Quote systemd DefaultEnvironment Proxy values

[feloy]

Quote systemd DefaultEnvironment Proxy values, as documented in systemd.conf man page:

Example:
DefaultEnvironment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6" Sets three variables "VAR1", "VAR2", "VAR3".

Double quote is not escaped, as there is no chance it appears in a proxy value. User can still espace it if really necessary

Fixes #23277
Fixes podman-desktop/podman-desktop#7894

How to test

1. Declare proxy env vars in containers.conf file, with comma special character in no_proxy, for example (please replace proxy IP/port with your own):

env = [
	'https_proxy=http://192.168.1.21:3128',
	'http_proxy=http://192.168.1.21:3128',
	'no_proxy=localhost,quay.io',
]

2. Create and start a new podman machine, and ssh to it

3. Check that no_proxy and NO_PROXY values are not escaped:

$ cat /etc/systemd/system.conf.d/default-env.conf 
[Manager]
DefaultEnvironment="http_proxy=http://192.168.1.21:3128"
DefaultEnvironment="https_proxy=http://192.168.1.21:3128"
DefaultEnvironment="no_proxy=host.containers.internal,quay.io"
DefaultEnvironment="HTTP_PROXY=http://192.168.1.21:3128"
DefaultEnvironment="HTTPS_PROXY=http://192.168.1.21:3128"
DefaultEnvironment="NO_PROXY=host.containers.internal,quay.io"

4. Restart podman machine so podman process takes these values into consideration

5. Check that proxy env vars are passed to podman process:

$ ps eww `pidof podman`
    PID TTY      STAT   TIME COMMAND
   1282 ?        Ssl    0:00 /usr/bin/podman --log-level=info system service HTTPS_PROXY=http://192.168.1.21:3128 HTTP_PROXY=http://192.168.1.21:3128 NO_PROXY=host.containers.internal,quay.io http_proxy=http://192.168.1.21:3128 https_proxy=http://192.168.1.21:3128 no_proxy=host.containers.internal,quay.io [...]

6. From a client (podman outside of VM or podman-desktop):

• pull an image from docker.io: proxy should log requests
• pull an image from quay.io: proxy should not log any request

Does this PR introduce a user-facing change?

Values for proxy env variables won't be escaped anymore.

Changed the way the proxy environment variables are defined in the systemd configuration file. These values were previously escaped for shell input reuse (%q), they are now not escaped.

[feloy]

I'll add some tests

[feloy]

I'll add some tests

Tests added, the PR is ready for review

[rhatdan]

LGTM

[Luap99]

you will need to rebase on latest main to fix the CI

[Luap99]

This will break if the vars contains a quote, I guess I am fine to trade quote is broken vs command is broken because the later is actually used in these vars while the quote most likely is never used.

However please fix the test and add a comma there

podman/pkg/machine/e2e/proxy_test.go

Line 79 in 77f5b4d

proxy1 := "http:// some special @;\" here"

[Luap99]

we already use assert github.com/stretchr/testify/assert so please use that instead, i.e.

assert.NoError(t, err)

[Luap99]

here you can use

assert.Equal(t, tt.want, str)

[Luap99]

please squash your commits into one
changes LGTM otherwise

[Luap99]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: feloy, Luap99

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Luap99]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[TheConen]

Is this fix already included in the latest 5.2.3 release? I could not find it in the changelog.

[Luap99]

It was not backported so it will be in 5.3

[TheConen]

Is there something like a timeline / roadmap when 5.3 will be released?

[Luap99]

End of October/early November most likely