victoria-metrics: mitigate timing attacks for basic auth and authkey comparisions about victoriametrics HOT 7 CLOSED

From the security POV this seems to be a very good suggestion, thanks @wasim-nihal!
It would be important to make sure that all credentials comparison functions will be converted to constant time comparison.

from victoriametrics.

I like this proposal as well!

from victoriametrics.

#6423 was merged and will be available in the next release.

from victoriametrics.

Thanks, @zekker6 , @hagen1778 for accepting the proposal!!

It would be important to make sure that all credentials comparison functions will be converted to constant time comparison.

As of now, I have taken note of only authkey and basic auth credential comparison. I will explore the codebase a bit more and see where such similar comparisons are made and open the PRs (maybe in stages). Any heads-up would be helpful 🚀

from victoriametrics.

@zekker6 @f41gh7 @hagen1778 Could you share some thoughts here?

from victoriametrics.

FYI, I reverted the commit 9b7e532 in 82d6394 . See commit description for the reasons of the revert.

from victoriametrics.

Additional notes regarding this issue additionally to comments at 82d6394 : it is expected that all the VictoriaMetrics components run in protected private networks - see these docs. The only component, which can be exposed to the public Internet is vmauth. If we are going to fix real security issues (if they really exist), then they must be fixed at vmauth at first.

from victoriametrics.