engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactor code to use subtle.ConstantTimeCompare for secure comparison (#466)

Browse source 
* Refactor code to use subtle.ConstantTimeCompare for secure comparison

* Refactor code to use subtle.ConstantTimeCompare for secure comparison
This commit is contained in:
Boshi Lian 2024-10-21 02:46:19 -07:00 • committed by GitHub
parent 3087aa4eb6
commit a3f69952c0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
plugin/docker/docker.go
View file

@ -3,8 +3,8 @@
package main
import (
"bytes"
"context"
"crypto/subtle"
"encoding/base64"
"fmt"
"net"
@ -211,7 +211,7 @@ func (p *plugin) findAndCreateUpstream(conn libplugin.ConnMetadata, password str
return nil, err
}
if bytes.Equal(authedPubkey.Marshal(), publicKey) {
if subtle.ConstantTimeCompare(authedPubkey.Marshal(), publicKey) == 1 {
return p.createUpstream(conn, pipe, "")
}
}

4
plugin/internal/workingdir/workingdir.go
View file

@ -2,7 +2,7 @@ package workingdir
import (
"bufio"
"bytes"
"crypto/subtle"
"fmt"
"os"
"path"
@ -60,7 +60,7 @@ func (w *Workingdir) Mapkey(pub []byte) ([]byte, error) {
return nil, err
}
if bytes.Equal(authedPubkey.Marshal(), pub) {
if subtle.ConstantTimeCompare(authedPubkey.Marshal(), pub) == 1 {
log.Infof("found mapping key %v", w.fullpath(userKeyFile))
return w.Readfile(userKeyFile)
}

3
plugin/kubernetes/kubernetes.go
View file

@ -3,6 +3,7 @@ package main
import (
"bytes"
"context"
"crypto/subtle"
"encoding/base64"
"fmt"
"os"
@ -295,7 +296,7 @@ func (p *plugin) findAndCreateUpstream(conn libplugin.ConnMetadata, password str
return nil, err
}
if bytes.Equal(authedPubkey.Marshal(), publicKey) {
if subtle.ConstantTimeCompare(authedPubkey.Marshal(), publicKey) == 1 {
return p.createUpstream(conn, pipe, "")
}
}

3
plugin/yaml/yaml.go
View file

@ -4,6 +4,7 @@ package main
import (
"bytes"
"crypto/subtle"
"encoding/base64"
"fmt"
"os"
@ -329,7 +330,7 @@ func (p *plugin) findAndCreateUpstream(conn libplugin.ConnMetadata, password str
return nil, err
}
if bytes.Equal(authedPubkey.Marshal(), publicKey) {
if subtle.ConstantTimeCompare(authedPubkey.Marshal(), publicKey) == 1 {
return p.createUpstream(conn, pipe.To, "")
}
}