Authenticated ciphertext could not be decoded

encode42 commented 2 years ago

System Information

Server:

 Run "php ./occ passwords:system:report debug" in your Nextcloud install directory and put the output here
 or fill out the fields below

 Nextcloud Version: 23.0.0.10
 PHP Version: 8.0.14
 Database and Version: MariaDB 10.5.13
 Server OS and Version: Unknown - Docker image
 Passwords Version: 2022.1.20

Client:

 Browser and Version: Firefox 96.0.1
 Client OS and Version: EndeavourOS

Steps to reproduce

Reproduction steps are entirely unknown.

Functioning Nextcloud instance about 4 months old.
Cron job is finicky, believe it ran during the update.
Updated MariaDB, Nextcloud (and its container), and the passwords app, no longer functions.

Expected result

Passwords are displayed.

Actual result

"Unable to complete request" on client, "Authenticated ciphertext could not be decoded." on server.

Nextcloud log

``` Can't access via web UI for some reason. https://mclo.gs/mRTiJNq ```

Browser log

``` Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source specified Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). moz-extension:33:9 Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). moz-extension:148:35 No OC found index.js:46:12 Proxying an event bus of version 2.1.1 with 1.3.0 index.es.js:2337:14 JQMIGRATE: Migrate is installed, version 3.3.2 jquery-migrate.min.js:2:708 jQuery is deprecated: The global jQuery is deprecated. It will be removed in a later versions without another warning. Please ship your own. globals.js:62:15 $ is deprecated: The global jQuery is deprecated. It will be removed in a later versions without another warning. Please ship your own. globals.js:62:15 jQuery is deprecated: The global jQuery is deprecated. It will be removed in a later versions without another warning. Please ship your own. 2 globals.js:62:15 Proxying an event bus of version 2.1.1 with 1.3.0 index.es.js:2337:14 Loading theming data for notification bell styling App.vue:138 $ is deprecated: The global jQuery is deprecated. It will be removed in a later versions without another warning. Please ship your own. globals.js:62:15 Registering notifications container as a menu App.vue:148 $ is deprecated: The global jQuery is deprecated. It will be removed in a later versions without another warning. Please ship your own. 2 globals.js:62:15 Notifications permissions granted App.vue:366 Polling interval updated to 30000 App.vue:326 Started background fetcher as session_keepalive is enabled App.vue:204 jQuery is deprecated: The global jQuery is deprecated. It will be removed in a later versions without another warning. Please ship your own. globals.js:62:15 $ is deprecated: The global jQuery is deprecated. It will be removed in a later versions without another warning. Please ship your own. globals.js:62:15 Proxying an event bus of version 2.1.1 with 1.3.0 unified-search.js:5:123638 session heartbeat polling started session-heartbeat.js:101:9 Got notification data App.vue:289 Polling interval updated to 30000 App.vue:326 Object { status: "error", id: 0, message: "Unable to complete request", response: Response } app.js:2:1293870 Uncaught (in promise) Object { status: "error", id: 0, message: "Unable to complete request", response: Response } [DEBUG] unified-search: Unified Search initialized with the following providers Object { 0: {…}, 1: {…}, 2: {…}, 3: {…}, 4: {…}, 5: {…}, 6: {…}, 7: {…}, 8: {…}, 9: {…}, … } unified-search.js:5:209323 Use of Mutation Events is deprecated. Use MutationObserver instead. content.js:30:325 ```

marius-wieschollek commented 2 years ago

This error seems to be thrown by Nextclouds encryption api if the encrypted data is missing some parts. I'm not sure what could cause this as the passwords app does not modify the encrypted data.

I would recommend restoring the latest automatic backup.

encode42 commented 2 years ago

Nextcloud's encryption is off, so that shouldn't interfere. Restoring from backups seemed to have no effect.

Update: Restoring a very old backup (2 months old) seems to have worked, though I'd like to keep what I've changed in that timespan. Any way to recover?

~~Another update: Exporting the latest backup, then re-importing said backup has restored functionality within the app. I'm guessing the database entered a janky state after an upgrade.~~

encode42 commented 2 years ago

imported the database wrong, issue stands :facepalm:

marius-wieschollek commented 2 years ago

I would like to point out that importing and restoring backups are two different things. Only restoring a backup overwrites the current database with the backup data.

If restoring an old backup does not fix the issue, then it's either not a problem with the data in the database or the broken data is already in that data.

You can also try the ./occ maintenance:repair command which should simply remove any item that can't be decrypted.

encode42 commented 2 years ago

I would like to point out that importing and restoring backups are two different things. Only restoring a backup overwrites the current database with the backup data.

Yes, figured that out after I closed the issue.

I did a diff check between the working and non-working backups, and it seems as though the data has been decrypted. All passwords are stored in plaintext.

One of these backups are before I ran a system update (Nextcloud apps, nc itself, etc), and the other was made during this issue.

I don't remember if I ever messed with Nextcloud's encryption settings, and am almost certain it's been disabled since setup, but I did notice that all downloaded files were just HTML files containing an error along the lines of "no default encryption module is set" after the update. The default encryption module was also disabled when I went to the app store.

Is this some sort of settings mismatch? It seems to me something went very wrong during the update process and entered an invalid state where the database is decrypted and the app doesn't expect it.

marius-wieschollek commented 2 years ago

All passwords are stored in plaintext.

Do you mean that the passwords app has stored passwords as plain text and human readable in the database or the backups?

If so, can you see the cseType and sseType values for these passwords?

but I did notice that all downloaded files were just HTML files containing an error along the lines of "no default encryption module is set" after the update.

I'm not sure if i can follow here. Do you mean your files stored in the file app?

encode42 commented 2 years ago

I'm not sure if i can follow here. Do you mean your files stored in the file app?

Yes, when I downloaded a file, it'd just download a file that contained the text "No default encryption module defined". It was "solved" by enabling the default encryption module on the app store.

I also checked Nextcloud's encryption status in the security panel, and it's disabled.

Do you mean that the passwords app has stored passwords as plain text and human readable in the database or the backups?

From what I gather, it appears as plain text in a backup stored in the password app's autoBackups directory. Only the non-functioning one though has this behavior, the functioning backup stores values encrypted.

If so, can you see the cseType and sseType values for these passwords?

It appears all cseType and sseType are the same between the backups. cseType is none, and sseType is SSEv1r2.

marius-wieschollek commented 2 years ago

If you restore one of the "working" backups, does the app return to function normally afterwards or is it still broken?

If the passwords are stored in plain text in the database, you can get the app back working by just simply setting the sseType to none for affected passwords. Encrypted values must have a "|" in them so UPDATE `oc_passwords_password_rv` SET sse_type = 'none' WHERE `password` NOT LIKE '%|%' would update the passwords. You might also have to do that for oc_passwords_folder_rv and oc_passwords_tag_rv

Can you check the integrity of the app and Nextcloud with

./occ integrity:check-app passwords
./occ integrity:check-core

There should have been no case where decrypted values are stored anywhere, regardless of the status of the encryption module. I really want to find out what could have caused this and how to prevent it.

encode42 commented 2 years ago

If you restore one of the "working" backups, does the app return to function normally afterwards or is it still broken?

Yep

I ran the suggested queries on the database, and everything's now working as normal.

Both of the integrity checks passed, I really have no idea what could've caused this.

I'll keep this open in case more information is found/needed, feel free to close whenever.

marius-wieschollek commented 2 years ago

I couldn't reproduce the issue so i added some more checks to make sure that the passwords are never saved without being encrypted first. I hope that this will prevent the issue in the future.

marius-wieschollek / passwords