search

cern-fts / davix

High-performance file management over WebDAV / HTTP
GNU Lesser General Public License v2.1
84 stars 36 forks source link

Encrypted key files do not parse correctly #50

Closed TLATER closed 4 years ago

TLATER commented 4 years ago

Hi, I'm trying to upload files with an encrypted PEM key, but I get the following:

tlater ~/projects/webdav-test $ davix-put --key tlater.key.pem --cert tlater.cert.pem test dav://server/test
(Davix::OpenSSL) Error: parse PEM private key failed tlater.key.pem : error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
(Davix::HttpRequest) Error: (Neon): SSL handshake failed, client certificate was requested: sslv3 alert handshake failure

Unencrypted key files do work, and curl will happily use this one, so I think there's something wrong here.

gbitzes commented 4 years ago

Thanks for the bug report!

This is really strange -- OpenSSL returns an error code of PEM_R_BAD_BASE64_DECODE, but in the error message it mentions bad decrypt.

I don't understand why the error code is not PEM_R_BAD_DECRYPT. davix checks for this error code to decide whether to ask the user for the key password.

Anyway, we now check if the error message contains bad decrypt, too. I assume this was caused by some recent change in OpenSSL behavior, since this used to work indeed.

Fix committed, I can provide updated packages from our CI repo if you're interested to test it out.

TLATER commented 4 years ago

Oh, that was quick. Thanks for the offer, I don't desperately want to try unless it's a useful test case for you.