mir/kea
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/kea synced 2025-09-03 15:35:17 +00:00
Code Issues Releases Wiki Activity

[#1721] update procedure to define new redactors

Browse Source
This commit is contained in:
Andrei Pavel
2021-05-21 15:52:39 +03:00
parent a7180d8877
commit 9e455eadb8
1 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/lib/process/libprocess.dox
View File

@@ -170,14 +170,22 @@ There are two tools to remove sensitive data as passwords or secrets from logs:
- redactedAccessString for database access strings - redactedAccessString for database access strings
- redactConfig for full configurations - redactConfig for full configurations
The redactConfig method must be defined in derived classes following this The jsonPathsToRedact method must be defined in derived classes following this
procedure: procedure:
- take the grammar (bison input file with the .yy extension) - Get all possible JSON paths from the root of the configuration to leaves that
- get the arcs between the start symbol and tokens handling sensitive fulfill the role of map keys and which contain "password" or "secret".
data i.e. passwords and secrets - For each of these paths, remove the root node and the leaf node.
- get the arcs between the start symbol and tokens handling free JSON - Include all the paths in the method. Duplicate subpaths are expected in the
values at the exception of user contexts e.g. hooks libraries parameters case of common subpaths to different leaves.
- give the set of keywords of these arcs to the redactConfig function
There are two special syntaxes:
- "[]" suggests that the searched element is a list. This is required for all
lists and is for performance gain.
- "*" as a last element in a JSON path tells the redacter to look in all
elements that follow for elements that contain "password" and "secret". This is
when the particular configuration that is targeted by the "*" does not have a
well defined structure, such as is the case for "parameters" in the
"hooks-libraries" map in "Dhcp4" and "Dhcp6".
@section cplMTConsiderations Multi-Threading Consideration for Controllable Process Layer @section cplMTConsiderations Multi-Threading Consideration for Controllable Process Layer