Bug 1399249 - [RFE] sos obfuscates full database connection url for openstack components
Summary: [RFE] sos obfuscates full database connection url for openstack components
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sos
Version: 7.3
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: 7.4
Assignee: Pavel Moravec
QA Contact: BaseOS QE - Apps
URL:
Whiteboard:
Depends On:
Blocks: 1473612
TreeView+ depends on / blocked
 
Reported: 2016-11-28 16:13 UTC by Vagner Farias
Modified: 2018-11-06 08:00 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-11-06 08:00:16 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github sosreport sos pull 1246 0 None None None 2018-03-08 20:47:31 UTC

Description Vagner Farias 2016-11-28 16:13:02 UTC
Description of problem:
sos reports don't include database connection url for openstack components because this information is obfuscated. Probably this was a side effect of obfuscating the password, which is part of the url.

$ grep '^connection\s*=' etc/{nova,glance,cinder,neutron}/*.conf
etc/nova/nova.conf:connection = *********
etc/glance/glance-api.conf:connection = *********
etc/glance/glance-registry.conf:connection = *********
etc/cinder/cinder.conf:connection = *********
etc/neutron/neutron.conf:connection = *********


Version-Release number of selected component (if applicable):
sos-3.2-36.el7ost.2.noarch

How reproducible:
Always.

Steps to Reproduce:
1. Run sosreport on an openstack controller node
2. Open the tarfile and cd into the directory
2. grep '^connection\s*=' etc/{nova,glance,cinder,neutron}/*.conf

Actual results:
$ grep '^connection\s*=' etc/{nova,glance,cinder,neutron}/*.conf
etc/nova/nova.conf:connection = *********
etc/glance/glance-api.conf:connection = *********
etc/glance/glance-registry.conf:connection = *********
etc/cinder/cinder.conf:connection = *********
etc/neutron/neutron.conf:connection = *********

Expected results:
Database server login, address and database should be shown, like in the example below. 

$ grep '^connection\s*=' etc/{nova,glance,cinder,neutron}/*.conf
etc/nova/nova.conf:connection = mysql://nova:********@mariadb-server/nova
etc/glance/glance-api.conf:connection = mysql://glance:********@mariadb-server/glance
etc/glance/glance-registry.conf:connection = mysql://glance:********@mariadb-server/glance
etc/cinder/cinder.conf:connection = mysql://cinder:********@mariadb-server/cinder
etc/neutron/neutron.conf:connection = mysql://neutron:********@mariadb-server/neutron

Comment 4 Pavel Moravec 2018-03-03 17:02:18 UTC
Lee or Vagner,
could you please provide valid examples of the URL with passwords syntax (that is obfuscated now), such that we can come up with better regexp?

Comment 5 Vagner Farias 2018-03-06 20:59:20 UTC
The following is from OSP 11.

[root@controller ~]# grep '^connection\s*=' /etc/{nova,glance,cinder,neutron}/*.conf
/etc/nova/nova.conf:connection=mysql+pymysql://nova_api:tYscXjtg6FC4u8rDxDPnXAkkp.0.21/nova_api?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo
/etc/nova/nova.conf:connection=mysql+pymysql://nova:tYscXjtg6FC4u8rDxDPnXAkkp.0.21/nova?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo
/etc/nova/nova.conf:connection=mysql+pymysql://nova_placement:tYscXjtg6FC4u8rDxDPnXAkkp.0.21/nova_placement?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo
/etc/glance/glance-api.conf:connection = mysql+pymysql://glance:BpjdGYndqYFEXcAfzaqTFEUC6.0.21/glance?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo
/etc/cinder/cinder.conf:connection = mysql+pymysql://cinder:hMeRV32kUMCuHPQzHEg3dD9Vt.0.21/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo
/etc/neutron/neutron.conf:connection=mysql+pymysql://neutron:tY9hAuBeEGH7k7A2KkzKWhnhx.0.21/ovs_neutron?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo

I'm sure that earlier versions had a slightly different syntax, as you may see in comment #0 (expected results).

Some differences I can see:

connection=mysql  x   connection=mysql+pymsql

The end of the line also changed. Now it has a "?" and some additional information.

I'm not a regexp expert, but I think the standard is more or less:

connection=[protocol]://[login_name]:[password]@[hostname_or_IP]/[service_name]

I can't tell if passwords may have ":" or "@" characters.

Comment 6 Pavel Moravec 2018-03-08 20:47:31 UTC
Thanks. I created PR 

https://github.com/sosreport/sos/pull/1246

that would be great to test (for potential copy&paste or forgotten-character errors).

Comment 7 Vagner Farias 2018-03-09 14:46:46 UTC
I may test, at least in OSP 11, when a RPM package is made available.

Comment 13 Pavel Moravec 2018-04-11 06:53:23 UTC
devel_ack+ for 7.6

Comment 15 Pavel Moravec 2018-11-06 08:00:16 UTC
This should have been fixed in RHEL7.6 due to previous updates done in sos 3.6 we rebased to in 7.6. Hence closing the BZ as fixed in current release:

package: sos-3.6-11

7.6.0 errata: https://access.redhat.com/errata/RHEA-2018:3144
7.6.0-day errata: https://access.redhat.com/errata/RHBA-2018:3338

(either one contains the fix)


Note You need to log in before you can comment on or make changes to this bug.