ValueError: AES key must be either 16, 24, or 32 bytes long

[Christian Berendt]

When using a string with a length != 16, 24, or 32 as value for the auth_encryption_key parameter in the /etc/heat/heat.conf file it is not possible to create new stacks. Creating a new stack (and probably anything else) will fail with the following exception:

ValueError: AES key must be either 16, 24, or 32 bytes long

Changing the auth_encryption_key parameter to a string with a length of 16, 24, or 32 solves the issue.

There should be at least a note in the parameter description that it is necessary to use a string with this specific length. A validation of the string value would be nice.

Tested with version 2014.2.1 (Juno).

[Angus Salkeld (asalkeld)]

https://github.com/openstack/heat/blob/master/heat/common/config.py#L302
This ^ is a good place to have the check.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/168779

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/168779
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=1dbb189270cffc0edf0721815582b39ab2776031
Submitter: Jenkins
Branch: master

commit 1dbb189270cffc0edf0721815582b39ab2776031
Author: Rajiv Kumar <email address hidden>
Date: Mon Mar 30 10:32:44 2015 +0530

    auth_encryption_key is being checked to be 16, 24, or 32

    If auth_encryption_key length is not 16 or 24 or 32 in that case
    heat operations such as stack-creates fails. This check has been
    added.

    Change-Id: Ic653d18dbb7523ca5286ae0951eb86ad72cbdb13
    Closes-bug: #1415887

[Emilien Macchi (emilienm)]

Tracking the bug in puppet-heat, so we can validate the data provided by Hiera or manifests and make sure it's valid. It will avoid some deployments issues.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/178478

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/178478
Committed: https://git.openstack.org/cgit/stackforge/puppet-heat/commit/?id=23d58ec2b61353befd2a324999ea7632a1a40e16
Submitter: Jenkins
Branch: master

commit 23d58ec2b61353befd2a324999ea7632a1a40e16
Author: Emilien Macchi <email address hidden>
Date: Tue Apr 28 22:27:58 2015 -0400

    Engine: validate auth_encryption_key

    When using a string with a length != 16, 24, or 32 as value for the
    auth_encryption_key parameter in the /etc/heat/heat.conf file it is not
    possible to create new stacks. Creating a new stack (and probably
    anything else) will fail with the following exception:

    ValueError: AES key must be either 16, 24, or 32 bytes long.

    Change-Id: I4e35cf0f782f22861319d05a3f028e5784ad26d5
    Closes-bug: #1415887

[Zane Bitter (zaneb)]

Looks like this patch was merged right at the beginning of Liberty but the bug was never targeted for that.