diff options
author | Noah Kantrowitz <noah@coderanger.net> | 2018-04-16 11:59:07 -0700 |
---|---|---|
committer | Noah Kantrowitz <noah@coderanger.net> | 2018-04-18 22:32:20 -0700 |
commit | b198b77215d46d843b5ffe05a8d2ea17d2457a2e (patch) | |
tree | 53b60b2f435806a38db58eb46b3978460beab237 | |
parent | 5e2067038d1cc80ada70a35d1e9e7bfbc3db2d3b (diff) | |
download | ohai-b198b77215d46d843b5ffe05a8d2ea17d2457a2e.tar.gz |
Make the digest algorithm configurable and default to SHA2 under FIPS-mode.
Signed-off-by: Noah Kantrowitz <noah@coderanger.net>
-rw-r--r-- | lib/ohai/plugins/shard.rb | 27 |
1 files changed, 22 insertions, 5 deletions
diff --git a/lib/ohai/plugins/shard.rb b/lib/ohai/plugins/shard.rb index 85560507..5bed48e1 100644 --- a/lib/ohai/plugins/shard.rb +++ b/lib/ohai/plugins/shard.rb @@ -18,12 +18,8 @@ Ohai.plugin(:ShardSeed) do require "openssl" - require "digest/md5" depends "hostname", "dmi", "machine_id", "machinename" provides "shard_seed" - # Disable this plugin by default under FIPS mode because even though we aren't - # using MD5 for cryptography, it will still throw up an error. - optional true if defined?(OpenSSL.fips_mode) && OpenSSL.fips_mode def get_dmi_property(dmi, thing) %w{system base_board chassis}.each do |section| @@ -37,6 +33,27 @@ Ohai.plugin(:ShardSeed) do [:machinename, :serial, :uuid] end + def default_digest_algorithm + if defined?(OpenSSL.fips_mode) && OpenSSL.fips_mode + # Even though it is being used safely, FIPS-mode will still blow up on + # any use of MD5 so default to SHA2 instead. + "sha256" + else + "md5" + end + end + + def digest_algorithm + case Ohai.config[:plugin][:shard_seed][:digest_algorithm] || default_digest_algorithm + when "md5" + require "digest/md5" + Digest::MD5 + when "sha256" + require "digest/sha2" + Digest::SHA256 + end + end + # Common sources go here. Put sources that need to be different per-platform # under their collect_data block. def create_seed(&block) @@ -56,7 +73,7 @@ Ohai.plugin(:ShardSeed) do yield(src) end end - shard_seed Digest::MD5.hexdigest(data)[0...7].to_i(16) + shard_seed digest_algorithm.hexdigest(data)[0...7].to_i(16) end collect_data(:darwin) do |