-add --type=asymmetric testvault1 --public-key-file=/tmp/key1.pub ------------------------ Added vault "testvault1" ------------------------ [root@rhel7-5 ~]# ipa vault-archive testvault1 --data="U2VjcmV0MTIzCg==" ------------------------------------- Archived data into vault "testvault1" ------------------------------------- [root@rhel7-5 ~]# ipa vault-retrieve testvault1 --private-key-file=/tmp/key2.prv ipa: ERROR: Invalid credentials [root@rhel7-5 ~]# Just to show that retrieve worked: [root@rhel7-5 ~]# ipa vault-retrieve testvault1 --private-key-file=/tmp/key1.prv -------------------------------------- Retrieved data from vault "testvault1" -------------------------------------- Data: U2VjcmV0MTIzCg== Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2404.html |
Description of problem: When retrieving an asymmetric vault with the incorrect private key, you see an internal error: [root@rhel7-1 ~]# ipa vault-retrieve testvault1 --private-key-file=/tmp/key2.prv ipa: ERROR: non-public: ValueError: Decryption failed. Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 137, in execute result = self.Command[_name](*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 447, in __call__ return self.__do_call(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 475, in __do_call ret = self.run(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 1199, in run return self.forward(*args, **options) File "/usr/lib/python2.7/site-packages/ipaclient/plugins/vault.py", line 993, in forward encryption_key = decrypt(encrypted_key, private_key=private_key) File "/usr/lib/python2.7/site-packages/ipaclient/plugins/vault.py", line 164, in decrypt label=None File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 538, in decrypt return _enc_dec_rsa(self._backend, self, ciphertext, padding) File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 76, in _enc_dec_rsa return _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum) File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 105, in _enc_dec_rsa_pkey_ctx _handle_rsa_enc_dec_error(backend, key) File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 151, in _handle_rsa_enc_dec_error raise ValueError("Decryption failed.") ValueError: Decryption failed. ipa: ERROR: an internal error has occurred Version-Release number of selected component (if applicable): ipa-server-4.4.0-4.el7.x86_64 How reproducible: always Steps to Reproduce: 1. generate 2 sets of keys to test with openssl genrsa -out /tmp/key1.prv 2048 openssl rsa -in /tmp/key1.prv -out /tmp/key1.pub -pubout openssl genrsa -out /tmp/key2.prv 2048 openssl rsa -in /tmp/key2.prv -out /tmp/key2.pub -pubout 2. Create new vault with some content ipa vault-add --type=asymmetric testvault1 --public-key-file=/tmp/key1.pub ipa vault-archive testvault1 --data="U2VjcmV0MTIzCg==" 3. Attempt to retrieve with the unused key file ipa vault-retrieve testvault1 --private-key-file=/tmp/key2.prv Actual results: Internal error and stack trace shown above Expected results: no internal error Additional info: Error message from /var/log/httpd/error_log: [Mon Aug 01 19:05:26.560451 2016] [:error] [pid 5226] ipa: INFO: [jsonserver_session] admin: vault_retrieve_internal/1(u'testvault1', session_key='\\xdb\\xb5\\x10\\x93\\xa3\\xe7\\xb9c\\xa0\\xce@\\xbe\\xdda\\x8a\\xe6\\xa9\\x96\\xfc((\\xe5\\xb4\\x11\\x17W\\t\\xbf\\xa2\\x1c)\\xc6\\x98e\\x19\\xf9G\\xfc\\x9f\\xbb\\x1b\\x9c5\\xdb\\xc9R1\\xa0\\xd4Z\\xb0;\\x1d\\xc4\\xea\\xfeB6>\\x1e\\x8dk\\x11\\xb8\\x91\\xc4\\xfcwl\\x06\\x85.\\xf6\\x89\\x0f\\xa6\\x91\\xe1C"\\x17\\xa4L.\\xf6\\x04\\x8e\\x83\\xfe\\xef\\x07\\x1ca\\x87\\x17>\\x01\\x18\\xe3\\x83G\\xa8\\x93\\xb8\\n(iL\\xc4Ej:\\x17\\xcf/\\xe2&\\xd1\\xf9:GA\\xfe2N\\xf2!\\xf0]\\xfe\\x8d\\xa7\\xc5\\x19"%\\x8c\\xae\\\\\\xc4JS\\xf5Z#\\xff\\x93\\xc5\\x96\\xf6\\xe0\\xbc\\x1e{\\xa5\\x9e}Y\\xc91|\\x17\\xec\\xffo>}\\xb9A\\xb3r\\xb3\\xac\\xd4\\xf3\\xf7\\xa1%\\x83\\xd7\\x1d\\xd0X\\x12C^\\xc9\\xb0\\xe1m\\xac\\xcb\\x00\\x80\\xfa\\xbd\\x17\\xd6\\xfb=\\x159r\\x1a>\\xcb\\x85B~b}0\\x8d\\xcc\\xab4\\xcc\\xdf\\x9aVp\\x97\\xc6\\xd3\\x9b\\xbb>\\x0c-`\\x1dB\\xa2\\xae\\xbc\\xb4\\xecY\\x1d\\xabf_\\xecr81\\x90\\x99\\xcfs\\x19\\xdc\\xea\\xed\\x07L', version=u'2.211'): SUCCESS