customisable sos clean parser

[pmoravec]

I would like to make cleaner bit more flexible and customisable in the ways of detecting patterns of sensitive data other than the well known few types (IPs, hostnames etc.). These parsers do a great job, but are rigidly tighten to very specific domains of sensitive data. On the other side, --keywords and --keyword-file lists just the extra sensitive texts to replace, without a context, that you need topre-populate or know in advance.

We don't cover user stories like:

• "my log files have API keys in form: [&\?]api_key=.*[&$] and I need to obfuscate the value"
• or our short hostnames are present in access logs as ,host=.*,

What about an extra parser+mapper, that will load a file with user-defined content like:

APIKEY [&\?]api_key=(.*)[&$]
SHORTHOST ,host=(.*),

That will consider the first word as type of replacement to be done, and the rest of line as regexp to detect the sensitive data - such that \1 is always the sensitive value to replace.

Replacement string will be the identified by the type / the first word and number, so the first ?api_key=foobar& will be replaced by ?api_key=APIKEY1& (we just need to avoid duplicit types).

The parser will be automatically loaded whenever a given known file (say, /etc/sos/cleaner/custom_parser.cfg) is present (with the option to disable it via --disable-parsers).

I can implement the idea on my own.

Do you see the proposal sound and useful?

[pmoravec]

PR proposal is #4404 . Despite mentioned there, no back-reference was automatically popped up here /o\ .