diff options
author | Jack Mulrow <jack.mulrow@mongodb.com> | 2017-02-03 14:37:27 -0500 |
---|---|---|
committer | Jack Mulrow <jack.mulrow@mongodb.com> | 2017-03-02 12:24:37 -0500 |
commit | 0d408153594e2e2366e0729397ca2890f00b026c (patch) | |
tree | 5201e5e9fd707447543bf8c638b0a701f314ca5e /src/mongo/crypto | |
parent | 8c173ff0776c2c4ab1698a26aee2d087f973a3de (diff) | |
download | mongo-0d408153594e2e2366e0729397ca2890f00b026c.tar.gz |
SERVER-27768 Implement HMAC key for signing Logical clock's storage & distribution
Diffstat (limited to 'src/mongo/crypto')
-rw-r--r-- | src/mongo/crypto/SConscript | 2 | ||||
-rw-r--r-- | src/mongo/crypto/mechanism_scram.cpp | 26 | ||||
-rw-r--r-- | src/mongo/crypto/sha1_block.cpp | 9 | ||||
-rw-r--r-- | src/mongo/crypto/sha1_block.h | 3 |
4 files changed, 12 insertions, 28 deletions
diff --git a/src/mongo/crypto/SConscript b/src/mongo/crypto/SConscript index a18405fbce5..b7f06827201 100644 --- a/src/mongo/crypto/SConscript +++ b/src/mongo/crypto/SConscript @@ -19,6 +19,7 @@ env.Library('sha1_block', ], LIBDEPS=[ '$BUILD_DIR/mongo/base', + '$BUILD_DIR/mongo/util/secure_compare_memory', ]) env.Library( @@ -45,6 +46,7 @@ env.Library('scramauth', ['mechanism_scram.cpp'], LIBDEPS=['$BUILD_DIR/mongo/base', '$BUILD_DIR/mongo/base/secure_allocator', + '$BUILD_DIR/mongo/util/secure_compare_memory', '$BUILD_DIR/mongo/util/secure_zero_memory', 'sha1_block_${MONGO_CRYPTO}']) diff --git a/src/mongo/crypto/mechanism_scram.cpp b/src/mongo/crypto/mechanism_scram.cpp index a1b3c69d8fc..b426dda6cbd 100644 --- a/src/mongo/crypto/mechanism_scram.cpp +++ b/src/mongo/crypto/mechanism_scram.cpp @@ -34,6 +34,7 @@ #include "mongo/platform/random.h" #include "mongo/util/base64.h" +#include "mongo/util/secure_compare_memory.h" #include "mongo/util/secure_zero_memory.h" namespace mongo { @@ -41,31 +42,6 @@ namespace scram { using std::unique_ptr; -namespace { -/** - * Compare two arrays of bytes for equality in constant time. - * - * This means that the function runs for the same amount of time even if they differ. Unlike memcmp, - * this function does not exit on the first difference. - * - * Returns true if the two arrays are equal. - * - * TODO: evaluate if LTO inlines or changes the code flow of this function. - */ -NOINLINE_DECL -bool consttimeMemEqual(volatile const unsigned char* s1, // NOLINT - using volatile to - volatile const unsigned char* s2, // NOLINT - disable compiler optimizations - size_t length) { - unsigned int ret = 0; - - for (size_t i = 0; i < length; ++i) { - ret |= s1[i] ^ s2[i]; - } - - return (1 & ((ret - 1) >> 8)); -} -} // namespace - // Compute the SCRAM step Hi() as defined in RFC5802 static SHA1Block HMACIteration(const unsigned char input[], size_t inputLen, diff --git a/src/mongo/crypto/sha1_block.cpp b/src/mongo/crypto/sha1_block.cpp index c978e545b20..9debee81fcc 100644 --- a/src/mongo/crypto/sha1_block.cpp +++ b/src/mongo/crypto/sha1_block.cpp @@ -34,6 +34,7 @@ #include "mongo/bson/bsonobjbuilder.h" #include "mongo/util/base64.h" #include "mongo/util/mongoutils/str.h" +#include "mongo/util/secure_compare_memory.h" namespace mongo { @@ -81,8 +82,12 @@ void SHA1Block::xorInline(const SHA1Block& other) { } } -bool SHA1Block::operator==(const SHA1Block& rhs) const { - return rhs._hash == this->_hash; +bool SHA1Block::operator==(const SHA1Block& other) const { + return consttimeMemEqual(this->_hash.data(), other._hash.data(), kHashLength); +} + +bool SHA1Block::operator!=(const SHA1Block& other) const { + return !(*this == other); } } // namespace mongo diff --git a/src/mongo/crypto/sha1_block.h b/src/mongo/crypto/sha1_block.h index 3398cea6018..a228540bcb0 100644 --- a/src/mongo/crypto/sha1_block.h +++ b/src/mongo/crypto/sha1_block.h @@ -90,7 +90,8 @@ public: void xorInline(const SHA1Block& other); std::string toString() const; - bool operator==(const SHA1Block& rhs) const; + bool operator==(const SHA1Block& other) const; + bool operator!=(const SHA1Block& other) const; private: HashType _hash; |