mirrors/garage
1
0
Fork 0
mirror of https://git.deuxfleurs.fr/Deuxfleurs/garage.git synced 2024-11-25 01:21:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

[fix-auth-ct-eq] use consant time comparison for awsv4 signature verification

Browse source
This commit is contained in:
Alex Auvolat 2024-02-29 12:43:25 +01:00
parent c00a028cc8
commit 70899b0e37
No known key found for this signature in database
GPG key ID: 0E496D15096376BE
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/api/signature/payload.rs
View file

@ -350,9 +350,9 @@ pub async fn verify_v4(
)
.ok_or_internal_error("Unable to build signing HMAC")?;
hmac.update(payload);
let our_signature = hex::encode(hmac.finalize().into_bytes());
if signature != our_signature {
return Err(Error::forbidden("Invalid signature".to_string()));
let signature = hex::decode(&signature).map_err(|_| Error::forbidden("Invalid signature"))?;
if hmac.verify_slice(&signature).is_err() {
return Err(Error::forbidden("Invalid signature"));
}
Ok(key)