dnim/rust-postgres
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #313 from FauxFaux/update-sha2-0.7

Browse Source 
Upgrade hmac, sha2 and generic_array
This commit is contained in:
Steven Fackler
2018-01-15 11:21:10 -08:00
committed by GitHub
parent 9d200ea387 bcc0996f04
commit 691eec2533
3 changed files with 29 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.circleci/config.yml
View File

@@ -27,7 +27,7 @@ jobs:
build:
working_directory: ~/build
docker:
- image: rust:1.19.0
- image: rust:1.20.0
environment:
RUSTFLAGS: -D warnings
- image: sfackler/rust-postgres-test:3

6
postgres-protocol/Cargo.toml
View File

@@ -12,10 +12,10 @@ base64 = "0.6"
byteorder = "1.0"
bytes = "0.4"
fallible-iterator = "0.1"
generic-array = "0.8"
hmac = "0.4"
generic-array = "0.9"
hmac = "0.5"
md5 = "0.3"
memchr = "1.0"
rand = "0.3"
sha2 = "0.6"
sha2 = "0.7"
stringprep = "0.1"

49
postgres-protocol/src/authentication/sasl.rs
View File

@@ -34,20 +34,21 @@ fn normalize(pass: &[u8]) -> Vec<u8> {
}
fn hi(str: &[u8], salt: &[u8], i: u32) -> GenericArray<u8, U32> {
let mut hmac = Hmac::<Sha256>::new(str);
let mut hmac = Hmac::<Sha256>::new(str)
.expect("HMAC is able to accept all key sizes");
hmac.input(salt);
hmac.input(&[0, 0, 0, 1]);
let mut prev = hmac.result();
let mut prev = hmac.result().code();
let mut hi = GenericArray::<u8, U32>::clone_from_slice(prev.code());
let mut hi = GenericArray::<u8, U32>::clone_from_slice(&prev);
for _ in 1..i {
let mut hmac = Hmac::<Sha256>::new(str);
hmac.input(prev.code());
prev = hmac.result();
let mut hmac = Hmac::<Sha256>::new(str).expect("already checked above");
hmac.input(prev.as_slice());
prev = hmac.result().code();
for (hi, prev) in hi.iter_mut().zip(prev.code()) {
*hi ^= *prev;
for (hi, prev) in hi.iter_mut().zip(prev) {
*hi ^= prev;
}
}
@@ -150,12 +151,13 @@ impl ScramSha256 {
let salted_password = hi(&password, &salt, parsed.iteration_count);
let mut hmac = Hmac::<Sha256>::new(&salted_password);
let mut hmac = Hmac::<Sha256>::new(&salted_password)
.expect("HMAC is able to accept all key sizes");
hmac.input(b"Client Key");
let client_key = hmac.result();
let client_key = hmac.result().code();
let mut hash = Sha256::default();
hash.input(client_key.code());
hash.input(client_key.as_slice());
let stored_key = hash.result();
self.message.clear();
@@ -163,13 +165,14 @@ impl ScramSha256 {
let auth_message = format!("n=,r={},{},{}", client_nonce, message, self.message);
let mut hmac = Hmac::<Sha256>::new(&stored_key);
let mut hmac = Hmac::<Sha256>::new(&stored_key)
.expect("HMAC is able to accept all key sizes");
hmac.input(auth_message.as_bytes());
let client_signature = hmac.result();
let mut client_proof = GenericArray::<u8, U32>::clone_from_slice(client_key.code());
let mut client_proof = GenericArray::<u8, U32>::clone_from_slice(&client_key);
for (proof, signature) in client_proof.iter_mut().zip(client_signature.code()) {
*proof ^= *signature;
*proof ^= signature;
}
write!(&mut self.message, ",p={}", base64::encode(&*client_proof)).unwrap();
@@ -215,20 +218,18 @@ impl ScramSha256 {
Err(e) => return Err(io::Error::new(io::ErrorKind::InvalidInput, e)),
};
let mut hmac = Hmac::<Sha256>::new(&salted_password);
let mut hmac = Hmac::<Sha256>::new(&salted_password)
.expect("HMAC is able to accept all key sizes");
hmac.input(b"Server Key");
let server_key = hmac.result();
let mut hmac = Hmac::<Sha256>::new(server_key.code());
let mut hmac = Hmac::<Sha256>::new(&server_key.code())
.expect("HMAC is able to accept all key sizes");
hmac.input(auth_message.as_bytes());
if hmac.verify(&verifier) {
Ok(())
} else {
Err(io::Error::new(
io::ErrorKind::InvalidInput,
"SCRAM verification error",
))
}
hmac.verify(&verifier).map_err(|_| io::Error::new(
io::ErrorKind::InvalidInput,
"SCRAM verification error",
))
}
}