use uuid.NewSHA1 package to generate uuids

[tariq1890]

Here is a post that goes into detail on the security limitations of the math/rand package.

Since the IMEX changes haven't publicised yet, I thought this would be a safe starting point to implement this change

[tariq1890]

It looks like CodeQL runs on an earlier version of Go

[ArangoGutierrez]

lgtm
@elezar ?

[klueska]

Have you tested to ensure that the generated UUID is the same for a constant seed value?

[tariq1890]

I haven't had the chance to test this on a running k8s cluster. I'll keep you posted on that.

However, I tried this sample go programme and I was able to confirm that UUID was generated deterministically for a given seed

func main() {

	ips := []string{
		"10.130.3.24",
		"10.130.3.53",
		"10.130.3.23",
		"10.130.3.31",
		"10.130.3.27",
		"10.130.3.25",
	}
	sort.Strings(ips)

	seed := strings.Join(ips, "\n")
	r := rand.NewChaCha8(sha256.Sum256([]byte(seed)))
	charset := make([]byte, 16)
	_, err := r.Read(charset)
	if err != nil {
		fmt.Printf("Error generating random number: %v", err)
	}
	u, _ := uuid.FromBytes(charset)

	fmt.Printf("Output: %s\n", u.String())
}

[elezar]

We are not using these random numbers to generate a cryptographically secure random number -- we just want a unique idenfiier for a set of input IPs. I'm happy to make this change, but let's add tests that capture the behaviour since we can't have IMEX domain IDs changing across device plugin updates.

[elezar]

Given the following post: https://stackoverflow.com/questions/77925673/generate-uuid-based-on-a-namespace-string-in-go

Would switching to using:

uuid.NewSHA1(namespace, content)

https://pkg.go.dev/github.com/google/uuid#NewSHA1

or https://pkg.go.dev/github.com/google/uuid#NewMD5

where namespace would be a cluster-wide constant and content is the content of the sorted IMEX config file.

[elezar]

If we're going to make a change such as this we should use the uuid.NewSHA1 or uuid.NewMD5 functions instead of rolling our own.

This was called out in the review of the original code in #965

[elezar]

Thanks @tariq1890