From 000ea7d13e261640025136d57239a1cfb2a21f04 Mon Sep 17 00:00:00 2001
From: Andrew White <andrewh@cdw.com>
Date: Sun, 26 Jul 2026 10:21:28 -0500
Subject: [PATCH] fix(playbooks): correct off-by-one field count check in
 redfish.py hosts parsing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

`playbooks/files/redfish.py` reads an Ansible-style hosts file and
queries each host's BMC over the RedFish API to verify BIOS settings for
confidential computing. If a host line in the hosts file is missing one
or two trailing fields (e.g. no `bmc_password=`), the script crashes
with an unhandled `IndexError` instead of printing the intended "Please
update BMC IP, Username and Password details in hosts file" hint.

## Root cause

```python
bmc = item.strip().split(' ')
if len(bmc) > 6:
    host = bmc[6]
    user = bmc[7]
    pas = bmc[8]
```

The guard `len(bmc) > 6` only guarantees index 6 exists, but the body
also indexes `bmc[7]` and `bmc[8]`. A well-formed line has 9 fields
(indices 0-8; the quoted `ansible_ssh_common_args='-o ...'` value splits
into two tokens on the space). Lines with 7 or 8 fields pass the check
and then crash:

| fields in line | len(bmc) | old check passes? | result |
|---|---|---|---|
| 9 (well-formed) | 9 | yes | OK |
| 8 (missing password) | 8 | yes | IndexError at bmc[8] |
| 7 (missing user+password) | 7 | yes | IndexError at bmc[7] |
| <=6 | <=6 | no | prints usage hint |

Reproducer hosts file:

```
node1 ansible_ssh_user=nvidia ansible_ssh_pass=nvidia ansible_sudo_pass=nvidia bmc_ip=192.0.2.2 bmc_username=root
```

```
Traceback (most recent call last):
  File "redfish.py", line 19, in <module>
    user = bmc[7]
IndexError: list index out of range
```

## Fix

One-character-class change: require all three indices to exist.

```python
if len(bmc) > 8:
```

## Testing

No automated tests exist in this repo for the playbooks or helper
scripts (no CI configuration present), so the script was exercised
manually with `uv run --with requests python3 redfish.py hosts` against
a fixture hosts file containing:

1. a well-formed 9-field line (unreachable TEST-NET BMC IP),
2. a 7-field line (missing `bmc_password=` and one more field),
3. an 8-field line (missing `bmc_password=`).

- Unmodified script (from `master`): crashes with
  `IndexError: list index out of range` on line 19 for case 2 — bug
  reproduced.
- Fixed script: case 1 still attempts the RedFish connection (prints
  "Server is not for RedFish API" for the unreachable IP, as before),
  and cases 2 and 3 now print the intended "Please update BMC IP,
  Username and Password details in hosts file" hint; exit code 0.
- `python3 -m py_compile playbooks/files/redfish.py` passes.

## Why existing tests missed it

The repository has no test suite or CI for this helper script; it is run
manually against a site-specific hosts file, which in practice always
contained well-formed lines.
---
 playbooks/files/redfish.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/playbooks/files/redfish.py b/playbooks/files/redfish.py
index d239b316..c52f6e5c 100755
--- a/playbooks/files/redfish.py
+++ b/playbooks/files/redfish.py
@@ -14,7 +14,7 @@
         print(' ')
     else:
         bmc = item.strip().split(' ')
-        if len(bmc) > 6:
+        if len(bmc) > 8:
             host = bmc[6]
             user = bmc[7]
             pas = bmc[8]