Skip to content

Commit fbb2970

Browse files
committed
PXB-2145 encrypt-key appears in process-list
Problem: Encrypt-key appears in process-list Fix: mask encrypt-key from processlist
1 parent e967681 commit fbb2970

File tree

1 file changed

+17
-15
lines changed

1 file changed

+17
-15
lines changed

storage/innobase/xtrabackup/src/xtrabackup.cc

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -820,8 +820,7 @@ struct my_option xb_client_options[] =
820820
&xtrabackup_encrypt_algo, &xtrabackup_encrypt_algo,
821821
&xtrabackup_encrypt_algo_typelib, GET_ENUM, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
822822

823-
{"encrypt-key", OPT_XTRA_ENCRYPT_KEY, "Encryption key to use.",
824-
(G_PTR*) &xtrabackup_encrypt_key, (G_PTR*) &xtrabackup_encrypt_key, 0,
823+
{"encrypt-key", OPT_XTRA_ENCRYPT_KEY, "Encryption key to use.",0, 0, 0,
825824
GET_STR_ALLOC, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
826825

827826
{"encrypt-key-file", OPT_XTRA_ENCRYPT_KEY_FILE, "File which contains encryption key to use.",
@@ -1532,6 +1531,17 @@ check_if_param_set(const char *param)
15321531
return param_set.find(param) != param_set.end();
15331532
}
15341533

1534+
/************************************************************************
1535+
Mask the argument value. This is to avoid showing secret data on command
1536+
line output */
1537+
static void hide_option(char *argument, char **opt) {
1538+
char *start = argument;
1539+
my_free(*opt);
1540+
*opt = my_strdup(PSI_NOT_INSTRUMENTED, argument, MYF(MY_FAE));
1541+
while (*argument) *argument++ = 'x'; /*Destroy argument */
1542+
if (*start) start[1] = 0; /*Cut length of argument */
1543+
}
1544+
15351545
my_bool
15361546
xb_get_one_option(int optid,
15371547
const struct my_option *opt,
@@ -1715,12 +1725,7 @@ xb_get_one_option(int optid,
17151725
argument= (char*) ""; /* Don't require password */
17161726
if (argument)
17171727
{
1718-
char *start = argument;
1719-
my_free(opt_password);
1720-
opt_password = my_strdup(PSI_NOT_INSTRUMENTED, argument,MYF(MY_FAE));
1721-
while (*argument) *argument++= 'x'; /* Destroy argument */
1722-
if (*start)
1723-
start[1] = 0; /* Cut length of argument */
1728+
hide_option(argument, &opt_password);
17241729
tty_password = false;
17251730
}
17261731
else
@@ -1731,13 +1736,7 @@ xb_get_one_option(int optid,
17311736
argument = (char*) ""; /* Don't require password */
17321737
if (argument)
17331738
{
1734-
char *start = argument;
1735-
my_free(opt_transition_key);
1736-
opt_transition_key = my_strdup(PSI_NOT_INSTRUMENTED,
1737-
argument,MYF(MY_FAE));
1738-
while (*argument) *argument++= 'x'; /* Destroy argument */
1739-
if (*start)
1740-
start[1] = 0; /* Cut length of argument */
1739+
hide_option(argument, &opt_transition_key);
17411740
tty_transition_key = false;
17421741
}
17431742
else
@@ -1747,6 +1746,9 @@ xb_get_one_option(int optid,
17471746
case OPT_GENERATE_TRANSITION_KEY:
17481747
use_dumped_tablespace_keys = true;
17491748
break;
1749+
case OPT_XTRA_ENCRYPT_KEY:
1750+
hide_option(argument, &xtrabackup_encrypt_key);
1751+
break;
17501752

17511753
#include "sslopt-case.h"
17521754

0 commit comments

Comments
 (0)