Bug #20671: rgw multisite: objects encrypted with SSE-KMS are stored unencrypted in target zone - rgw - Ceph

Actions

Copy link

Bug #20671

closed

rgw multisite: objects encrypted with SSE-KMS are stored unencrypted in target zone

Added by Casey Bodley almost 7 years ago. Updated over 6 years ago.

Status:

Resolved

Priority:

High

Assignee:

Casey Bodley

Target version:

% Done:

Source:

Tags:

Backport:

luminous

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

Crash signature (v1):

Crash signature (v2):

Description

When SSE-KMS encryption is used, multisite sync is able to fetch the decrypted contents of the object. However, it stores the unencrypted object data to rados, along with the original SSE-KMS encryption attributes. So when a client reads that object from the secondary zone, radosgw tries to decrypt the already-unencrypted data and returns garbage data.

Related issues 2 (0 open — 2 closed)