Backport: sec: perform constant time compare for sensitive values (#22537) (#22792)

Author: LakshmiNarayananDesikan

.changelog/22537.txt

@@ -0,0 +1,3 @@
+```release-note:security
+security: perform constant time compare for sensitive values.
+```

agent/consul/acl.go

@@ -5,6 +5,7 @@ package consul
 
 import (
 	"context"
+	"crypto/subtle"
 	"fmt"
 	"sort"
 	"sync"
@@ -969,7 +970,7 @@ func (r *ACLResolver) resolveTokenToIdentityAndPolicies(token string) (structs.A
 		lastErr = err
 
 		if tokenErr, ok := err.(*policyOrRoleTokenError); ok {
-			if acl.IsErrNotFound(err) && tokenErr.token == identity.SecretToken() {
+			if acl.IsErrNotFound(err) && subtle.ConstantTimeCompare([]byte(tokenErr.token), []byte(identity.SecretToken())) == 1 {
 				// token was deleted while resolving policies
 				return nil, nil, acl.ErrNotFound
 			}
@@ -1008,8 +1009,7 @@ func (r *ACLResolver) resolveTokenToIdentityAndRoles(token string) (structs.ACLI
 		lastErr = err
 
 		if tokenErr, ok := err.(*policyOrRoleTokenError); ok {
-			if acl.IsErrNotFound(err) && tokenErr.token == identity.SecretToken() {
-				// token was deleted while resolving roles
+			if acl.IsErrNotFound(err) && subtle.ConstantTimeCompare([]byte(tokenErr.token), []byte(identity.SecretToken())) == 1 { // token was deleted while resolving roles
 				return nil, nil, acl.ErrNotFound
 			}
 

agent/consul/acl_endpoint.go

@@ -5,6 +5,7 @@ package consul
 
 import (
 	"context"
+	"crypto/subtle"
 	"errors"
 	"fmt"
 	"os"
@@ -613,7 +614,7 @@ func (a *ACL) TokenDelete(args *structs.ACLTokenDeleteRequest, reply *string) er
 	}
 
 	if token != nil {
-		if args.Token == token.SecretID {
+		if subtle.ConstantTimeCompare([]byte(args.Token), []byte(token.SecretID)) == 1 {
 			return fmt.Errorf("Deletion of the request's authorization token is not permitted")
 		}
 

agent/consul/auth/token_writer.go

@@ -4,6 +4,7 @@
 package auth
 
 import (
+	"crypto/subtle"
 	"errors"
 	"fmt"
 	"time"
@@ -185,7 +186,7 @@ func (w *TokenWriter) Update(token *structs.ACLToken) (*structs.ACLToken, error)
 
 	if token.SecretID == "" {
 		token.SecretID = match.SecretID
-	} else if match.SecretID != token.SecretID {
+	} else if subtle.ConstantTimeCompare([]byte(match.SecretID), []byte(token.SecretID)) != 1 {
 		return nil, errors.New("Changing a token's SecretID is not permitted")
 	}