You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by bh...@apache.org on 2015/01/14 16:02:53 UTC
[1/3] git commit: updated refs/heads/4.5 to 7885a6c
Repository: cloudstack
Updated Branches:
refs/heads/4.5 9a677595f -> 7885a6c4e
Use constant-time comparison functions when checking signatures
This limits the likeliness of timing attacks against the API.
See http://codahale.com/a-lesson-in-timing-attacks/ for the
full rationale.
Signed-off-by: Rohit Yadav <ro...@shapeblue.com>
Conflicts:
server/src/com/cloud/api/ApiServer.java
server/src/com/cloud/user/AccountManagerImpl.java
(cherry picked from commit 9b4e39e837af498599859c4a6687eb8bf9f8ad89)
Signed-off-by: Rohit Yadav <ro...@shapeblue.com>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/162c5af6
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/162c5af6
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/162c5af6
Branch: refs/heads/4.5
Commit: 162c5af6f8ede5adcabcdc026a08028f4b442f60
Parents: 9a67759
Author: Pierre-Yves Ritschard <py...@spootnik.org>
Authored: Wed Jan 14 11:27:35 2015 +0100
Committer: Rohit Yadav <ro...@shapeblue.com>
Committed: Wed Jan 14 20:25:21 2015 +0530
----------------------------------------------------------------------
server/src/com/cloud/api/ApiServer.java | 4 ++-
.../com/cloud/api/ConstantTimeComparator.java | 36 ++++++++++++++++++++
.../com/cloud/servlet/ConsoleProxyServlet.java | 3 +-
.../src/com/cloud/user/AccountManagerImpl.java | 4 ++-
4 files changed, 44 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/162c5af6/server/src/com/cloud/api/ApiServer.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/ApiServer.java b/server/src/com/cloud/api/ApiServer.java
index f35bd9d..785a822 100755
--- a/server/src/com/cloud/api/ApiServer.java
+++ b/server/src/com/cloud/api/ApiServer.java
@@ -908,9 +908,11 @@ public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiSer
final SecretKeySpec keySpec = new SecretKeySpec(secretKey.getBytes(), "HmacSHA1");
mac.init(keySpec);
mac.update(unsignedRequest.getBytes());
+
final byte[] encryptedBytes = mac.doFinal();
final String computedSignature = Base64.encodeBase64String(encryptedBytes);
- final boolean equalSig = signature.equals(computedSignature);
+ final boolean equalSig = ConstantTimeComparator.compareStrings(signature, computedSignature);
+
if (!equalSig) {
s_logger.info("User signature: " + signature + " is not equaled to computed signature: " + computedSignature);
} else {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/162c5af6/server/src/com/cloud/api/ConstantTimeComparator.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/ConstantTimeComparator.java b/server/src/com/cloud/api/ConstantTimeComparator.java
new file mode 100644
index 0000000..4612eee
--- /dev/null
+++ b/server/src/com/cloud/api/ConstantTimeComparator.java
@@ -0,0 +1,36 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.api;
+
+public class ConstantTimeComparator {
+
+ public static boolean compareBytes(byte[] b1, byte[] b2) {
+ if (b1.length != b2.length) {
+ return false;
+ }
+
+ int result = 0;
+ for (int i = 0; i < b1.length; i++) {
+ result |= b1[i] ^ b2[i];
+ }
+ return result == 0;
+ }
+
+ public static boolean compareStrings(String s1, String s2) {
+ return compareBytes(s1.getBytes(), s2.getBytes());
+ }
+}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/162c5af6/server/src/com/cloud/servlet/ConsoleProxyServlet.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/servlet/ConsoleProxyServlet.java b/server/src/com/cloud/servlet/ConsoleProxyServlet.java
index bf021ea..b6a8d63 100644
--- a/server/src/com/cloud/servlet/ConsoleProxyServlet.java
+++ b/server/src/com/cloud/servlet/ConsoleProxyServlet.java
@@ -45,6 +45,7 @@ import com.google.gson.GsonBuilder;
import org.apache.cloudstack.framework.security.keys.KeysManager;
+import com.cloud.api.ConstantTimeComparator;
import com.cloud.exception.PermissionDeniedException;
import com.cloud.host.HostVO;
import com.cloud.server.ManagementServer;
@@ -653,7 +654,7 @@ public class ConsoleProxyServlet extends HttpServlet {
mac.update(unsignedRequest.getBytes());
byte[] encryptedBytes = mac.doFinal();
String computedSignature = Base64.encodeBase64String(encryptedBytes);
- boolean equalSig = signature.equals(computedSignature);
+ boolean equalSig = ConstantTimeComparator.compareStrings(signature, computedSignature);
if (!equalSig) {
s_logger.debug("User signature: " + signature + " is not equaled to computed signature: " + computedSignature);
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/162c5af6/server/src/com/cloud/user/AccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index 3c00f91..44c687f 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -62,6 +62,7 @@ import org.apache.cloudstack.managed.context.ManagedContextRunnable;
import org.apache.cloudstack.region.gslb.GlobalLoadBalancerRuleDao;
import com.cloud.api.ApiDBUtils;
+import com.cloud.api.ConstantTimeComparator;
import com.cloud.api.query.vo.ControlledViewEntity;
import com.cloud.configuration.Config;
import com.cloud.configuration.ConfigurationManager;
@@ -485,6 +486,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
@Override
public void checkAccess(Account caller, AccessType accessType, boolean sameOwner, String apiName, ControlledEntity... entities) {
+
//check for the same owner
Long ownerId = null;
ControlledEntity prevEntity = null;
@@ -2058,7 +2060,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
mac.update(unsignedRequest.getBytes());
byte[] encryptedBytes = mac.doFinal();
String computedSignature = new String(Base64.encodeBase64(encryptedBytes));
- boolean equalSig = signature.equals(computedSignature);
+ boolean equalSig = ConstantTimeComparator.compareStrings(signature, computedSignature);
if (!equalSig) {
s_logger.info("User signature: " + signature + " is not equaled to computed signature: " + computedSignature);
} else {
[2/3] git commit: updated refs/heads/4.5 to 7885a6c
Posted by bh...@apache.org.
move ConstantTimeComparator to utils
(cherry picked from commit b2393c31ed8f689e45227f12371fc042c9dbd0e4)
Signed-off-by: Rohit Yadav <ro...@shapeblue.com>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/5ea74147
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/5ea74147
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/5ea74147
Branch: refs/heads/4.5
Commit: 5ea74147460550ea0fdbcdf1139fb3f104006458
Parents: 162c5af
Author: Pierre-Yves Ritschard <py...@spootnik.org>
Authored: Wed Jan 14 12:14:00 2015 +0100
Committer: Rohit Yadav <ro...@shapeblue.com>
Committed: Wed Jan 14 20:25:32 2015 +0530
----------------------------------------------------------------------
server/src/com/cloud/api/ApiServer.java | 1 +
.../com/cloud/api/ConstantTimeComparator.java | 36 ------------------
.../com/cloud/servlet/ConsoleProxyServlet.java | 2 +-
.../src/com/cloud/user/AccountManagerImpl.java | 2 +-
.../com/cloud/utils/ConstantTimeComparator.java | 39 ++++++++++++++++++++
5 files changed, 42 insertions(+), 38 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/5ea74147/server/src/com/cloud/api/ApiServer.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/ApiServer.java b/server/src/com/cloud/api/ApiServer.java
index 785a822..8821d0f 100755
--- a/server/src/com/cloud/api/ApiServer.java
+++ b/server/src/com/cloud/api/ApiServer.java
@@ -40,6 +40,7 @@ import com.cloud.user.DomainManager;
import com.cloud.user.User;
import com.cloud.user.UserAccount;
import com.cloud.user.UserVO;
+import com.cloud.utils.ConstantTimeComparator;
import com.cloud.utils.HttpUtils;
import com.cloud.utils.NumbersUtil;
import com.cloud.utils.Pair;
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/5ea74147/server/src/com/cloud/api/ConstantTimeComparator.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/ConstantTimeComparator.java b/server/src/com/cloud/api/ConstantTimeComparator.java
deleted file mode 100644
index 4612eee..0000000
--- a/server/src/com/cloud/api/ConstantTimeComparator.java
+++ /dev/null
@@ -1,36 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements. See the NOTICE file
-// distributed with this work for additional information
-// regarding copyright ownership. The ASF licenses this file
-// to you under the Apache License, Version 2.0 (the
-// "License"); you may not use this file except in compliance
-// with the License. You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied. See the License for the
-// specific language governing permissions and limitations
-// under the License.
-package com.cloud.api;
-
-public class ConstantTimeComparator {
-
- public static boolean compareBytes(byte[] b1, byte[] b2) {
- if (b1.length != b2.length) {
- return false;
- }
-
- int result = 0;
- for (int i = 0; i < b1.length; i++) {
- result |= b1[i] ^ b2[i];
- }
- return result == 0;
- }
-
- public static boolean compareStrings(String s1, String s2) {
- return compareBytes(s1.getBytes(), s2.getBytes());
- }
-}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/5ea74147/server/src/com/cloud/servlet/ConsoleProxyServlet.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/servlet/ConsoleProxyServlet.java b/server/src/com/cloud/servlet/ConsoleProxyServlet.java
index b6a8d63..4694a47 100644
--- a/server/src/com/cloud/servlet/ConsoleProxyServlet.java
+++ b/server/src/com/cloud/servlet/ConsoleProxyServlet.java
@@ -45,7 +45,6 @@ import com.google.gson.GsonBuilder;
import org.apache.cloudstack.framework.security.keys.KeysManager;
-import com.cloud.api.ConstantTimeComparator;
import com.cloud.exception.PermissionDeniedException;
import com.cloud.host.HostVO;
import com.cloud.server.ManagementServer;
@@ -54,6 +53,7 @@ import com.cloud.user.Account;
import com.cloud.user.AccountManager;
import com.cloud.user.User;
import com.cloud.uservm.UserVm;
+import com.cloud.utils.ConstantTimeComparator;
import com.cloud.utils.Pair;
import com.cloud.utils.Ternary;
import com.cloud.utils.db.EntityManager;
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/5ea74147/server/src/com/cloud/user/AccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index 44c687f..6e9e0d7 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -62,7 +62,6 @@ import org.apache.cloudstack.managed.context.ManagedContextRunnable;
import org.apache.cloudstack.region.gslb.GlobalLoadBalancerRuleDao;
import com.cloud.api.ApiDBUtils;
-import com.cloud.api.ConstantTimeComparator;
import com.cloud.api.query.vo.ControlledViewEntity;
import com.cloud.configuration.Config;
import com.cloud.configuration.ConfigurationManager;
@@ -133,6 +132,7 @@ import com.cloud.user.Account.State;
import com.cloud.user.dao.AccountDao;
import com.cloud.user.dao.UserAccountDao;
import com.cloud.user.dao.UserDao;
+import com.cloud.utils.ConstantTimeComparator;
import com.cloud.utils.NumbersUtil;
import com.cloud.utils.Pair;
import com.cloud.utils.Ternary;
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/5ea74147/utils/src/com/cloud/utils/ConstantTimeComparator.java
----------------------------------------------------------------------
diff --git a/utils/src/com/cloud/utils/ConstantTimeComparator.java b/utils/src/com/cloud/utils/ConstantTimeComparator.java
new file mode 100644
index 0000000..4d4a595
--- /dev/null
+++ b/utils/src/com/cloud/utils/ConstantTimeComparator.java
@@ -0,0 +1,39 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.utils;
+
+public class ConstantTimeComparator {
+
+ public static boolean compareBytes(byte[] b1, byte[] b2) {
+ if (b1.length != b2.length) {
+ return false;
+ }
+
+ int result = 0;
+ for (int i = 0; i < b1.length; i++) {
+ result |= b1[i] ^ b2[i];
+ }
+ return result == 0;
+ }
+
+ public static boolean compareStrings(String s1, String s2) {
+ return compareBytes(s1.getBytes(), s2.getBytes());
+ }
+}
[3/3] git commit: updated refs/heads/4.5 to 7885a6c
Posted by bh...@apache.org.
Add absolute schema references to support MySQL 5.6 better
(cherry picked from commit 396936ea5e84d079394664fd1d0596a94e159855)
Signed-off-by: Rohit Yadav <ro...@shapeblue.com>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/7885a6c4
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/7885a6c4
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/7885a6c4
Branch: refs/heads/4.5
Commit: 7885a6c4efe13a07b3966ef8684152dda5108f8b
Parents: 5ea7414
Author: Erik Weber <te...@gmail.com>
Authored: Wed Jan 14 14:52:47 2015 +0100
Committer: Rohit Yadav <ro...@shapeblue.com>
Committed: Wed Jan 14 20:32:40 2015 +0530
----------------------------------------------------------------------
setup/db/create-schema-premium.sql | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/7885a6c4/setup/db/create-schema-premium.sql
----------------------------------------------------------------------
diff --git a/setup/db/create-schema-premium.sql b/setup/db/create-schema-premium.sql
index 2f86c0b..a8feff4 100644
--- a/setup/db/create-schema-premium.sql
+++ b/setup/db/create-schema-premium.sql
@@ -296,7 +296,7 @@ CREATE TABLE `cloud`.`netapp_volume` (
`password` varchar(200) COMMENT 'password',
`round_robin_marker` int COMMENT 'This marks the volume to be picked up for lun creation, RR fashion',
PRIMARY KEY (`id`),
- CONSTRAINT `fk_netapp_volume__pool_id` FOREIGN KEY `fk_netapp_volume__pool_id` (`pool_id`) REFERENCES `netapp_pool` (`id`) ON DELETE CASCADE,
+ CONSTRAINT `fk_netapp_volume__pool_id` FOREIGN KEY `fk_netapp_volume__pool_id` (`pool_id`) REFERENCES `cloud`.`netapp_pool` (`id`) ON DELETE CASCADE,
INDEX `i_netapp_volume__pool_id`(`pool_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
@@ -315,7 +315,7 @@ CREATE TABLE `cloud`.`netapp_lun` (
`size` bigint NOT NULL COMMENT 'lun size',
`volume_id` bigint unsigned NOT NULL COMMENT 'parent volume id',
PRIMARY KEY (`id`),
- CONSTRAINT `fk_netapp_lun__volume_id` FOREIGN KEY `fk_netapp_lun__volume_id` (`volume_id`) REFERENCES `netapp_volume` (`id`) ON DELETE CASCADE,
+ CONSTRAINT `fk_netapp_lun__volume_id` FOREIGN KEY `fk_netapp_lun__volume_id` (`volume_id`) REFERENCES `cloud`.`netapp_volume` (`id`) ON DELETE CASCADE,
INDEX `i_netapp_lun__volume_id`(`volume_id`),
INDEX `i_netapp_lun__lun_name`(`lun_name`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;