From: Stefan Sterz <s.sterz@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>,
Mira Limbeck <m.limbeck@proxmox.com>
Subject: Re: [pve-devel] [PATCH manager] report: filter comments in VM/CT configs
Date: Fri, 16 Dec 2022 10:01:49 +0100 [thread overview]
Message-ID: <8177369c-e2cb-d2ee-fb08-6290795e1ccf@proxmox.com> (raw)
In-Reply-To: <20221215165700.2061397-1-m.limbeck@proxmox.com>
On 12/15/22 17:57, Mira Limbeck wrote:
> Since some users keep their passwords in the VM/CT configs as comments
> and those are most of the time unnecessary when looking through the
> report, filter those.
>
> In addition to the comments, also filter the `cipassword` option
> since it contains the hash of the password.
>
> To facilitate the filtering, a new sub 'file2text' is introduced that
> can filter the file contents if required.
> This sub replaces the 'cat ...' commands.
>
> Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
> ---
> I did not add print to STDERR in file2text for now since it got quite
> chatty.
> If this is wanted, I'll send a v2 adding it. But since file2text is also
> called by dir2text the 'OK' at the end won't always align, especially
> when dir2text is used.
>
> PVE/Report.pm | 48 +++++++++++++++++++++++++++++++++---------------
> 1 file changed, 33 insertions(+), 15 deletions(-)
>
> diff --git a/PVE/Report.pm b/PVE/Report.pm
> index 90b7cb1c..7ebe98f7 100644
> --- a/PVE/Report.pm
> +++ b/PVE/Report.pm
> @@ -5,16 +5,34 @@ use warnings;
>
> use PVE::Tools;
>
> +my sub file2text {
> + my ($file, $filter) = @_;
> + my $text = "\n# cat $file\n";
> +
maybe this should be something like `cat $file | grep -v
"\(\(^\s*#\)\|\(^cipassword\)\)"` or `filtered contents of $file`? just
to make it clearer to someone that just looks at the report that we
don't *just* do a `cat` anymore, but do filter sensitive information.
although, i do think that the amount of users that know what is in the
config files and don't check what is actually in the report is probably
rather small.
> + my $contents = PVE::Tools::file_get_contents($file);
> + if ($filter) {
> + foreach my $line (split('\n', $contents)) {
> + next if $line =~ m/^\s*#/;
> + next if $line =~ m/^cipassword/;
> +
> + $text .= "$line\n";
> + }
> + } else {
> + $text .= $contents;
> + }
> +
> + return $text;
> +}
> +
> # output the content of all the files of a directory
> my sub dir2text {
> - my ($target_dir, $regexp) = @_;
> + my ($target_dir, $regexp, $filter) = @_;
>
> print STDERR "dir2text '${target_dir}${regexp}'...";
> my $text = '';
> PVE::Tools::dir_glob_foreach($target_dir, $regexp, sub {
> my ($file) = @_;
> - $text .= "\n# cat $target_dir$file\n";
> - $text .= PVE::Tools::file_get_contents($target_dir.$file)."\n";
> + $text .= file2text($target_dir.$file, $filter)."\n";
> });
> return $text;
> }
> @@ -30,9 +48,9 @@ my $init_report_cmds = sub {
> cmds => [
> 'hostname',
> 'pveversion --verbose',
> - 'cat /etc/hosts',
> + sub { file2text('/etc/hosts') },
> 'pvesubscription get',
> - 'cat /etc/apt/sources.list',
> + sub { file2text('/etc/apt/sources.list') },
> sub { dir2text('/etc/apt/sources.list.d/', '.*list') },
> sub { dir2text('/etc/apt/sources.list.d/', '.*sources') },
> 'lscpu',
> @@ -50,9 +68,9 @@ my $init_report_cmds = sub {
> storage => {
> order => 30,
> cmds => [
> - 'cat /etc/pve/storage.cfg',
> + sub { file2text('/etc/pve/storage.cfg') },
> 'pvesm status',
> - 'cat /etc/fstab',
> + sub { file2text('/etc/fstab') },
> 'findmnt --ascii',
> 'df --human -T',
> 'proxmox-boot-tool status',
> @@ -62,9 +80,9 @@ my $init_report_cmds = sub {
> order => 40,
> cmds => [
> 'qm list',
> - sub { dir2text('/etc/pve/qemu-server/', '\d.*conf') },
> + sub { dir2text('/etc/pve/qemu-server/', '\d.*conf', 1) },
> 'pct list',
> - sub { dir2text('/etc/pve/lxc/', '\d.*conf') },
> + sub { dir2text('/etc/pve/lxc/', '\d.*conf', 1) },
> ],
> },
> network => {
> @@ -73,14 +91,14 @@ my $init_report_cmds = sub {
> 'ip -details -statistics address',
> 'ip -details -4 route show',
> 'ip -details -6 route show',
> - 'cat /etc/network/interfaces',
> + sub { file2text('/etc/network/interfaces') },
> ],
> },
> firewall => {
> order => 50,
> cmds => [
> sub { dir2text('/etc/pve/firewall/', '.*fw') },
> - 'cat /etc/pve/local/host.fw',
> + sub { file2text('/etc/pve/local/host.fw') },
> 'iptables-save',
> ],
> },
> @@ -89,7 +107,7 @@ my $init_report_cmds = sub {
> cmds => [
> 'pvecm nodes',
> 'pvecm status',
> - 'cat /etc/pve/corosync.conf 2>/dev/null',
> + sub { file2text('/etc/pve/corosync.conf') },
> 'ha-manager status',
> ],
> },
> @@ -135,7 +153,7 @@ my $init_report_cmds = sub {
> 'ceph df',
> 'ceph osd df tree',
> 'ceph device ls',
> - 'cat /etc/ceph/ceph.conf',
> + sub { file2text('/etc/ceph/ceph.conf') },
> 'ceph config dump',
> 'pveceph pool ls',
> 'ceph versions',
> @@ -144,8 +162,8 @@ my $init_report_cmds = sub {
>
> if (cmd_exists('multipath')) {
> push @{$report_def->{disks}->{cmds}},
> - 'cat /etc/multipath.conf',
> - 'cat /etc/multipath/wwids',
> + sub { file2text('/etc/multipath.conf') },
> + sub { file2text('/etc/multipath/wwids') },
> 'multipath -ll',
> ;
> }
next prev parent reply other threads:[~2022-12-16 9:01 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-15 16:57 Mira Limbeck
2022-12-16 9:01 ` Stefan Sterz [this message]
2022-12-16 10:31 ` Thomas Lamprecht
2022-12-16 11:14 ` Mira Limbeck
2022-12-16 12:15 ` Fiona Ebner
2022-12-28 14:18 ` Stefan Sterz
2022-12-30 14:34 ` Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8177369c-e2cb-d2ee-fb08-6290795e1ccf@proxmox.com \
--to=s.sterz@proxmox.com \
--cc=m.limbeck@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox