Merge lp:~lutostag/maas/1.5+nonce-generation-fix into lp:maas/1.5

[Greg Lutostanski]

Fix nonce generation to use uuid.uuid4() rather than random [0-9]{8} string; makes nonce collisions WAY less likely.

Fix nonce generation to use uuid.uuid4() rather than random [0-9]{8} string; makes nonce collisions WAY less likely.

[Julian Edwards (julian-edwards)]

I think this is ok with my changes suggested in the diff comments, but please wait for a second opinion before landing.

review: Approve

[Julian Edwards (julian-edwards)]

Also, can you set a commit message and don't worry about the other branches for 1.6 and trunk, we'll migrate the revision directly.

[Julian Edwards (julian-edwards)]

On 11/07/14 16:50, Raphaël Badin wrote:
> Although the term nonce means "number used once", I don't see anything in the code that prevents us from using the canonical form of a UUID (i.e. with the dashes); The oauth specification explicitly says "A nonce is a random string, uniquely generated for each request."

Yes, but what I was driving at is that it's a lot nicer than using
string formatting.

[lp:~lutostag/maas/1.5+nonce-generation-fix]

2293. By Greg Lutostanski on 2014-07-11

use get_hex rather than string formatting to coerce nonce into a string

[Julian Edwards (julian-edwards)]

I'm going to merge this to trunk and then backport to release branches.

=== modified file 'etc/maas/templates/commissioning-user-data/snippets/maas_api_helper.py'
--- etc/maas/templates/commissioning-user-data/snippets/maas_api_helper.py	2013-10-22 23:45:39 +0000
+++ etc/maas/templates/commissioning-user-data/snippets/maas_api_helper.py	2014-07-11 14:30:38 +0000
@@ -12,6 +12,7 @@
 import sys
 import time
 import urllib2
+import uuid
 
 import oauth.oauth as oauth
 import yaml
@@ -60,7 +61,7 @@
 
     params = {
         'oauth_version': "1.0",
-        'oauth_nonce': oauth.generate_nonce(),
+        'oauth_nonce': uuid.uuid4().get_hex(),
         'oauth_timestamp': timestamp,
         'oauth_token': token.key,
         'oauth_consumer_key': consumer.key,
 
=== modified file 'src/apiclient/maas_client.py'
--- src/apiclient/maas_client.py	2014-04-29 06:57:26 +0000
+++ src/apiclient/maas_client.py	2014-07-11 14:30:38 +0000
@@ -21,6 +21,7 @@
 import gzip
 from io import BytesIO
 import urllib2
+import uuid
 
 from apiclient.encode_json import encode_json_data
 from apiclient.multipart import encode_multipart_data
@@ -45,7 +46,8 @@
             with the signature.
         """
         oauth_request = oauth.OAuthRequest.from_consumer_and_token(
-            self.consumer_token, token=self.resource_token, http_url=url)
+            self.consumer_token, token=self.resource_token, http_url=url,
+            parameters={'oauth_nonce': uuid.uuid4().get_hex()})
         oauth_request.sign_request(
             oauth.OAuthSignatureMethod_PLAINTEXT(), self.consumer_token,
             self.resource_token)