-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix session_log failure to hide "no_log" data. #3331
Conversation
Fixes: cc @dannywade Please, test this PR (@dannywade ) and verify it fixes what you saw in #3307 |
@ktbyers - I confirmed it works! Test output is below (using the same test from before - sanitizing the 10.1.1.1 IP address). Thank you for looking into this and the quick turnaround!
|
@dannywade FYI, there still are probably some edge cases where the session_log write operation is broken into two chunks and consequently misses the obfuscation. They should be very rare, but it is hard to cover all the cases (and it is a hard tradeoff between the use/value of the session log itself and the value of filtering/obscuring). So I would always view the session log as containing sensitive data and act appropriately (of course, it really is this way filter or no filter as the router contains a lot of sensitive information that it will output and the vast majority of people will not filter it all). |
@ktbyers - Agreed. Thanks again for working through this - I really appreciate it! |
@dannywade Yeah, that change ended up being bigger than anticipated :-) |
Netmiko's session_log failed to properly filter no_log data (password and secret) in certain situations. This appeared to mostly occur on configuration changes (i.e. using send_config_set or send_config_from_file).
It was due to the session_log.write() spanning to calls and hence the no_log filter failing to match the data.