Change in vdsm[ovirt-3.5]: jsonrpc: filter params while logging secure method invocation
nsoffer at redhat.com
nsoffer at redhat.com
Fri May 15 14:39:20 UTC 2015
Nir Soffer has posted comments on this change.
Change subject: jsonrpc: filter params while logging secure method invocation
......................................................................
Patch Set 1:
(3 comments)
https://gerrit.ovirt.org/#/c/40961/1/lib/yajsonrpc/__init__.py
File lib/yajsonrpc/__init__.py:
Line 453: SECURE_METHODS = ('VM.desktopLogin', 'StoragePool.disconnectStorageServer'
Line 454: 'StoragePool.connectStorageServer',
Line 455: 'ISCSIConnection.discoverSendTargets',
Line 456: 'VM.setTicket',
Line 457: 'StoragePool.validateStorageServerConnection')
These should be called SECURE_ARGS, and used to filter out arguments from "Calling" log.
We need a another list SECURE_RETURN for filtering the return value. The only method that need this is Host.getDeviceList.
Line 458:
Line 459: def __init__(self, bridge, threadFactory=None):
Line 460: self._bridge = bridge
Line 461: self._workQueue = Queue()
Line 505: self._log_message(logLevel, 'Return', req.method, res)
Line 506: ctx.requestDone(JsonRpcResponse(res, None, req.id))
Line 507:
Line 508: def _log_message(self, logLevel, prefix, method, args):
Line 509: if method in self.SECURE_METHODS:
This check should be in the caller, as we need 2 checks, one for filtering input parameters and one for filtering the result.
Line 510: message = prefix + " '{0}' in bridge".format(method)
Line 511: else:
Line 512: message = prefix + " '{0}' in bridge with {1}".format(method, args)
Line 513: self.log.log(logLevel, message)
Line 506: ctx.requestDone(JsonRpcResponse(res, None, req.id))
Line 507:
Line 508: def _log_message(self, logLevel, prefix, method, args):
Line 509: if method in self.SECURE_METHODS:
Line 510: message = prefix + " '{0}' in bridge".format(method)
Lets use "...in bridge with (args filtered)"
Line 511: else:
Line 512: message = prefix + " '{0}' in bridge with {1}".format(method, args)
Line 513: self.log.log(logLevel, message)
Line 514:
--
To view, visit https://gerrit.ovirt.org/40961
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I34a36a361d2be28343352ae83ceac94b86162a12
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.5
Gerrit-Owner: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei at redhat.com>
Gerrit-Reviewer: automation at ovirt.org
Gerrit-HasComments: Yes
More information about the vdsm-patches
mailing list