libvirt driver's to_xml method logs iscsi auth_password if debug

[Matt Riedemann]

If you have debug logging enabled the libvirt driver's to_xml method logs the iscsi auth_password in plain text.

[Matt Riedemann (mriedem)]

It's the block_device_info object that has the password getting logged.

[Matt Riedemann (mriedem)]

Patch is up: https://review.openstack.org/#/c/93787/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/93787
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=5dda3a6ab2becb5dd0b58c088f6daad807e12276
Submitter: Jenkins
Branch: master

commit 5dda3a6ab2becb5dd0b58c088f6daad807e12276
Author: Matt Riedemann <email address hidden>
Date: Thu May 15 12:22:19 2014 -0700

    Mask block_device_info auth_password in virt driver debug logs

    The block_device_info object can have an auth_password key which is
    getting logged at debug level in several virt drivers so we need to
    sanitize the message getting logged.

    Adds tests to ensure the logged messages are properly sanitized.

    Note that bug 1321785 was opened to track the long-term design issues
    with storing the password in the block_device_info dict since this can
    crop up elsewhere if it's logged. The immediate fix here is to mask
    what's already exposed.

    Closes-Bug: #1319943

    Change-Id: I0eae07ce3f0f39861eb97ec3dec44895386c7d04

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/99536

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/99536
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=14080812961e5a2f6a7054a45d2afa013e4f3899
Submitter: Jenkins
Branch: stable/icehouse

commit 14080812961e5a2f6a7054a45d2afa013e4f3899
Author: Matt Riedemann <email address hidden>
Date: Thu May 15 12:22:19 2014 -0700

    Mask block_device_info auth_password in virt driver debug logs

    The block_device_info object can have an auth_password key which is
    getting logged at debug level in several virt drivers so we need to
    sanitize the message getting logged.

    Adds tests to ensure the logged messages are properly sanitized.

    Note that bug 1321785 was opened to track the long-term design issues
    with storing the password in the block_device_info dict since this can
    crop up elsewhere if it's logged. The immediate fix here is to mask
    what's already exposed.

    Closes-Bug: #1319943

    (cherry picked from commit 5dda3a6ab2becb5dd0b58c088f6daad807e12276)

    Conflicts:
     nova/tests/virt/libvirt/test_libvirt.py
     nova/tests/virt/vmwareapi/test_vmops.py

    Change-Id: I0eae07ce3f0f39861eb97ec3dec44895386c7d04