From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 28 Jan 2026 18:51:09 +0000 (-0500)
Subject: re-add %R, as "print with secrets suppressed"
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3d6ff893aad792cc16ddc8e715ad0e925aa70fbc;p=thirdparty%2Ffreeradius-server.git

re-add %R, as "print with secrets suppressed"

mainly for edit assignments and debug outputs.

Note that %pairs.print() will still print all of the data, even if
they're secret.  And any error messages will still print the data
---

diff --git a/src/lib/server/exec_legacy.c b/src/lib/server/exec_legacy.c
index 1435f941509..710c33f8370 100644
--- a/src/lib/server/exec_legacy.c
+++ b/src/lib/server/exec_legacy.c
@@ -538,10 +538,10 @@ wait:
 		if (WIFEXITED(status)) {
 			status = WEXITSTATUS(status);
 			if (status != 0) {
-				RERROR("Program returned code (%d) and output \"%pV\"", status,
+				RERROR("Program returned code (%d) and output %pV", status,
 				       fr_box_strvalue_len(answer, len));
 			} else {
-				RDEBUG2("Program returned code (%d) and output \"%pV\"", status,
+				RDEBUG2("Program returned code (%d) and output %pV", status,
 					fr_box_strvalue_len(answer, len));
 			}
 
diff --git a/src/lib/server/tmpl_tokenize.c b/src/lib/server/tmpl_tokenize.c
index 71c59d688b3..1368f2935bc 100644
--- a/src/lib/server/tmpl_tokenize.c
+++ b/src/lib/server/tmpl_tokenize.c
@@ -289,7 +289,7 @@ void tmpl_attr_debug(FILE *fp, tmpl_t const *vpt)
 		return;
 	}
 
-	fprintf(fp, "tmpl_t %s (%.8x) \"%pV\" (%p)\n",
+	fprintf(fp, "tmpl_t %s (%.8x) %pV (%p)\n",
 		tmpl_type_to_str(vpt->type),
 		vpt->type,
 		fr_box_strvalue_len(vpt->name, vpt->len), vpt);
diff --git a/src/lib/unlang/edit.c b/src/lib/unlang/edit.c
index f16aebbc8eb..1eed7390bac 100644
--- a/src/lib/unlang/edit.c
+++ b/src/lib/unlang/edit.c
@@ -50,7 +50,7 @@ static void rdebug_assign(request_t *request, char const *attr, fr_token_t op, f
 
 	switch (box->type) {
 	case FR_TYPE_QUOTED:
-		RDEBUG2("%s %s \"%pV\"", attr, fr_tokens[op], box);
+		RDEBUG2("%s %s %pR", attr, fr_tokens[op], box);
 		break;
 
 	case FR_TYPE_INTERNAL:
@@ -66,7 +66,7 @@ static void rdebug_assign(request_t *request, char const *attr, fr_token_t op, f
 			break;
 		}
 
-		RDEBUG2("%s %s %pV", attr, fr_tokens[op], box);
+		RDEBUG2("%s %s %pR", attr, fr_tokens[op], box);
 		break;
 	}
 }
@@ -386,7 +386,7 @@ static int apply_edits_to_list(request_t *request, unlang_frame_state_edit_t *st
 		relative = (fr_pair_parse_t) { };
 
 		if (fr_pair_list_afrom_substr(&root, &relative, &FR_SBUFF_IN(box->vb_strvalue, box->vb_length)) < 0) {
-			RPEDEBUG("Failed parsing string '%pV' as attribute list", box);
+			RPEDEBUG("Failed parsing string %pV as attribute list", box);
 			return -1;
 		}
 
diff --git a/src/lib/unlang/foreach.c b/src/lib/unlang/foreach.c
index f62d81a4386..dafce3b69ba 100644
--- a/src/lib/unlang/foreach.c
+++ b/src/lib/unlang/foreach.c
@@ -191,7 +191,7 @@ next:
 
 	fr_value_box_clear_value(&state->value->data);
 	if (fr_value_box_cast(state->value, &state->value->data, state->value->vp_type, state->value->da, box) < 0) {
-		RDEBUG("Failed casting 'foreach' iteration variable '%s' from %pV", state->value->da->name, box);
+		RPEDEBUG("Failed casting 'foreach' iteration variable '%s' from %pV", state->value->da->name, box);
 		goto next;
 	}
 
@@ -224,7 +224,7 @@ static unlang_action_t unlang_foreach_xlat_expanded(unlang_result_t *p_result, r
 
 next:
 	if (fr_value_box_cast(state->value, &state->value->data, state->value->vp_type, state->value->da, box) < 0) {
-		RDEBUG("Failed casting 'foreach' iteration variable '%s' from %pV", state->value->da->name, box);
+		RPEDEBUG("Failed casting 'foreach' iteration variable '%s' from %pV", state->value->da->name, box);
 		box = fr_dcursor_next(&state->cursor);
 		if (!box) goto done;
 
@@ -361,7 +361,7 @@ next:
 		}
 
 #ifndef NDEBUG
-		RDEBUG2("# looping with: %s = %pV", state->value->da->name, &vp->data);
+		RDEBUG2("# looping with: %s = %pR", state->value->da->name, &vp->data);
 #endif
 	}
 
diff --git a/src/lib/unlang/map_builtin.c b/src/lib/unlang/map_builtin.c
index 1cdbbeb50be..c6fe6366036 100644
--- a/src/lib/unlang/map_builtin.c
+++ b/src/lib/unlang/map_builtin.c
@@ -52,7 +52,7 @@ static int _list_map_proc_get_value(TALLOC_CTX *ctx, fr_pair_list_t *out,
 	if (!vp) return -1;
 
 	if (fr_value_box_cast(vp, &vp->data, vp->data.type, vp->da, value) < 0) {
-		RPEDEBUG("Failed casting \"%pV\" for attribute %s", value, vp->da->name);
+		RPEDEBUG("Failed casting %pR for attribute %s", value, vp->da->name);
 		talloc_free(vp);
 		return -1;
 	}
diff --git a/src/lib/unlang/xlat_builtin.c b/src/lib/unlang/xlat_builtin.c
index 46f0dac73ed..2aab69718df 100644
--- a/src/lib/unlang/xlat_builtin.c
+++ b/src/lib/unlang/xlat_builtin.c
@@ -1048,7 +1048,7 @@ static xlat_action_t xlat_func_integer(TALLOC_CTX *ctx, fr_dcursor_t *out,
 	switch (in_vb->type) {
 	default:
 	error:
-		RPEDEBUG("Failed converting %pV (%s) to an integer", in_vb,
+		RPEDEBUG("Failed converting %pR (%s) to an integer", in_vb,
 			 fr_type_to_str(in_vb->type));
 		talloc_free(in_vb);
 		return XLAT_ACTION_FAIL;
diff --git a/src/lib/unlang/xlat_eval.c b/src/lib/unlang/xlat_eval.c
index 6bc210634fe..497374212b2 100644
--- a/src/lib/unlang/xlat_eval.c
+++ b/src/lib/unlang/xlat_eval.c
@@ -243,13 +243,13 @@ static inline void xlat_debug_log_expansion(request_t *request, xlat_exp_t const
 			a = fr_value_box_list_head(args);
 			b = fr_value_box_list_next(args, a);
 
-			RDEBUG2("| (%pV %s %pV)", a, fr_tokens[node->call.func->token], b);
+			RDEBUG2("| (%pR %s %pR)", a, fr_tokens[node->call.func->token], b);
 
 #ifndef NDEBUG
 			if (a && b) {
 				a = fr_value_box_list_next(args, b);
 				if (a) {
-					RDEBUG2("| ... ??? %pV", a);
+					RDEBUG2("| ... ??? %pR", a);
 					fr_assert(0);
 				}
 			}
@@ -296,7 +296,7 @@ static inline void xlat_debug_log_result(request_t *request, xlat_exp_t const *n
 
 	if (!RDEBUG_ENABLED2) return;
 
-	RDEBUG2("| --> %pV", result);
+	RDEBUG2("| --> %pR", result);
 }
 
 static int xlat_arg_stringify(request_t *request, xlat_arg_parser_t const *arg, xlat_exp_t const *node, fr_value_box_t *vb)
@@ -1128,7 +1128,7 @@ xlat_action_t xlat_frame_eval_resume(TALLOC_CTX *ctx, fr_dcursor_t *out,
 
 		fr_dcursor_next(out);		/* Wind to the start of this functions output */
 		if (node->call.func) {
-			RDEBUG2("| --> %pV", fr_dcursor_current(out));
+			RDEBUG2("| --> %pR", fr_dcursor_current(out));
 			if (!xlat_process_return(request, node->call.func, (fr_value_box_list_t *)out->dlist,
 					 fr_dcursor_current(out))) return XLAT_ACTION_FAIL;
 		}
diff --git a/src/lib/unlang/xlat_expr.c b/src/lib/unlang/xlat_expr.c
index 9a95cb4852e..7f4f14c8d09 100644
--- a/src/lib/unlang/xlat_expr.c
+++ b/src/lib/unlang/xlat_expr.c
@@ -354,7 +354,7 @@ static xlat_action_t xlat_binary_op(TALLOC_CTX *ctx, fr_dcursor_t *out,
 
 	rcode = fr_value_calc_binary_op(dst, dst, default_type, a, op, b);
 	if (rcode < 0) {
-		RPEDEBUG("Failed calculating '%pV %s %pV'", a, fr_tokens[op], b);
+		RPEDEBUG("Failed calculating '%pR %s %pR'", a, fr_tokens[op], b);
 		talloc_free(dst);
 		return XLAT_ACTION_FAIL;
 	}
diff --git a/src/lib/unlang/xlat_pair.c b/src/lib/unlang/xlat_pair.c
index e3fd6c6b9d9..ac594576472 100644
--- a/src/lib/unlang/xlat_pair.c
+++ b/src/lib/unlang/xlat_pair.c
@@ -102,7 +102,7 @@ int xlat_decode_value_box_list(TALLOC_CTX *ctx, fr_pair_list_t *out,
 		ssize_t		len;
 
 		if (vb->type != FR_TYPE_OCTETS) {
-			RWDEBUG("Skipping value \"%pV\", expected value of type %s, got type %s",
+			RWDEBUG("Skipping value \"%pR\", expected value of type %s, got type %s",
 				vb,
 				fr_type_to_str(FR_TYPE_OCTETS),
 				fr_type_to_str(vb->type));
diff --git a/src/lib/unlang/xlat_tokenize.c b/src/lib/unlang/xlat_tokenize.c
index ff298a4e843..c931e62e3b1 100644
--- a/src/lib/unlang/xlat_tokenize.c
+++ b/src/lib/unlang/xlat_tokenize.c
@@ -2006,7 +2006,7 @@ int xlat_resolve(xlat_exp_head_t *head, xlat_res_rules_t const *xr_rules)
 				 *	FIXME - Produce proper error with marker
 				 */
 				if (!xr_rules->allow_unresolved) {
-					fr_strerror_printf("Failed resolving function \"%pV\"",
+					fr_strerror_printf("Failed resolving function %pV",
 							   fr_box_strvalue_buffer(node->fmt));
 					return -1;
 				}
diff --git a/src/lib/util/print.c b/src/lib/util/print.c
index 43ba190cecb..62e852667b3 100644
--- a/src/lib/util/print.c
+++ b/src/lib/util/print.c
@@ -668,15 +668,17 @@ static char *fr_vasprintf_internal(TALLOC_CTX *ctx, char const *fmt, va_list ap,
 			 *	subst types
 			 */
 			switch (*(p + 1)) {
+			case 'R':
+				/*
+				 *	If the caller explicitly asks to suppress secrets via '%pR', then we
+				 *	do that.
+				 */
+				suppress_secrets = true;
+				FALL_THROUGH;
+
 			case 'V':
 			{
 				fr_value_box_t const *in = va_arg(ap_q, fr_value_box_t const *);
-				fr_sbuff_escape_rules_t const *e_rules = NULL;
-
-				/*
-				 *	Value boxes get escaped as double-quoted strings.
-				 */
-				e_rules = &fr_value_escape_double;
 
 				/*
 				 *	Allocations that are not part of the output
@@ -687,7 +689,11 @@ static char *fr_vasprintf_internal(TALLOC_CTX *ctx, char const *fmt, va_list ap,
 					subst = talloc_typed_strdup(NULL, "<<< secret >>>");
 
 				} else if (in) {
-					fr_value_box_aprint(NULL, &subst, in, e_rules);
+					/*
+					 *	Value boxes get escaped as double-quoted strings.
+					 */
+					fr_value_box_aprint(NULL, &subst, in, &fr_value_escape_double);
+
 				} else {
 					subst = talloc_typed_strdup(NULL, "(null)");
 				}