[Tarantool-patches] [PATCH] box: replication shouldn't leak user password

[Tarantool-patches] [PATCH] box: replication shouldn't leak user password

[Maria]

It was possible to leak user password through setting 'replication'
configuration option in first box.cfg invocation. This happened due
to unconditional logging in load_cfg function. The patch introduces
conditional logging.

Closes #4493
---
Issue:
https://github.com/tarantool/tarantool/issues/4493
Branch:
https://github.com/tarantool/tarantool/tree/eljashm/gh-4493-box.cfg-log-may-leak-passwords

 src/box/lua/load_cfg.lua   |  3 +++
 test/box/load_cfg.result   | 37 +++++++++++++++++++++++++++++++++++++
 test/box/load_cfg.test.lua | 14 ++++++++++++++
 test/box/lua/cfg_test6.lua | 10 ++++++++++
 4 files changed, 64 insertions(+)
 create mode 100644 test/box/load_cfg.result
 create mode 100644 test/box/load_cfg.test.lua
 create mode 100644 test/box/lua/cfg_test6.lua

diff --git a/src/box/lua/load_cfg.lua b/src/box/lua/load_cfg.lua
index 85617c8f0..5aa6ce703 100644
--- a/src/box/lua/load_cfg.lua
+++ b/src/box/lua/load_cfg.lua
@@ -548,6 +548,9 @@ local function load_cfg(cfg)
                 fun()
             end
             if not compare_cfg(val, default_cfg[key]) then
+                if log_cfg_option[key] ~= nil then
+                    val = log_cfg_option[key](val)
+                end
                 log.info("set '%s' configuration option to %s", key, json.encode(val))
             end
         end
diff --git a/test/box/load_cfg.result b/test/box/load_cfg.result
new file mode 100644
index 000000000..0abffd409
--- /dev/null
+++ b/test/box/load_cfg.result
@@ -0,0 +1,37 @@
+-- test-run result file version 2
+env = require('test_run')
+ | ---
+ | ...
+test_run = env.new()
+ | ---
+ | ...
+
+--
+-- gh-4493: Replication user password may leak to logs
+--
+test_run:cmd('create server cfg_tester7 with script = "box/lua/cfg_test6.lua"')
+ | ---
+ | - true
+ | ...
+test_run:cmd("start server cfg_tester7")
+ | ---
+ | - true
+ | ...
+-- test there is replication log in log
+test_run:grep_log('cfg_tester7', 'set \'replication\' configuration option to', 1000)
+ | ---
+ | - set 'replication' configuration option to
+ | ...
+-- test there is no password in log
+test_run:grep_log('cfg_tester7', 'test-cluster-cookie', 1000)
+ | ---
+ | - null
+ | ...
+test_run:cmd("stop server cfg_tester7")
+ | ---
+ | - true
+ | ...
+test_run:cmd("cleanup server cfg_tester7")
+ | ---
+ | - true
+ | ...
diff --git a/test/box/load_cfg.test.lua b/test/box/load_cfg.test.lua
new file mode 100644
index 000000000..e0c3b361b
--- /dev/null
+++ b/test/box/load_cfg.test.lua
@@ -0,0 +1,14 @@
+env = require('test_run')
+test_run = env.new()
+
+--
+-- gh-4493: Replication user password may leak to logs
+--
+test_run:cmd('create server cfg_tester7 with script = "box/lua/cfg_test6.lua"')
+test_run:cmd("start server cfg_tester7")
+-- test there is replication log in log
+test_run:grep_log('cfg_tester7', 'set \'replication\' configuration option to', 1000)
+-- test there is no password in log
+test_run:grep_log('cfg_tester7', 'test-cluster-cookie', 1000)
+test_run:cmd("stop server cfg_tester7")
+test_run:cmd("cleanup server cfg_tester7")
diff --git a/test/box/lua/cfg_test6.lua b/test/box/lua/cfg_test6.lua
new file mode 100644
index 000000000..efcfc6f3e
--- /dev/null
+++ b/test/box/lua/cfg_test6.lua
@@ -0,0 +1,10 @@
+#!/usr/bin/env tarantool
+os = require('os')
+
+box.cfg{
+    listen = os.getenv("LISTEN"),
+    replication         = "admin:test-cluster-cookie@" .. os.getenv("LISTEN"),
+    replication_connect_timeout = 0.1,
+}
+
+require('console').listen(os.getenv('ADMIN'))
-- 
2.20.1 (Apple Git-117)

Re: [Tarantool-patches] [PATCH] box: replication shouldn't leak user password

[Vladislav Shpilevoy]

Hi! Thanks for the patch!

> diff --git a/test/box/load_cfg.test.lua b/test/box/load_cfg.test.lua
> new file mode 100644
> index 000000000..e0c3b361b
> --- /dev/null
> +++ b/test/box/load_cfg.test.lua

Please, move the test to box/cfg.test.lua.

Re: [Tarantool-patches] [PATCH] box: replication shouldn't leak user password

[Maria Khaydich]

[-- Attachment #1: Type: text/plain, Size: 455 bytes --]


Thank you for the review.
Test was moved to existing file. 
  
>Среда, 18 декабря 2019, 0:56 +03:00 от Vladislav Shpilevoy <v.shpilevoy@tarantool.org>:
> 
>Hi! Thanks for the patch!
> 
>> diff --git a/test/box/load_cfg.test.lua b/test/box/load_cfg.test.lua
>> new file mode 100644
>> index 000000000..e0c3b361b
>> --- /dev/null
>> +++ b/test/box/load_cfg.test.lua
>Please, move the test to box/cfg.test.lua. 
 
 
--
Maria Khaydich
 

[-- Attachment #2: Type: text/html, Size: 1022 bytes --]

Re: [Tarantool-patches] [PATCH] box: replication shouldn't leak user password

[Vladislav Shpilevoy]

Thanks for the fixes!

Now I noticed, that the new test passes even without the fix.
This is because symbol '-' in test_run:grep_log() is considered
a special symbol of regular expr. It needs to be escaped. Escape
in Lua regexp is done by %.

I've pushed my review fix on top of this commit. See it below
and on the branch.

================================================================================

diff --git a/test/box/cfg.result b/test/box/cfg.result
index d75148adf..fe20eea01 100644
--- a/test/box/cfg.result
+++ b/test/box/cfg.result
@@ -598,7 +598,7 @@ test_run:grep_log('cfg_tester7', 'set \'replication\' configuration option to',
  | - set 'replication' configuration option to
  | ...
 -- test there is no password in log
-test_run:grep_log('cfg_tester7', 'test-cluster-cookie', 1000)
+test_run:grep_log('cfg_tester7', 'test%-cluster%-cookie', 1000)
  | ---
  | - null
  | ...
diff --git a/test/box/cfg.test.lua b/test/box/cfg.test.lua
index a80844c0e..ba273bb73 100644
--- a/test/box/cfg.test.lua
+++ b/test/box/cfg.test.lua
@@ -150,6 +150,6 @@ test_run:cmd("start server cfg_tester7")
 -- test there is replication log in log
 test_run:grep_log('cfg_tester7', 'set \'replication\' configuration option to', 1000)
 -- test there is no password in log
-test_run:grep_log('cfg_tester7', 'test-cluster-cookie', 1000)
+test_run:grep_log('cfg_tester7', 'test%-cluster%-cookie', 1000)
 test_run:cmd("stop server cfg_tester7")
 test_run:cmd("cleanup server cfg_tester7")

Re: [Tarantool-patches] [PATCH] box: replication shouldn't leak user password

[Igor Munkin]

Masha,

Thanks, the patch LGTM considering Vlad's remarks and review fix on top.
Please don't forget to squash it with the original patch.

On 13.12.19, Maria wrote:
> It was possible to leak user password through setting 'replication'
> configuration option in first box.cfg invocation. This happened due
> to unconditional logging in load_cfg function. The patch introduces
> conditional logging.
> 
> Closes #4493
> ---
> Issue:
> https://github.com/tarantool/tarantool/issues/4493
> Branch:
> https://github.com/tarantool/tarantool/tree/eljashm/gh-4493-box.cfg-log-may-leak-passwords
> 
>  src/box/lua/load_cfg.lua   |  3 +++
>  test/box/load_cfg.result   | 37 +++++++++++++++++++++++++++++++++++++
>  test/box/load_cfg.test.lua | 14 ++++++++++++++
>  test/box/lua/cfg_test6.lua | 10 ++++++++++
>  4 files changed, 64 insertions(+)
>  create mode 100644 test/box/load_cfg.result
>  create mode 100644 test/box/load_cfg.test.lua
>  create mode 100644 test/box/lua/cfg_test6.lua
> 

<snipped>

> -- 
> 2.20.1 (Apple Git-117)
> 

-- 
Best regards,
IM

Re: [Tarantool-patches] [PATCH] box: replication shouldn't leak user password

[Maria Khaydich]

[-- Attachment #1: Type: text/plain, Size: 1251 bytes --]


Squashed them. Looks like we’ve got to LGTMs here.

  
>Среда, 26 февраля 2020, 19:19 +03:00 от Igor Munkin <imun@tarantool.org>:
> 
>Masha,
>
>Thanks, the patch LGTM considering Vlad's remarks and review fix on top.
>Please don't forget to squash it with the original patch.
>
>On 13.12.19, Maria wrote:
>> It was possible to leak user password through setting 'replication'
>> configuration option in first box.cfg invocation. This happened due
>> to unconditional logging in load_cfg function. The patch introduces
>> conditional logging.
>>
>> Closes #4493
>> ---
>> Issue:
>>  https://github.com/tarantool/tarantool/issues/4493
>> Branch:
>>  https://github.com/tarantool/tarantool/tree/eljashm/gh-4493-box.cfg-log-may-leak-passwords
>>
>> src/box/lua/load_cfg.lua | 3 +++
>> test/box/load_cfg.result | 37 +++++++++++++++++++++++++++++++++++++
>> test/box/load_cfg.test.lua | 14 ++++++++++++++
>> test/box/lua/cfg_test6.lua | 10 ++++++++++
>> 4 files changed, 64 insertions(+)
>> create mode 100644 test/box/load_cfg.result
>> create mode 100644 test/box/load_cfg.test.lua
>> create mode 100644 test/box/lua/cfg_test6.lua
>>
>
><snipped>
>
>> --
>> 2.20.1 (Apple Git-117)
>>
>
>--
>Best regards,
>IM 
 
 
--
Maria Khaydich
 

[-- Attachment #2: Type: text/html, Size: 2035 bytes --]

Re: [Tarantool-patches] [PATCH] box: replication shouldn't leak user password

[Kirill Yukhin]

Hello,

On 13 дек 00:25, Maria wrote:
> It was possible to leak user password through setting 'replication'
> configuration option in first box.cfg invocation. This happened due
> to unconditional logging in load_cfg function. The patch introduces
> conditional logging.
> 
> Closes #4493
> ---
> Issue:
> https://github.com/tarantool/tarantool/issues/4493
> Branch:
> https://github.com/tarantool/tarantool/tree/eljashm/gh-4493-box.cfg-log-may-leak-passwords

I've checked your patch into 1.10, 2.2, 2.3 and master.

--
Regards, Kirill Yukhin