From 4c924aea98d77e0b0a7b95bc1a4040b95df2663d Mon Sep 17 00:00:00 2001 From: Kordian Pawelec Date: Thu, 2 Jul 2026 15:13:45 +0100 Subject: [PATCH 1/4] adding the parser to the .lex and .y files --- cfg.lex | 6 ++++++ cfg.y | 22 +++++++++++++++++++++- redact_pii.c | 26 ++++++++++++++++++++++++-- redact_pii.h | 11 +++++++++++ 4 files changed, 62 insertions(+), 3 deletions(-) diff --git a/cfg.lex b/cfg.lex index f305ea2b896..d0b5e8d2075 100644 --- a/cfg.lex +++ b/cfg.lex @@ -280,6 +280,8 @@ MCAST_TTL "mcast_ttl" TOS "tos" DISABLE_DNS_FAILOVER "disable_dns_failover" REDACT_PII_ "redact_pii_" +REDACT_TEMPLATE "redact_template" +REDACT_MODE "redact_mode" DISABLE_DNS_BLACKLIST "disable_dns_blacklist" DST_BLACKLIST "dst_blacklist" MAX_WHILE_LOOPS "max_while_loops" @@ -527,6 +529,10 @@ SPACE [ ] return DISABLE_DNS_FAILOVER; } {REDACT_PII_} { count(); yylval.strval=yytext; return REDACT_PII_;} +{REDACT_TEMPLATE} { count(); yylval.strval=yytext; + return REDACT_TEMPLATE;} +{REDACT_MODE} { count(); yylval.strval=yytext; + return REDACT_MODE;} {DISABLE_DNS_BLACKLIST} { count(); yylval.strval=yytext; return DISABLE_DNS_BLACKLIST; } {DST_BLACKLIST} { count(); yylval.strval=yytext; diff --git a/cfg.y b/cfg.y index e4097cd6997..818bb222a18 100644 --- a/cfg.y +++ b/cfg.y @@ -111,6 +111,7 @@ #include "config.h" #include "mem/rpm_mem.h" #include "poll_types.h" +#include "redact_pii.h" #ifdef SHM_EXTRA_STATS #include "mem/module_info.h" @@ -394,6 +395,8 @@ extern int cfg_parse_only_routes; %token TOS %token DISABLE_DNS_FAILOVER %token REDACT_PII_ +%token REDACT_TEMPLATE +%token REDACT_MODE %token DISABLE_DNS_BLACKLIST %token DST_BLACKLIST %token DISABLE_STATELESS_FWD @@ -1592,7 +1595,24 @@ assign_stm: LOGLEVEL EQUAL snumber { IFOR(); | REDACT_PII_ EQUAL NUMBER { IFOR(); redact_pii_=$3; } - | REDACT_PII_ error { yyerror("boolean value expected"); } + | REDACT_PII_ error { yyerror("boolean value expected"); } + | REDACT_TEMPLATE EQUAL STRING { IFOR(); + redact_template=$3; + } + | REDACT_TEMPLATE error { yyerror("string value expected"); } + | REDACT_MODE EQUAL STRING { IFOR(); + if (strcasecmp($3, "replace")==0) + redact_mode=REDACT_REPLACE; + else if (strcasecmp($3, "append")==0) + redact_mode=REDACT_APPEND; + else if (strcasecmp($3, "prepend")==0) + redact_mode=REDACT_PREPEND; + else if (strcasecmp($3, "format")==0) + redact_mode=REDACT_FORMAT; + else + yyerror("redact_mode must be: replace|append|prepend|format"); + } + | REDACT_MODE error { yyerror("string value expected (replace|append|prepend|format)"); } | DISABLE_DNS_BLACKLIST EQUAL NUMBER { IFOR(); disable_dns_blacklist=$3; } diff --git a/redact_pii.c b/redact_pii.c index 1ad0a85b6c1..a5e66eea0f8 100644 --- a/redact_pii.c +++ b/redact_pii.c @@ -1,9 +1,31 @@ #include +#include #include "ut.h" #include "redact_pii.h" int redact_pii_ = 0; +char *redact_template = "****"; +int redact_mode = REDACT_REPLACE; -inline const char* redact_pii(const char* input) { - return redact_pii_ ? "****" : ZSW(input); +inline const char* redact_pii(const char* input) { + static char buf[512]; + const char *safe = ZSW(input); + + if (!redact_pii_) + return safe; + + switch (redact_mode) { + case REDACT_APPEND: + snprintf(buf, sizeof(buf), "%s%s", safe, redact_template); + return buf; + case REDACT_PREPEND: + snprintf(buf, sizeof(buf), "%s%s", redact_template, safe); + return buf; + case REDACT_FORMAT: + snprintf(buf, sizeof(buf), redact_template, safe); + return buf; + case REDACT_REPLACE: + default: + return redact_template; + } } diff --git a/redact_pii.h b/redact_pii.h index 5a6f2d589a6..267583b20fd 100644 --- a/redact_pii.h +++ b/redact_pii.h @@ -20,6 +20,17 @@ #ifndef redact_pii_h #define redact_pii_h +enum { + REDACT_REPLACE = 0, + REDACT_APPEND, + REDACT_PREPEND, + REDACT_FORMAT +}; + +extern int redact_pii_; +extern char *redact_template; +extern int redact_mode; const char* redact_pii(const char* input); + #endif From e954506c76617085b7565db96dfa91f4f0aca254 Mon Sep 17 00:00:00 2001 From: Kordian Pawelec Date: Fri, 3 Jul 2026 11:50:47 +0100 Subject: [PATCH 2/4] redact_pii: memcpy-based impl with format mode split in cfg.y --- cfg.y | 31 +++++++++++++++++++++++- redact_pii.c | 66 +++++++++++++++++++++++++++++++++++++--------------- redact_pii.h | 8 +++++++ 3 files changed, 85 insertions(+), 20 deletions(-) diff --git a/cfg.y b/cfg.y index 818bb222a18..88c30e68df9 100644 --- a/cfg.y +++ b/cfg.y @@ -1598,6 +1598,20 @@ assign_stm: LOGLEVEL EQUAL snumber { IFOR(); | REDACT_PII_ error { yyerror("boolean value expected"); } | REDACT_TEMPLATE EQUAL STRING { IFOR(); redact_template=$3; + if (redact_mode == REDACT_FORMAT) { + char *pct = strstr(redact_template, "%s"); + if (pct) { + redact_fmt.left.s = redact_template; + redact_fmt.left.len = pct - redact_template; + redact_fmt.right.s = pct + 2; + redact_fmt.right.len = strlen(pct + 2); + } else { + redact_fmt.left.s = redact_template; + redact_fmt.left.len = strlen(redact_template); + redact_fmt.right.s = ""; + redact_fmt.right.len = 0; + } + } } | REDACT_TEMPLATE error { yyerror("string value expected"); } | REDACT_MODE EQUAL STRING { IFOR(); @@ -1607,8 +1621,23 @@ assign_stm: LOGLEVEL EQUAL snumber { IFOR(); redact_mode=REDACT_APPEND; else if (strcasecmp($3, "prepend")==0) redact_mode=REDACT_PREPEND; - else if (strcasecmp($3, "format")==0) + else if (strcasecmp($3, "format")==0) { redact_mode=REDACT_FORMAT; + if (redact_template) { + char *pct = strstr(redact_template, "%s"); + if (pct) { + redact_fmt.left.s = redact_template; + redact_fmt.left.len = pct - redact_template; + redact_fmt.right.s = pct + 2; + redact_fmt.right.len = strlen(pct + 2); + } else { + redact_fmt.left.s = redact_template; + redact_fmt.left.len = strlen(redact_template); + redact_fmt.right.s = ""; + redact_fmt.right.len = 0; + } + } + } else yyerror("redact_mode must be: replace|append|prepend|format"); } diff --git a/redact_pii.c b/redact_pii.c index a5e66eea0f8..ac312d7141e 100644 --- a/redact_pii.c +++ b/redact_pii.c @@ -1,31 +1,59 @@ #include -#include #include "ut.h" #include "redact_pii.h" int redact_pii_ = 0; char *redact_template = "****"; int redact_mode = REDACT_REPLACE; +redact_log_format_t redact_fmt = {{NULL, 0}, {NULL, 0}}; + +#define REDACT_BUF_SIZE 512 inline const char* redact_pii(const char* input) { - static char buf[512]; - const char *safe = ZSW(input); + static char buf[REDACT_BUF_SIZE]; + const char *safe = ZSW(input); + size_t input_len, idx; - if (!redact_pii_) - return safe; + if (!redact_pii_) + return safe; - switch (redact_mode) { - case REDACT_APPEND: - snprintf(buf, sizeof(buf), "%s%s", safe, redact_template); - return buf; - case REDACT_PREPEND: - snprintf(buf, sizeof(buf), "%s%s", redact_template, safe); - return buf; - case REDACT_FORMAT: - snprintf(buf, sizeof(buf), redact_template, safe); - return buf; - case REDACT_REPLACE: - default: - return redact_template; - } + switch (redact_mode) { + case REDACT_REPLACE: + return redact_template; + case REDACT_APPEND: + input_len = strlen(safe); + idx = 0; + memcpy(buf + idx, safe, input_len); + idx += input_len; + memcpy(buf + idx, redact_template, strlen(redact_template)); + idx += strlen(redact_template); + buf[idx] = '\0'; + return buf; + case REDACT_PREPEND: + input_len = strlen(safe); + idx = 0; + memcpy(buf + idx, redact_template, strlen(redact_template)); + idx += strlen(redact_template); + memcpy(buf + idx, safe, input_len); + idx += input_len; + buf[idx] = '\0'; + return buf; + case REDACT_FORMAT: + input_len = strlen(safe); + idx = 0; + if (redact_fmt.left.len > 0) { + memcpy(buf + idx, redact_fmt.left.s, redact_fmt.left.len); + idx += redact_fmt.left.len; + } + memcpy(buf + idx, safe, input_len); + idx += input_len; + if (redact_fmt.right.len > 0) { + memcpy(buf + idx, redact_fmt.right.s, redact_fmt.right.len); + idx += redact_fmt.right.len; + } + buf[idx] = '\0'; + return buf; + default: + return redact_template; + } } diff --git a/redact_pii.h b/redact_pii.h index 267583b20fd..1a2faa254ff 100644 --- a/redact_pii.h +++ b/redact_pii.h @@ -20,6 +20,8 @@ #ifndef redact_pii_h #define redact_pii_h +#include "str.h" + enum { REDACT_REPLACE = 0, REDACT_APPEND, @@ -27,9 +29,15 @@ enum { REDACT_FORMAT }; +typedef struct { + str left; + str right; +} redact_log_format_t; + extern int redact_pii_; extern char *redact_template; extern int redact_mode; +extern redact_log_format_t redact_fmt; const char* redact_pii(const char* input); From a4c6f73d658eb108c183add167ccd788f78c34d0 Mon Sep 17 00:00:00 2001 From: Kordian Pawelec Date: Fri, 3 Jul 2026 12:24:11 +0100 Subject: [PATCH 3/4] addinf init redact --- redact_pii.c | 22 ++++++++++++++++++++++ redact_pii.h | 2 ++ 2 files changed, 24 insertions(+) diff --git a/redact_pii.c b/redact_pii.c index ac312d7141e..781081001a7 100644 --- a/redact_pii.c +++ b/redact_pii.c @@ -57,3 +57,25 @@ inline const char* redact_pii(const char* input) { return redact_template; } } + +inline int redact_pii_len(const char* input, int orig_len) { + size_t tpl_len, input_len; + + if (!redact_pii_) + return orig_len; + + switch (redact_mode) { + case REDACT_REPLACE: + return (int)strlen(redact_template); + case REDACT_APPEND: + return orig_len + (int)strlen(redact_template); + case REDACT_PREPEND: + return (int)strlen(redact_template) + orig_len; + case REDACT_FORMAT: + input_len = input ? strlen(input) : 0; + tpl_len = redact_fmt.left.len + input_len + redact_fmt.right.len; + return (int)tpl_len; + default: + return (int)strlen(redact_template); + } +} diff --git a/redact_pii.h b/redact_pii.h index 1a2faa254ff..6d434bbe1e4 100644 --- a/redact_pii.h +++ b/redact_pii.h @@ -40,5 +40,7 @@ extern int redact_mode; extern redact_log_format_t redact_fmt; const char* redact_pii(const char* input); +int redact_pii_len(const char* input, int orig_len); +#define REDACT_PII(len, s) redact_pii_len((s), (len)), redact_pii((s)) #endif From 92d1ce9912d99bc35068b96d71a8c2da953517c8 Mon Sep 17 00:00:00 2001 From: Kordian Pawelec Date: Fri, 3 Jul 2026 13:40:55 +0100 Subject: [PATCH 4/4] remove init redact --- redact_pii.c | 22 ---------------------- redact_pii.h | 2 -- 2 files changed, 24 deletions(-) diff --git a/redact_pii.c b/redact_pii.c index 781081001a7..ac312d7141e 100644 --- a/redact_pii.c +++ b/redact_pii.c @@ -57,25 +57,3 @@ inline const char* redact_pii(const char* input) { return redact_template; } } - -inline int redact_pii_len(const char* input, int orig_len) { - size_t tpl_len, input_len; - - if (!redact_pii_) - return orig_len; - - switch (redact_mode) { - case REDACT_REPLACE: - return (int)strlen(redact_template); - case REDACT_APPEND: - return orig_len + (int)strlen(redact_template); - case REDACT_PREPEND: - return (int)strlen(redact_template) + orig_len; - case REDACT_FORMAT: - input_len = input ? strlen(input) : 0; - tpl_len = redact_fmt.left.len + input_len + redact_fmt.right.len; - return (int)tpl_len; - default: - return (int)strlen(redact_template); - } -} diff --git a/redact_pii.h b/redact_pii.h index 6d434bbe1e4..1a2faa254ff 100644 --- a/redact_pii.h +++ b/redact_pii.h @@ -40,7 +40,5 @@ extern int redact_mode; extern redact_log_format_t redact_fmt; const char* redact_pii(const char* input); -int redact_pii_len(const char* input, int orig_len); -#define REDACT_PII(len, s) redact_pii_len((s), (len)), redact_pii((s)) #endif