Merge lp:~julian-edwards/maas/nonce-fix-bug-1190986 into lp:~maas-committers/maas/trunk

[Julian Edwards]

Fix nonce generation to use uuid.uuid4() rather than random [0-9]{8} string; makes nonce collisions WAY less likely.

Greg's branch, already reviewed by me, landing separately so I can backport rather that forward port.

https://code.launchpad.net/~lutostag/maas/1.5+nonce-generation-fix/+merge/226407

[Julian Edwards (julian-edwards)]

review: Approve

=== modified file 'etc/maas/templates/commissioning-user-data/snippets/maas_api_helper.py'
--- etc/maas/templates/commissioning-user-data/snippets/maas_api_helper.py	2013-10-22 23:45:39 +0000
+++ etc/maas/templates/commissioning-user-data/snippets/maas_api_helper.py	2014-07-15 02:47:25 +0000
@@ -12,6 +12,7 @@
 import sys
 import time
 import urllib2
+import uuid
 
 import oauth.oauth as oauth
 import yaml
@@ -60,7 +61,7 @@
 
     params = {
         'oauth_version': "1.0",
-        'oauth_nonce': oauth.generate_nonce(),
+        'oauth_nonce': uuid.uuid4().get_hex(),
         'oauth_timestamp': timestamp,
         'oauth_token': token.key,
         'oauth_consumer_key': consumer.key,

=== modified file 'src/apiclient/maas_client.py'
--- src/apiclient/maas_client.py	2014-07-10 16:44:15 +0000
+++ src/apiclient/maas_client.py	2014-07-15 02:47:25 +0000
@@ -22,6 +22,7 @@
 import gzip
 from io import BytesIO
 import urllib2
+import uuid
 
 from apiclient.encode_json import encode_json_data
 from apiclient.multipart import encode_multipart_data
@@ -46,7 +47,8 @@
             with the signature.
         """
         oauth_request = oauth.OAuthRequest.from_consumer_and_token(
-            self.consumer_token, token=self.resource_token, http_url=url)
+            self.consumer_token, token=self.resource_token, http_url=url,
+            parameters={'oauth_nonce': uuid.uuid4().get_hex()})
         oauth_request.sign_request(
             oauth.OAuthSignatureMethod_PLAINTEXT(), self.consumer_token,
             self.resource_token)