[rancid] [PATCH] panos.pm: filter secrets

The attached patch filters out snmp-community-string and all "key " values (encryption/authentication keys for OSPF and other protocols, IPsec pre-shared-keys, etc.) in PanOS/Panorama configs and fixes the initial comment line to begin with # like all the other comments.

Result:

- !RANCID-CONTENT-TYPE: paloalto
+ #RANCID-CONTENT-TYPE: paloalto

-                             snmp-community-string XXXXXXXX;
+ #                            snmp-community-string <removed>;

-                                   key XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX;
+ #                                  key <removed>;

_______________________________________________
Rancid-discuss mailing list
[email protected]
http://www.shrubbery.net/mailman/listinfo/rancid-discuss

--- panos.pm.filter-secrets	2019-02-06 02:03:28.000000000 -0500
+++ panos.pm	2019-02-20 11:41:31.184369874 -0500
@@ -78,7 +78,7 @@
 sub init {
 
     # add content lines and separators
-    ProcessHistory("","","","!RANCID-CONTENT-TYPE: $devtype\n!\n");
+    ProcessHistory("","","","#RANCID-CONTENT-TYPE: $devtype\n!\n");
 
     0;
 }
@@ -190,6 +190,13 @@
 	    return(1);
 	}
 
+	if (/^(\s*snmp-community-string )[^ ;]+(\s?[;{])$/ && $filter_commstr) {
+	    $_ = "#$1<removed>$2\n";
+	}
+	if (/^(\s*key )[^ ;]+(\s?[;{])$/ && $filter_pwds >= 1) {
+	    $_ = "#$1<removed>$2\n";
+	}
+
 	ProcessHistory("","","","$_");
 	# end of config
     }