chore: Enable G404 rule for gosec

[zak-pawel]

PR:

• Introduces github.com/chanxuehong/rand dependency which provides random number/bytes related functions - it has interface very similar to math/rand, except that it prefers to use crypto/rand to implement functions.
• Enables gosec:G404 rule.
• Fixes gosec G404: Use of weak random number generator (math/rand instead of crypto/rand) for production code.
• Ignores mentioned findings for test code.

resolves: #12949

[powersj]

github.com/chanxuehong/rand

Why use this over using "crypto/rand" directly? I realize this is a small addition, but if we can do it without yet another dependency I would prefer that.

[zak-pawel]

github.com/chanxuehong/rand

Why use this over using "crypto/rand" directly? I realize this is a small addition, but if we can do it without yet another dependency I would prefer that.

@powersj
This is API of math/rand:

And this is API of crypto/rand:

This library provides almost the same API as math/rand but prefers to use crypto/rand.

Alternatively we can write our own wrapper...

[powersj]

I am aware of the larger API. My question is in order to justify the addition of a dependency that has not been updated in 2 years with what appears to be near zero usage can you report how many of those functions we would need to wrap instead?

[zak-pawel]

can you report how many of those functions we would need to wrap instead?

• rand.Int31n
• rand.Int63
• rand.Int63n
• rand.Intn
• rand.Float64

[zak-pawel]

@powersj Alternatively, we can just copy these 4-5 files to our repo, review correctness of algorithms (eg. compare with current implementation of math/rand) and have it in Telegraf's codebase.

[powersj]

Thanks for looking into how many functions we actually use.

With only 5 functions I would prefer we have our own copys in internal and not add the external dependency please. I don't think we should wholesale copy that project, but instead just write replacements for those 5 functions.

Thanks again

[zak-pawel]

Thanks for looking into how many functions we actually use.

With only 5 functions I would prefer we have our own copys in internal and not add the external dependency please. I don't think we should wholesale copy that project, but instead just write replacements for those 5 functions.

@powersj
I'm starting to wonder if we really want to do this work to "fix" only these findings? Maybe it is not worth it...

internal/internal.go:128:13                            gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
internal/internal.go:146:13                            gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
plugins/inputs/example/example.go:106:13               gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
plugins/inputs/mock/mock.go:69:11                      gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
plugins/inputs/powerdns_recursor/protocol_v1.go:22:18  gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
plugins/inputs/powerdns_recursor/protocol_v2.go:20:18  gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
plugins/inputs/statsd/running_stats.go:84:11           gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
plugins/inputs/vsphere/endpoint.go:572:13              gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)

[powersj]

internal/internal.go:128:13                            gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
internal/internal.go:146:13                            gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)

these two are for random sleep and random duration, probably not something that needs to be cryptographically secure, can ignore

plugins/inputs/example/example.go:106:13               gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)

example plugin, don't care about this other than maybe removing it from the example as a bad practice?

plugins/inputs/mock/mock.go:69:11                      gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)

used for generating random, non-critical data, can ignore

plugins/inputs/powerdns_recursor/protocol_v1.go:22:18  gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
plugins/inputs/powerdns_recursor/protocol_v2.go:20:18  gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)

used to set up socket file with random-ish name, can ignore

plugins/inputs/statsd/running_stats.go:84:11           gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)
plugins/inputs/vsphere/endpoint.go:572:13           gosec  G404: Use of weak random number generator (math/rand instead of crypto/rand)   

both pick random index, can ignore

[zak-pawel]

@powersj Do you propose we should not enable this rule at all or we should enable it and ignore all tests occurences (in .golangci.yml) and explicitly ignore all existing occurences in non-test code?

[powersj]

I'd like to hear from @srebhan if he agrees with my assessment above first. However, I am leaning towards not enabling.

[zak-pawel]

@srebhan A penny for your thoughts :)

[srebhan]

@srebhan A penny for your thoughts :)

@zak-pawel usually I'm paid in beer... ;-P

In my opinion we should enable G404 to make us aware about weak RNGs during review. Otherwise I would silence the following occurrences without any code change:

• internal/internal.go:128 and internal/internal.go:146 as not security critical
• plugins/inputs/mock/mock.go:69 as not security critical
• plugins/inputs/statsd/running_stats.go:84 as not security critical
• plugins/inputs/vsphere/endpoint.go:572 as not security critical

For the following occurrences I suggest modifying the code as follows:

• plugins/inputs/example/example.go:106 change the example to not use random numbers
• plugins/inputs/powerdns_recursor/protocol_v1.go:22 and plugins/inputs/powerdns_recursor/protocol_v2.go:20 replace the random-number with either a os.CreateTemp construct or a UUID or omit the laddr and get the LocalAddr of the socket (not sure if this works in that case).

Does that help?

[telegraf-tiger]

Download PR build artifacts for linux_amd64.tar.gz, darwin_amd64.tar.gz, and windows_amd64.zip.
Downloads for additional architectures and packages are available below.

🥳 This pull request decreases the Telegraf binary size by -2.33 % for linux amd64 (new size: 168.8 MB, nightly size 172.8 MB)

📦 Click here to get additional PR build artifacts

Artifact URLs

DEB	RPM	TAR GZ	ZIP
amd64.deb	aarch64.rpm	darwin_amd64.tar.gz	windows_amd64.zip
arm64.deb	armel.rpm	darwin_arm64.tar.gz	windows_arm64.zip
armel.deb	armv6hl.rpm	freebsd_amd64.tar.gz	windows_i386.zip
armhf.deb	i386.rpm	freebsd_armv7.tar.gz
i386.deb	ppc64le.rpm	freebsd_i386.tar.gz
mips.deb	riscv64.rpm	linux_amd64.tar.gz
mipsel.deb	s390x.rpm	linux_arm64.tar.gz
ppc64el.deb	x86_64.rpm	linux_armel.tar.gz
riscv64.deb		linux_armhf.tar.gz
s390x.deb		linux_i386.tar.gz
		linux_mips.tar.gz
		linux_mipsel.tar.gz
		linux_ppc64le.tar.gz
		linux_riscv64.tar.gz
		linux_s390x.tar.gz

[srebhan]

Nice. Thanks @zak-pawel!