Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
Cloud:OpenStack:Havana
openstack-swift-doc
swift-tempurl-timing.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File swift-tempurl-timing.patch of Package openstack-swift-doc
commit 6c378b4b65524ea3b485c47d829ed0aebbdb86c0 Author: Samuel Merritt <sam@swiftstack.com> Date: Fri Jan 3 09:26:11 2014 -0800 Backported tempurl const time compare for 1.10.0 Change-Id: I6db8f9a568dab8403ed74a83ba0c9548f06425e1 diff --git a/swift/common/middleware/tempurl.py b/swift/common/middleware/tempurl.py index ffc1431..ae2f4a1 100644 --- a/swift/common/middleware/tempurl.py +++ b/swift/common/middleware/tempurl.py @@ -98,7 +98,7 @@ from urlparse import parse_qs from swift.proxy.controllers.base import get_account_info from swift.common.swob import HeaderKeyDict -from swift.common.utils import split_path +from swift.common.utils import split_path, streq_const_time #: Default headers to remove from incoming requests. Simply a whitespace @@ -267,17 +267,20 @@ class TempURL(object): if not keys: return self._invalid(env, start_response) if env['REQUEST_METHOD'] == 'HEAD': - hmac_vals = self._get_hmacs(env, temp_url_expires, keys, - request_method='GET') - if temp_url_sig not in hmac_vals: - hmac_vals = self._get_hmacs(env, temp_url_expires, keys, - request_method='PUT') - if temp_url_sig not in hmac_vals: - return self._invalid(env, start_response) + hmac_vals = (self._get_hmacs(env, temp_url_expires, keys, + request_method='GET') + + self._get_hmacs(env, temp_url_expires, keys, + request_method='PUT')) else: hmac_vals = self._get_hmacs(env, temp_url_expires, keys) - if temp_url_sig not in hmac_vals: - return self._invalid(env, start_response) + + # While it's true that any() will short-circuit, this doesn't affect + # the timing-attack resistance since the only way this will + # short-circuit is when a valid signature is passed in. + is_valid_hmac = any(streq_const_time(temp_url_sig, h) + for h in hmac_vals) + if not is_valid_hmac: + return self._invalid(env, start_response) self._clean_incoming_headers(env) env['swift.authorize'] = lambda req: None env['swift.authorize_override'] = True
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor