The guard held the exact unbounded apt-get install text, so the new
timeout wrapper failed it. Require the timeout command and allow the
apt transfer options, so an unbounded install now fails the guard.
The PR test job ran apt-get against the xcat.org repository with no
time limit of its own. When the repository stalled, the job hung on the
update step until the sixty minute workflow limit canceled the run, and
the log gave no reason.
Wrap the apt-get update and install steps in a timeout command and give
apt a transfer timeout with retries. A stalled repository now fails the
step in minutes, the driver prints its install error report, and a
rerun is possible at once.
Extract the secret set, the command maps and the redaction routines from
xcatd.pm. Drive the real routines, because the module needs daemon
dependencies that the test host does not have.
Cover a multi-word value, a quoted value, spaces around the operator,
the "+=", ",=", "^=", "!=", "=~" and "!~" operators, the community
strings, a secret embedded in a compound argument with and without
quotes, each Getopt::Long password option form with bundles, the "?"
help letter, abbreviations, "+" prefixes and two-dash letters, values
that hold another secret letter, non-secret compact values that a value
option absorbs, long names that start with a secret letter, the mkvm
case forms and compact values, the chvm positional passwords, the mkvm
clone pw= operand, the vCenter cluster passwords, the snmpc site value
through chdef and tabch with compound selectors, the authentication
tokens, and the product keys. Assert that validate() redacts the
argument vector, that the joined result runs through redact_password,
and that the dispatch trace builds its text from redacted arguments.
Keep every attribute and column pair from Schema.pm, so a removed
table-qualified mapping fails the test.
The daemon redacted secret attributes on the joined command string. The
match failed when a value held a space. The match also failed for a "+="
splice assignment. The validate() path did not quote the arguments, so a
multi-word secret value kept its later words in syslog and in the
auditlog table. A password that a command receives through an option or
a positional operand was not redacted at all. The debug dispatch trace
wrote the raw arguments to syslog when site.xcatdebugmode was set.
Redact the argument vector before the daemon joins it. Add
redact_password_args for this task. The routine masks the value of a
secret attribute in any argument, at the start or embedded after another
token. An embedded secret assignment masks to the end of the argument,
because a shell value may hold quotes and spaces. The routine allows
spaces around the operator. It accepts the "=", "+=", ",=", "^=", "!=",
"=~" and "!~" operators that chdef, nodech and node selection use. It
masks a password option value in each form that Getopt::Long accepts: a
separate argument, a compact short option, a bundle of short options
with the "?" help letter, a "+" option prefix, a single-letter option
with two dashes, a long option, a long option with an equals sign, and
an abbreviated long option. The long-name match runs first, so a long
option keeps its name and masks its value. A walk over each bundle then
finds the first secret letter, so the mask always starts at the option
and the result does not depend on hash order. The walk knows which
other letters of a command take a value, so a secret letter inside such
a value does not redact and the audit text stays correct. The walk also
knows which letters take an integer, because the z/VM cpu option
consumes only its signed digits and the parser then continues the
bundle into the password option. The value stops match letter case,
because a bundle keeps short options case sensitive and an unknown
capital letter does not absorb the rest. The mkvm secret match ignores
letter case, because the z/VM parser keeps the Getopt::Long default for
long names. The mkhwconn match keeps letter case, because -p
is the hardware control point and -P is the password. The routine knows
the password options of bmcdiscover, switchdiscover, mkhwconn, mkvm,
createvcluster, lsvcluster and rmvcluster, the rspconfig password
assignments, the mkvm clone pw= operand, and the positional password
operands of chvm. It masks the site.value argument of tabch and chtab
when a selector or a site.key assignment names snmpc. An exact short
option that takes a non-secret value stays visible, so the PPC mkvm -p
profile is not an abbreviation of --password. The dispatch trace builds
its text from the redacted vector.
Add snmpc, productkey, prodkey.key, tokenid and token.tokenid to the
secret list, with community and pdu.community. The secret list holds
only attributes that map to a secret column, so key and sshkeydir stay
visible.
redact_password keeps a second pass over the joined string. This pass
masks an embedded secret assignment to the end of the line, because the
argument boundaries are gone after the join.
The commands.log response classifier marks a response sensitive when the
request was redacted. The argument vector pass sets that signal, so a
secret whose name has no "passw" text still marks its response.
Vinícius Ferrão
Vinícius Ferrão
Daniel Hilst
Vinícius Ferrão