Change in vdsm[ovirt-3.5]: jsonrpc: Prevent password logging

ybronhei at redhat.com ybronhei at redhat.com
Mon May 18 10:31:16 UTC 2015


Yaniv Bronhaim has submitted this change and it was merged.

Change subject: jsonrpc: Prevent password logging
......................................................................


jsonrpc: Prevent password logging

Vdsm should not expose passwords in log messages. We have code in HSM,
protecting some methods that accept connection lists, which may include
a password parameter. However this is not the right place to protect
passwords, as they are logged now by the jsonrpc server.

This patch introduces the password library, providing:

  ProtectedPassword     class for wrapping password value, so it is not
                        logged or persisted by mistake.

  protect_passwords     replace passwords value with ProtectedPassword
                        object in nested structures.

  unprotect_passwords   replace ProtectedPassword objects with the
                        actual password value.

The jsonprc server protect request parameters and response result
containing passwords for logging purpose by using protect_passwords
method introduced in password module.


Change-Id: I34a36a361d2be28343352ae83ceac94b86162a12
Signed-off-by: pkliczewski <piotr.kliczewski at gmail.com>
Bug-Url: https://bugzilla.redhat.com/1220039
Relates-To: https://gerrit.ovirt.org/#/c/40707
Reviewed-on: https://gerrit.ovirt.org/40961
Reviewed-by: Yaniv Bronhaim <ybronhei at redhat.com>
Continuous-Integration: Yaniv Bronhaim <ybronhei at redhat.com>
---
M debian/vdsm-python.install
M lib/vdsm/Makefile.am
A lib/vdsm/password.py
M lib/yajsonrpc/__init__.py
M vdsm.spec.in
5 files changed, 111 insertions(+), 4 deletions(-)

Approvals:
  Piotr Kliczewski: Verified
  Yaniv Bronhaim: Looks good to me, approved; Passed CI tests



-- 
To view, visit https://gerrit.ovirt.org/40961
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I34a36a361d2be28343352ae83ceac94b86162a12
Gerrit-PatchSet: 9
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.5
Gerrit-Owner: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei at redhat.com>
Gerrit-Reviewer: automation at ovirt.org


More information about the vdsm-patches mailing list