Skip to content

Commit 607ac8f

Browse files
yadvryadvr
committed
services, awsapi: use better string comparision
Signed-off-by: Rohit Yadav <[email protected]> (cherry picked from commit d08369a) Signed-off-by: Rohit Yadav <[email protected]>
1 parent 8c68ac1 commit 607ac8f

6 files changed

Lines changed: 21 additions & 5 deletions

File tree

‎awsapi/src/com/cloud/bridge/util/EC2RestAuth.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
// under the License.
1717
package com.cloud.bridge.util;
1818

19+
import com.cloud.utils.ConstantTimeComparator;
20+
1921
import java.io.UnsupportedEncodingException;
2022
import java.net.URLDecoder;
2123
import java.security.SignatureException;
@@ -209,7 +211,7 @@ public boolean verifySignature(String httpVerb, String secretKey, String signatu
209211
if (-1 != offset)
210212
signature = URLDecoder.decode(signature, "UTF-8");
211213

212-
boolean match = signature.equals(calSig);
214+
boolean match = ConstantTimeComparator.compareStrings(signature, calSig);
213215
if (!match)
214216
logger.error("Signature mismatch, [" + signature + "] [" + calSig + "] over [" + StringToSign + "]");
215217
return match;

‎awsapi/src/com/cloud/bridge/util/RestAuth.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
// under the License.
1717
package com.cloud.bridge.util;
1818

19+
import com.cloud.utils.ConstantTimeComparator;
20+
1921
import java.io.UnsupportedEncodingException;
2022
import java.net.URLDecoder;
2123
import java.security.InvalidKeyException;
@@ -286,7 +288,7 @@ public boolean verifySignature(String httpVerb, String secretKey, String signatu
286288
if (-1 != offset)
287289
signature = URLDecoder.decode(signature, "UTF-8");
288290

289-
boolean match = signature.equals(calSig);
291+
boolean match = ConstantTimeComparator.compareStrings(signature, calSig);
290292
if (!match)
291293
logger.error("Signature mismatch, [" + signature + "] [" + calSig + "] over [" + StringToSign + "]");
292294

‎services/console-proxy-rdp/rdpconsole/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,11 @@
6161
<version>${cs.junit.version}</version>
6262
<scope>test</scope>
6363
</dependency>
64+
<dependency>
65+
<groupId>org.apache.cloudstack</groupId>
66+
<artifactId>cloud-utils</artifactId>
67+
<version>${project.version}</version>
68+
</dependency>
6469
<!-- Apache Portable Runtime implementation of SSL protocol, which is compatible with broken MS RDP SSL suport.
6570
NOTE: tomcat-native package with /usr/lib/libtcnative-1.so library is necessary for APR to work. -->
6671
<dependency>

‎services/console-proxy-rdp/rdpconsole/src/main/java/rdpclient/ntlmssp/ClientNtlmsspPubKeyAuth.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
// under the License.
1717
package rdpclient.ntlmssp;
1818

19+
import com.cloud.utils.ConstantTimeComparator;
20+
1921
import java.nio.charset.Charset;
2022

2123
import rdpclient.ntlmssp.asn1.NegoItem;
@@ -604,7 +606,7 @@ public void dump(ByteBuffer buf) {
604606

605607
private void dumpNegoToken(ByteBuffer buf) {
606608
String signature = buf.readVariableString(RdpConstants.CHARSET_8);
607-
if (!signature.equals(NTLMSSP))
609+
if (!ConstantTimeComparator.compareStrings(signature, NTLMSSP))
608610
throw new RuntimeException("Unexpected NTLM message singature: \"" + signature + "\". Expected signature: \"" + NTLMSSP + "\". Data: " + buf + ".");
609611

610612
// MessageType (CHALLENGE)

‎services/console-proxy-rdp/rdpconsole/src/main/java/rdpclient/ntlmssp/ServerNtlmsspChallenge.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
// under the License.
1717
package rdpclient.ntlmssp;
1818

19+
import com.cloud.utils.ConstantTimeComparator;
20+
1921
import java.util.Arrays;
2022

2123
import rdpclient.ntlmssp.asn1.NegoItem;
@@ -70,7 +72,7 @@ public void parseNtlmChallenge(ByteBuffer buf) {
7072

7173
// Signature: "NTLMSSP\0"
7274
String signature = buf.readVariableString(RdpConstants.CHARSET_8);
73-
if (!signature.equals(NTLMSSP))
75+
if (!ConstantTimeComparator.compareStrings(signature, NTLMSSP))
7476
throw new RuntimeException("Unexpected NTLM message singature: \"" + signature + "\". Expected signature: \"" + NTLMSSP + "\". Data: " + buf + ".");
7577

7678
// MessageType (CHALLENGE)

‎services/console-proxy-rdp/rdpconsole/src/main/java/streamer/SocketWrapperImpl.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@
3232
import javax.net.ssl.SSLSocketFactory;
3333
import javax.net.ssl.TrustManager;
3434

35+
import org.apache.cloudstack.utils.security.SSLUtils;
36+
3537
import streamer.debug.MockServer;
3638
import streamer.debug.MockServer.Packet;
3739
import streamer.ssl.SSLState;
@@ -139,7 +141,8 @@ public void upgradeToSsl() {
139141

140142
SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
141143
sslSocket = (SSLSocket)sslSocketFactory.createSocket(socket, address.getHostName(), address.getPort(), true);
142-
sslSocket.setEnabledProtocols(new String[]{"TLSv1", "TLSv1.1", "TLSv1.2"});
144+
sslSocket.setEnabledProtocols(SSLUtils.getSupportedProtocols(sslSocket.getEnabledProtocols()));
145+
143146
sslSocket.startHandshake();
144147

145148
InputStream sis = sslSocket.getInputStream();

0 commit comments

Comments
 (0)