Skip to content

bug: error decrypting config file #11565

Description

@Visserr2

Current Behavior

I upgraded our test-env to Apisix 3.10. In the logging I have a lot of errors about decrypting config file:

`/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init_etcd

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:255: load_stream(): new plugins: {"ip-restriction":true,"limit-conn":true,"mqtt-proxy":true,"syslog":true}, context: init_worker_by_lua

2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua

2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua

2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua

2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua`

Think it has something to do with "enable sensitive fields encryption by default". The plugins of the certain routes does still work (AFAIK) but I'm not sure if these errors are a problem. Also it spits all te sensitive information in de logging. I put the word "redacted" in logging above instead of the real secret. In the logging you can see "openid-connect" but this is also true for other plugins like "basic-auth". Also when changing/enable route the there errors also show up in logging.

Expected Behavior

At least not show the sensitive information in logging.

Also a way to mitigate these errors

Error Logs

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:255: load_stream(): new plugins: {"ip-restriction":true,"limit-conn":true,"mqtt-proxy":true,"syslog":true}, context: init_worker_by_lua

2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua

2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua

2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua

2024/09/10 18:00:31 [error] 49#49: 3 [lua] ssl.lua:157: aes_decrypt_pkey(): base64 decode ssl key failed. key[redacted] , context: init_worker_by_lua

2024/09/10 18:00:31 [warn] 49#49: 3 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: nil, context: init_worker_by_lua`

Steps to Reproduce

Starting up Apisix 3.10

Environment

  • 3.10 ( apache/apisix:3.10.0-debian)
  • 3.5.15 (bitnami/etcd:3.5.15)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    Status
    ✅ Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions