[Box Backup] Exception: Cipher EVPFinalFailure (5/6)

[Eric Cronin]

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--Apple-Mail-1-128939796
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed

I will send you the keys off-list.  I believe the procedure to  
duplicate this would involve (at least)

*compile bbackupd linked against openssl 0.9.8c (d should also work  
if I read CVS correctly, but c seems to be known to be different)
*create a new account on a bbstored matching the keys
*back up some files (the account was at about 20G total when this  
happened)
*upgrade openssl on the client to 0.9.8e
*see if things still work...

There seems to be a dependency on either the key or the amount of  
data backed up before the 0.9.8e switch (or the uploaded block  
count?  this account was about a year old in lazy mode).  We have one  
other machine which is at 0.9.8e right now (and started out at  
0.9.8), and it is operating fine.  It is both newer and lower usage  
than my account was...

As other tools which do block-based local encryption seem to have  
been bitten, I'm not sure it is a bug in boxbackup (e.g. calling an  
API wrong), but it is certainly possible box could work around it...

Thanks,
Eric

On May 2, 2007, at 1:42 PM, Chris Wilson wrote:

> Hi Eric,
>
> On Tue, 1 May 2007, Eric Cronin wrote:
>
>> I was bitten by the mysterious Cipher EVPFinalFailure (5/6) error  
>> about 3 weeks ago also, which coincides with when I updated  
>> OpenSSL on both the client and server to 0.9.8e I wasn't able to  
>> get a precise time as to when it started due to log rotation).  As  
>> I was the only one experiencing the errors, I chalked it up to  
>> something getting majorly broken with my keys and the encrypted  
>> blocks on disk, and created a new account on the same server and  
>> started backing up from scratch to it. Very strangely, this has  
>> been working fine for about 5 days now, which seems odd if it was  
>> and openssl bug.
>
> Thank you for reminding us that this is not the first time that  
> this bug has been seen.
>
> I don't claim to understand much about the internals of OpenSSL,  
> but I think that the bug is in the padding of certain data, and  
> regenerating your certificates might well have changed the length  
> of some encrypted data which results in the error being bypassed/ 
> worked around.
>
> I still think that there may be a bug in OpenSSL 0.9.8d and above,  
> or else some change in functionality which has exposed a previously  
> hidden bug in Box Backup.
>
> In any case, I think that since we have seen two independent bug  
> reports, this now counts as a confirmed bug, so I will add it to  
> the bug tracker and try to fix it as soon as I can.
>
> Do you, by any chance, have a copy of your old certificates and  
> private keys (not encryption keys) that you could send me? Since  
> reproducing the bug appears to depend on these factors, a copy of  
> the keys and certs would be very helpful in reproducing and  
> debugging it.
>
>> For me at least it was far more than just a cosmetic error:  
>> bbackupquery could issue usage and cd, but list or restore  
>> operations errored out. Also, based on the statistics lines and  
>> traffic graphs on the boxbackup port, 0 bytes were successfully  
>> being backed up the entire period when I was seeing this error.
>
> That's good to know as well, that should help me to narrow down the  
> bug and produce a test case.
>
> Cheers, Chris.
> -- 
> _____ __     _
> \  __/ / ,__(_)_  | Chris Wilson <0000 at qwirx.com> - Cambs UK |
> / (_/ ,\/ _/ /_ \ | Security/C/C++/Java/Perl/SQL/HTML Developer |
> \ _/_/_/_//_/___/ | We are GNU-free your mind-and your software |
> _______________________________________________
> boxbackup mailing list
> boxbackup@fluffy.co.uk
> http://lists.warhead.org.uk/mailman/listinfo/boxbackup
>


--Apple-Mail-1-128939796
content-type: application/pgp-signature; x-mac-type=70674453;
	name=PGP.sig
content-description: This is a digitally signed message part
content-disposition: inline; filename=PGP.sig
content-transfer-encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (Darwin)

iQEVAwUBRjksvtx5OUWjSTrqAQgfnAf/UJour863EmDtPA6guHmWhJVl7c2qrabA
GYwYFh5xDSeJg+sA/RwkQHuZdzG5tJXyWP7g2xAGiQuOI4kmE6rQl/NPQrU09iOM
s7rxdSj7Hg+nVuRdPG7B0aOst8j+VLChyA9sTFTsIumrxYRHzIa7DaEPNxlpKBL7
kif3QuWYZ7igkmLjkwxcGLdbLJdcHWOAv6GgsNWAsJPXfgaJTF7czGoukKtteqSv
BCHCAFPqy0bycX+4ys8Ubw9fkpJfNDr1Ky78Q94T0qAhiuPEuuLlXo6FKCCEQsjP
SCWNzGNxhsdOzHms8BVTsQdNy7TKwnnaNAKauzU9H5bebo9m9iPS+g==
=65ba
-----END PGP SIGNATURE-----

--Apple-Mail-1-128939796--