From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Daniel P. Berrange" Subject: Re: [PATCH] Scrub VNC passwords from XenD log files Date: Wed, 6 Dec 2006 19:43:09 +0000 Message-ID: <20061206194309.GE13126@redhat.com> References: <20061205193125.GF21067@redhat.com> <20061206122520.GE17323@leeni.uk.xensource.com> <20061206171603.GA13126@redhat.com> <20061206172435.GA30076@leeni.uk.xensource.com> Reply-To: "Daniel P. Berrange" Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="UugvWAfsgieZRqgk" Return-path: Content-Disposition: inline In-Reply-To: <20061206172435.GA30076@leeni.uk.xensource.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Ewan Mellor Cc: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org --UugvWAfsgieZRqgk Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Dec 06, 2006 at 05:24:36PM +0000, Ewan Mellor wrote: > On Wed, Dec 06, 2006 at 05:16:03PM +0000, Daniel P. Berrange wrote: > > > I didn't add the signed-off-by because the patch isn't finished - I really > > just wanted to see if people were amenable to this kind of approach before > > doing more work on it. Since you like it, I'll finish it off shortly - there > > just a couple more test cases I need to go through - suspend/restore & inactive > > domains - to verify passwords are always scrubbed correctly. I'll post a final > > version of the patch by the end of today if all goes to plan. > > Great, thanks. I think you're right that this is the best of all the > available options, fiddly though it is. Perhaps we could write a final check > at the end of xm-test, to make sure that "vncpasswd" doesn't appear in the > logs anywhere -- that would make sure that this never regresses. Attached is a final version of the patch to scrub passwords. I have tested it with HVM guests, and parvirt guests, using 'start', 'new', 'create', 'suspend', 'resume' commands to XM. In all cases, no password was present to the XenD log files created. Signed-off-by: Daniel P. Berrange Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=| --UugvWAfsgieZRqgk Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="xen-3.0.4-scrub-passwords-2.patch" diff -ruN xen-unstable.hg-12722/tools/python/xen/xend/XendConfig.py xen-unstable.hg-12722.new/tools/python/xen/xend/XendConfig.py --- xen-unstable.hg-12722/tools/python/xen/xend/XendConfig.py 2006-12-04 14:43:22.000000000 -0500 +++ xen-unstable.hg-12722.new/tools/python/xen/xend/XendConfig.py 2006-12-06 12:49:16.000000000 -0500 @@ -42,6 +42,39 @@ def bool0(v): return v != '0' and bool(v) +# Recursively copy a data struct, scrubbing out VNC passwords. +# Will scrub any dict entry with a key of 'vncpasswd' or any +# 2-element list whose first member is 'vncpasswd'. It will +# also scrub a string matching '(vncpasswd XYZ)'. Everything +# else is no-op passthrough +def scrub_password(data): + if type(data) == dict or type(data) == XendConfig: + scrubbed = {} + for key in data.keys(): + if key == "vncpasswd": + scrubbed[key] = "XXXXXXXX" + else: + scrubbed[key] = scrub_password(data[key]) + return scrubbed + elif type(data) == list: + if len(data) == 2 and type(data[0]) == str and data[0] == 'vncpasswd': + return ['vncpasswd', 'XXXXXXXX'] + else: + scrubbed = [] + for entry in data: + scrubbed.append(scrub_password(entry)) + return scrubbed + elif type(data) == tuple: + scrubbed = [] + for entry in data: + scrubbed.append(scrub_password(entry)) + return tuple(scrubbed) + elif type(data) == str: + return re.sub(r'\(vncpasswd\s+[^\)]+\)','(vncpasswd XXXXXX)', data) + else: + return data + + # Mapping from XendConfig configuration keys to the old # legacy configuration keys that map directly. @@ -269,7 +302,7 @@ # output from xc.domain_getinfo self._dominfo_to_xapi(dominfo) - log.debug('XendConfig.init: %s' % self) + log.debug('XendConfig.init: %s' % scrub_password(self)) # validators go here self.validate() @@ -473,7 +506,7 @@ else: for opt, val in config[1:]: dev_info[opt] = val - log.debug("XendConfig: reading device: %s" % dev_info) + log.debug("XendConfig: reading device: %s" % scrub_password(dev_info)) # create uuid if it doesn't dev_uuid = dev_info.get('uuid', uuid.createString()) dev_info['uuid'] = dev_uuid diff -ruN xen-unstable.hg-12722/tools/python/xen/xend/XendDomainInfo.py xen-unstable.hg-12722.new/tools/python/xen/xend/XendDomainInfo.py --- xen-unstable.hg-12722/tools/python/xen/xend/XendDomainInfo.py 2006-12-04 14:43:22.000000000 -0500 +++ xen-unstable.hg-12722.new/tools/python/xen/xend/XendDomainInfo.py 2006-12-06 12:49:41.000000000 -0500 @@ -40,6 +40,7 @@ from xen.xend import balloon, sxp, uuid, image, arch from xen.xend import XendRoot, XendNode, XendConfig +from xen.xend.XendConfig import scrub_password from xen.xend.XendBootloader import bootloader from xen.xend.XendError import XendError, VmError from xen.xend.XendDevices import XendDevices @@ -148,7 +149,7 @@ @raise VmError: Invalid configuration or failure to start. """ - log.debug("XendDomainInfo.create(%s)", config) + log.debug("XendDomainInfo.create(%s)", scrub_password(config)) vm = XendDomainInfo(XendConfig.XendConfig(sxp_obj = config)) try: vm.start() @@ -175,7 +176,7 @@ @raise XendError: Errors with configuration. """ - log.debug("XendDomainInfo.recreate(%s)", info) + log.debug("XendDomainInfo.recreate(%s)", scrub_password(info)) assert not info['dying'] @@ -257,7 +258,7 @@ @raise XendError: Errors with configuration. """ - log.debug("XendDomainInfo.restore(%s)", config) + log.debug("XendDomainInfo.restore(%s)", scrub_password(config)) vm = XendDomainInfo(XendConfig.XendConfig(sxp_obj = config), resume = True) try: @@ -280,7 +281,7 @@ @raise XendError: Errors with configuration. """ - log.debug("XendDomainInfo.createDormant(%s)", domconfig) + log.debug("XendDomainInfo.createDormant(%s)", scrub_password(domconfig)) # domid does not make sense for non-running domains. domconfig.pop('domid', None) @@ -520,11 +521,11 @@ @param dev_config: device configuration @type dev_config: SXP object (parsed config) """ - log.debug("XendDomainInfo.device_create: %s" % dev_config) + log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config)) dev_type = sxp.name(dev_config) dev_uuid = self.info.device_add(dev_type, cfg_sxp = dev_config) dev_config_dict = self.info['devices'][dev_uuid][1] - log.debug("XendDomainInfo.device_create: %s" % dev_config_dict) + log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config_dict)) devid = self._createDevice(dev_type, dev_config_dict) self._waitForDevice(dev_type, devid) return self.getDeviceController(dev_type).sxpr(devid) @@ -746,7 +747,7 @@ to_store.update(self._vcpuDomDetails()) - log.debug("Storing domain details: %s", to_store) + log.debug("Storing domain details: %s", scrub_password(to_store)) self._writeDom(to_store) @@ -1188,7 +1189,7 @@ """ for (devclass, config) in self.info.get('devices', {}).values(): if devclass in XendDevices.valid_devices(): - log.info("createDevice: %s : %s" % (devclass, config)) + log.info("createDevice: %s : %s" % (devclass, scrub_password(config))) self._createDevice(devclass, config) if self.image: @@ -1661,7 +1662,7 @@ if not self._readVm('xend/restart_count'): to_store['xend/restart_count'] = str(0) - log.debug("Storing VM details: %s", to_store) + log.debug("Storing VM details: %s", scrub_password(to_store)) self._writeVm(to_store) self._setVmPermissions() --UugvWAfsgieZRqgk Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel --UugvWAfsgieZRqgk--