freeipa

#7292 vault: occasional failures to retrieve archived data
Closed: worksforme by rcritten. Opened by ftweedal.

Closed: worksforme
Reopen Issue

Issue

Sometimes the vault tests are failing in CI with:

 test_vault_plugin.test_command[0024: vault_retrieve: Retrieve secret from standard vault converted to symmetric vault]

The related part of kra/debug log contains:

[01/Dec/2017:13:19:03][ajp-nio-127.0.0.1-8009-exec-10]: SecurityDataProcessor.archive wrappedSecurityData: M9YykgoPRbw64yb4scickw==
[01/Dec/2017:13:19:03][ajp-nio-127.0.0.1-8009-exec-10]: EncryptionUnit.decryptExternalPrivate
[01/Dec/2017:13:19:03][ajp-nio-127.0.0.1-8009-exec-10]: EncryptionUnit.encryptInternalPrivate
[01/Dec/2017:13:19:03][ajp-nio-127.0.0.1-8009-exec-10]: Failed to create security data to archive: Failed to generate crypto context

It is nondeterministic where this fails. It happens often in CI, but it hard to reproduce
in other environments (I ran test_vault_plugin 100 times on my machine; only two test runs failed).

Steps to Reproduce

  1. Hammer the test_vault_plugin tests.
  2. Keep doing that until a failure is observed.

Version/Release/Distribution

pki-10.5.1-3; freeipa-4.6.90 (master)

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

The problem may be in JSS or NSS. I cannot find any difference in how the method is called
between invocations that fail and ones that succeed, except that a different 16-byte IV is used,
and a different 128-bit AES key is used (which has just been generated).

Java call stack:

org.mozilla.jss.crypto.TokenException: Failed to generate crypto context                         
        at org.mozilla.jss.pkcs11.PK11Cipher.initContext(Native Method)                          
        at org.mozilla.jss.pkcs11.PK11Cipher.initEncrypt(PK11Cipher.java:98)                     
        at com.netscape.cmsutil.crypto.CryptoUtil.encryptUsingSymmetricKey(CryptoUtil.java:2639) 
        at com.netscape.kra.StorageKeyUnit.encryptInternalPrivate(StorageKeyUnit.java:1116)      
        at com.netscape.kra.SecurityDataProcessor.archive(SecurityDataProcessor.java:237)        
        at com.netscape.kra.SecurityDataService.serviceRequest(SecurityDataService.java:57)      
        at com.netscape.kra.KRAService.serviceRequest(KRAService.java:96)                        
        at com.netscape.cmscore.request.ARequestQueue.stateEngine(ARequestQueue.java:615)        
        at com.netscape.cmscore.request.ARequestQueue.processRequest(ARequestQueue.java:382)     
        at com.netscape.cms.servlet.key.KeyRequestDAO.submitRequest(KeyRequestDAO.java:231)      
        at org.dogtagpki.server.kra.rest.KeyRequestService.archiveKey(KeyRequestService.java:153)
        ...

It's happening more often on Travis now.
Edited by cheimes

Metadata Update from @cheimes:
- Issue priority set to: important
- Issue set to the milestone: FreeIPA 4.6

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.6.2 (was: FreeIPA 4.6)

Metadata Update from @tdudlak:
- Issue set to the milestone: FreeIPA 4.6.3 (was: FreeIPA 4.6.2)

Hello, any update on this?

I am able to see this vault-retrieve failure on
http://jenkins.idm.lab.eng.brq.redhat.com/view/FreeIPA%20Integration%20-%20master%20Fedora%2026/job/freeipa-timed-integration-f26master-vault-domlevel-1/83/testReport/
It's reproducible on recent runs

Afraid not. Buried by other issues ATM. Keep prodding :)

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.6.4 (was: FreeIPA 4.6.3)

FreeIPA 4.6.3 has been released, moving to FreeIPA 4.6.4 milestone

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.6.5 (was: FreeIPA 4.6.4)

Metadata Update from @frenaud:
- Issue tagged with: test-failure, tests

We haven't seen failures of this test in the last 10 months. I"m going to assume it was fixed as a side effect of another change.

Metadata Update from @rcritten:
- Issue close_status updated to: worksforme
- Issue set to the milestone: None (was: FreeIPA 4.6.5)
- Issue status updated to: Closed (was: Open)
Metadata

test-failure tests

None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.