Internally use HMAC in http auth

To at least get constant time compare.
Also fix incorrect parsing of the creds (were incorrectly stripped).
Also add unit tests.

1 files changed, 29 insertions, 8 deletions

diff --git a/src/HttpServer.cc b/src/HttpServer.cc
index 5da8ec2d..ade21620 100644
--- a/src/HttpServer.cc
+++ b/src/HttpServer.cc
@@ -42,6 +42,7 @@
 #include "DlAbortEx.h"
 #include "message.h"
 #include "util.h"
+#include "util_security.h"
 #include "LogFactory.h"
 #include "Logger.h"
 #include "base64.h"
@@ -57,6 +58,8 @@
 
 namespace aria2 {
 
+std::unique_ptr<util::security::HMAC> HttpServer::hmac_;
+
 HttpServer::HttpServer(const std::shared_ptr<SocketCore>& socket)
  : socket_(socket),
    socketRecvBuffer_(new SocketRecvBuffer(socket_)),
@@ -279,7 +282,7 @@ bool HttpServer::sendBufferIsEmpty() const
 
 bool HttpServer::authenticate()
 {
-  if(username_.empty()) {
+  if (!username_) {
     return true;
   }
 
@@ -292,19 +295,37 @@ bool HttpServer::authenticate()
   if(!util::streq(p.first.first, p.first.second, "Basic")) {
     return false;
   }
+
   std::string userpass = base64::decode(p.second.first, p.second.second);
-  auto up = util::divide(std::begin(userpass), std::end(userpass), ':');
-  return util::streq(up.first.first, up.first.second,
-                     username_.begin(), username_.end()) &&
-    util::streq(up.second.first, up.second.second,
-                password_.begin(), password_.end());
+  auto up = util::divide(std::begin(userpass), std::end(userpass), ':', false);
+  std::string username(up.first.first, up.first.second);
+  std::string password(up.second.first, up.second.second);
+  return *username_ == hmac_->getResult(username) &&
+    (!password_ || *password_ == hmac_->getResult(password));
 }
 
 void HttpServer::setUsernamePassword
 (const std::string& username, const std::string& password)
 {
-  username_ = username;
-  password_ = password;
+  using namespace util::security;
+
+  if (!hmac_) {
+    hmac_ = HMAC::createRandom();
+  }
+
+  if (!username.empty()) {
+    username_ = make_unique<HMACResult>(hmac_->getResult(username));
+  }
+  else {
+    username_.reset();
+  }
+
+  if (!password.empty()) {
+    password_ = make_unique<HMACResult>(hmac_->getResult(password));
+  }
+  else {
+    password_.reset();
+  }
 }
 
 int HttpServer::setupResponseRecv()