git.iko.soy/skrepka
on master help sign in
Fix LookupPresence normalizeHex crash, safeCompare length handling, and genToken entropy
3d65e98iko
server.knot+27−12
compare with master
unifiedsplit
@@ -98,16 +98,31 @@ route Api = AuthApi | ClientApi | FederationApi | MaintenanceApi
98-- Helpers
98-- Helpers
99-- ============================================
99-- ============================================
100
100
101+hexDigit = \n ->
102+ if n == 0 then "0" else if n == 1 then "1" else if n == 2 then "2" else if n == 3 then "3"
103+ else if n == 4 then "4" else if n == 5 then "5" else if n == 6 then "6" else if n == 7 then "7"
104+ else if n == 8 then "8" else if n == 9 then "9" else if n == 10 then "a" else if n == 11 then "b"
105+ else if n == 12 then "c" else if n == 13 then "d" else if n == 14 then "e" else "f"
106+
107+byteToHex = \n -> hexDigit (n / 16) ++ hexDigit (n - (n / 16) * 16)
108+
109+intTo3Hex = \n ->
110+ let b0 = n / 65536
111+ let r0 = n - b0 * 65536
112+ let b1 = r0 / 256
113+ let b2 = r0 - b1 * 256
114+ byteToHex b0 ++ byteToHex b1 ++ byteToHex b2
115+
101genToken = do
116genToken = do
102− a <- randomInt 2147483647
117+ a <- randomInt 16777216
103− b <- randomInt 2147483647
118+ b <- randomInt 16777216
104− c <- randomInt 2147483647
119+ c <- randomInt 16777216
105− d <- randomInt 2147483647
120+ d <- randomInt 16777216
106− e <- randomInt 2147483647
121+ e <- randomInt 16777216
107− f <- randomInt 2147483647
122+ f <- randomInt 16777216
108− g <- randomInt 2147483647
123+ g <- randomInt 16777216
109− h <- randomInt 2147483647
124+ h <- randomInt 16777216
110− yield (bytesToHex (textToBytes (show a ++ show b ++ show c ++ show d ++ show e ++ show f ++ show g ++ show h)))
125+ yield (intTo3Hex a ++ intTo3Hex b ++ intTo3Hex c ++ intTo3Hex d ++ intTo3Hex e ++ intTo3Hex f ++ intTo3Hex g ++ intTo3Hex h)
111
126
112tooLong = \s maxLen -> not (drop maxLen s == "")
127tooLong = \s maxLen -> not (drop maxLen s == "")
113
128
@@ -202,8 +217,8 @@ verifyMaintenanceAuth = \authorization ->
202clampTtl = \ttl -> if ttl < 1 then 1 else if ttl > maxPresenceTtl then maxPresenceTtl else ttl
217clampTtl = \ttl -> if ttl < 1 then 1 else if ttl > maxPresenceTtl then maxPresenceTtl else ttl
203
218
204safeCompareLoop = \s1 s2 result ->
219safeCompareLoop = \s1 s2 result ->
205− if s1 == ""
220+ if s1 == "" && s2 == ""
206− then result + (if s2 == "" then 0 else 1)
221+ then result
207 else safeCompareLoop (drop 1 s1) (drop 1 s2) (result + (if take 1 s1 == take 1 s2 then 0 else 1))
222 else safeCompareLoop (drop 1 s1) (drop 1 s2) (result + (if take 1 s1 == take 1 s2 then 0 else 1))
208
223
209safeCompare = \a b -> safeCompareLoop a b 0 == 0
224safeCompare = \a b -> safeCompareLoop a b 0 == 0
@@ -575,7 +590,7 @@ serve = \req -> case req of
575
590
576 LookupPresence {pubkey, authorization, respond} -> do
591 LookupPresence {pubkey, authorization, respond} -> do
577 let validPubkey = not (pubkey == "") && not (tooLong pubkey maxPubkeyLen) && isValidHex pubkey
592 let validPubkey = not (pubkey == "") && not (tooLong pubkey maxPubkeyLen) && isValidHex pubkey
578− let pubkey = normalizeHex pubkey
593+ let pubkey = if isValidHex pubkey then normalizeHex pubkey else pubkey
579 t <- now
594 t <- now
580 result <- atomic do
595 result <- atomic do
581 pr <- pruneExpired t
596 pr <- pruneExpired t