mirror of
https://github.com/OffchainLabs/prysm.git
synced 2026-01-10 07:58:22 -05:00
Mask credentials for logging (#8429)
* Added MaskCredentialsLogging to logutil, which masks the user info, path and query. It leaves the hostname and port untouched . Making it more secure during logging * Added MaskCredentialsLogging to logutil, which masks the user info,path and query. It leaves the hostname and port untouched . Making it more secure during logging * Added newline based on the PR checks * Update shared/logutil/logutil.go Co-authored-by: Preston Van Loon <preston@prysmaticlabs.com> * Update shared/logutil/logutil.go Co-authored-by: Preston Van Loon <preston@prysmaticlabs.com> * Gazelle * Update shared/logutil/logutil.go Co-authored-by: Preston Van Loon <preston@prysmaticlabs.com> * Update shared/logutil/logutil.go Co-authored-by: Preston Van Loon <preston@prysmaticlabs.com> * added unit tests * updated one test case * added logutil_test.go unit test cases * Refactor validator subnet subscriptions to be non-blocking (#8319) * Use response.NextEpochDuties for aggregator subnet subscriptions (credit: @KaanKC PR #8204). Make committee subnet subscriptions method non-blocking call * Fix test * Fix test Co-authored-by: prylabs-bulldozer[bot] <58059840+prylabs-bulldozer[bot]@users.noreply.github.com> Co-authored-by: terence tsao <terence@prysmaticlabs.com> * Add Ability to Specify All Public Keys When Exiting Validators (#8399) * add programmatic voluntary exit * add exit all flag * test * lint * add multiple exits test * fix test Co-authored-by: prylabs-bulldozer[bot] <58059840+prylabs-bulldozer[bot]@users.noreply.github.com> * Increase Validation Queue (#8431) Co-authored-by: prylabs-bulldozer[bot] <58059840+prylabs-bulldozer[bot]@users.noreply.github.com> * Validator: add a DEBUG log to show batch attestation save duration (#8432) * Add a debug log to show duration * Autofix issues in 1 file Resolved issues in validator/db/kv/attester_protection.go via DeepSource Autofix Co-authored-by: prylabs-bulldozer[bot] <58059840+prylabs-bulldozer[bot]@users.noreply.github.com> Co-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com> * Add Mutex and Block Profiling (#8435) * Implement GetStateRoot in the beacon API (#8402) * update ethereumapis dependency * span * initial implementation * introduce stategen Service interface and MockService * Include AddStateForSlot function in the mock service * return states from mock * add GenesisState to POWChain mock * populate roots in helper state * initialize Slot when creating helper state * tests * code refactor - extract helper functions * gzl * use SetSlot in tests * handle SetSlot error * use new testutil's NewBeaconState * gzl * go mod tidy * rename Service to StateManager * move regex check to helper Co-authored-by: Raul Jordan <raul@prysmaticlabs.com> Co-authored-by: prylabs-bulldozer[bot] <58059840+prylabs-bulldozer[bot]@users.noreply.github.com> * On Block Cleanup (#8438) * Beacon API: update GetStateRoot (#8437) * Address various feedbacks * Gaz * More nil check * Update beacon-chain/rpc/beaconv1/state_test.go Co-authored-by: Radosław Kapka <rkapka@wp.pl> * Update beacon-chain/rpc/beaconv1/state_test.go Co-authored-by: Radosław Kapka <rkapka@wp.pl> * Update beacon-chain/rpc/beaconv1/state_test.go Co-authored-by: Radosław Kapka <rkapka@wp.pl> * Update beacon-chain/rpc/beaconv1/state_test.go Co-authored-by: Radosław Kapka <rkapka@wp.pl> * Update beacon-chain/rpc/beaconv1/state_test.go Co-authored-by: Radosław Kapka <rkapka@wp.pl> Co-authored-by: Radosław Kapka <rkapka@wp.pl> * qualifying my unix user ahaddad - no real changes to the files * Update shared/logutil/logutil.go * Update shared/logutil/logutil.go * Update shared/logutil/logutil.go * Update shared/logutil/logutil.go * Update shared/logutil/logutil.go Co-authored-by: Preston Van Loon <preston@prysmaticlabs.com> Co-authored-by: prylabs-bulldozer[bot] <58059840+prylabs-bulldozer[bot]@users.noreply.github.com> Co-authored-by: terence tsao <terence@prysmaticlabs.com> Co-authored-by: Raul Jordan <raul@prysmaticlabs.com> Co-authored-by: Nishant Das <nishdas93@gmail.com> Co-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com> Co-authored-by: Radosław Kapka <rkapka@wp.pl>
This commit is contained in:
ahadda5
@@ -31,6 +31,7 @@ go_library(
|
||||
"//proto/beacon/db:go_default_library",
|
||||
"//shared/bytesutil:go_default_library",
|
||||
"//shared/hashutil:go_default_library",
|
||||
"//shared/logutil:go_default_library",
|
||||
"//shared/params:go_default_library",
|
||||
"//shared/timeutils:go_default_library",
|
||||
"//shared/traceutil:go_default_library",
|
||||
|
||||
@@ -34,6 +34,7 @@ import (
|
||||
contracts "github.com/prysmaticlabs/prysm/contracts/deposit-contract"
|
||||
protodb "github.com/prysmaticlabs/prysm/proto/beacon/db"
|
||||
"github.com/prysmaticlabs/prysm/shared/bytesutil"
|
||||
"github.com/prysmaticlabs/prysm/shared/logutil"
|
||||
"github.com/prysmaticlabs/prysm/shared/params"
|
||||
"github.com/prysmaticlabs/prysm/shared/timeutils"
|
||||
"github.com/prysmaticlabs/prysm/shared/trieutil"
|
||||
@@ -466,7 +467,7 @@ func (s *Service) waitForConnection() {
|
||||
s.connectedETH1 = true
|
||||
s.runError = nil
|
||||
log.WithFields(logrus.Fields{
|
||||
"endpoint": s.currHttpEndpoint,
|
||||
"endpoint": logutil.MaskCredentialsLogging(s.currHttpEndpoint),
|
||||
}).Info("Connected to eth1 proof-of-work chain")
|
||||
return
|
||||
}
|
||||
@@ -514,7 +515,7 @@ func (s *Service) waitForConnection() {
|
||||
s.connectedETH1 = true
|
||||
s.runError = nil
|
||||
log.WithFields(logrus.Fields{
|
||||
"endpoint": s.currHttpEndpoint,
|
||||
"endpoint": logutil.MaskCredentialsLogging(s.currHttpEndpoint),
|
||||
}).Info("Connected to eth1 proof-of-work chain")
|
||||
return
|
||||
}
|
||||
|
||||
@@ -20,7 +20,10 @@ go_library(
|
||||
|
||||
go_test(
|
||||
name = "go_default_test",
|
||||
srcs = ["stream_test.go"],
|
||||
srcs = [
|
||||
"logutil_test.go",
|
||||
"stream_test.go",
|
||||
],
|
||||
embed = [":go_default_library"],
|
||||
deps = ["//shared/testutil/require:go_default_library"],
|
||||
)
|
||||
|
||||
@@ -4,7 +4,9 @@ package logutil
|
||||
|
||||
import (
|
||||
"io"
|
||||
"net/url"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/prysmaticlabs/prysm/shared/params"
|
||||
"github.com/sirupsen/logrus"
|
||||
@@ -28,3 +30,26 @@ func ConfigurePersistentLogging(logFileName string) error {
|
||||
logrus.Info("File logging initialized")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Masks the url credentials before logging for security purpose
|
||||
// [scheme:][//[userinfo@]host][/]path[?query][#fragment] --> [scheme:][//[***]host][/***][#***]
|
||||
// if the format is not matched nothing is done, string is returned as is.
|
||||
func MaskCredentialsLogging(currUrl string) string {
|
||||
// error if the input is not a URL
|
||||
MaskedUrl := currUrl
|
||||
u, err := url.Parse(currUrl)
|
||||
if err != nil {
|
||||
return currUrl // Not a URL, nothing to do
|
||||
}
|
||||
// Mask the userinfo and the URI (path?query or opaque?query ) and fragment, leave the scheme and host(host/port) untouched
|
||||
if u.User != nil {
|
||||
MaskedUrl = strings.Replace(MaskedUrl, u.User.String(), "***", 1)
|
||||
}
|
||||
if len(u.RequestURI()) > 1 { // Ignore the '/'
|
||||
MaskedUrl = strings.Replace(MaskedUrl, u.RequestURI(), "/***", 1)
|
||||
}
|
||||
if len(u.Fragment) > 0 {
|
||||
MaskedUrl = strings.Replace(MaskedUrl, u.RawFragment, "***", 1)
|
||||
}
|
||||
return MaskedUrl
|
||||
}
|
||||
|
||||
26
shared/logutil/logutil_test.go
Normal file
26
shared/logutil/logutil_test.go
Normal file
@@ -0,0 +1,26 @@
|
||||
package logutil
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/prysmaticlabs/prysm/shared/testutil/require"
|
||||
)
|
||||
|
||||
var urltests = []struct {
|
||||
url string
|
||||
maskedUrl string
|
||||
}{
|
||||
{"https://a:b@xyz.net", "https://***@xyz.net"},
|
||||
{"https://eth-goerli.alchemyapi.io/v2/tOZG5mjl3.zl_nZdZTNIBUzsDq62R_dkOtY",
|
||||
"https://eth-goerli.alchemyapi.io/***"},
|
||||
{"https://google.com/search?q=golang", "https://google.com/***"},
|
||||
{"https://user@example.com/foo%2fbar", "https://***@example.com/***"},
|
||||
{"http://john@example.com/#x/y%2Fz", "http://***@example.com/#***"},
|
||||
{"https://me:pass@example.com/foo/bar?x=1&y=2", "https://***@example.com/***"},
|
||||
}
|
||||
|
||||
func TestMaskCredentialsLogging(t *testing.T) {
|
||||
for _, test := range urltests {
|
||||
require.Equal(t, MaskCredentialsLogging(test.url), test.maskedUrl)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user