summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNoah Kantrowitz <noah@coderanger.net>2018-04-16 11:59:07 -0700
committerNoah Kantrowitz <noah@coderanger.net>2018-04-18 22:32:20 -0700
commitb198b77215d46d843b5ffe05a8d2ea17d2457a2e (patch)
tree53b60b2f435806a38db58eb46b3978460beab237
parent5e2067038d1cc80ada70a35d1e9e7bfbc3db2d3b (diff)
downloadohai-b198b77215d46d843b5ffe05a8d2ea17d2457a2e.tar.gz
Make the digest algorithm configurable and default to SHA2 under FIPS-mode.
Signed-off-by: Noah Kantrowitz <noah@coderanger.net>
-rw-r--r--lib/ohai/plugins/shard.rb27
1 files changed, 22 insertions, 5 deletions
diff --git a/lib/ohai/plugins/shard.rb b/lib/ohai/plugins/shard.rb
index 85560507..5bed48e1 100644
--- a/lib/ohai/plugins/shard.rb
+++ b/lib/ohai/plugins/shard.rb
@@ -18,12 +18,8 @@
Ohai.plugin(:ShardSeed) do
require "openssl"
- require "digest/md5"
depends "hostname", "dmi", "machine_id", "machinename"
provides "shard_seed"
- # Disable this plugin by default under FIPS mode because even though we aren't
- # using MD5 for cryptography, it will still throw up an error.
- optional true if defined?(OpenSSL.fips_mode) && OpenSSL.fips_mode
def get_dmi_property(dmi, thing)
%w{system base_board chassis}.each do |section|
@@ -37,6 +33,27 @@ Ohai.plugin(:ShardSeed) do
[:machinename, :serial, :uuid]
end
+ def default_digest_algorithm
+ if defined?(OpenSSL.fips_mode) && OpenSSL.fips_mode
+ # Even though it is being used safely, FIPS-mode will still blow up on
+ # any use of MD5 so default to SHA2 instead.
+ "sha256"
+ else
+ "md5"
+ end
+ end
+
+ def digest_algorithm
+ case Ohai.config[:plugin][:shard_seed][:digest_algorithm] || default_digest_algorithm
+ when "md5"
+ require "digest/md5"
+ Digest::MD5
+ when "sha256"
+ require "digest/sha2"
+ Digest::SHA256
+ end
+ end
+
# Common sources go here. Put sources that need to be different per-platform
# under their collect_data block.
def create_seed(&block)
@@ -56,7 +73,7 @@ Ohai.plugin(:ShardSeed) do
yield(src)
end
end
- shard_seed Digest::MD5.hexdigest(data)[0...7].to_i(16)
+ shard_seed digest_algorithm.hexdigest(data)[0...7].to_i(16)
end
collect_data(:darwin) do