From 3c21de41334a33d313450f747658f90e28017d89 Mon Sep 17 00:00:00 2001 From: Tam Mach Date: Thu, 17 Oct 2024 12:56:28 +0000 Subject: [PATCH] policy: Use timing-safe string comparison [ upstream commit 1e298fad5ecff399849a689fb0730551afe42422 ] When validating the input header value against a secret, it is advisable to use a timing-safe string comparison operator with a runtime that is independent of the number of equivalent prefix bytes of the secret and header value. This commit is to use CRYPTO_memcmp function[^1] for string comparison, similar to what is done in envoy codebase. [^1]: https://github.com/openssl/openssl/blob/master/doc/man3/CRYPTO_memcmp.pod Signed-off-by: Tam Mach --- cilium/network_policy.cc | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/cilium/network_policy.cc b/cilium/network_policy.cc index 93991e0a8..fef8e7b0f 100644 --- a/cilium/network_policy.cc +++ b/cilium/network_policy.cc @@ -18,6 +18,7 @@ #include "cilium/grpc_subscription.h" #include "cilium/ipcache.h" #include "cilium/secret_watcher.h" +#include "openssl/ssl.h" namespace Envoy { namespace Cilium { @@ -75,8 +76,13 @@ class HeaderMatch : public Logger::Loggable { else if (value_.length() == 0) ENVOY_LOG(info, "Cilium HeaderMatch missing SDS secret value for header {}", name_); } - if (header_value.result().has_value()) - matches = (header_value.result().value() == *match_value); + if (header_value.result().has_value()) { + const absl::string_view val = header_value.result().value(); + if (val.length() == match_value->length()) { + // Use constant time comparison for security reason + matches = CRYPTO_memcmp(val.data(), match_value->data(), match_value->length()) == 0; + } + } } if (matches) {