You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Jul 11, 2023. It is now read-only.
To reduce the risk of logging sensitive data, we need to edit log lines where we log the CommonName of a certificate and need to replace it with the cert's SerialNumber.
Here is a search result pointing to some of these log lines:
Alternatively another way to find these could be: grep -Iir "log\." $(find . -name '*.go') | grep -i 'CN' --color | grep '%s'
Another search: grep -Iir "log\." $(find . -name '*.go') | grep -i 'GetCommonName' --color
It would be good to tweak these log messages and indicate that what we are logging is the certificate's SerialNumber. With this context we can reference it to other OSM components.
log.Info().Msgf("Broadcast update received for %s", proxy.GetCommonName())
Should be changed to Broadcast update received for certificate with SerialNumber %s. For this we would need to use GetSerialNumber() from the Certificater interface instead of GetCommonName()
Note: please ensure that all cert issuers have GetSerialNumber() properly implemented (vs just a placeholder): #2312
The text was updated successfully, but these errors were encountered:
To reduce the risk of logging sensitive data, we need to edit log lines where we log the CommonName of a certificate and need to replace it with the cert's SerialNumber.
Here is a search result pointing to some of these log lines:
Alternatively another way to find these could be:
grep -Iir "log\." $(find . -name '*.go') | grep -i 'CN' --color | grep '%s'
Another search:
grep -Iir "log\." $(find . -name '*.go') | grep -i 'GetCommonName' --color
It would be good to tweak these log messages and indicate that what we are logging is the certificate's SerialNumber. With this context we can reference it to other OSM components.
For example the message in this log line:
osm/pkg/envoy/ads/stream.go
Line 160 in ee1ce5e
Should be changed to
Broadcast update received for certificate with SerialNumber %s
. For this we would need to useGetSerialNumber()
from theCertificater
interface instead ofGetCommonName()
The text was updated successfully, but these errors were encountered: