apache

www/apache

mirror of https://github.com/apache/httpd.git synced 2026-10-28 11:57:22 +03:00

Files

Joe Orton 7f5de0aebf Add ap_*_timingsafe() constant-time comparison functions:

* include/httpd.h: Declare ap_memeq_timingsafe(),
  ap_streq_timingsafe(), ap_strneq_timingsafe().

* server/util.c: Implement, wrapping apr_*_timingsafe() if
  APR >= 1.8, with a fallback to copied-in versions.

* modules/aaa/mod_auth_digest.c: Replace apr_crypto_equals()
  with ap_memeq_timingsafe(). Remove apr_crypto.h include.

* modules/session/mod_session_crypto.c: Replace local
  ap_crypto_equals() with ap_memeq_timingsafe(). Remove
  the local implementation and macro alias.

Github: closes #638


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1933389 13f79535-47bb-0310-9956-ffa450edef68

2026-04-27 12:54:48 +00:00

config.m4

…

Makefile.in

…

mod_session_cookie.c

PR56040: add SessionCookieMaxAge On/Off

2020-03-02 00:58:36 +00:00

mod_session_cookie.dsp

…

mod_session_crypto.c

Add ap_*_timingsafe() constant-time comparison functions: