doveadm: client-connection - Use timing safe credential check

diff --git a/src/doveadm/client-connection-http.c b/src/doveadm/client-connection-http.c
index 81ae9f51daddfe69c65363b419375fdefb9ee4a0..f76054865305fc51554e0abca8b5112a9c7ffcd3 100644 (file)
--- a/src/doveadm/client-connection-http.c
+++ b/src/doveadm/client-connection-http.c
@@ -973,7 +973,9 @@ doveadm_http_server_auth_basic(struct client_request_http *req,
        value = p_strdup_printf(conn->conn.pool,
                                "doveadm:%s", set->doveadm_password);
        base64_encode(value, strlen(value), b64_value);
-       if (creds->data != NULL && strcmp(creds->data, str_c(b64_value)) == 0)
+
+       if (creds->data != NULL &&
+           str_equals_timing_almost_safe(value, creds->data))
                return TRUE;
 
        e_error(conn->conn.event,
@@ -1000,7 +1002,8 @@ doveadm_http_server_auth_api_key(struct client_request_http *req,
        b64_value = str_new(conn->conn.pool, 32);
        base64_encode(set->doveadm_api_key,
                      strlen(set->doveadm_api_key), b64_value);
-       if (creds->data != NULL && strcmp(creds->data, str_c(b64_value)) == 0)
+       if (creds->data != NULL &&
+           str_equals_timing_almost_safe(creds->data, str_c(b64_value)))
                return TRUE;
 
        e_error(conn->conn.event,

diff --git a/src/doveadm/client-connection-tcp.c b/src/doveadm/client-connection-tcp.c
index 936bb03f014409dca3ead1e5c907ca4ac4a2a851..cb16f7214b43795fff26c2cdfa358f6cd937962d 100644 (file)
--- a/src/doveadm/client-connection-tcp.c
+++ b/src/doveadm/client-connection-tcp.c
@@ -400,9 +400,7 @@ client_connection_tcp_authenticate(struct client_connection_tcp *conn)
                return -1;
        }
        pass = t_strndup(data + 9, size - 9);
-       if (strlen(pass) != strlen(set->doveadm_password) ||
-           !mem_equals_timing_safe(pass, set->doveadm_password,
-                                   strlen(pass))) {
+       if (!str_equals_timing_almost_safe(pass, set->doveadm_password)) {
                e_error(conn->conn.event,
                        "doveadm client authenticated with wrong password");
                return -1;