GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 08:46:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

Resolves: #315

Browse Source 
Filter out sensitive headers when logging

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
This commit is contained in:
Alan Jowett
2020-06-26 17:18:55 -06:00
parent e4f5c93381
commit 4204d8a5c0
1 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/worker-http.c
View File

@@ -171,6 +171,14 @@ static const dtls_ciphersuite_st ciphersuites12[] = {
} }
}; };
#define STR_ST(x) {.data = (uint8_t*)x, .length = sizeof(x)-1}
static const str_st sensitve_http_headers[] = {
STR_ST("Cookie"),
STR_ST("X-DTLS-Master-Secret"),
STR_ST("Authorization"),
{NULL, 0}
};
#ifdef HAVE_LZ4 #ifdef HAVE_LZ4
/* Wrappers over LZ4 functions */ /* Wrappers over LZ4 functions */
static static
@@ -250,6 +258,17 @@ unsigned switch_comp_priority(void *pool, const char *modstring)
} }
#endif #endif
static bool header_is_sensitive(str_st * header)
{
size_t i;
for (i = 0; sensitve_http_headers[i].length != 0; i++) {
if ((header->length == sensitve_http_headers[i].length) &&
(strncasecmp((char*)header->data, (char*)sensitve_http_headers[i].data, header->length) == 0))
return true;
}
return false;
}
static static
void header_value_check(struct worker_st *ws, struct http_req_st *req) void header_value_check(struct worker_st *ws, struct http_req_st *req)
{ {
@@ -268,9 +287,7 @@ void header_value_check(struct worker_st *ws, struct http_req_st *req)
if (req->value.length <= 0) if (req->value.length <= 0)
return; return;
if (WSPCONFIG(ws)->debug < DEBUG_SENSITIVE && if (WSPCONFIG(ws)->debug < DEBUG_SENSITIVE && header_is_sensitive(&req->header))
((req->header.length == 6 && strncasecmp((char*)req->header.data, "Cookie", 6) == 0) ||
(req->header.length == 20 && strncasecmp((char*)req->header.data, "X-DTLS-Master-Secret", 20) == 0)))
oclog(ws, LOG_HTTP_DEBUG, "HTTP processing: %.*s: (censored)", (int)req->header.length, oclog(ws, LOG_HTTP_DEBUG, "HTTP processing: %.*s: (censored)", (int)req->header.length,
req->header.data); req->header.data);
else else