From 791ec89c5e18de8a70f9d417677a7e35421249fb Mon Sep 17 00:00:00 2001 From: Jeff Wendling Date: Tue, 14 May 2019 21:08:52 +0000 Subject: [PATCH] make caveat nonces random (#1964) --- cmd/uplink/cmd/share.go | 6 +++++- pkg/macaroon/caveat.go | 9 ++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/cmd/uplink/cmd/share.go b/cmd/uplink/cmd/share.go index 52d2bfe6e..6a8d94ed7 100644 --- a/cmd/uplink/cmd/share.go +++ b/cmd/uplink/cmd/share.go @@ -88,7 +88,11 @@ func shareMain(cmd *cobra.Command, args []string) (err error) { return err } - caveat := macaroon.NewCaveat() + caveat, err := macaroon.NewCaveat() + if err != nil { + return err + } + caveat.DisallowDeletes = shareCfg.DisallowDeletes || shareCfg.Readonly caveat.DisallowLists = shareCfg.DisallowLists || shareCfg.Writeonly caveat.DisallowReads = shareCfg.DisallowReads || shareCfg.Writeonly diff --git a/pkg/macaroon/caveat.go b/pkg/macaroon/caveat.go index 898281d44..6ce0fff4e 100644 --- a/pkg/macaroon/caveat.go +++ b/pkg/macaroon/caveat.go @@ -4,14 +4,13 @@ package macaroon import ( - "encoding/binary" - "time" + "crypto/rand" ) // NewCaveat returns a Caveat with a nonce initialized to the current timestamp // in nanoseconds. -func NewCaveat() Caveat { +func NewCaveat() (Caveat, error) { var buf [8]byte - binary.BigEndian.PutUint64(buf[:], uint64(time.Now().UnixNano())) - return Caveat{Nonce: buf[:]} + _, err := rand.Read(buf[:]) + return Caveat{Nonce: buf[:]}, err }