opuppet/puppetlabs-stdlib
4
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

fqdn_rotate: Don't use the value itself as part of the random seed

Browse source 
Previously, the random number generator was seeded with the array or
string to be rotated in addition to any values specifically provided for
seeding. This behavior is potentially insecure in that it allows an
attacker who can modify the source data to choose the post-shuffle
order.
This commit is contained in:
Eli Young 2015-05-28 18:15:05 -07:00
parent a383705fdb
commit 601f681787
3 changed files with 3 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/puppet/parser/functions/fqdn_rotate.rb
View file

@ -11,7 +11,7 @@ Rotates an array a random number of times based on a nodes fqdn.
raise(Puppet::ParseError, "fqdn_rotate(): Wrong number of arguments " +
"given (#{arguments.size} for 1)") if arguments.size < 1
value = arguments[0]
value = arguments.shift
require 'digest/md5'
unless value.is_a?(Array) || value.is_a?(String)

2
spec/acceptance/fqdn_rotate_spec.rb
View file

@ -36,7 +36,7 @@ describe 'fqdn_rotate function', :unless => UNSUPPORTED_PLATFORMS.include?(fact(
EOS
apply_manifest(pp, :catch_failures => true) do |r|
expect(r.stdout).to match(/fqdn_rotate is \["c", "d", "a", "b"\]/)
expect(r.stdout).to match(/fqdn_rotate is \["d", "a", "b", "c"\]/)
end
end
end

6
spec/functions/fqdn_rotate_spec.rb
View file

@ -5,10 +5,6 @@ describe 'fqdn_rotate' do
it { is_expected.to run.with_params().and_raise_error(Puppet::ParseError, /wrong number of arguments/i) }
it { is_expected.to run.with_params(0).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) }
it { is_expected.to run.with_params({}).and_raise_error(Puppet::ParseError, /Requires either array or string to work with/) }
it {
pending("Current implementation ignores parameters after the first.")
is_expected.to run.with_params("one", "two").and_raise_error(Puppet::ParseError)
}
it { is_expected.to run.with_params('').and_return('') }
it { is_expected.to run.with_params('a').and_return('a') }
@ -38,7 +34,7 @@ describe 'fqdn_rotate' do
it "should use the Puppet::Util.deterministic_rand function" do
if Puppet::Util.respond_to?(:deterministic_rand)
Puppet::Util.expects(:deterministic_rand).with(113646079810780526294648115052177588845,4)
Puppet::Util.expects(:deterministic_rand).with(44489829212339698569024999901561968770,4)
fqdn_rotate("asdf")
else
skip 'Puppet::Util#deterministic_rand not available'