From 7a614fd8a1686643ffd1bf236a565f6957b83691 Mon Sep 17 00:00:00 2001 From: Tania Date: Fri, 3 Jun 2022 17:06:00 +0200 Subject: [PATCH] Encryption: Stop decrypting EE encrypted secrets with legacy encryption (#50090) --- pkg/services/secrets/manager/manager.go | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/pkg/services/secrets/manager/manager.go b/pkg/services/secrets/manager/manager.go index aa5c539ecf8..631097d7c8f 100644 --- a/pkg/services/secrets/manager/manager.go +++ b/pkg/services/secrets/manager/manager.go @@ -291,8 +291,15 @@ func newRandomDataKey() ([]byte, error) { } func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, error) { + if len(payload) == 0 { + return nil, fmt.Errorf("unable to decrypt empty payload") + } + // Use legacy encryption service if featuremgmt.FlagDisableEnvelopeEncryption toggle is on if s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) { + if len(payload) > 0 && payload[0] == '#' { + return nil, fmt.Errorf("failed to decrypt a secret encrypted with envelope encryption: envelope encryption is disabled") + } return s.enc.Decrypt(ctx, payload, setting.SecretKey) } @@ -309,11 +316,6 @@ func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, e } }() - if len(payload) == 0 { - err = fmt.Errorf("unable to decrypt empty payload") - return nil, err - } - var dataKey []byte if payload[0] != '#' {