Use constant time compare for bootstrap tokens

Signed-off-by: Joe Beda <joe.github@bedafamily.com>
This commit is contained in:
Joe Beda 2017-03-14 14:06:33 +00:00
parent 5e29e1ee05
commit c46d6bb825
No known key found for this signature in database
GPG Key ID: 4296898C63A3591D

View File

@ -20,6 +20,7 @@ Package bootstrap provides a token authenticator for TLS bootstrap secrets.
package bootstrap
import (
"crypto/subtle"
"fmt"
"regexp"
"time"
@ -95,7 +96,7 @@ func (t *TokenAuthenticator) AuthenticateToken(token string) (user.Info, bool, e
}
ts := getSecretString(secret, bootstrapapi.BootstrapTokenSecretKey)
if ts != tokenSecret {
if subtle.ConstantTimeCompare([]byte(ts), []byte(tokenSecret)) != 1 {
return nil, false, nil
}