From 5645d7a5e3cf8da9179ae262b6bdfbb3bb54e460 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joan=20L=C3=B3pez=20de=20la=20Franca=20Beltran?= <5459617+joanlopez@users.noreply.github.com> Date: Mon, 23 May 2022 07:57:48 +0200 Subject: [PATCH] Encryption: Fix b64 encoding on CLI secretsmigrations commands (#49340) --- .../commands/secretsmigrations/reencrypt_secrets.go | 12 ++++++------ .../commands/secretsmigrations/rollback_secrets.go | 12 ++++++------ .../commands/secretsmigrations/secretsmigrations.go | 2 ++ 3 files changed, 14 insertions(+), 12 deletions(-) diff --git a/pkg/cmd/grafana-cli/commands/secretsmigrations/reencrypt_secrets.go b/pkg/cmd/grafana-cli/commands/secretsmigrations/reencrypt_secrets.go index 62d6a95421c..f60c6c6c29e 100644 --- a/pkg/cmd/grafana-cli/commands/secretsmigrations/reencrypt_secrets.go +++ b/pkg/cmd/grafana-cli/commands/secretsmigrations/reencrypt_secrets.go @@ -86,7 +86,7 @@ func (s b64Secret) reencrypt(ctx context.Context, secretsSrv *manager.SecretsSer } err := sqlStore.WithTransactionalDbSession(ctx, func(sess *sqlstore.DBSession) error { - decoded, err := base64.StdEncoding.DecodeString(row.Secret) + decoded, err := s.encoding.DecodeString(row.Secret) if err != nil { logger.Warn("Could not decode base64-encoded secret while re-encrypting it", "table", s.tableName, "id", row.Id, "error", err) return err @@ -104,7 +104,7 @@ func (s b64Secret) reencrypt(ctx context.Context, secretsSrv *manager.SecretsSer return err } - encoded := base64.StdEncoding.EncodeToString(encrypted) + encoded := s.encoding.EncodeToString(encrypted) if s.hasUpdatedColumn { updateSQL := fmt.Sprintf("UPDATE %s SET %s = ?, updated = ? WHERE id = ?", s.tableName, s.columnName) _, err = sess.Exec(updateSQL, encoded, nowInUTC(), row.Id) @@ -276,10 +276,10 @@ func ReEncryptSecrets(_ utils.CommandLine, runner runner.Runner) error { reencrypt(context.Context, *manager.SecretsService, *sqlstore.SQLStore) }{ simpleSecret{tableName: "dashboard_snapshot", columnName: "dashboard_encrypted"}, - b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_access_token"}}, - b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_refresh_token"}}, - b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_token_type"}}, - b64Secret{simpleSecret: simpleSecret{tableName: "secrets", columnName: "value"}, hasUpdatedColumn: true}, + b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_access_token"}, encoding: base64.StdEncoding}, + b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_refresh_token"}, encoding: base64.StdEncoding}, + b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_token_type"}, encoding: base64.StdEncoding}, + b64Secret{simpleSecret: simpleSecret{tableName: "secrets", columnName: "value"}, hasUpdatedColumn: true, encoding: base64.RawStdEncoding}, jsonSecret{tableName: "data_source"}, jsonSecret{tableName: "plugin_setting"}, alertingSecret{}, diff --git a/pkg/cmd/grafana-cli/commands/secretsmigrations/rollback_secrets.go b/pkg/cmd/grafana-cli/commands/secretsmigrations/rollback_secrets.go index a2f23ec0a43..5618ee1a629 100644 --- a/pkg/cmd/grafana-cli/commands/secretsmigrations/rollback_secrets.go +++ b/pkg/cmd/grafana-cli/commands/secretsmigrations/rollback_secrets.go @@ -96,7 +96,7 @@ func (s b64Secret) rollback( } err := sqlStore.WithTransactionalDbSession(ctx, func(sess *sqlstore.DBSession) error { - decoded, err := base64.StdEncoding.DecodeString(row.Secret) + decoded, err := s.encoding.DecodeString(row.Secret) if err != nil { logger.Warn("Could not decode base64-encoded secret while rolling it back", "table", s.tableName, "id", row.Id, "error", err) return err @@ -114,7 +114,7 @@ func (s b64Secret) rollback( return err } - encoded := base64.StdEncoding.EncodeToString(encrypted) + encoded := s.encoding.EncodeToString(encrypted) if s.hasUpdatedColumn { updateSQL := fmt.Sprintf("UPDATE %s SET %s = ?, updated = ? WHERE id = ?", s.tableName, s.columnName) _, err = sess.Exec(updateSQL, encoded, nowInUTC(), row.Id) @@ -300,10 +300,10 @@ func RollBackSecrets(_ utils.CommandLine, runner runner.Runner) error { rollback(context.Context, *manager.SecretsService, encryption.Internal, *sqlstore.SQLStore, string) bool }{ simpleSecret{tableName: "dashboard_snapshot", columnName: "dashboard_encrypted"}, - b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_access_token"}}, - b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_refresh_token"}}, - b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_token_type"}}, - b64Secret{simpleSecret: simpleSecret{tableName: "secrets", columnName: "value"}, hasUpdatedColumn: true}, + b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_access_token"}, encoding: base64.StdEncoding}, + b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_refresh_token"}, encoding: base64.StdEncoding}, + b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_token_type"}, encoding: base64.StdEncoding}, + b64Secret{simpleSecret: simpleSecret{tableName: "secrets", columnName: "value"}, hasUpdatedColumn: true, encoding: base64.RawStdEncoding}, jsonSecret{tableName: "data_source"}, jsonSecret{tableName: "plugin_setting"}, alertingSecret{}, diff --git a/pkg/cmd/grafana-cli/commands/secretsmigrations/secretsmigrations.go b/pkg/cmd/grafana-cli/commands/secretsmigrations/secretsmigrations.go index ab663701967..fa12ec55ee0 100644 --- a/pkg/cmd/grafana-cli/commands/secretsmigrations/secretsmigrations.go +++ b/pkg/cmd/grafana-cli/commands/secretsmigrations/secretsmigrations.go @@ -1,6 +1,7 @@ package secretsmigrations import ( + "encoding/base64" "time" "github.com/grafana/grafana/pkg/infra/log" @@ -14,6 +15,7 @@ type simpleSecret struct { type b64Secret struct { simpleSecret hasUpdatedColumn bool + encoding *base64.Encoding } type jsonSecret struct {