Core/grin
0
0
Fork 0
mirror of https://github.com/mimblewimble/grin.git synced 2025-01-20 19:11:08 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use constant-time token verification in API (#1690)

Browse source 
Fixes #1641. The size of the token can be leaked, even if we pad or cut user's input we can't make it indistinguishable form the normal case.
This commit is contained in:
hashmap 2018-10-09 15:32:53 +02:00 committed by Quentin Le Sceller
parent 7e7697bf4b
commit 8ee8043fd9
4 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Cargo.lock generated
View file

@ -681,6 +681,7 @@ dependencies = [
"hyper-rustls 0.14.0 (registry+https://github.com/rust-lang/crates.io-index)",
"lazy_static 1.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
"regex 1.0.5 (registry+https://github.com/rust-lang/crates.io-index)",
"ring 0.13.2 (registry+https://github.com/rust-lang/crates.io-index)",
"rustls 0.13.1 (registry+https://github.com/rust-lang/crates.io-index)",
"serde 1.0.79 (registry+https://github.com/rust-lang/crates.io-index)",
"serde_derive 1.0.79 (registry+https://github.com/rust-lang/crates.io-index)",

1
api/Cargo.toml
View file

@ -11,6 +11,7 @@ failure_derive = "0.1.1"
hyper = "0.12"
lazy_static = "1"
regex = "1"
ring = "0.13"
serde = "1"
serde_derive = "1"
serde_json = "1"

7
api/src/auth.rs
View file

@ -15,6 +15,7 @@
use futures::future::ok;
use hyper::header::{HeaderValue, AUTHORIZATION, WWW_AUTHENTICATE};
use hyper::{Body, Request, Response, StatusCode};
use ring::constant_time::verify_slices_are_equal;
use router::{Handler, HandlerObj, ResponseFuture};
// Basic Authentication Middleware
@ -38,8 +39,10 @@ impl Handler for BasicAuthMiddleware {
req: Request<Body>,
mut handlers: Box<Iterator<Item = HandlerObj>>,
) -> ResponseFuture {
if req.headers().contains_key(AUTHORIZATION)
&& req.headers()[AUTHORIZATION] == self.api_basic_auth
if req.headers().contains_key(AUTHORIZATION) && verify_slices_are_equal(
req.headers()[AUTHORIZATION].as_bytes(),
&self.api_basic_auth.as_bytes(),
).is_ok()
{
handlers.next().unwrap().call(req, handlers)
} else {

1
api/src/lib.rs
View file

@ -27,6 +27,7 @@ extern crate hyper;
#[macro_use]
extern crate lazy_static;
extern crate regex;
extern crate ring;
extern crate serde;
#[macro_use]
extern crate serde_derive;