mirrors/versitygw
1
0
Fork 0
mirror of https://github.com/versity/versitygw.git synced 2026-09-23 00:14:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2350 from versity/ben/secure-compare

Browse Source 
fix: use constant-time comparisons for SigV4 signatures
This commit is contained in:
Ben McClelland
2026-09-03 15:00:56 -07:00
committed by GitHub
parent ca2f0d33a7 c7f8bc0ab5
commit b4ddb7d77a
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
s3api/middlewares/object-post-auth.go
+1 -1
View File
@@ -189,7 +189,7 @@ func AuthorizePostObject(root RootUserConfig, iam auth.IAMService, region string
return err
}
if expectedSig != signatureHex {
if !sigv4auth.SecureCompare(expectedSig, signatureHex) {
debuglogger.Logf("POST object signature mismatch: expected %s got %s", expectedSig, signatureHex)
// The String to sign for POST request is the base64 encoded policy
// For POST incorrect signature no canonical request and canonical request bytes are returned
s3api/utils/signed-chunk-reader.go
+3 -2
View File
@@ -32,6 +32,7 @@ import (
"github.com/aws/aws-sdk-go-v2/service/s3/types"
"github.com/versity/versitygw/debuglogger"
"github.com/versity/versitygw/internal/sigv4auth"
"github.com/versity/versitygw/s3err"
)
@@ -235,7 +236,7 @@ func (cr *ChunkReader) verifyTrailerSignature() error {
strToSign := cr.getTrailerChunkStringToSign()
sig := hex.EncodeToString(hmac256(cr.signingKey, []byte(strToSign)))
if sig != cr.trailerSig {
if !sigv4auth.SecureCompare(sig, cr.trailerSig) {
debuglogger.Logf("incorrect trailing signature: (calculated): %v, (got): %v", sig, cr.trailerSig)
return s3err.GetSignatureDoesNotMatchErr(cr.accessKey, strToSign, cr.trailerSig, HexBytes(strToSign), cr.canonicalString, HexBytes(cr.canonicalString))
}
@@ -262,7 +263,7 @@ func (cr *ChunkReader) checkSignature() error {
cr.chunkHash.Reset()
cr.prevSig = hex.EncodeToString(hmac256(cr.signingKey, []byte(sigstr)))
if cr.prevSig != cr.parsedSig {
if !sigv4auth.SecureCompare(cr.prevSig, cr.parsedSig) {
debuglogger.Logf("incorrect signature: (calculated): %v, (got) %v", cr.prevSig, cr.parsedSig)
return s3err.GetSignatureDoesNotMatchErr(cr.accessKey, sigstr, cr.parsedSig, HexBytes(sigstr), cr.canonicalString, HexBytes(cr.canonicalString))
}