Skip to content
This repository has been archived by the owner on Jul 11, 2023. It is now read-only.

In log lines where CN of a cert is used - replace it with cert's SerialNumber #2311

Closed
draychev opened this issue Jan 15, 2021 · 0 comments
Closed
Assignees

Comments

@draychev
Copy link
Contributor

draychev commented Jan 15, 2021

To reduce the risk of logging sensitive data, we need to edit log lines where we log the CommonName of a certificate and need to replace it with the cert's SerialNumber.

Here is a search result pointing to some of these log lines:

Alternatively another way to find these could be: grep -Iir "log\." $(find . -name '*.go') | grep -i 'CN' --color | grep '%s'
Another search: grep -Iir "log\." $(find . -name '*.go') | grep -i 'GetCommonName' --color

It would be good to tweak these log messages and indicate that what we are logging is the certificate's SerialNumber. With this context we can reference it to other OSM components.

For example the message in this log line:

log.Info().Msgf("Broadcast update received for %s", proxy.GetCommonName())

Should be changed to Broadcast update received for certificate with SerialNumber %s. For this we would need to use GetSerialNumber() from the Certificater interface instead of GetCommonName()

Note: please ensure that all cert issuers have GetSerialNumber() properly implemented (vs just a placeholder): #2312

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants