From c6b7dc012a21fd53b8c1b75a97daf678bbf3b42e Mon Sep 17 00:00:00 2001
From: Harshavardhana <harsha@minio.io>
Date: Tue, 18 May 2021 07:22:31 -0700
Subject: [PATCH] fix: use key.Ciphertext for DecryptKey in KeyStatus (#12313)

enhance GlobalKMS.Stat() for kes to actually perform
a network call to check Version() of kes and also
implicitly that its reachable.
---
 cmd/admin-handlers.go | 7 ++-----
 pkg/kms/kes.go        | 6 ++++++
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/cmd/admin-handlers.go b/cmd/admin-handlers.go
index 30f484d8b..3fd7038f4 100644
--- a/cmd/admin-handlers.go
+++ b/cmd/admin-handlers.go
@@ -1304,6 +1304,7 @@ func (a adminAPIHandlers) KMSKeyStatusHandler(w http.ResponseWriter, r *http.Req
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrKMSNotConfigured), r.URL)
 		return
 	}
+
 	stat, err := GlobalKMS.Stat()
 	if err != nil {
 		writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInternalError), err.Error(), r.URL)
@@ -1333,7 +1334,7 @@ func (a adminAPIHandlers) KMSKeyStatusHandler(w http.ResponseWriter, r *http.Req
 	}
 
 	// 2. Verify that we can indeed decrypt the (encrypted) key
-	decryptedKey, err := GlobalKMS.DecryptKey(key.KeyID, key.Plaintext, kmsContext)
+	decryptedKey, err := GlobalKMS.DecryptKey(key.KeyID, key.Ciphertext, kmsContext)
 	if err != nil {
 		response.DecryptionErr = err.Error()
 		resp, err := json.Marshal(response)
@@ -1800,10 +1801,6 @@ func fetchKMSStatus() madmin.KMS {
 		kmsStat.Status = stat.Name
 		return kmsStat
 	}
-	if err := checkConnection(stat.Endpoints[0], 15*time.Second); err != nil {
-		kmsStat.Status = string(madmin.ItemOffline)
-		return kmsStat
-	}
 	kmsStat.Status = string(madmin.ItemOnline)
 
 	kmsContext := kms.Context{"MinIO admin API": "ServerInfoHandler"} // Context for a test key operation
diff --git a/pkg/kms/kes.go b/pkg/kms/kes.go
index e21712d11..b98de7de2 100644
--- a/pkg/kms/kes.go
+++ b/pkg/kms/kes.go
@@ -22,6 +22,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"errors"
+	"time"
 
 	"github.com/minio/kes"
 )
@@ -79,6 +80,11 @@ var _ KMS = (*kesClient)(nil) // compiler check
 // Stat returns the current KES status containing a
 // list of KES endpoints and the default key ID.
 func (c *kesClient) Stat() (Status, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if _, err := c.client.Version(ctx); err != nil {
+		return Status{}, err
+	}
 	var endpoints = make([]string, len(c.client.Endpoints))
 	copy(endpoints, c.client.Endpoints)
 	return Status{