cloudstack-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bhais...@apache.org
Subject [1/3] git commit: updated refs/heads/master to 78c3ef0
Date Wed, 14 Jan 2015 14:50:23 GMT
Repository: cloudstack
Updated Branches:
  refs/heads/master 4eafdccc3 -> 78c3ef0e1


Use constant-time comparison functions when checking signatures

This limits the likeliness of timing attacks against the API.
See http://codahale.com/a-lesson-in-timing-attacks/ for the
full rationale.

Conflicts:
	server/src/com/cloud/api/ApiServer.java
	server/src/com/cloud/user/AccountManagerImpl.java


Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/9b4e39e8
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/9b4e39e8
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/9b4e39e8

Branch: refs/heads/master
Commit: 9b4e39e837af498599859c4a6687eb8bf9f8ad89
Parents: 185f7e0
Author: Pierre-Yves Ritschard <pyr@spootnik.org>
Authored: Wed Jan 14 11:27:35 2015 +0100
Committer: Pierre-Yves Ritschard <pyr@spootnik.org>
Committed: Wed Jan 14 11:32:29 2015 +0100

----------------------------------------------------------------------
 server/src/com/cloud/api/ApiServer.java         |  4 ++-
 .../com/cloud/api/ConstantTimeComparator.java   | 36 ++++++++++++++++++++
 .../com/cloud/servlet/ConsoleProxyServlet.java  |  3 +-
 .../src/com/cloud/user/AccountManagerImpl.java  |  4 ++-
 4 files changed, 44 insertions(+), 3 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9b4e39e8/server/src/com/cloud/api/ApiServer.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/ApiServer.java b/server/src/com/cloud/api/ApiServer.java
index e60af3b..357504f 100644
--- a/server/src/com/cloud/api/ApiServer.java
+++ b/server/src/com/cloud/api/ApiServer.java
@@ -910,9 +910,11 @@ public class ApiServer extends ManagerBase implements HttpRequestHandler,
ApiSer
             final SecretKeySpec keySpec = new SecretKeySpec(secretKey.getBytes(), "HmacSHA1");
             mac.init(keySpec);
             mac.update(unsignedRequest.getBytes());
+
             final byte[] encryptedBytes = mac.doFinal();
             final String computedSignature = Base64.encodeBase64String(encryptedBytes);
-            final boolean equalSig = signature.equals(computedSignature);
+            final boolean equalSig = ConstantTimeComparator.compareStrings(signature, computedSignature);
+
             if (!equalSig) {
                 s_logger.info("User signature: " + signature + " is not equaled to computed
signature: " + computedSignature);
             } else {

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9b4e39e8/server/src/com/cloud/api/ConstantTimeComparator.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/ConstantTimeComparator.java b/server/src/com/cloud/api/ConstantTimeComparator.java
new file mode 100644
index 0000000..4612eee
--- /dev/null
+++ b/server/src/com/cloud/api/ConstantTimeComparator.java
@@ -0,0 +1,36 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.api;
+
+public class ConstantTimeComparator {
+
+    public static boolean compareBytes(byte[] b1, byte[] b2) {
+        if (b1.length != b2.length) {
+            return false;
+        }
+
+        int result = 0;
+        for (int i = 0; i < b1.length; i++) {
+            result |= b1[i] ^ b2[i];
+        }
+        return result == 0;
+    }
+
+    public static boolean compareStrings(String s1, String s2) {
+        return compareBytes(s1.getBytes(), s2.getBytes());
+    }
+}

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9b4e39e8/server/src/com/cloud/servlet/ConsoleProxyServlet.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/servlet/ConsoleProxyServlet.java b/server/src/com/cloud/servlet/ConsoleProxyServlet.java
index 8cbe82b..2e79792 100644
--- a/server/src/com/cloud/servlet/ConsoleProxyServlet.java
+++ b/server/src/com/cloud/servlet/ConsoleProxyServlet.java
@@ -45,6 +45,7 @@ import com.google.gson.GsonBuilder;
 
 import org.apache.cloudstack.framework.security.keys.KeysManager;
 
+import com.cloud.api.ConstantTimeComparator;
 import com.cloud.exception.PermissionDeniedException;
 import com.cloud.host.HostVO;
 import com.cloud.hypervisor.Hypervisor;
@@ -659,7 +660,7 @@ public class ConsoleProxyServlet extends HttpServlet {
             mac.update(unsignedRequest.getBytes());
             byte[] encryptedBytes = mac.doFinal();
             String computedSignature = Base64.encodeBase64String(encryptedBytes);
-            boolean equalSig = signature.equals(computedSignature);
+            boolean equalSig = ConstantTimeComparator.compareStrings(signature, computedSignature);
             if (!equalSig) {
                 s_logger.debug("User signature: " + signature + " is not equaled to computed
signature: " + computedSignature);
             }

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9b4e39e8/server/src/com/cloud/user/AccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index 983a58a..36983cc 100644
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -63,6 +63,7 @@ import org.apache.cloudstack.managed.context.ManagedContextRunnable;
 import org.apache.cloudstack.region.gslb.GlobalLoadBalancerRuleDao;
 
 import com.cloud.api.ApiDBUtils;
+import com.cloud.api.ConstantTimeComparator;
 import com.cloud.api.query.vo.ControlledViewEntity;
 import com.cloud.configuration.Config;
 import com.cloud.configuration.ConfigurationManager;
@@ -488,6 +489,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager,
M
 
     @Override
     public void checkAccess(Account caller, AccessType accessType, boolean sameOwner, String
apiName, ControlledEntity... entities) {
+
         //check for the same owner
         Long ownerId = null;
         ControlledEntity prevEntity = null;
@@ -2061,7 +2063,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager,
M
                 mac.update(unsignedRequest.getBytes());
                 byte[] encryptedBytes = mac.doFinal();
                 String computedSignature = new String(Base64.encodeBase64(encryptedBytes));
-                boolean equalSig = signature.equals(computedSignature);
+                boolean equalSig = ConstantTimeComparator.compareStrings(signature, computedSignature);
                 if (!equalSig) {
                     s_logger.info("User signature: " + signature + " is not equaled to computed
signature: " + computedSignature);
                 } else {


Mime
View raw message