From 711ea1c2cb252547181dc32d44b697a1dcda4cb0 Mon Sep 17 00:00:00 2001 From: Tania Date: Fri, 3 Jun 2022 17:35:53 +0200 Subject: [PATCH] Encryption: Stop decrypting EE encrypted secrets with legacy encryption (#50090) (#50176) (cherry picked from commit 7a614fd8a1686643ffd1bf236a565f6957b83691) --- pkg/services/secrets/manager/manager.go | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/pkg/services/secrets/manager/manager.go b/pkg/services/secrets/manager/manager.go index 2c1f23b03db..dc767ded1af 100644 --- a/pkg/services/secrets/manager/manager.go +++ b/pkg/services/secrets/manager/manager.go @@ -180,8 +180,15 @@ func (s *SecretsService) keyName(scope string) string { } func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, error) { - // Use legacy encryption service if featuremgmt.FlagEnvelopeEncryption toggle is off + if len(payload) == 0 { + return nil, fmt.Errorf("unable to decrypt empty payload") + } + + // Use legacy encryption service if featuremgmt.FlagDisableEnvelopeEncryption toggle is on if !s.features.IsEnabled(featuremgmt.FlagEnvelopeEncryption) { + if len(payload) > 0 && payload[0] == '#' { + return nil, fmt.Errorf("failed to decrypt a secret encrypted with envelope encryption: envelope encryption is disabled") + } return s.enc.Decrypt(ctx, payload, setting.SecretKey) } @@ -194,11 +201,6 @@ func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, e }).Inc() }() - if len(payload) == 0 { - err = fmt.Errorf("unable to decrypt empty payload") - return nil, err - } - var dataKey []byte if payload[0] != '#' {