[cli] add "dataset active|pending -ns" support (#11518)

This CLI command argument "-ns" prints out the dataset fields and
redact the sensitive values, including the network key and PSKc
fields.

src/cli/README_DATASET.md

@@ -346,7 +346,7 @@ Done
 
 ### active
 
-Usage: `dataset active [-x]`
+Usage: `dataset active [-x|-ns]`
 
 Print Active Operational Dataset in human-readable form.
 
@@ -366,6 +366,24 @@ Security Policy: 672 onrc 0
 Done
 ```
 
+Print Active Operational Dataset in human-readable form and redact the sensitive values.
+
+```bash
+> dataset active -ns
+Active Timestamp: 1
+Channel: 15
+Wake-up Channel: 16
+Channel Mask: 0x07fff800
+Ext PAN ID: 39758ec8144b07fb
+Mesh Local Prefix: fdf1:f1ad:d079:7dc0::/64
+Network Key: [Redacted]
+Network Name: OpenThread-5938
+PAN ID: 0x5938
+PSKc: [Redacted]
+Security Policy: 672 onrc 0
+Done
+```
+
 Print Active Operational Dataset as hex-encoded TLVs.
 
 ```bash
@@ -620,7 +638,7 @@ Done
 
 ### pending
 
-Usage: `dataset pending [-x]`
+Usage: `dataset pending [-x|-ns]`
 
 Print Pending Operational Dataset in human-readable form.
 
@@ -641,6 +659,25 @@ Security Policy: 672 onrc 0
 Done
 ```
 
+Print Pending Operational Dataset in human-readable form and redact the sensitive values.
+
+```bash
+> dataset pending -ns
+Pending Timestamp: 2
+Active Timestamp: 1
+Channel: 26
+Channel Mask: 0x07fff800
+Delay: 58706
+Ext PAN ID: a74182f4d3f4de41
+Mesh Local Prefix: fd46:c1b9:e159:5574::/64
+Network Key: [Redacted]
+Network Name: OpenThread-bff8
+PAN ID: 0xbff8
+PSKc: [Redacted]
+Security Policy: 672 onrc 0
+Done
+```
+
 Print Pending Operational Dataset as hex-encoded TLVs.
 
 ```bash

src/cli/cli_dataset.cpp

@@ -578,28 +578,29 @@ exit:
     return error;
 }
 
-otError Dataset::Print(otOperationalDatasetTlvs &aDatasetTlvs)
+otError Dataset::Print(otOperationalDatasetTlvs &aDatasetTlvs, bool aNonsensitiveOnly)
 {
     struct ComponentTitle
     {
-        const char *mTitle; // Title to output.
-        const char *mName;  // To use with `LookupMapper()`.
+        const char *mTitle;       // Title to output.
+        const char *mName;        // To use with `LookupMapper()`.
+        bool        mIsSensitive; // Whether the field is sensitive.
     };
 
     static const ComponentTitle kTitles[] = {
-        {"Pending Timestamp", "pendingtimestamp"},
-        {"Active Timestamp", "activetimestamp"},
-        {"Channel", "channel"},
-        {"Wake-up Channel", "wakeupchannel"},
-        {"Channel Mask", "channelmask"},
-        {"Delay", "delay"},
-        {"Ext PAN ID", "extpanid"},
-        {"Mesh Local Prefix", "meshlocalprefix"},
-        {"Network Key", "networkkey"},
-        {"Network Name", "networkname"},
-        {"PAN ID", "panid"},
-        {"PSKc", "pskc"},
-        {"Security Policy", "securitypolicy"},
+        {"Pending Timestamp", "pendingtimestamp", false},
+        {"Active Timestamp", "activetimestamp", false},
+        {"Channel", "channel", false},
+        {"Wake-up Channel", "wakeupchannel", false},
+        {"Channel Mask", "channelmask", false},
+        {"Delay", "delay", false},
+        {"Ext PAN ID", "extpanid", false},
+        {"Mesh Local Prefix", "meshlocalprefix", false},
+        {"Network Key", "networkkey", true},
+        {"Network Name", "networkname", false},
+        {"PAN ID", "panid", false},
+        {"PSKc", "pskc", true},
+        {"Security Policy", "securitypolicy", false},
     };
 
     otError              error;
@@ -609,12 +610,21 @@ otError Dataset::Print(otOperationalDatasetTlvs &aDatasetTlvs)
 
     for (const ComponentTitle &title : kTitles)
     {
-        const ComponentMapper *mapper = LookupMapper(title.mName);
+        const ComponentMapper *mapper;
+
+        mapper = LookupMapper(title.mName);
 
         if (dataset.mComponents.*mapper->mIsPresentPtr)
         {
             OutputFormat("%s: ", title.mTitle);
-            (this->*mapper->mOutput)(dataset);
+            if (aNonsensitiveOnly && title.mIsSensitive)
+            {
+                OutputLine("[Redacted]");
+            }
+            else
+            {
+                (this->*mapper->mOutput)(dataset);
+            }
         }
     }
 
@@ -688,8 +698,24 @@ exit:
  * 0e08000000000001000000030000103506000...3023d82c841eff0e68db86f35740c030000ff
  * Done
  * @endcode
- * @cparam dataset active [-x]
- * The optional `-x` argument prints the Active Operational %Dataset values as hex-encoded TLVs.
+ * @code
+ * dataset active -ns
+ * Active Timestamp: 1
+ * Channel: 13
+ * Channel Mask: 0x07fff800
+ * Ext PAN ID: d63e8e3e495ebbc3
+ * Mesh Local Prefix: fd3d:b50b:f96d:722d::/64
+ * Network Key: [Redacted]
+ * Network Name: OpenThread-8f28
+ * PAN ID: 0x8f28
+ * PSKc: [Redacted]
+ * Security Policy: 0, onrcb
+ * Done
+ * @endcode
+ * @cparam dataset active [-x|-ns]
+ * * The optional `-x` argument prints the Active Operational Dataset values as hex-encoded TLVs.
+ * * The optional `-ns` argument prints the Active Operational Dataset values and redact the sensitive values, including
+ * the network key and PSKc fields.
  * @par api_copy
  * #otDatasetGetActive
  * @par
@@ -704,12 +730,16 @@ template <> otError Dataset::Process<Cmd("active")>(Arg aArgs[])
 
     if (aArgs[0].IsEmpty())
     {
-        error = Print(dataset);
+        error = Print(dataset, /* aNonsensitiveOnly */ false);
     }
     else if (aArgs[0] == "-x")
     {
         OutputBytesLine(dataset.mTlvs, dataset.mLength);
     }
+    else if (aArgs[0] == "-ns")
+    {
+        error = Print(dataset, /* aNonsensitiveOnly */ true);
+    }
     else
     {
         error = OT_ERROR_INVALID_ARGS;
@@ -728,12 +758,16 @@ template <> otError Dataset::Process<Cmd("pending")>(Arg aArgs[])
 
     if (aArgs[0].IsEmpty())
     {
-        error = Print(datasetTlvs);
+        error = Print(datasetTlvs, /* aNonsensitiveOnly */ false);
     }
     else if (aArgs[0] == "-x")
     {
         OutputBytesLine(datasetTlvs.mTlvs, datasetTlvs.mLength);
     }
+    else if (aArgs[0] == "-ns")
+    {
+        error = Print(datasetTlvs, /* aNonsensitiveOnly */ true);
+    }
     else
     {
         error = OT_ERROR_INVALID_ARGS;
@@ -1283,7 +1317,7 @@ otError Dataset::Process(Arg aArgs[])
 
     if (aArgs[0].IsEmpty())
     {
-        ExitNow(error = Print(sDatasetTlvs));
+        ExitNow(error = Print(sDatasetTlvs, /* aNonsensitiveOnly */ false));
     }
 
     /**

src/cli/cli_dataset.hpp

@@ -124,7 +124,7 @@ private:
 
     template <CommandId kCommandId> otError Process(Arg aArgs[]);
 
-    otError Print(otOperationalDatasetTlvs &aDatasetTlvs);
+    otError Print(otOperationalDatasetTlvs &aDatasetTlvs, bool aNonsensitiveOnly);
 
 #if OPENTHREAD_CONFIG_DATASET_UPDATER_ENABLE && OPENTHREAD_FTD
     otError     ProcessUpdater(Arg aArgs[]);

tests/scripts/expect/cli-dataset.exp

@@ -45,6 +45,17 @@ expect -re {Network Name: [^\r\n]+}
 expect -re {PAN ID: 0x[0-9a-f]{4}}
 expect -re {PSKc: [0-9a-f]{32}}
 expect -re {Security Policy: \d+ o?n?r?c?b?}
+send "dataset active -ns\n"
+expect -re {Active Timestamp: \d+}
+expect -re {Channel: (\d+)}
+expect -re {Channel Mask: 0x[0-9a-f]{8}}
+expect -re {Ext PAN ID: [0-9a-f]{16}}
+expect -re {Mesh Local Prefix: ([0-9a-f]{1,4}:){3}[0-9a-f]{1,4}::\/64}
+expect -re {Network Key: \[Redacted\]}
+expect -re {Network Name: [^\r\n]+}
+expect -re {PAN ID: 0x[0-9a-f]{4}}
+expect -re {PSKc: \[Redacted\]}
+expect -re {Security Policy: \d+ o?n?r?c?b?}
 send "dataset pending\n"
 expect "Error 23: NotFound"
 send "dataset init active\n"