From 601f681787c8d6c02bb3566b8cefde289377be0e Mon Sep 17 00:00:00 2001
From: Eli Young <elyscape@gmail.com>
Date: Thu, 28 May 2015 18:15:05 -0700
Subject: fqdn_rotate: Don't use the value itself as part of the random seed

Previously, the random number generator was seeded with the array or
string to be rotated in addition to any values specifically provided for
seeding. This behavior is potentially insecure in that it allows an
attacker who can modify the source data to choose the post-shuffle
order.
---
 lib/puppet/parser/functions/fqdn_rotate.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib/puppet/parser')

diff --git a/lib/puppet/parser/functions/fqdn_rotate.rb b/lib/puppet/parser/functions/fqdn_rotate.rb
index d9741a0..e1a50e6 100644
--- a/lib/puppet/parser/functions/fqdn_rotate.rb
+++ b/lib/puppet/parser/functions/fqdn_rotate.rb
@@ -11,7 +11,7 @@ Rotates an array a random number of times based on a nodes fqdn.
     raise(Puppet::ParseError, "fqdn_rotate(): Wrong number of arguments " +
       "given (#{arguments.size} for 1)") if arguments.size < 1
 
-    value = arguments[0]
+    value = arguments.shift
     require 'digest/md5'
 
     unless value.is_a?(Array) || value.is_a?(String)
-- 
cgit v1.2.3


From d7c846035321774e824e3424f59cb24703fcfb2a Mon Sep 17 00:00:00 2001
From: Eli Young <elyscape@gmail.com>
Date: Mon, 1 Jun 2015 16:09:47 -0700
Subject: fqdn_rotate: Improve documentation

---
 lib/puppet/parser/functions/fqdn_rotate.rb | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

(limited to 'lib/puppet/parser')

diff --git a/lib/puppet/parser/functions/fqdn_rotate.rb b/lib/puppet/parser/functions/fqdn_rotate.rb
index e1a50e6..b66431d 100644
--- a/lib/puppet/parser/functions/fqdn_rotate.rb
+++ b/lib/puppet/parser/functions/fqdn_rotate.rb
@@ -2,16 +2,23 @@
 # fqdn_rotate.rb
 #
 
-module Puppet::Parser::Functions
-  newfunction(:fqdn_rotate, :type => :rvalue, :doc => <<-EOS
-Rotates an array a random number of times based on a nodes fqdn.
-    EOS
-  ) do |arguments|
+Puppet::Parser::Functions.newfunction(
+  :fqdn_rotate,
+  :type => :rvalue,
+  :doc => "Usage: `fqdn_rotate(VALUE, [SEED])`. VALUE is required and
+  must be an array or a string. SEED is optional and may be any number
+  or string.
+
+  Rotates VALUE a random number of times, combining the `$fqdn` fact and
+  the value of SEED for repeatable randomness. (That is, each node will
+  get a different random rotation from this function, but a given node's
+  result will be the same every time unless its hostname changes.) Adding
+  a SEED can be useful if you need more than one unrelated rotation.") do |args|
 
     raise(Puppet::ParseError, "fqdn_rotate(): Wrong number of arguments " +
-      "given (#{arguments.size} for 1)") if arguments.size < 1
+      "given (#{args.size} for 1)") if args.size < 1
 
-    value = arguments.shift
+    value = args.shift
     require 'digest/md5'
 
     unless value.is_a?(Array) || value.is_a?(String)
@@ -31,7 +38,7 @@ Rotates an array a random number of times based on a nodes fqdn.
 
     elements = result.size
 
-    seed = Digest::MD5.hexdigest([lookupvar('::fqdn'),arguments].join(':')).hex
+    seed = Digest::MD5.hexdigest([lookupvar('::fqdn'),args].join(':')).hex
     # deterministic_rand() was added in Puppet 3.2.0; reimplement if necessary
     if Puppet::Util.respond_to?(:deterministic_rand)
       offset = Puppet::Util.deterministic_rand(seed, elements).to_i
@@ -51,7 +58,6 @@ Rotates an array a random number of times based on a nodes fqdn.
     result = string ? result.join : result
 
     return result
-  end
 end
 
 # vim: set ts=2 sw=2 et :
-- 
cgit v1.2.3