Skip to content

Commit e36be16

Browse files
JocLRojasJocLRojas
committed
chore(modules-config): improve error context in decryption failures
1 parent fc6efd3 commit e36be16

3 files changed

Lines changed: 5 additions & 162 deletions

File tree

‎plugins/modules-config/config/config.go‎

Lines changed: 0 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -161,14 +161,6 @@ func (s *ConfigServer) NotifyUpdate(moduleName string, section *ConfigurationSec
161161

162162
func (s *ConfigServer) fetchModuleConfig(backend, moduleName, internalKey string) (*ConfigurationSection, int, error) {
163163
url := fmt.Sprintf("%s/api/utm-modules/moduleDetails?nameShort=%s&serverId=1", backend, moduleName)
164-
// Remove after testing, before release to production
165-
catcher.Info("fetchModuleConfig: requesting", map[string]any{
166-
"process": "plugin_com.utmstack.modules-config",
167-
"module": moduleName,
168-
"url": url,
169-
"internalKey": internalKey,
170-
"internalKeyLen": len(internalKey),
171-
})
172164

173165
response, status, err := utils.DoReq[ConfigurationSection](
174166
url,
@@ -177,54 +169,17 @@ func (s *ConfigServer) fetchModuleConfig(backend, moduleName, internalKey string
177169
map[string]string{"Utm-Internal-Key": internalKey},
178170
true,
179171
)
180-
// Remove after testing, before release to production
181-
catcher.Info("fetchModuleConfig: response received", map[string]any{
182-
"process": "plugin_com.utmstack.modules-config",
183-
"module": moduleName,
184-
"status": status,
185-
"err": fmt.Sprintf("%v", err),
186-
"groupCount": len(response.ModuleGroups),
187-
"moduleName": response.ModuleName,
188-
})
189172

190173
if err != nil || status != http.StatusOK {
191174
return nil, status, err
192175
}
193-
// Remove after testing, before release to production
194-
for _, g := range response.ModuleGroups {
195-
for _, cnf := range g.ModuleGroupConfigurations {
196-
catcher.Info("fetchModuleConfig: incoming field (pre-decrypt)", map[string]any{
197-
"process": "plugin_com.utmstack.modules-config",
198-
"module": moduleName,
199-
"groupId": g.Id,
200-
"confKey": cnf.ConfKey,
201-
"confDataType": cnf.ConfDataType,
202-
"valueLen": len(cnf.ConfValue),
203-
"confValue": cnf.ConfValue,
204-
})
205-
}
206-
}
207176

208177
if err := s.runDecrypter(&response); err != nil {
209178
return nil, status, catcher.Error("failed to decrypt module config", err, map[string]any{
210179
"process": "plugin_com.utmstack.modules-config",
211180
"module": moduleName,
212181
})
213182
}
214-
// Remove after testing, before release to production
215-
for _, g := range response.ModuleGroups {
216-
for _, cnf := range g.ModuleGroupConfigurations {
217-
catcher.Info("fetchModuleConfig: field (post-decrypt)", map[string]any{
218-
"process": "plugin_com.utmstack.modules-config",
219-
"module": moduleName,
220-
"groupId": g.Id,
221-
"confKey": cnf.ConfKey,
222-
"confDataType": cnf.ConfDataType,
223-
"valueLen": len(cnf.ConfValue),
224-
"confValue": cnf.ConfValue,
225-
})
226-
}
227-
}
228183

229184
return &response, status, nil
230185
}

‎plugins/modules-config/crypto/crypto.go‎

Lines changed: 4 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package crypto
22

33
import (
44
"fmt"
5-
"runtime/debug"
65
"strings"
76

87
"github.com/AtlasInsideCorp/AtlasInsideAES"
@@ -41,30 +40,12 @@ func decryptGroupConfigurations(moduleName string, group *config.ModuleGroup, ke
4140
if group == nil {
4241
return
4342
}
44-
// Remove after testing, before release to production
43+
4544
for _, cnf := range group.ModuleGroupConfigurations {
46-
catcher.Info("crypto: evaluating field", map[string]any{
47-
"process": "plugin_com.utmstack.modules-config",
48-
"module": moduleName,
49-
"groupId": group.Id,
50-
"confKey": cnf.ConfKey,
51-
"confDataType": cnf.ConfDataType,
52-
"valueLen": len(cnf.ConfValue),
53-
"confValue": cnf.ConfValue,
54-
"key": key,
55-
"keyLen": len(key),
56-
})
57-
// Remove after testing, before release to production
5845
if !shouldDecrypt(moduleName, cnf.ConfDataType, cnf.ConfValue) {
59-
catcher.Info("crypto: skipped (shouldDecrypt=false)", map[string]any{
60-
"process": "plugin_com.utmstack.modules-config",
61-
"module": moduleName,
62-
"confKey": cnf.ConfKey,
63-
"confDataType": cnf.ConfDataType,
64-
})
6546
continue
6647
}
67-
// Remove after testing, before release to production
48+
6849
plain, err := safeAESDecrypt(cnf.ConfValue, key)
6950
if err != nil {
7051
_ = catcher.Error("failed to decrypt configuration value", err, map[string]any{
@@ -73,43 +54,23 @@ func decryptGroupConfigurations(moduleName string, group *config.ModuleGroup, ke
7354
"groupId": group.Id,
7455
"confKey": cnf.ConfKey,
7556
"confDataType": cnf.ConfDataType,
76-
"valueLen": len(cnf.ConfValue),
77-
"confValue": cnf.ConfValue,
78-
"key": key,
79-
"keyLen": len(key),
8057
})
8158
continue
8259
}
83-
// Remove after testing, before release to production
84-
catcher.Info("crypto: decrypted OK", map[string]any{
85-
"process": "plugin_com.utmstack.modules-config",
86-
"module": moduleName,
87-
"groupId": group.Id,
88-
"confKey": cnf.ConfKey,
89-
"plainLen": len(plain),
90-
"plainHead": firstChars(plain, 64),
91-
})
60+
9261
cnf.ConfValue = plain
9362
}
9463
}
9564

9665
func safeAESDecrypt(cipherText, key string) (plain string, err error) {
9766
defer func() {
9867
if r := recover(); r != nil {
99-
stack := string(debug.Stack())
100-
err = fmt.Errorf("decryption panic recovered: %v | stack: %s", r, stack)
68+
err = fmt.Errorf("decryption failed (malformed ciphertext or wrong key): %v", r)
10169
}
10270
}()
10371
return AtlasInsideAES.AESDecrypt(cipherText, []byte(key))
10472
}
10573

106-
func firstChars(s string, n int) string {
107-
if len(s) <= n {
108-
return s
109-
}
110-
return s[:n]
111-
}
112-
11374
func shouldDecrypt(moduleName, confDataType, confValue string) bool {
11475
if confValue == "" {
11576
return false

‎plugins/modules-config/handlers.go‎

Lines changed: 1 addition & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
package main
22

33
import (
4-
"bytes"
5-
"io"
64
"net"
75
"net/http"
86

@@ -24,13 +22,6 @@ func startGRPCServer() error {
2422
if err != nil {
2523
return catcher.Error("failed to listen on port 9003", err, map[string]any{"process": "plugin_com.utmstack.modules-config"})
2624
}
27-
// Remove after testing, before release to production
28-
catcher.Info("startGRPCServer: initializing decrypter", map[string]any{
29-
"process": "plugin_com.utmstack.modules-config",
30-
"InternalKey": InternalKey,
31-
"InternalKeyLen": len(InternalKey),
32-
"BackendService": BackendService,
33-
})
3425

3526
config.GetConfigServer().SetDecrypter(func(section *config.ConfigurationSection) error {
3627
return crypto.DecryptConfigurationSection(section, InternalKey)
@@ -78,62 +69,13 @@ func UpdateModuleConfig(c *gin.Context) {
7869
return
7970
}
8071

81-
rawBody, readErr := io.ReadAll(c.Request.Body)
82-
if readErr != nil {
83-
_ = catcher.Error("failed to read request body", readErr, map[string]any{
84-
"process": "plugin_com.utmstack.modules-config",
85-
"module": moduleName,
86-
})
87-
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to read body"})
88-
return
89-
}
90-
c.Request.Body = io.NopCloser(bytes.NewBuffer(rawBody))
91-
// Remove after testing, before release to production
92-
catcher.Info("UpdateModuleConfig: raw request body", map[string]any{
93-
"process": "plugin_com.utmstack.modules-config",
94-
"module": moduleName,
95-
"bodyLen": len(rawBody),
96-
"rawBody": string(rawBody),
97-
})
98-
9972
body := []config.ConfigurationSection{}
10073
if err := c.ShouldBindJSON(&body); err != nil {
101-
_ = catcher.Error("failed to bind JSON in UpdateModuleConfig", err, map[string]any{
102-
"process": "plugin_com.utmstack.modules-config",
103-
"module": moduleName,
104-
})
10574
c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body"})
10675
return
10776
}
10877

109-
catcher.Info("UpdateModuleConfig: parsed body", map[string]any{
110-
"process": "plugin_com.utmstack.modules-config",
111-
"module": moduleName,
112-
"sectionCount": len(body),
113-
})
114-
// Remove after testing, before release to production
11578
if len(body) != 0 {
116-
for _, g := range body[0].ModuleGroups {
117-
for _, cnf := range g.ModuleGroupConfigurations {
118-
catcher.Info("incoming Update field (pre-decrypt)", map[string]any{
119-
"process": "plugin_com.utmstack.modules-config",
120-
"module": moduleName,
121-
"groupId": g.Id,
122-
"confKey": cnf.ConfKey,
123-
"confDataType": cnf.ConfDataType,
124-
"valueLen": len(cnf.ConfValue),
125-
"confValue": cnf.ConfValue,
126-
})
127-
}
128-
}
129-
// Remove after testing, before release to production
130-
catcher.Info("UpdateModuleConfig: calling decrypter", map[string]any{
131-
"process": "plugin_com.utmstack.modules-config",
132-
"module": moduleName,
133-
"InternalKey": InternalKey,
134-
"InternalKeyLen": len(InternalKey),
135-
})
136-
13779
if err := crypto.DecryptConfigurationSection(&body[0], InternalKey); err != nil {
13880
_ = catcher.Error("failed to decrypt module config on update", err, map[string]any{
13981
"process": "plugin_com.utmstack.modules-config",
@@ -142,21 +84,6 @@ func UpdateModuleConfig(c *gin.Context) {
14284
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to decrypt configuration"})
14385
return
14486
}
145-
// Remove after testing, before release to production
146-
for _, g := range body[0].ModuleGroups {
147-
for _, cnf := range g.ModuleGroupConfigurations {
148-
catcher.Info("Update field (post-decrypt)", map[string]any{
149-
"process": "plugin_com.utmstack.modules-config",
150-
"module": moduleName,
151-
"groupId": g.Id,
152-
"confKey": cnf.ConfKey,
153-
"confDataType": cnf.ConfDataType,
154-
"valueLen": len(cnf.ConfValue),
155-
"confValue": cnf.ConfValue,
156-
})
157-
}
158-
}
159-
16087
config.GetConfigServer().NotifyUpdate(moduleName, &body[0])
16188
} else {
16289
catcher.Info("Received empty configuration body, no updates made", map[string]any{"process": "plugin_com.utmstack.modules-config"})
@@ -177,7 +104,7 @@ func ValidateModuleConfig(c *gin.Context) {
177104
c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body"})
178105
return
179106
}
180-
// Remove after testing, before release to production
107+
181108
if err := crypto.DecryptModuleGroup(moduleName, &body, InternalKey); err != nil {
182109
_ = catcher.Error("failed to decrypt module config on validate", err, map[string]any{
183110
"process": "plugin_com.utmstack.modules-config",

0 commit comments

Comments
 (0)