Use sanitization constant-time comparisons

Author: eldryoth

Cargo.lock

@@ -54,7 +54,7 @@ proxy = [
     "dep:rustix",
     "dep:serde_json",
     "dep:sha2",
-    "dep:subtle",
+    "dep:sanitization",
     "dep:ureq",
     "dep:zeroize",
 ]
@@ -280,7 +280,7 @@ rustls = { version = "0.23.40", optional = true }
 rustls-native-certs = { version = "0.8.3", optional = true }
 rustix = { version = "1.1.4", features = ["fs", "net", "process"], optional = true }
 sha2 = { version = "0.11.0", optional = true }
-subtle = { version = "2.6.1", optional = true }
+sanitization = { version = "1.2.0", optional = true }
 tokio = { version = "1.52.3", default-features = false, features = ["fs", "io-util", "net", "process", "rt", "time"], optional = true }
 tokio-openssl = { version = "0.6.5", optional = true }
 tokio-rustls = { version = "0.26.4", optional = true }

Cargo.toml

@@ -33,7 +33,7 @@ rustls = { version = "0.23.40", optional = true }
 rustls-native-certs = { version = "0.8.3", optional = true }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
-subtle = "2.6.1"
+sanitization = "1.2.0"
 tokio = { version = "1.52.3", default-features = false, features = ["io-util", "macros", "net", "process", "rt", "sync", "time"] }
 tokio-openssl = { version = "0.6.5", optional = true }
 tokio-rustls = { version = "0.26.4", optional = true }

crates/fluxheim-load-balancer/Cargo.toml

@@ -2,7 +2,7 @@ use std::net::IpAddr;
 use std::sync::{Mutex, OnceLock};
 use std::time::{Duration, Instant};
 
-use subtle::ConstantTimeEq;
+use sanitization::ct::ConstantTimeEq;
 use zeroize::{Zeroize, Zeroizing};
 
 use fluxheim_config::{
@@ -750,4 +750,20 @@ mod tests {
         let replay = TestRequest::default().with_header("cookie", format!("other_lb={token}"));
         assert_eq!(managed_cookie_key(&replay, "other_lb"), None);
     }
+
+    #[test]
+    fn managed_cookie_hmac_rejects_tampered_tag() {
+        let key = [3_u8; MANAGED_COOKIE_KEY_BYTES];
+        let token = managed_cookie_token(b"fluxheim_lb", &key).unwrap();
+        let mut tampered = token.into_bytes();
+        let last = tampered
+            .last_mut()
+            .expect("managed-cookie token is non-empty");
+        *last = if *last == b'A' { b'B' } else { b'A' };
+        let tampered = String::from_utf8(tampered).unwrap();
+        let request =
+            TestRequest::default().with_header("cookie", format!("fluxheim_lb={tampered}"));
+
+        assert_eq!(managed_cookie_key(&request, "fluxheim_lb"), None);
+    }
 }

crates/fluxheim-load-balancer/src/persistence.rs

@@ -16,9 +16,9 @@ use http::{HeaderMap, Response, StatusCode, header};
 use pingora::apps::http_app::{HttpServer, ServeHttp};
 use pingora::protocols::http::ServerSession;
 use pingora::services::listening::Service;
+use sanitization::ct::ConstantTimeEq;
 use serde::Serialize;
 use serde_json::{Value, json};
-use subtle::ConstantTimeEq;
 use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
 
 use crate::config::{AdminAuthThrottleConfig, AdminConfig, AdminHealthResponseMode, Config};
@@ -3197,7 +3197,8 @@ fn constant_time_eq(candidate: &[u8], token: &AdminToken) -> bool {
     let candidate_digest = digest_admin_token(candidate, token.mac_provider);
     let candidate_len = (candidate.len() as u64).to_le_bytes();
     let token_len = (token.len as u64).to_le_bytes();
-    bool::from(candidate_digest.ct_eq(&token.digest) & candidate_len.ct_eq(&token_len))
+    (candidate_digest.ct_eq(&token.digest) & candidate_len.ct_eq(&token_len))
+        .declassify("admin bearer-token comparison result is public")
 }
 
 fn digest_admin_token(
@@ -4240,8 +4241,9 @@ mod tests {
 
     use super::{
         AdminApp, AdminAuthThrottle, AdminToken, MAX_ADMIN_TOKEN_FILE_BYTES,
-        admin_services_from_config, authorized, constant_time_eq, error_response, json_response,
-        native_admin_target_parts, read_bounded_secret_file, read_secret_file,
+        admin_fingerprint_list_contains, admin_services_from_config, authorized, constant_time_eq,
+        error_response, json_response, native_admin_target_parts, read_bounded_secret_file,
+        read_secret_file,
     };
     #[cfg(feature = "cache")]
     use crate::config::ByteSize;
@@ -7842,6 +7844,7 @@ mod tests {
         let token = AdminToken::new("secret-token", false);
         assert!(authorized(Some("Bearer secret-token"), &token));
         assert!(!authorized(Some("Bearer secret"), &token));
+        assert!(!authorized(Some("Bearer secret-token-extra"), &token));
         assert!(!constant_time_eq(b"secret", &token));
         assert!(!authorized(
             Some(&format!(
@@ -7852,6 +7855,22 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn certificate_fingerprint_comparison_uses_exact_length_match() {
+        let fingerprint = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        let values = vec![fingerprint.to_owned()];
+
+        assert!(admin_fingerprint_list_contains(&values, fingerprint));
+        assert!(!admin_fingerprint_list_contains(
+            &values,
+            &fingerprint[..63]
+        ));
+        assert!(!admin_fingerprint_list_contains(
+            &values,
+            &format!("{fingerprint}a")
+        ));
+    }
+
     #[test]
     fn admin_client_certificate_policy_requires_trusted_fingerprint_header() {
         let app = app_with_config(Config {

src/admin.rs

@@ -4,7 +4,7 @@ use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 
-use subtle::ConstantTimeEq;
+use sanitization::ct::ConstantTimeEq;
 use tokio::sync::{OwnedSemaphorePermit, Semaphore};
 
 use crate::config::RateLimitMode;