MDN fails to decrypt after upgrading from 2.3.1 to 2.6.1

[sdgathman]

Receiving files seems to work ok. Sending log from 2.3.1:

2018-09-25 15:40:17.223 FINE AS2SenderModule: Connecting to: http://edi2.xxxxx.com:60080/ [OPENAS2-25092018154017-0400-67dedc4c-f99e-482d-a58d-3a6e4ffebe03@editorialunilit_SAN_2475979_PROD_074240599]
2018-09-25 15:40:17.310 FINE AS2SenderModule: transferred 2910 bytes in 0.33 seconds at 86.118 KBps [OPENAS2-25092018154017-0400-67dedc4c-f99e-482d-a58d-3a6e4ffebe03@editorialunilit_SAN_2475979_PROD_074240599]
2018-09-25 15:40:17.469 FINE AS2Util: received MDN [automatic-action/MDN-sent-automatically; processed] [OPENAS2-25092018154017-0400-67dedc4c-f99e-482d-a58d-3a6e4ffebe03@editorialunilit_SAN_2475979_PROD_074240599]
2018-09-25 15:40:17.739 FINE AS2Util: Message sent and MDN received successfully. [OPENAS2-25092018154017-0400-67dedc4c-f99e-482d-a58d-3a6e4ffebe03@editorialunilit_SAN_2475979_PROD_074240599]
2018-09-25 15:40:17.739 FINE AS2Util: deleted /var/lib/openas2/config/../data/pendingMDN3/OPENAS2-25092018154017-0400-67dedc4c-f99e-482d-a58d-3a6e4ffebe03@editorialunilit_SAN_2475979_PROD_074240599 [OPENAS2-25092018154017-0400-67dedc4c-f99e-482d-a58d-3a6e4ffebe03@editorialunilit_SAN_2475979_PROD_074240599]

Sending log after upgrade to 2.6.1:

2018-09-26 13:32:18.550 FINE AS2SenderModule: Connecting to: http://edi2.xxxxx.com:60080/ [<OPENAS2-26092018132852-0400-b7485b05-841c-4b47-98c6-814af9a6b91c@editorialunilit_SAN_2475979_PROD_074240599>]
2018-09-26 13:32:19.011 FINE AS2SenderModule: Message sent and response received in 347 millisecondsms [<OPENAS2-26092018132852-0400-b7485b05-841c-4b47-98c6-814af9a6b91c@editorialunilit_SAN_2475979_PROD_074240599>]
2018-09-26 13:32:19.104 FINE AS2Util: received MDN [automatic-action/MDN-sent-automatically; processed/error: decryption-failed] [<OPENAS2-26092018132852-0400-b7485b05-841c-4b47-98c6-814af9a6b91c@editorialunilit_SAN_2475979_PROD_074240599>]
2018-09-26 13:32:19.106 WARNING AS2Util: Disposition exception on MDN. Disposition: automatic-action/MDN-sent-automatically; processed/error: decryption-failed [<OPENAS2-26092018132852-0400-b7485b05-841c-4b47-98c6-814af9a6b91c@editorialunilit_SAN_2475979_PROD_074240599>]
org.openas2.DispositionException: automatic-action/mdn-sent-automatically; processed/error:decryption-failed
	at org.openas2.util.DispositionType.validate(DispositionType.java:107)
	at org.openas2.util.AS2Util.checkMDN(AS2Util.java:187)
	at org.openas2.util.AS2Util.processMDN(AS2Util.java:504)
	at org.openas2.processor.sender.AS2SenderModule.processResponse(AS2SenderModule.java:243)
	at org.openas2.processor.sender.AS2SenderModule.sendMessage(AS2SenderModule.java:216)
	at org.openas2.processor.sender.AS2SenderModule.handle(AS2SenderModule.java:131)
	at org.openas2.processor.DefaultProcessor.handle(DefaultProcessor.java:65)
	at org.openas2.processor.resender.DirectoryResenderModule.processFile(DirectoryResenderModule.java:186)
	at org.openas2.processor.resender.DirectoryResenderModule.resend(DirectoryResenderModule.java:106)
	at org.openas2.processor.resender.BaseResenderModule$PollTask.run(BaseResenderModule.java:34)
	at java.util.TimerThread.mainLoop(Timer.java:555)
	at java.util.TimerThread.run(Timer.java:505)
2018-09-26 13:32:19.109 ERROR AS2Util: Disposition exception processing MDN ... [<OPENAS2-26092018132852-0400-b7485b05-841c-4b47-98c6-814af9a6b91c@editorialunilit_SAN_2475979_PROD_074240599>]
org.openas2.DispositionException: automatic-action/mdn-sent-automatically; processed/error:decryption-failed
	at org.openas2.util.DispositionType.validate(DispositionType.java:107)
	at org.openas2.util.AS2Util.checkMDN(AS2Util.java:187)
	at org.openas2.util.AS2Util.processMDN(AS2Util.java:504)
	at org.openas2.processor.sender.AS2SenderModule.processResponse(AS2SenderModule.java:243)
	at org.openas2.processor.sender.AS2SenderModule.sendMessage(AS2SenderModule.java:216)
	at org.openas2.processor.sender.AS2SenderModule.handle(AS2SenderModule.java:131)
	at org.openas2.processor.DefaultProcessor.handle(DefaultProcessor.java:65)
	at org.openas2.processor.resender.DirectoryResenderModule.processFile(DirectoryResenderModule.java:186)
	at org.openas2.processor.resender.DirectoryResenderModule.resend(DirectoryResenderModule.java:106)
	at org.openas2.processor.resender.BaseResenderModule$PollTask.run(BaseResenderModule.java:34)
	at java.util.TimerThread.mainLoop(Timer.java:555)
	at java.util.TimerThread.run(Timer.java:505)
2018-09-26 13:32:19.133 FINE AS2Util: Renamed pending info file : OPENAS2-26092018132852-0400-b7485b05-841c-4b47-98c6-814af9a6b91c@editorialunilit_SAN_2475979_PROD_074240599 :::: New name: OPENAS2-26092018133219-0400-9c431a42-164e-4dae-9ee2-93a775bd140d@editorialunilit_SAN_2475979_PROD_074240599 [<OPENAS2-26092018133219-0400-9c431a42-164e-4dae-9ee2-93a775bd140d@editorialunilit_SAN_2475979_PROD_074240599>]
2018-09-26 13:32:19.137 FINE DirectoryResenderModule: message put in resend queue [<OPENAS2-26092018133219-0400-9c431a42-164e-4dae-9ee2-93a775bd140d@editorialunilit_SAN_2475979_PROD_074240599>]

[sdgathman]

partnership config:

        <partnership name="unilit-to-readerlink">
                <sender name="unilit"/>
                <receiver name="readerlink"/>
                <attribute name="protocol" value="as2"/>
                <attribute name="content_transfer_encoding" value="8bit"/>
                <attribute name="subject" value="From Unilit to Readerlink"/>
                <attribute name="as2_url" value="http://edi2.xxxxx.com:60080/"/>
                <attribute name="as2_mdn_to" value="edi@unilit.us"/>
                <!--  <attribute name="as2_receipt_option" value="http://localhost:10080"/>   ...for async MDN-->
                <attribute name="as2_mdn_options" value="signed-receipt-protocol=optional, pkcs7-signature; signed-receipt-micalg=optional, SHA256"/>
                <attribute name="encrypt" value="3DES"/>
                <attribute name="sign" value="SHA256"/>
                <attribute name="prevent_canonicalization_for_mic" value="false"/>
                <attribute name="remove_cms_algorithm_protection_attrib" value="false"/>
        </partnership>

I've tried changing SHA256 to SHA1 - same error. I can try tweaking a few other things, but I may have to downgrade.

[uhurusurfa]

Just released 2.6.2 today if you are still in the process of upgrading - check the release notes in 2.6.2 for issues when upgrading from versions prior to 2.5.0 - specifically in the 2.6.2 OpenAS2HoiwTo.pdf there is a section titles "Content Length Versus Chunked" that will guide you to a solution.

NOTE: You can just set the same attribute in 2.6.1 but was not documented for that release.

[sdgathman]

Thanks. BTW, got openas2 package accepted in Fedora.

https://bodhi.fedoraproject.org/updates/FEDORA-2018-c1754a58aa

[sdgathman]

After adding the no_chunked attribute, do I have to resend the message? Has it already frozen the encoding in the resend queue?

If not, that didn't fix it. Also, wouldn't that also be a problem on 2.3.1 if that was the issue ?? Or did 2.3.1 not implement the chunked encoding?

[sdgathman]

New partnership config on 2.6.1:

        <partnership name="unilit-to-readerlink">
                <sender name="unilit"/>
                <receiver name="readerlink"/>
                <attribute name="protocol" value="as2"/>
                <attribute name="content_transfer_encoding" value="8bit"/>
                <attribute name="subject" value="From Unilit to Readerlink"/>
                <attribute name="as2_url" value="http://edi2.xxxxx.com:60080/"/>
                <attribute name="as2_mdn_to" value="edi@unilit.us"/>
                <!--  <attribute name="as2_receipt_option" value="http://localhost:10080"/>   ...for async MDN-->
                <attribute name="as2_mdn_options" value="signed-receipt-protocol=optional, pkcs7-signature; signed-receipt-micalg=optional, SHA256"/>
                <attribute name="encrypt" value="3DES"/>
                <attribute name="sign" value="SHA256"/>
                <attribute name="prevent_canonicalization_for_mic" value="false"/>
                <attribute name="remove_cms_algorithm_protection_attrib" value="false"/>
                <attribute name="no_chunked_max_size" value="104857600"/>
        </partnership>

[sdgathman]

Upgraded to 2.6.2, and problem went away. Haven't tried removing the no_chunked attrib yet.

[uhurusurfa]

Thanks for getting it accepted in Fedora - will add that to the "features" on the project home page.
The resend queue contains already encrypted versions of the message so you will need to delete the message in the resend queue and post a new file to get it ti re-encrypt and sign the message.

[uhurusurfa]

If you want to automate deployment to Fedora with each new release we can add it to the OpenAS2 development cycle