Brad Davidson 239021e759 Consistently use constant-time comparison of password hashes ...

As per https://github.com/golang/go/issues/47001 even subtle.ConstantTimeCompare should never be used with variable-length inputs, as it will return 0 if the lengths do not match. Switch to consistently using constant-time comparisons of hashes for password checks to avoid any possible side-channel leaks that could be combined with other vectors to discover password lengths.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

2023-05-09 13:54:50 -07:00

..

agent

Bump cni plugins to v1.2.0-k3s1

2023-05-04 13:58:42 -07:00

apis/k3s.cattle.io

Create CRDs with schema

2023-04-27 20:42:46 -07:00

authenticator

Consistently use constant-time comparison of password hashes

2023-05-09 13:54:50 -07:00

bootstrap

Replace deprecated ioutil package (#6230)

2022-10-07 17:36:57 -07:00

cgroups

Replace deprecated ioutil package (#6230)

2022-10-07 17:36:57 -07:00

cli

Migrate netutil methods into /utils/net.go

2023-05-04 16:49:16 +02:00

clientaccess

Fail to validate server tokens that use bootstrap id/secret format

2023-05-05 12:24:35 -07:00

cloudprovider

Kubernetes v1.27.1 (#7271)

2023-04-18 21:48:36 -07:00

cluster

Fail to validate server tokens that use bootstrap id/secret format

2023-05-05 12:24:35 -07:00

codegen

[master] changing package to k3s-io (#4846)

2022-03-02 15:47:27 -08:00

configfilearg

Enable FindString to search dotD config files (#7323)

2023-05-02 11:18:23 -07:00

containerd

Update to v1.26.0-k3s1 (#6370)

2022-12-10 01:42:15 +02:00

crd

Create CRDs with schema

2023-04-27 20:42:46 -07:00

ctr

Build & enable ctr with k3s server

2019-06-30 09:30:25 -07:00

daemons

Handle multiple arguments with StringSlice flags (#7380)

2023-05-02 09:55:48 -07:00

data

code changes to drop the vendor dir

2021-12-21 14:23:38 -07:00

datadir

[master] changing package to k3s-io (#4846)

2022-03-02 15:47:27 -08:00

dataverify

Add file verification for data directory

2020-10-06 10:29:27 -07:00

deploy

local-storage: Fix permission (#7217)

2023-05-04 10:43:54 -07:00

etcd

Fix MemberList error handling and incorrect etcd-arg passthrough

2023-04-28 22:04:30 -07:00

flock

Update golangci-lint to 1.45.2

2022-04-13 14:48:42 -07:00

generated

Create CRDs with schema

2023-04-27 20:42:46 -07:00

kubeadm

Add support for k3s token command

2023-02-07 14:55:04 -08:00

kubectl

Track upstream changes to kubectl command execution

2022-03-16 17:19:18 -07:00

node

[master] changing package to k3s-io (#4846)

2022-03-02 15:47:27 -08:00

nodeconfig

Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent

2023-02-10 09:43:34 -08:00

nodepassword

Consistently use constant-time comparison of password hashes

2023-05-09 13:54:50 -07:00

passwd

Consistently use constant-time comparison of password hashes

2023-05-09 13:54:50 -07:00

rootless

Address nits from self-review

2022-11-21 15:23:30 -08:00

rootlessports

[master] changing package to k3s-io (#4846)

2022-03-02 15:47:27 -08:00

secretsencrypt

Ignore value conflicts when reencrypting secrets (#6850)

2023-02-07 13:58:44 -08:00

server

Consistently use constant-time comparison of password hashes

2023-05-09 13:54:50 -07:00

static

go generate

2023-04-28 11:13:47 -07:00

token

Replace deprecated ioutil package (#6230)

2022-10-07 17:36:57 -07:00

untar

Bump wharfie to v0.5.1 and use shared decompression code

2021-12-07 12:50:57 -08:00

util

Migrate netutil methods into /utils/net.go

2023-05-04 16:49:16 +02:00

version

remove hard coded value

2020-07-09 11:20:06 -07:00