Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package wicked for openSUSE:Factory checked in at 2024-03-21 17:00:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wicked (Old) and /work/SRC/openSUSE:Factory/.wicked.new.1905 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wicked" Thu Mar 21 17:00:08 2024 rev:99 rq:1159817 version:0.6.74 Changes: -------- --- /work/SRC/openSUSE:Factory/wicked/wicked.changes 2024-03-17 22:10:35.688525514 +0100 +++ /work/SRC/openSUSE:Factory/.wicked.new.1905/wicked.changes 2024-03-21 17:00:18.912088559 +0100 @@ -1,0 +2,7 @@ +Thu Mar 19 17:00:01 UTC 2024 - Clemens Famulla-Conrad <cfamullacon...@suse.com> + +- hide secrets in debug log (bsc#1221194) + [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] + [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] + +------------------------------------------------------------------- New: ---- 0003-move-all-attribute-definitions-to-compiler-h.patch 0004-hide-secrets-in-debug-log-bsc-1221194.patch BETA DEBUG BEGIN: New:- hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] New: [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wicked.spec ++++++ --- /var/tmp/diff_new_pack.w5FqJR/_old 2024-03-21 17:00:19.476109728 +0100 +++ /var/tmp/diff_new_pack.w5FqJR/_new 2024-03-21 17:00:19.480109878 +0100 @@ -28,6 +28,8 @@ Source1: wicked-rpmlintrc Patch1: 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch Patch2: 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch +Patch3: 0003-move-all-attribute-definitions-to-compiler-h.patch +Patch4: 0004-hide-secrets-in-debug-log-bsc-1221194.patch # # Upstream First - openSUSE Build Service Policy: # @@ -173,7 +175,7 @@ %autopatch -p1 %build -test -x ./configure || autoreconf --force --install +autoreconf --force --install export CFLAGS="-std=gnu89 $RPM_OPT_FLAGS -fPIC" LDFLAGS="-pie" %configure \ --with-piddir=%{wicked_piddir} \ ++++++ 0003-move-all-attribute-definitions-to-compiler-h.patch ++++++ >From 71c88af525fe35e32af665dfa776104aa2a48f67 Mon Sep 17 00:00:00 2001 From: Clemens Famulla-Conrad <cfamullacon...@suse.de> Date: Tue, 19 Mar 2024 10:15:12 +0100 Subject: [PATCH 1/3] Move all __attribute__ definitions to compiler.h --- client/ifreload.c | 15 +++++++------- include/Makefile.am | 1 + include/wicked/compiler.h | 42 +++++++++++++++++++++++++++++++++++++++ include/wicked/logging.h | 24 +++++++++------------- src/duid.c | 9 +-------- src/duid.h | 15 +++++--------- src/fsm.c | 3 ++- testing/wunit.h | 5 +++-- 8 files changed, 71 insertions(+), 43 deletions(-) create mode 100644 include/wicked/compiler.h diff --git a/client/ifreload.c b/client/ifreload.c index 8786cb3b..d8525457 100644 --- a/client/ifreload.c +++ b/client/ifreload.c @@ -38,6 +38,7 @@ #include <wicked/netinfo.h> #include <wicked/logging.h> #include <wicked/fsm.h> +#include <wicked/compiler.h> #include "wicked-client.h" #include "appconfig.h" @@ -59,7 +60,7 @@ ifreload_mark_add(ni_ifworker_array_t *marked, ni_ifworker_t *w) static inline void ifreload_mark_down_lower_deps(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifworker_t *lower, - void (*logit)(const char *, ...) __fmtattr) + void (*logit)(const char *, ...) ni__printf(1, 2)) { ni_ifworker_t *w; unsigned int i; @@ -94,7 +95,7 @@ ifreload_mark_down_lower_deps(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, static ni_bool_t ifreload_mark_down(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifworker_t *w, - void (*logit)(const char *, ...) __fmtattr, + void (*logit)(const char *, ...) ni__printf(1, 2), unsigned int depth) { /* ifdown is disabled when persistent mode is on (todo: add --force?) */ @@ -176,7 +177,7 @@ ifreload_mark_down(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifworker static void ifreload_mark_up_slave_deps(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifworker_t *master, - void (*logit)(const char *, ...) __fmtattr) + void (*logit)(const char *, ...) ni__printf(1, 2)) { ni_ifworker_t *w; unsigned int i; @@ -207,7 +208,7 @@ ifreload_mark_up_slave_deps(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni static void ifreload_mark_up_master(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifworker_t *w, - void (*logit)(const char *, ...) __fmtattr) + void (*logit)(const char *, ...) ni__printf(1, 2)) { if (!ni_ifcheck_worker_config_exists(w)) { logit("skipping %s set-up: no configuration available", w->name); @@ -228,7 +229,7 @@ ifreload_mark_up_master(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifw static void ifreload_mark_up_lower_deps(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifworker_t *lower, - void (*logit)(const char *, ...) __fmtattr) + void (*logit)(const char *, ...) ni__printf(1, 2)) { ni_ifworker_t *w; unsigned int i; @@ -268,7 +269,7 @@ ifreload_mark_up_lower_deps(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni static ni_bool_t ifreload_mark_up(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifworker_t *w, - void (*logit)(const char *, ...) __fmtattr) + void (*logit)(const char *, ...) ni__printf(1, 2)) { if (!ni_ifcheck_worker_config_exists(w)) { logit("skipping %s set-up: no configuration available", w->name); @@ -299,7 +300,7 @@ ifreload_mark_up(const ni_fsm_t *fsm, ni_ifworker_array_t *marked, ni_ifworker_t static void ifreload_mark_workers(const ni_fsm_t *fsm, ni_ifworker_array_t *down_marked, ni_ifworker_array_t *up_marked, const char *ifname) { - void (*logit)(const char *, ...) __fmtattr = ifname ? ni_note : ni_info; + void (*logit)(const char *, ...) ni__printf(1, 2) = ifname ? ni_note : ni_info; ni_ifworker_t *w; unsigned int i; diff --git a/include/Makefile.am b/include/Makefile.am index b913cafa..fed931d1 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -10,6 +10,7 @@ wicked_include_HEADERS = \ wicked/bridge.h \ wicked/client.h \ wicked/constants.h \ + wicked/compiler.h \ wicked/dbus.h \ wicked/dbus-errors.h \ wicked/dbus-service.h \ diff --git a/include/wicked/compiler.h b/include/wicked/compiler.h new file mode 100644 index 00000000..f5edf9a2 --- /dev/null +++ b/include/wicked/compiler.h @@ -0,0 +1,42 @@ +/* + * Compiler specific definitions + * + * Copyright (C) 2024 SUSE LLC + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + * + */ + +#ifndef NI_WICKED_COMPILER_H +#define NI_WICKED_COMPILER_H + +#ifdef __GNUC__ + +# define ni__printf(a, b) __attribute__ ((format (printf, a, b))) +# define ni__noreturn __attribute__ ((noreturn)) +# define ni__packed __attribute__ ((__packed__)) +# define ni__unused __attribute__ ((unused)) +# define ni__constructor __attribute__ ((constructor)) + +#else /* __GNUC__ */ + +# define ni__printf(a, b) /* */ +# define ni__noreturn /* */ +# define ni__packed /* */ +# define ni__unused /* */ +# define ni__constructor /* */ + +#endif + +#endif /* NI_WICKED_COMPILER_H */ diff --git a/include/wicked/logging.h b/include/wicked/logging.h index 7d2fbd89..db8874a5 100644 --- a/include/wicked/logging.h +++ b/include/wicked/logging.h @@ -8,22 +8,16 @@ #define __WICKED_LOGGING_H__ #include <wicked/types.h> +#include <wicked/compiler.h> -#ifdef __GNUC__ -# define __fmtattr __attribute__ ((format (printf, 1, 2))) -# define __noreturn __attribute__ ((noreturn)) -#else -# define __fmtattr /* */ -# define __noreturn /* */ -#endif - -extern void ni_info(const char *, ...) __fmtattr; -extern void ni_note(const char *, ...) __fmtattr; -extern void ni_warn(const char *, ...) __fmtattr; -extern void ni_error(const char *, ...) __fmtattr; -extern void ni_error_extra(const char *, ...) __fmtattr; -extern void ni_trace(const char *, ...) __fmtattr; -extern void ni_fatal(const char *, ...) __fmtattr __noreturn; + +extern void ni_info(const char *, ...) ni__printf(1, 2); +extern void ni_note(const char *, ...) ni__printf(1, 2); +extern void ni_warn(const char *, ...) ni__printf(1, 2); +extern void ni_error(const char *, ...) ni__printf(1, 2); +extern void ni_error_extra(const char *, ...) ni__printf(1, 2); +extern void ni_trace(const char *, ...) ni__printf(1, 2); +extern void ni_fatal(const char *, ...) ni__printf(1, 2) ni__noreturn; extern int ni_enable_debug(const char *); extern int ni_debug_set_default(const char *); diff --git a/src/duid.c b/src/duid.c index 188b9e2d..fcc8321c 100644 --- a/src/duid.c +++ b/src/duid.c @@ -71,11 +71,6 @@ struct ni_duid_map { struct flock flock; }; -/* - * compiler (gcc) specific ... - */ -#define NI_PACKED __attribute__((__packed__)) - /* * DUID typed packed data union */ @@ -84,9 +79,7 @@ typedef union ni_duid_data { ni_duid_llt_t llt; ni_duid_ll_t ll; ni_duid_en_t en; -} NI_PACKED ni_duid_data_t; - -#undef NI_PACKED +} ni__packed ni_duid_data_t; /* diff --git a/src/duid.h b/src/duid.h index 756d7cef..c7eec24c 100644 --- a/src/duid.h +++ b/src/duid.h @@ -27,6 +27,7 @@ #include <wicked/types.h> #include <wicked/util.h> +#include <wicked/compiler.h> /* @@ -61,11 +62,6 @@ #define NI_DUID_TYPE_LL 3 #define NI_DUID_TYPE_UUID 4 -/* - * We use gcc compiler specific attributes for - * these direct access structs to duid members. - */ -#define NI_PACKED __attribute__((__packed__)) /* * DUID type 1, Link-layer address plus time @@ -77,7 +73,7 @@ typedef struct ni_duid_llt { uint16_t hwtype; /* link layer address type */ uint32_t v6time; /* second since 2000 % 2^32 */ unsigned char hwaddr[]; /* link layer address */ -} NI_PACKED ni_duid_llt_t; +} ni__packed ni_duid_llt_t; /* * DUID type 2, Vendor-assigned unique ID based on Enterprise Number @@ -89,7 +85,7 @@ typedef struct ni_duid_en { uint16_t type; /* type 2 */ uint32_t enterprise; /* assigned enterprise-number */ unsigned char identifier[]; /* machine unique identifier */ -} NI_PACKED ni_duid_en_t; +} ni__packed ni_duid_en_t; /* * DUID type 3, Link-layer address @@ -100,7 +96,7 @@ typedef struct ni_duid_ll { uint16_t type; /* type 3 */ uint16_t hwtype; /* RFC 826 hardware type code */ unsigned char hwaddr[]; /* link layer address */ -} NI_PACKED ni_duid_ll_t; +} ni__packed ni_duid_ll_t; /* * DUID type 4, UUID-Based DHCPv6 Unique Identifier @@ -111,9 +107,8 @@ typedef struct ni_duid_ll { typedef struct ni_duid_uuid { uint16_t type; /* type 4 */ ni_uuid_t uuid; /* RFC4122 UUID as bytes */ -} NI_PACKED ni_duid_uuid_t; +} ni__packed ni_duid_uuid_t; -#undef NI_PACKED typedef struct ni_duid_map ni_duid_map_t; diff --git a/src/fsm.c b/src/fsm.c index 603e8b44..caadd9b9 100644 --- a/src/fsm.c +++ b/src/fsm.c @@ -26,6 +26,7 @@ #include <wicked/client.h> #include <wicked/bridge.h> #include <wicked/ovs.h> +#include <wicked/compiler.h> #include <xml-schema.h> #include "dbus-objects/model.h" @@ -2910,7 +2911,7 @@ ni_ifworker_type_from_object_path(const char *path, const char **suffix) unsigned int ni_fsm_get_matching_workers(ni_fsm_t *fsm, ni_ifmatcher_t *match, ni_ifworker_array_t *result) { - void (*logit)(const char *, ...) __fmtattr; + void (*logit)(const char *, ...) ni__printf(1, 2); unsigned int i; if (ni_string_eq(match->name, "all")) { diff --git a/testing/wunit.h b/testing/wunit.h index af79826f..84f14223 100644 --- a/testing/wunit.h +++ b/testing/wunit.h @@ -43,6 +43,7 @@ #include <string.h> #include <wicked/logging.h> #include <wicked/util.h> +#include <wicked/compiler.h> typedef struct wunit_s wunit_t; typedef void (*wunit_test_fn)(); @@ -60,7 +61,7 @@ struct wunit_s { *current; }; -__attribute__((unused)) static wunit_t wunit_ctx = { +ni__unused static wunit_t wunit_ctx = { .testcases_idx = 0, .fail = 0, .ok = 0, @@ -110,7 +111,7 @@ __attribute__((unused)) static wunit_t wunit_ctx = { #define TESTCASE(ts_name) \ static void testcase_##ts_name(void); \ - static void wunit_register_##ts_name(void) __attribute__((constructor)); \ + static void wunit_register_##ts_name(void) ni__constructor; \ static void wunit_register_##ts_name(void) \ { \ unsigned int i = wunit_ctx.testcases_idx; \ -- 2.35.3 >From c273e4f26650059b69c097c671b7bfb8c1018068 Mon Sep 17 00:00:00 2001 From: Clemens Famulla-Conrad <cfamullacon...@suse.de> Date: Tue, 19 Mar 2024 10:16:03 +0100 Subject: [PATCH 2/3] wunit.h: add header guard macros --- testing/wunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/testing/wunit.h b/testing/wunit.h index 84f14223..6fb31d60 100644 --- a/testing/wunit.h +++ b/testing/wunit.h @@ -38,6 +38,9 @@ * make check */ +#ifndef NI_TESTING_WUNIT_H +#define NI_TESTING_WUNIT_H + #include <stdlib.h> #include <stdio.h> #include <string.h> @@ -151,3 +154,5 @@ ni__unused static wunit_t wunit_ctx = { \ return wunit_ctx.fail > 0 ? 1 : 0; \ } + +#endif /* NI_TESTING_WUNIT_H */ -- 2.35.3 >From 4847702c1872661e80e5802cbf8405c033d310ec Mon Sep 17 00:00:00 2001 From: Clemens Famulla-Conrad <cfamullacon...@suse.de> Date: Tue, 19 Mar 2024 10:16:03 +0100 Subject: [PATCH 3/3] logging.h: align header guard macro --- include/wicked/logging.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/wicked/logging.h b/include/wicked/logging.h index db8874a5..4938450e 100644 --- a/include/wicked/logging.h +++ b/include/wicked/logging.h @@ -4,8 +4,8 @@ * Copyright (C) 2010-2012 Olaf Kirch <o...@suse.de> */ -#ifndef __WICKED_LOGGING_H__ -#define __WICKED_LOGGING_H__ +#ifndef NI_WICKED_LOGGING_H +#define NI_WICKED_LOGGING_H #include <wicked/types.h> #include <wicked/compiler.h> @@ -143,4 +143,4 @@ extern unsigned int ni_log_level; __warned = 1; \ } while (0) -#endif /* __WICKED_LOGGING_H__ */ +#endif /* NI_WICKED_LOGGING_H */ -- 2.35.3 ++++++ 0004-hide-secrets-in-debug-log-bsc-1221194.patch ++++++ >From 4e71bade4efa1eb62468a715b973d8b77daf59b1 Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski <m...@suse.com> Date: Tue, 19 Mar 2024 11:01:32 +0100 Subject: [PATCH 1/5] xml: add xml_node_hide_cdata utility function --- include/wicked/xml.h | 18 +++---- src/xml.c | 113 ++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 115 insertions(+), 16 deletions(-) diff --git a/include/wicked/xml.h b/include/wicked/xml.h index dbf3a80e..8acf24b2 100644 --- a/include/wicked/xml.h +++ b/include/wicked/xml.h @@ -3,7 +3,8 @@ * This basically parses tags, attributes and CDATA, and that's * just about it. * - * Copyright (C) 2009-2012 Olaf Kirch <o...@suse.de> + * Copyright (C) 2009-2012 Olaf Kirch <o...@suse.de> + * Copyright (C) 2009-2024 SUSE LLC * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -15,15 +16,11 @@ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * - * You should have received a copy of the GNU General Public License along - * with this program; if not, see <http://www.gnu.org/licenses/> or write - * to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, - * Boston, MA 02110-1301 USA. - * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. */ - -#ifndef __WICKED_XML_H__ -#define __WICKED_XML_H__ +#ifndef NI_WICKED_XML_H +#define NI_WICKED_XML_H #include <stdio.h> #include <wicked/util.h> @@ -109,6 +106,7 @@ extern int xml_node_uuid(const xml_node_t *, unsigned int, const ni_uuid_t *, n extern int xml_node_content_uuid(const xml_node_t *, unsigned int, const ni_uuid_t *, ni_uuid_t *); extern int xml_node_print_fn(const xml_node_t *, void (*)(const char *, void *), void *); extern int xml_node_print_debug(const xml_node_t *, unsigned int facility); +extern void xml_node_hide_cdata(xml_node_t *, const char * const [], const char *); extern xml_node_t * xml_node_scan(FILE *fp, const char *location); extern void xml_node_set_cdata(xml_node_t *, const char *); extern void xml_node_set_int(xml_node_t *, int); @@ -185,4 +183,4 @@ xml_document_is_empty(const xml_document_t *doc) return (!doc || xml_node_is_empty(doc->root)); } -#endif /* __WICKED_XML_H__ */ +#endif /* NI_WICKED_XML_H */ diff --git a/src/xml.c b/src/xml.c index 59c31924..a55af56f 100644 --- a/src/xml.c +++ b/src/xml.c @@ -1,7 +1,8 @@ /* * XML objects - document and node * - * Copyright (C) 2009-2012 Olaf Kirch <o...@suse.de> + * Copyright (C) 2009-2012 Olaf Kirch <o...@suse.de> + * Copyright (C) 2009-2024 SUSE LLC * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -13,11 +14,8 @@ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * - * You should have received a copy of the GNU General Public License along - * with this program; if not, see <http://www.gnu.org/licenses/> or write - * to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, - * Boston, MA 02110-1301 USA. - * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -26,6 +24,7 @@ #include <wicked/xml.h> #include <wicked/logging.h> #include "util_priv.h" +#include "slist_priv.h" #include <inttypes.h> #define XML_DOCUMENTARRAY_CHUNK 1 @@ -863,3 +862,105 @@ xml_node_dict_set(xml_node_t *parent, const char *name, const char *value) child = xml_node_create(parent, name); xml_node_set_cdata(child, value); } + +typedef struct xml_node_name_path xml_node_name_path_t; + +struct xml_node_name_path { + xml_node_name_path_t * next; + ni_string_array_t path; +}; + +static xml_node_name_path_t * +xml_node_name_path_new(void) +{ + return calloc(1, sizeof(xml_node_name_path_t)); +} + +static void +xml_node_name_path_free(xml_node_name_path_t *item) +{ + if (item) { + ni_string_array_destroy(&item->path); + free(item); + } +} + +static inline ni_bool_t +xml_node_name_path_match(xml_node_t *node, const ni_string_array_t *path) +{ + ni_bool_t ret = FALSE; + const char *name; + unsigned int i; + + if (!node || !path) + return FALSE; + + for (i = 0; i < path->count; ++i) { + name = path->data[i]; + + if (!node || !ni_string_eq(node->name, name)) + return FALSE; + + node = node->parent; + ret = TRUE; + } + return ret; +} + +static ni_define_slist_destroy(xml_node_name_path); +static ni_define_slist_append(xml_node_name_path); + +static ni_bool_t +xml_node_name_path_list_create(xml_node_name_path_t **list, const char * const npaths[]) +{ + xml_node_name_path_t *item; + const char * const *nptr; + + if (!list || !npaths) + return FALSE; + + for (nptr = npaths; *nptr; ++nptr) { + if (!(item = xml_node_name_path_new())) { + xml_node_name_path_list_destroy(list); + return FALSE; + } + if (!ni_string_split(&item->path, *nptr, "/", 0)) + xml_node_name_path_free(item); + else + xml_node_name_path_list_append(list, item); + } + return TRUE; +} + +static void +xml_node_name_path_list_hide_cdata(xml_node_t *node, + const xml_node_name_path_t *list, const char *hidden) +{ + const xml_node_name_path_t *item; + xml_node_t *child; + + ni_slist_foreach(list, item) { + if (!xml_node_name_path_match(node, &item->path)) + continue; + + xml_node_set_cdata(node, hidden); + } + + for (child = node->children; child; child = child->next) + xml_node_name_path_list_hide_cdata(child, list, hidden); +} + +extern void +xml_node_hide_cdata(xml_node_t *node, const char * const npaths[], const char *hidden) +{ + xml_node_name_path_t *list = NULL; + + if (!node || !npaths) + return; + + if (!xml_node_name_path_list_create(&list, npaths) || !list) + return; + + xml_node_name_path_list_hide_cdata(node, list, hidden); + xml_node_name_path_list_destroy(&list); +} -- 2.35.3 >From 6b57f56261bc576aadaaf8c898931ba0170c2171 Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski <m...@suse.com> Date: Tue, 19 Mar 2024 11:01:32 +0100 Subject: [PATCH 2/5] logging: add ni_debug_(verbose_)config_xml utility Replaces cdata in a copy of a config node and it's children that contain passwords before logging it. --- include/wicked/logging.h | 6 ++++++ src/logging.c | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) diff --git a/include/wicked/logging.h b/include/wicked/logging.h index 4938450e..a260a2c6 100644 --- a/include/wicked/logging.h +++ b/include/wicked/logging.h @@ -18,6 +18,9 @@ extern void ni_error(const char *, ...) ni__printf(1, 2); extern void ni_error_extra(const char *, ...) ni__printf(1, 2); extern void ni_trace(const char *, ...) ni__printf(1, 2); extern void ni_fatal(const char *, ...) ni__printf(1, 2) ni__noreturn; +extern void ni_debug_verbose_config_xml(const xml_node_t *, + unsigned int, unsigned int, + const char *, ...) ni__printf(4, 5); extern int ni_enable_debug(const char *); extern int ni_debug_set_default(const char *); @@ -117,6 +120,9 @@ extern unsigned int ni_log_level; } \ } while (0) +#define ni_debug_config_xml(xml_node, level, fmt, args...) \ + ni_debug_verbose_config_xml(xml_node, level, NI_TRACE_WICKED_XML, fmt, ##args) + #define ni_debug_none(fmt, args...) do { } while (0) #define ni_debug_verbose(level, facility, fmt, args...) \ diff --git a/src/logging.c b/src/logging.c index 42e9f5e5..ce3a1623 100644 --- a/src/logging.c +++ b/src/logging.c @@ -18,6 +18,7 @@ #include <wicked/logging.h> #include <wicked/util.h> +#include <wicked/xml.h> #include "util_priv.h" #define NI_LOG_PID (1 << 0) @@ -624,3 +625,39 @@ ni_fatal(const char *fmt, ...) exit(1); } +void +ni_debug_verbose_config_xml(const xml_node_t *node, + unsigned int level, unsigned int facility, + const char *fmt, ...) +{ + static const char *hidden = "***"; + static const char * const npaths[] = { + "client-key-passwd", + "passphrase", + "password", + "modem-pin", + "wep/key", + NULL + }; + xml_node_t *clone; + va_list ap; + + if (!node || !ni_debug_guard(level, facility)) + return; + + if (!(clone = xml_node_clone(node, NULL))) + return; + + xml_node_hide_cdata(clone, npaths, hidden); + + va_start(ap, fmt); + if (!ni_log_syslog) + __ni_log_stderr("::: ", fmt, ap, ""); + else + vsyslog(level, fmt, ap); + + va_end(ap); + + xml_node_print_debug(clone, facility); + xml_node_free(clone); +} -- 2.35.3 >From fb46cbdb2a200515bdc839dfaeaaf0ec9d0ee78c Mon Sep 17 00:00:00 2001 From: Clemens Famulla-Conrad <cfamullacon...@suse.de> Date: Tue, 19 Mar 2024 11:01:32 +0100 Subject: [PATCH 3/5] wpa-supplicant: hide private_key_passwd from log --- src/wpa-supplicant.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/wpa-supplicant.c b/src/wpa-supplicant.c index 15a62b33..097f3036 100644 --- a/src/wpa-supplicant.c +++ b/src/wpa-supplicant.c @@ -1224,7 +1224,9 @@ ni_debug_escape_net_property(const char *prop_name) NI_WPA_NET_PROPERTY_WEP_KEY1, NI_WPA_NET_PROPERTY_WEP_KEY2, NI_WPA_NET_PROPERTY_WEP_KEY3, - NI_WPA_NET_PROPERTY_PASSWORD + NI_WPA_NET_PROPERTY_PASSWORD, + NI_WPA_NET_PROPERTY_PRIVATE_KEY, + NI_WPA_NET_PROPERTY_PRIVATE_KEY_PASSWD }; if (!ni_wpa_net_property_type(prop_name, &type)) -- 2.35.3 >From 8b1e2826556a4c58a3c63bf41d1a7c2352ac44af Mon Sep 17 00:00:00 2001 From: Clemens Famulla-Conrad <cfamullacon...@suse.de> Date: Tue, 19 Mar 2024 11:01:32 +0100 Subject: [PATCH 4/5] nanny: use ni_debug_config_xml for config dump --- nanny/device.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/nanny/device.c b/nanny/device.c index d769cf24..890f479d 100644 --- a/nanny/device.c +++ b/nanny/device.c @@ -205,8 +205,8 @@ ni_factory_device_apply_policy(ni_fsm_t *fsm, ni_ifworker_t *w, ni_managed_polic w->name, type_name); return -1; } - ni_debug_nanny("%s: using device config", w->name); - xml_node_print_debug(config, 0); + + ni_debug_config_xml(config, NI_LOG_DEBUG, "%s: using device config", w->name); ni_ifworker_set_config(w, config, ni_fsm_policy_origin(policy)); xml_node_free(config); @@ -269,8 +269,7 @@ ni_managed_device_apply_policy(ni_managed_device_t *mdev, ni_managed_policy_t *m ni_error("%s: error when applying policy to %s document", w->name, type_name); return -1; } - ni_debug_nanny("%s: using device config", w->name); - xml_node_print_debug(config, 0); + ni_debug_config_xml(config, NI_LOG_DEBUG, "%s: using device config", w->name); ni_managed_device_set_policy(mdev, mpolicy, config); xml_node_free(config); -- 2.35.3 >From 909ee2f91299c8660c675df1170a100c5eb00a89 Mon Sep 17 00:00:00 2001 From: Clemens Famulla-Conrad <cfamullacon...@suse.de> Date: Tue, 19 Mar 2024 11:01:32 +0100 Subject: [PATCH 5/5] firmware: use ni_debug_config_xml for config dump --- src/firmware.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/firmware.c b/src/firmware.c index 2842664b..517bc266 100644 --- a/src/firmware.c +++ b/src/firmware.c @@ -158,8 +158,8 @@ ni_netif_firmware_discovery_script_ifconfig(xml_document_t **doc, xml_document_free(*doc); *doc = NULL; } else if (ni_log_level_at(NI_LOG_DEBUG2)) { - ni_debug_ifconfig("%s discovery script xml output:", type); - xml_node_print_debug(xml_document_root(*doc), NI_TRACE_IFCONFIG); + ni_debug_verbose_config_xml(xml_document_root(*doc), NI_LOG_DEBUG2, + NI_TRACE_IFCONFIG, "%s discovery script xml output:", type); } } ni_buffer_destroy(&buf); -- 2.35.3