development/git
development/git
1
0
Fork 0
mirror of https://github.com/git/git synced 2024-08-27 11:39:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
git/builtin
History
brian m. carlson edc6dccf81 builtin/receive-pack: use constant-time comparison for HMAC value 
When we're comparing a push cert nonce, we currently do so using strcmp.
Most implementations of strcmp short-circuit and exit as soon as they
know whether two values are equal.  This, however, is a problem when
we're comparing the output of HMAC, as it leaks information in the time
taken about how much of the two values match if they do indeed differ.

In our case, the nonce is used to prevent replay attacks against our
server via the embedded timestamp and replay attacks using requests from
a different server via the HMAC.  Push certs, which contain the nonces,
are signed, so an attacker cannot tamper with the nonces without
breaking validation of the signature.  They can, of course, create their
own signatures with invalid nonces, but they can also create their own
signatures with valid nonces, so there's nothing to be gained.  Thus,
there is no security problem.

Even though it doesn't appear that there are any negative consequences
from the current technique, for safety and to encourage good practices,
let's use a constant time comparison function for nonce verification.
POSIX does not provide one, but they are easy to write.

The technique we use here is also used in NaCl and the Go standard
library and relies on the fact that bitwise or and xor are constant time
on all known architectures.

We need not be concerned about exiting early if the actual and expected
lengths differ, since the standard cryptographic assumption is that
everyone, including an attacker, knows the format of and algorithm used
in our nonces (and in any event, they have the source code and can
determine it easily).  As a result, we assume everyone knows how long
our nonces should be.  This philosophy is also taken by the Go standard
library and other cryptographic libraries when performing constant time
comparisons on HMAC values.

Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2020-04-09 18:17:27 -07:00
..
add.c add: error appropriately on repository with no commits 2019-04-10 12:52:50 +09:00
am.c Merge branch 'en/merge-recursive-cleanup' 2019-10-15 13:47:59 +09:00
annotate.c
apply.c apply.c: make init_apply_state() take a struct repository 2018-08-13 14:14:44 -07:00
archive.c pack-protocol.txt: accept error packets in any context 2019-01-02 13:05:30 -08:00
bisect--helper.c bisect--helper: verify HEAD could be parsed before continuing 2019-05-28 10:51:01 -07:00
blame.c Merge branch 'rs/dedup-includes' 2019-10-11 14:24:48 +09:00
branch.c Merge branch 'po/doc-branch' into maint 2019-07-29 12:38:16 -07:00
bundle.c create_bundle(): drop unused "header" parameter 2019-01-24 12:35:44 -08:00
cat-file.c Merge branch 'cc/multi-promisor' 2019-09-18 11:50:09 -07:00
check-attr.c cache.h: flip NO_THE_INDEX_COMPATIBILITY_MACROS switch 2019-01-24 11:55:06 -08:00
check-ignore.c treewide: rename 'exclude' methods to 'pattern' 2019-09-05 14:05:12 -07:00
check-mailmap.c
check-ref-format.c
checkout-index.c Merge branch 'nd/the-index-final' 2019-02-06 22:05:23 -08:00
checkout.c Merge branch 'en/merge-recursive-cleanup' 2019-10-15 13:47:59 +09:00
clean.c Merge branch 'en/clean-nested-with-ignored' 2019-10-11 14:24:46 +09:00
clone.c Sync with 2.23.1 2019-12-06 16:31:39 +01:00
column.c builtin: consistently pass cmd_* prefix to parse_options 2019-05-13 14:22:53 +09:00
commit-graph.c Merge branch 'gs/commit-graph-trace-with-cmd' 2019-10-15 13:48:00 +09:00
commit-tree.c commit-tree: utilize parse-options api 2019-03-08 10:31:24 +09:00
commit.c wt-status: convert struct wt_status to object_id 2019-08-19 15:04:59 -07:00
config.c Merge branch 'jk/save-getenv-result' 2019-01-29 12:47:54 -08:00
count-objects.c rename "alternate_object_database" to "object_directory" 2018-11-13 14:22:02 +09:00
credential.c
describe.c Merge branch 'ew/hashmap' 2019-10-15 13:48:02 +09:00
diff-files.c cache.h: flip NO_THE_INDEX_COMPATIBILITY_MACROS switch 2019-01-24 11:55:06 -08:00
diff-index.c cache.h: flip NO_THE_INDEX_COMPATIBILITY_MACROS switch 2019-01-24 11:55:06 -08:00
diff-tree.c Merge branch 'en/combined-all-paths' 2019-03-07 09:59:54 +09:00
diff.c Merge branch 'nd/diff-parseopt-4' 2019-04-25 16:41:12 +09:00
difftool.c hashmap: remove type arg from hashmap_{get,put,remove}_entry 2019-10-07 10:20:12 +09:00
env--helper.c env--helper: mark a file-local symbol as static 2019-07-11 14:31:04 -07:00
fast-export.c Merge branch 'ew/hashmap' 2019-10-15 13:48:02 +09:00
fetch-pack.c fetch_pack(): drop unused parameters 2019-03-20 18:34:09 +09:00
fetch.c fetch: delay fetch_if_missing=0 until after config 2019-10-24 11:34:44 +09:00
fmt-merge-msg.c Merge branch 'nd/the-index' 2018-10-19 13:34:02 +09:00
for-each-ref.c parse_opt_ref_sorting: always use with NONEG flag 2019-03-21 12:03:35 +09:00
fsck.c object: convert lookup_object() to use object_id 2019-06-20 10:18:09 -07:00
gc.c Merge branch 'cc/multi-promisor' 2019-09-18 11:50:09 -07:00
get-tar-commit-id.c builtin/get-tar-commit-id: make hash size independent 2019-04-01 11:57:39 +09:00
grep.c Merge branch 'cb/pcre2-chartables-leakfix' 2019-10-23 14:43:11 +09:00
hash-object.c builtin: consistently pass cmd_* prefix to parse_options 2019-05-13 14:22:53 +09:00
help.c completion: add more parameter value completion 2019-02-20 12:31:56 -08:00
index-pack.c Merge branch 'bc/object-id-part17' 2019-10-11 14:24:46 +09:00
init-db.c Merge branch 'nd/init-relative-template-fix' into maint 2019-07-25 14:27:06 -07:00
interpret-trailers.c interpret-trailers: load default config 2019-06-19 07:12:49 -07:00
log.c Merge branch 'bw/format-patch-o-create-leading-dirs' 2019-10-18 11:40:48 +09:00
ls-files.c Merge branch 'ds/include-exclude' 2019-09-30 13:19:32 +09:00
ls-remote.c parse_opt_ref_sorting: always use with NONEG flag 2019-03-21 12:03:35 +09:00
ls-tree.c Merge branch 'nd/attr-pathspec-in-tree-walk' 2019-01-14 15:29:28 -08:00
mailinfo.c
mailsplit.c
merge-base.c Merge branch 'pk/rebase-in-c-4-opts' 2018-11-02 11:04:55 +09:00
merge-file.c assert NOARG/NONEG behavior of parse-options callbacks 2018-11-06 12:56:29 +09:00
merge-index.c cache.h: flip NO_THE_INDEX_COMPATIBILITY_MACROS switch 2019-01-24 11:55:06 -08:00
merge-ours.c cache.h: flip NO_THE_INDEX_COMPATIBILITY_MACROS switch 2019-01-24 11:55:06 -08:00
merge-recursive.c Ensure index matches head before invoking merge machinery, round N 2019-08-19 10:08:03 -07:00
merge-tree.c Merge branch 'jk/tree-walk-overflow' 2019-08-22 12:34:10 -07:00
merge.c Merge branch 'tg/stash-refresh-index' 2019-10-07 11:32:53 +09:00
mktag.c object-store: move object access functions to object-store.h 2018-05-16 11:42:03 +09:00
mktree.c mktree: drop unused length parameter 2019-05-13 14:22:54 +09:00
multi-pack-index.c multi-pack-index: prepare 'repack' subcommand 2019-06-11 10:34:40 -07:00
mv.c cache.h: flip NO_THE_INDEX_COMPATIBILITY_MACROS switch 2019-01-24 11:55:06 -08:00
name-rev.c name-rev: avoid cutoff timestamp underflow 2019-09-28 13:36:04 +09:00
notes.c Merge branch 'nd/the-index' into md/list-objects-filter-by-depth 2019-01-15 15:38:29 -08:00
pack-objects.c Merge branch 'jk/misc-uninitialized-fixes' 2019-09-30 13:19:30 +09:00
pack-redundant.c object-store: rename and expand packed_git's sha1 member 2019-04-01 11:57:38 +09:00
pack-refs.c Honor core.precomposeUnicode in more places 2019-04-26 10:54:03 +09:00
patch-id.c patch-id: convert to use the_hash_algo 2019-08-19 15:04:57 -07:00
prune-packed.c Merge branch 'rj/prune-packed-excess-args' 2019-03-07 09:59:55 +09:00
prune.c object: convert lookup_object() to use object_id 2019-06-20 10:18:09 -07:00
pull.c pull, fetch: add --set-upstream option 2019-08-19 13:05:58 -07:00
push.c Merge branch 'js/trace2-fetch-push' 2019-10-15 13:48:03 +09:00
range-diff.c builtin: consistently pass cmd_* prefix to parse_options 2019-05-13 14:22:53 +09:00
read-tree.c cmd_{read,write}_tree: rename "unused" variable that is used 2019-05-13 14:22:53 +09:00
rebase.c Merge branch 'bw/rebase-autostash-keep-current-branch' 2019-09-30 13:19:32 +09:00
receive-pack.c builtin/receive-pack: use constant-time comparison for HMAC value 2020-04-09 18:17:27 -07:00
reflog.c Merge branch 'jk/loose-object-cache-oid' 2019-02-06 22:05:27 -08:00
remote-ext.c
remote-fd.c
remote.c remove_all_fetch_refspecs(): drop unused "remote" parameter 2019-05-13 14:22:54 +09:00
repack.c Merge branch 'bc/object-id-part17' 2019-10-11 14:24:46 +09:00
replace.c Merge branch 'bc/object-id-part17' 2019-10-11 14:24:46 +09:00
rerere.c Merge branch 'nd/the-index' into md/list-objects-filter-by-depth 2019-01-15 15:38:29 -08:00
reset.c Merge branch 'nd/tree-walk-with-repo' 2019-07-19 11:30:21 -07:00
rev-list.c Merge branch 'rs/dedup-includes' 2019-10-11 14:24:48 +09:00
rev-parse.c builtin/rev-parse: switch to use the_hash_algo 2019-08-19 15:04:57 -07:00
revert.c Merge branch 'ra/cherry-pick-revert-skip' 2019-07-19 11:30:21 -07:00
rm.c Merge branch 'jc/denoise-rm-to-resolve' into maint 2019-07-29 12:38:17 -07:00
send-pack.c pack-protocol.txt: accept error packets in any context 2019-01-02 13:05:30 -08:00
shortlog.c Merge branch 'nd/show-gitcomp-compilation-fix' into maint 2018-12-15 12:24:33 +09:00
show-branch.c show-branch: drop unused parameter from show_independent() 2019-05-13 14:22:54 +09:00
show-index.c builtin/show-index: replace sha1_to_hex 2019-08-19 15:04:59 -07:00
show-ref.c Merge branch 'en/unicode-in-refnames' 2019-05-19 16:45:30 +09:00
stash.c Merge branch 'jj/stash-reset-only-toplevel' 2019-10-18 11:40:49 +09:00
stripspace.c stripspace: allow -s/-c outside git repository 2018-12-26 15:41:47 -08:00
submodule--helper.c Sync with 2.23.1 2019-12-06 16:31:39 +01:00
symbolic-ref.c
tag.c tag: add tag.gpgSign config option to force all tags be GPG-signed 2019-06-05 14:39:28 -07:00
unpack-file.c object-store: move object access functions to object-store.h 2018-05-16 11:42:03 +09:00
unpack-objects.c object: convert lookup_object() to use object_id 2019-06-20 10:18:09 -07:00
update-index.c repo-settings: parse core.untrackedCache 2019-08-13 13:33:55 -07:00
update-ref.c update-ref: allow --no-deref with --stdin 2018-09-12 15:17:17 -07:00
update-server-info.c parse-options: let OPT__FORCE take optional flags argument 2018-02-09 10:24:50 -08:00
upload-archive.c archive: initialize archivers earlier 2018-10-26 10:17:59 +09:00
upload-pack.c builtin: consistently pass cmd_* prefix to parse_options 2019-05-13 14:22:53 +09:00
var.c
verify-commit.c Merge branch 'jk/no-system-includes-in-dot-c' 2019-07-31 14:38:56 -07:00
verify-pack.c
verify-tag.c verify-tag: drop signal.h include 2019-06-19 08:19:21 -07:00
worktree.c Merge branch 'rs/dedup-includes' 2019-10-11 14:24:48 +09:00
write-tree.c cmd_{read,write}_tree: rename "unused" variable that is used 2019-05-13 14:22:53 +09:00