Skip to content

Commit b2c1370

Browse files
leoparenteleoparente
authored
chore: add redact package to not print sensitive data (#270)
1 parent 7eec240 commit b2c1370

File tree

11 files changed

+896
-62
lines changed

11 files changed

+896
-62
lines changed

‎agent/agent.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"github.com/netboxlabs/orb-agent/agent/config"
1515
"github.com/netboxlabs/orb-agent/agent/configmgr"
1616
"github.com/netboxlabs/orb-agent/agent/policymgr"
17+
"github.com/netboxlabs/orb-agent/agent/redact"
1718
"github.com/netboxlabs/orb-agent/agent/secretsmgr"
1819
"github.com/netboxlabs/orb-agent/agent/telemetry"
1920
"github.com/netboxlabs/orb-agent/agent/version"
@@ -183,7 +184,7 @@ func (a *orbAgent) Start(ctx context.Context, cancelFunc context.CancelFunc) err
183184
agentCtx := context.WithValue(ctx, routineKey, "agentRoutine")
184185
a.cancelFunction = cancelFunc
185186
a.logger.Info("agent started", "version", version.GetBuildVersion(), "routine", agentCtx.Value(routineKey))
186-
a.logger.Info("requested backends", "values", a.config.OrbAgent.Backends)
187+
a.logger.Info("requested backends", "values", redact.SensitiveData(a.config.OrbAgent.Backends))
187188

188189
if err := a.secretsManager.Start(ctx); err != nil {
189190
a.logger.Error("error during start secrets manager", "error", err)

‎agent/backend/devicediscovery/device_discovery.go‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/netboxlabs/orb-agent/agent/backend"
1616
"github.com/netboxlabs/orb-agent/agent/config"
1717
"github.com/netboxlabs/orb-agent/agent/policies"
18+
"github.com/netboxlabs/orb-agent/agent/redact"
1819
)
1920

2021
var _ backend.Backend = (*deviceDiscoveryBackend)(nil)
@@ -29,7 +30,6 @@ const (
2930
defaultExec = "device-discovery"
3031
defaultAPIHost = "localhost"
3132
defaultAPIPort = "8072"
32-
maskedSecret = "********"
3333
)
3434

3535
type deviceDiscoveryBackend struct {
@@ -160,7 +160,7 @@ func (d *deviceDiscoveryBackend) Start(ctx context.Context, cancelFunc context.C
160160
if !d.diodeTargetFromOtel {
161161
opts = append(opts,
162162
"--diode-client-id", d.diodeClientID,
163-
"--diode-client-secret", maskedSecret,
163+
"--diode-client-secret", d.diodeClientSecret,
164164
)
165165
}
166166
dOptions = append(opts, dOptions...)
@@ -170,16 +170,7 @@ func (d *deviceDiscoveryBackend) Start(ctx context.Context, cancelFunc context.C
170170
dOptions = append(dOptions, "--otel-endpoint", d.diodeOtelEndpoint)
171171
}
172172

173-
d.logger.Info("device-discovery startup", "arguments", dOptions)
174-
175-
if !d.diodeDryRun {
176-
for i, arg := range dOptions {
177-
if arg == maskedSecret {
178-
dOptions[i] = d.diodeClientSecret
179-
break
180-
}
181-
}
182-
}
173+
d.logger.Info("device-discovery startup", "arguments", redact.Args(dOptions))
183174

184175
d.proc = backend.NewCmdOptions(backend.CmdOptions{
185176
Buffered: false,

‎agent/backend/networkdiscovery/network_discovery.go‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"github.com/netboxlabs/orb-agent/agent/backend"
1717
"github.com/netboxlabs/orb-agent/agent/config"
1818
"github.com/netboxlabs/orb-agent/agent/policies"
19+
"github.com/netboxlabs/orb-agent/agent/redact"
1920
)
2021

2122
var _ backend.Backend = (*networkDiscoveryBackend)(nil)
@@ -30,7 +31,6 @@ const (
3031
defaultExec = "network-discovery"
3132
defaultAPIHost = "localhost"
3233
defaultAPIPort = "8073"
33-
maskedSecret = "********"
3434
)
3535

3636
type networkDiscoveryBackend struct {
@@ -169,7 +169,7 @@ func (d *networkDiscoveryBackend) Start(ctx context.Context, cancelFunc context.
169169
if !d.diodeTargetFromOtel {
170170
opts = append(opts,
171171
"--diode-client-id", d.diodeClientID,
172-
"--diode-client-secret", maskedSecret,
172+
"--diode-client-secret", d.diodeClientSecret,
173173
)
174174
}
175175
dOptions = append(opts, dOptions...)
@@ -187,16 +187,7 @@ func (d *networkDiscoveryBackend) Start(ctx context.Context, cancelFunc context.
187187
"endpoint", d.diodeOtelEndpoint)
188188
}
189189

190-
d.logger.Info("network-discovery startup", "arguments", dOptions)
191-
192-
if !d.diodeDryRun {
193-
for i, arg := range dOptions {
194-
if arg == maskedSecret {
195-
dOptions[i] = d.diodeClientSecret
196-
break
197-
}
198-
}
199-
}
190+
d.logger.Info("network-discovery startup", "arguments", redact.Args(dOptions))
200191

201192
d.proc = backend.NewCmdOptions(backend.CmdOptions{
202193
Buffered: false,

‎agent/backend/snmpdiscovery/snmp_discovery.go‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"github.com/netboxlabs/orb-agent/agent/backend"
1717
"github.com/netboxlabs/orb-agent/agent/config"
1818
"github.com/netboxlabs/orb-agent/agent/policies"
19+
"github.com/netboxlabs/orb-agent/agent/redact"
1920
)
2021

2122
var _ backend.Backend = (*snmpDiscoveryBackend)(nil)
@@ -30,7 +31,6 @@ const (
3031
defaultExec = "snmp-discovery"
3132
defaultAPIHost = "localhost"
3233
defaultAPIPort = "8070"
33-
maskedSecret = "********"
3434
)
3535

3636
type snmpDiscoveryBackend struct {
@@ -169,7 +169,7 @@ func (d *snmpDiscoveryBackend) Start(ctx context.Context, cancelFunc context.Can
169169
if !d.diodeTargetFromOtel {
170170
opts = append(opts,
171171
"--diode-client-id", d.diodeClientID,
172-
"--diode-client-secret", maskedSecret,
172+
"--diode-client-secret", d.diodeClientSecret,
173173
)
174174
}
175175
dOptions = append(opts, dOptions...)
@@ -187,17 +187,7 @@ func (d *snmpDiscoveryBackend) Start(ctx context.Context, cancelFunc context.Can
187187
"endpoint", d.diodeOtelEndpoint)
188188
}
189189

190-
d.logger.Info("snmp-discovery startup", "arguments", dOptions)
191-
192-
if !d.diodeDryRun {
193-
// Swap the masked secret used for logging with the real value before execution
194-
for i, arg := range dOptions {
195-
if arg == maskedSecret {
196-
dOptions[i] = d.diodeClientSecret
197-
break
198-
}
199-
}
200-
}
190+
d.logger.Info("snmp-discovery startup", "arguments", redact.Args(dOptions))
201191

202192
d.proc = backend.NewCmdOptions(backend.CmdOptions{
203193
Buffered: false,

‎agent/backend/worker/worker.go‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/netboxlabs/orb-agent/agent/backend"
1616
"github.com/netboxlabs/orb-agent/agent/config"
1717
"github.com/netboxlabs/orb-agent/agent/policies"
18+
"github.com/netboxlabs/orb-agent/agent/redact"
1819
)
1920

2021
var _ backend.Backend = (*workerBackend)(nil)
@@ -29,7 +30,6 @@ const (
2930
defaultExec = "orb-worker"
3031
defaultAPIHost = "localhost"
3132
defaultAPIPort = "8071"
32-
maskedSecret = "********"
3333
)
3434

3535
type workerBackend struct {
@@ -160,7 +160,7 @@ func (d *workerBackend) Start(ctx context.Context, cancelFunc context.CancelFunc
160160
if !d.diodeTargetFromOtel {
161161
opts = append(opts,
162162
"--diode-client-id", d.diodeClientID,
163-
"--diode-client-secret", maskedSecret,
163+
"--diode-client-secret", d.diodeClientSecret,
164164
)
165165
}
166166
dOptions = append(opts, dOptions...)
@@ -170,17 +170,7 @@ func (d *workerBackend) Start(ctx context.Context, cancelFunc context.CancelFunc
170170
dOptions = append(dOptions, "--otel-endpoint", d.diodeOtelEndpoint)
171171
}
172172

173-
d.logger.Info("worker startup", "arguments", dOptions)
174-
175-
if !d.diodeDryRun {
176-
// Swap the masked secret used for logging with the real value before execution
177-
for i, arg := range dOptions {
178-
if arg == maskedSecret {
179-
dOptions[i] = d.diodeClientSecret
180-
break
181-
}
182-
}
183-
}
173+
d.logger.Info("worker startup", "arguments", redact.Args(dOptions))
184174

185175
d.proc = backend.NewCmdOptions(backend.CmdOptions{
186176
Buffered: false,

‎agent/configmgr/fleet.go‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"github.com/netboxlabs/orb-agent/agent/configmgr/fleet"
1515
"github.com/netboxlabs/orb-agent/agent/otlpbridge"
1616
"github.com/netboxlabs/orb-agent/agent/policymgr"
17+
"github.com/netboxlabs/orb-agent/agent/redact"
1718
)
1819

1920
// Compile-time check to ensure fleetConfigManager implements Manager interface
@@ -271,11 +272,8 @@ func (fleetManager *fleetConfigManager) refreshAndReconnect(ctx context.Context,
271272
}
272273

273274
func (fleetManager *fleetConfigManager) configToSafeString(cfg config.Config) (string, error) {
274-
if cfg.OrbAgent.ConfigManager.Sources.Fleet.ClientSecret != "" {
275-
cfg.OrbAgent.ConfigManager.Sources.Fleet.ClientSecret = "******"
276-
}
277-
278-
configYaml, err := yaml.Marshal(cfg)
275+
redacted := redact.SensitiveData(cfg)
276+
configYaml, err := yaml.Marshal(redacted)
279277
if err != nil {
280278
return "", fmt.Errorf("failed to marshal agent config: %w", err)
281279
}

‎agent/configmgr/fleet/auth.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ import (
1515

1616
"github.com/go-jose/go-jose/v4"
1717
"github.com/go-jose/go-jose/v4/jwt"
18+
19+
"github.com/netboxlabs/orb-agent/agent/redact"
1820
)
1921

2022
// AuthTokenManager manages auth tokens
@@ -92,7 +94,7 @@ func (fleetManager *AuthTokenManager) GetToken(ctx context.Context, tokenURL str
9294
},
9395
}
9496

95-
fleetManager.logger.Debug("sending token request", "url", tokenURL, "data", data, "client_id", clientID)
97+
fleetManager.logger.Debug("sending token request", "url", tokenURL, "data", redact.SensitiveData(data), "client_id", clientID)
9698

9799
resp, err := httpClient.Do(req.WithContext(ctx))
98100
if err != nil {

‎agent/configmgr/fleet_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,7 @@ func TestFleetConfigManager_configToSafeString(t *testing.T) {
279279
{
280280
name: "sanitizes non-empty client secret",
281281
clientSecret: "my-super-secret-password",
282-
wantSecret: "******",
282+
wantSecret: "********",
283283
wantErr: false,
284284
checkInYAML: true,
285285
},
@@ -334,9 +334,9 @@ func TestFleetConfigManager_configToSafeString(t *testing.T) {
334334
assert.Contains(t, result, tt.wantSecret, "sanitized secret should be in output")
335335
// YAML can use either single or double quotes, so check for either
336336
assert.True(t,
337-
strings.Contains(result, "client_secret: '******'") ||
338-
strings.Contains(result, "client_secret: \"******\"") ||
339-
strings.Contains(result, "client_secret: ******"),
337+
strings.Contains(result, "client_secret: '********'") ||
338+
strings.Contains(result, "client_secret: \"********\"") ||
339+
strings.Contains(result, "client_secret: ********"),
340340
"client_secret should be masked in YAML output")
341341
}
342342
})

0 commit comments

Comments
 (0)