| Server IP : 49.231.201.246 / Your IP : 216.73.216.149 Web Server : Apache/2.4.18 (Ubuntu) System : Linux 246 4.4.0-210-generic #242-Ubuntu SMP Fri Apr 16 09:57:56 UTC 2021 x86_64 User : root ( 0) PHP Version : 7.0.33-0ubuntu0.16.04.16 Disable Function : exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/share/sosreport/sos/plugins/ |
Upload File : |
# Copyright (C) 2007 Sadique Puthen <sputhenp@redhat.com>
# Copyright (C) 2019 Red Hat Inc., Stepan Broz <sbroz@redhat.com>
# This file is part of the sos project: https://github.com/sosreport/sos
#
# This copyrighted material is made available to anyone wishing to use,
# modify, copy, or redistribute it subject to the terms and conditions of
# version 2 of the GNU General Public License.
#
# See the LICENSE file in the source distribution for further information.
from sos.plugins import Plugin, RedHatPlugin, DebianPlugin, UbuntuPlugin
class Libreswan(Plugin, RedHatPlugin, DebianPlugin, UbuntuPlugin):
"""Libreswan IPsec
"""
plugin_name = 'libreswan'
profiles = ('network', 'security', 'openshift')
option_list = [
("ipsec-barf", "collect the output of the ipsec barf command",
"slow", False)
]
files = ('/etc/ipsec.conf',)
packages = ('libreswan', 'openswan')
def setup(self):
self.add_copy_spec([
"/etc/ipsec.conf",
"/etc/ipsec.d",
"/proc/net/xfrm_stat"
])
# although this is 'verification' it's normally a very quick
# operation so is not conditional on --verify
self.add_cmd_output([
'ipsec verify',
'ipsec whack --status',
'ipsec whack --listall',
'certutil -L -d sql:/etc/ipsec.d',
'ip xfrm policy',
'ip xfrm state'
])
if self.get_option("ipsec-barf"):
self.add_cmd_output("ipsec barf")
self.add_forbidden_path([
'/etc/ipsec.secrets',
'/etc/ipsec.secrets.d',
'/etc/ipsec.d/*.db',
'/etc/ipsec.d/*.secrets'
])
def postproc(self):
# Remove any sensitive data.
# "ip xfrm state" output contains encryption or authentication private
# keys:
xfrm_state_regexp = r'(aead|auth|auth-trunc|enc)' \
r'(\s.*\s)(0x[0-9a-f]+)'
self.do_cmd_output_sub("state", xfrm_state_regexp,
r"\1\2********")
if self.get_option("ipsec-barf"):
self.do_cmd_output_sub("barf", xfrm_state_regexp,
r"\1\2********")
# vim: set et ts=4 sw=4 :