def login(user, secret):
"""Validates a user supplied user/password against an expected value.
The expected value is pulled from the pecan config. Note that this
value is currently stored in the clear inside that config, so we
are assuming that the config is protected using file perms, etc.
This function provides some resistance to timing attacks, but
information on the expected user/password lengths can still be
leaked. It may also be possible to use a timing attack to see
which input failed validation. See comments below for details.
:param user: The user supplied username (unicode or string)
:param secret: The user supplied password (unicode or string)
:return: None on failure or an AuthDetails object on success
"""
# convert input to strings
user = str(user)
secret = str(secret)
# expected values
try:
expected_user = str(jsonloader.conf.auth['static']['user'])
expected_secret = str(jsonloader.conf.auth['static']['secret'])
except (KeyError, TypeError):
logger.warning("auth conf missing static user or secret")
return None
# In python, len(<string>) is O(1)
# Short circuit this if lengths don't match
if len(user) != len(expected_user):
logger.info("failed static auth: invalid username ({})".format(user))
return None
if len(secret) != len(expected_secret):
logger.info("failed static auth: invalid password")
return None
# This technique is used to provide a constant time string compare
# between the user input and the expected values.
valid_user = util.constant_time_compare(user, expected_user)
valid_secret = util.constant_time_compare(secret, expected_secret)
# This if statement results in a potential timing attack where the
# statement could return more quickly if valid_secret=False. We
# do not see an obvious solution to this problem, but also believe
# that leaking which input was valid isn't as big of a concern.
if valid_user and valid_secret:
return results.AuthDetails(username=expected_user, groups=[])
logger.info("failed static auth for user {}".format(user))
def login(user, secret):
"""Validates a user supplied user/password against an expected value.
The expected value is pulled from the pecan config. Note that this
value is currently stored in the clear inside that config, so we
are assuming that the config is protected using file perms, etc.
This function provides some resistance to timing attacks, but
information on the expected user/password lengths can still be
leaked. It may also be possible to use a timing attack to see
which input failed validation. See comments below for details.
:param user: The user supplied username (unicode or string)
:param secret: The user supplied password (unicode or string)
:return: None on failure or an AuthDetails object on success
"""
# convert input to strings
user = str(user)
secret = str(secret)
# expected values
try:
expected_user = str(jsonloader.conf.auth['static']['user'])
expected_secret = str(jsonloader.conf.auth['static']['secret'])
except (KeyError, TypeError):
logger.warning("auth conf missing static user or secret")
return None
# In python, len(<string>) is O(1)
# Short circuit this if lengths don't match
if len(user) != len(expected_user):
logger.info("failed static auth: invalid username ({})".format(user))
return None
if len(secret) != len(expected_secret):
logger.info("failed static auth: invalid password")
return None
# This technique is used to provide a constant time string compare
# between the user input and the expected values.
valid_user = util.constant_time_compare(user, expected_user)
valid_secret = util.constant_time_compare(secret, expected_secret)
# This if statement results in a potential timing attack where the
# statement could return more quickly if valid_secret=False. We
# do not see an obvious solution to this problem, but also believe
# that leaking which input was valid isn't as big of a concern.
if valid_user and valid_secret:
return results.AuthDetails(username=expected_user, groups=[])
logger.info("failed static auth for user {}".format(user))
def test_compare_with_shim_different_len(self, compare_digest):
compare_digest.side_effect = AttributeError(
"'hmac' has no attribute 'compare_digest'")
self.assertFalse(util.constant_time_compare("abc", ""))
def test_compare_with_hmac(self, compare_digest):
compare_digest.return_value = True
self.assertTrue(util.constant_time_compare("", ""))
def test_compare_with_shim_different_len(self, compare_digest):
compare_digest.side_effect = AttributeError(
"'hmac' has no attribute 'compare_digest'")
self.assertFalse(util.constant_time_compare("abc", ""))
def test_compare_with_hmac(self, compare_digest):
compare_digest.return_value = True
self.assertTrue(util.constant_time_compare("", ""))
