mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-09-05 04:27:55 +00:00
Vinícius Ferrão
031ad68a41
The commands.log response classifier used a "passw" text match on the request arguments. A secret whose name has no such text passed the check, so a read of an authentication key, a privacy key or the snmpc site value logged its bare value in the response. A command that expands an argument also passed the check: nodels with a table name returns every column of the table, and lsdef returns attributes that the request never names. The daemon also ran redact_password over the whole connection log on each request, so the redactor split at the first request of the connection and the change signal swept the text of earlier requests and responses. Add secret_in_request. The routine reports a request that names a secret attribute, selects a secret site key, or dumps a table that owns a secret column through tabdump or nodels, from the same secret set that the argument redaction uses. The response classifier calls it, so the response of such a request logs as redacted. Add secret_in_response. The routine reports response text that holds "passw" or a secret attribute name in assignment or column form. The response finalizer calls it in place of the bare text match, so an expanded listing that carries an authentication key or a product key logs as redacted even when the request never names it. The lsvm response is the directory entry, whose passwords are positional, so the classifier marks the command itself. Build each request segment alone, redact the segment, and then append it to the connection log. The redactor now always sees the current command, and the change signal covers only the current request.