Skip to content

Commit cafd3c6

Browse files
Effi-SEffi-S
committed
Hashing sensitive info
Signed-off-by: Effi-S <effi.szt@gmail.com>
1 parent 2a9d181 commit cafd3c6

11 files changed

Lines changed: 159 additions & 11 deletions

File tree

‎token/services/identity/idemix/crypto/config.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ func NewFabricCAIdemixConfig(issuerPublicKey []byte, dir string) (*Config, error
173173
func NewConfigFromRaw(issuerPublicKey []byte, configRaw []byte) (*Config, error) {
174174
config := &config.IdemixConfig{}
175175
if err := proto.Unmarshal(configRaw, config); err != nil {
176-
return nil, errors.Wrapf(err, "failed to unmarshal idemix config at [%s]", string(configRaw))
176+
return nil, errors.Wrapf(err, "failed to unmarshal idemix config of PK [%s]", utils.Hashable(issuerPublicKey))
177177
}
178178
// match public keys
179179
if !bytes.Equal(issuerPublicKey, config.Ipk) {

‎token/services/identity/idemix/crypto/deserializer.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111

1212
bccsp "github.com/IBM/idemix/bccsp/types"
1313
"github.com/LFDT-Panurus/panurus/token/services/identity/idemix/schema"
14+
"github.com/LFDT-Panurus/panurus/token/services/utils"
1415
"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/errors"
1516
"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/proto"
1617
)
@@ -112,7 +113,7 @@ func (d *Deserializer) DeserializeAgainstNymEID(identity []byte, nymEID []byte)
112113
func (d *Deserializer) DeserializeAuditInfo(_ context.Context, raw []byte) (*AuditInfo, error) {
113114
ai, err := DeserializeAuditInfo(raw)
114115
if err != nil {
115-
return nil, errors.Wrapf(err, "failed deserializing audit info [%s]", string(raw))
116+
return nil, errors.Wrapf(err, "failed deserializing audit info [%s]", utils.Hashable(raw))
116117
}
117118
ai.Csp = d.Csp
118119
ai.IssuerPublicKey = d.IssuerPublicKey

‎token/services/identity/idemix/deserializer.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ type AuditInfoDeserializer struct{}
181181
func (c *AuditInfoDeserializer) DeserializeAuditInfo(ctx context.Context, identity driver.Identity, raw []byte) (driver2.AuditInfo, error) {
182182
ai, err := crypto2.DeserializeAuditInfo(raw)
183183
if err != nil {
184-
return nil, errors.Wrapf(err, "failed deserializing audit info [%s]", string(raw))
184+
return nil, errors.Wrapf(err, "failed deserializing audit info [%s]", utils.Hashable(raw))
185185
}
186186

187187
return ai, nil

‎token/services/identity/idemixnym/deserializer.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
driver2 "github.com/LFDT-Panurus/panurus/token/services/identity/driver"
1515
"github.com/LFDT-Panurus/panurus/token/services/identity/idemix"
1616
"github.com/LFDT-Panurus/panurus/token/services/identity/idemixnym/nym"
17+
"github.com/LFDT-Panurus/panurus/token/services/utils"
1718
"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/errors"
1819
)
1920

@@ -103,7 +104,7 @@ type AuditInfoDeserializer struct{}
103104
func (c *AuditInfoDeserializer) DeserializeAuditInfo(ctx context.Context, identity driver.Identity, raw []byte) (driver2.AuditInfo, error) {
104105
ai, err := nym.DeserializeAuditInfo(raw)
105106
if err != nil {
106-
return nil, errors.Wrapf(err, "failed deserializing audit info [%s]", string(raw))
107+
return nil, errors.Wrapf(err, "failed deserializing audit info [%s]", utils.Hashable(raw))
107108
}
108109

109110
return ai, nil

‎token/services/identity/interop/htlc/deserializer.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"github.com/LFDT-Panurus/panurus/token/services/identity"
1515
idriver "github.com/LFDT-Panurus/panurus/token/services/identity/driver"
1616
"github.com/LFDT-Panurus/panurus/token/services/interop/htlc"
17+
"github.com/LFDT-Panurus/panurus/token/services/utils"
1718
"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/errors"
1819
)
1920

@@ -182,14 +183,14 @@ func (a *AuditDeserializer) DeserializeAuditInfo(ctx context.Context, identity d
182183
si := &ScriptInfo{}
183184
err = json.Unmarshal(raw, si)
184185
if err != nil || (len(si.Sender) == 0 && len(si.Recipient) == 0) {
185-
return nil, errors.Errorf("invalid audit info, failed unmarshal [%s][%d][%d]", string(raw), len(si.Sender), len(si.Recipient))
186+
return nil, errors.Errorf("invalid audit info, failed unmarshal [%s][%d][%d]", utils.Hashable(raw), len(si.Sender), len(si.Recipient))
186187
}
187188
if len(si.Recipient) == 0 {
188189
return nil, errors.Errorf("no recipient defined")
189190
}
190191
ai, err := a.AuditInfoDeserializer.DeserializeAuditInfo(ctx, script.Recipient, si.Recipient)
191192
if err != nil {
192-
return nil, errors.Wrapf(err, "failed unmarshalling audit info [%s]", raw)
193+
return nil, errors.Wrapf(err, "failed unmarshalling audit info [%s]", utils.Hashable(raw))
193194
}
194195

195196
return ai, nil

‎token/services/identity/interop/htlc/validator.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313

1414
"github.com/LFDT-Panurus/panurus/token/services/identity"
1515
"github.com/LFDT-Panurus/panurus/token/services/interop/htlc"
16+
"github.com/LFDT-Panurus/panurus/token/services/utils"
1617
"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/errors"
1718
)
1819

@@ -87,7 +88,7 @@ func MetadataClaimKeyCheck(action Action, script *htlc.Script, op OperationType,
8788
// Unmarshal signature to ClaimSignature
8889
claim := &htlc.ClaimSignature{}
8990
if err := json.Unmarshal(sig, claim); err != nil {
90-
return "", errors.Wrapf(err, "failed unmarshalling claim signature [%s]", string(sig))
91+
return "", errors.Wrapf(err, "failed unmarshalling claim signature [%s]", utils.Hashable(sig))
9192
}
9293
// Check that it is well-formed
9394
if len(claim.Preimage) == 0 || len(claim.RecipientSignature) == 0 {

‎token/services/identity/x509/crypto/config.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ SPDX-License-Identifier: Apache-2.0
77
package crypto
88

99
import (
10+
"fmt"
11+
1012
"github.com/LFDT-Panurus/panurus/token/services/identity/x509/crypto/pkcs11"
1113
"github.com/LFDT-Panurus/panurus/token/services/identity/x509/crypto/protos-go/v1/config"
1214
"github.com/go-viper/mapstructure/v2"
@@ -75,6 +77,20 @@ type KeyIDMapping struct {
7577
ID string `yaml:"ID,omitempty"`
7678
}
7779

80+
// String renders the PKCS11 configuration for logging with the PIN redacted, so
81+
// the secret can never reach a log line or error string, even when a *PKCS11 is
82+
// interpolated directly or as a field of a *BCCSP. It is nil-safe.
83+
func (p *PKCS11) String() string {
84+
if p == nil {
85+
return "<nil>"
86+
}
87+
88+
return fmt.Sprintf(
89+
"{Security:%d Hash:%s Library:%s Label:%s Pin:[REDACTED] SoftwareVerify:%t Immutable:%t AltID:%s KeyIDs:%v SessionCacheSize:%d}",
90+
p.Security, p.Hash, p.Library, p.Label, p.SoftwareVerify, p.Immutable, p.AltID, p.KeyIDs, p.SessionCacheSize,
91+
)
92+
}
93+
7894
// ToBCCSPOpts converts the passed opts to `config.BCCSP`
7995
func ToBCCSPOpts(boxed any) (*BCCSP, error) {
8096
opts := &Opts{}

‎token/services/identity/x509/crypto/msp.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"crypto/x509"
1313
"encoding/pem"
1414

15+
"github.com/LFDT-Panurus/panurus/token/services/utils"
1516
"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/errors"
1617
"github.com/hyperledger/fabric-lib-go/bccsp"
1718
)
@@ -242,7 +243,7 @@ func (f *IdentityFactory) getCertFromPem(idBytes []byte) (*x509.Certificate, err
242243
// Decode the pem bytes
243244
pemCert, _ := pem.Decode(idBytes)
244245
if pemCert == nil {
245-
return nil, errors.Errorf("could not decode pem bytes [%v]", idBytes)
246+
return nil, errors.Errorf("could not decode pem bytes [%v]", utils.Hashable(idBytes))
246247
}
247248

248249
// get a cert

‎token/services/identity/x509/crypto/pkcs11/disabled.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ SPDX-License-Identifier: Apache-2.0
99
package pkcs11
1010

1111
import (
12+
"fmt"
13+
1214
"github.com/hyperledger/fabric-lib-go/bccsp"
1315
)
1416

@@ -33,6 +35,15 @@ type PKCS11Opts struct {
3335
SessionCacheSize uint `yaml:"SessionCacheSize,omitempty"`
3436
}
3537

38+
// String renders the PKCS11 With redacted Pin,
39+
// So interpolated (with %v/%s/%+v) doesn't reach a log line.
40+
func (o PKCS11Opts) String() string {
41+
return fmt.Sprintf(
42+
"{Security:%d Hash:%s Library:%s Label:%s Pin:[REDACTED] SoftwareVerify:%t Immutable:%t AltID:%s KeyIDs:%v SessionCacheSize:%d}",
43+
o.Security, o.Hash, o.Library, o.Label, o.SoftwareVerify, o.Immutable, o.AltID, o.KeyIDs, o.SessionCacheSize,
44+
)
45+
}
46+
3647
func NewProvider(opts any, ks bccsp.KeyStore, mapper func(ski []byte) []byte) (bccsp.BCCSP, error) {
3748
panic("pkcs11 not included in build. Use: go build -tags pkcs11")
3849
}

‎token/services/identity/x509/crypto/pkcs11/pkcs11.go‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ SPDX-License-Identifier: Apache-2.0
99
package pkcs11
1010

1111
import (
12+
"fmt"
1213
"os"
1314

1415
"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/errors"
@@ -24,15 +25,27 @@ const (
2425
)
2526

2627
type (
27-
PKCS11Opts = pkcs11.PKCS11Opts
28+
// PKCS11Opts is a defined type (not an alias) over the fabric-lib PKCS11
29+
// options so it can carry a redacting String().
30+
PKCS11Opts pkcs11.PKCS11Opts
2831
KeyIDMapping = pkcs11.KeyIDMapping
2932
)
3033

34+
// String renders the PKCS11 With redacted Pin,
35+
// So interpolated (with %v/%s/%+v) doesn't reach a log line.
36+
func (o PKCS11Opts) String() string {
37+
return fmt.Sprintf(
38+
"{Security:%d Hash:%s Library:%s Label:%s Pin:[REDACTED] SoftwareVerify:%t Immutable:%t AltID:%s KeyIDs:%v SessionCacheSize:%d}",
39+
o.Security, o.Hash, o.Library, o.Label, o.SoftwareVerify, o.Immutable, o.AltID, o.KeyIDs, o.SessionCacheSize,
40+
)
41+
}
42+
3143
// NewProvider returns a pkcs11 provider
3244
func NewProvider(opts PKCS11Opts, ks bccsp.KeyStore, mapper func(ski []byte) []byte) (*pkcs11.Provider, error) {
33-
csp, err := pkcs11.New(opts, ks, pkcs11.WithKeyMapper(mapper))
45+
csp, err := pkcs11.New(pkcs11.PKCS11Opts(opts), ks, pkcs11.WithKeyMapper(mapper))
3446
if err != nil {
35-
return nil, errors.WithMessagef(err, "Failed initializing PKCS11 library with config [%+v]", opts)
47+
// opts.String() redacts the PIN, so the secret never reaches the error string.
48+
return nil, errors.WithMessagef(err, "Failed initializing PKCS11 library with config [%v]", opts)
3649
}
3750
return csp, nil
3851
}

0 commit comments

Comments
 (0)