basavaraj-sm05 60576f8bd1 net/socks5: compare proxy auth credentials in constant time ...

The SOCKS5 server checked the client-supplied username and password against the configured credentials with plain string equality, which returns on the first differing byte. In tsnet the password is a random 128-bit value that gates every dial out through the node, and the listener is on 127.0.0.1, so a local process can time the auth reject to recover it a byte at a time with unlimited attempts and no lockout. The LocalAPI sharing the same loopback listener already compares its credential with subtle.ConstantTimeCompare; do the same here for both fields, evaluating both so the username result does not gate whether the password is examined.

Updates #20998

Signed-off-by: basavaraj-sm05 <basavaraj@digiscrypt.com>

2026-08-28 11:53:43 -07:00

..

socks5_test.go

all: use Go 1.26 things, run most gofix modernizers

2026-03-06 13:32:03 -08:00

socks5.go

net/socks5: compare proxy auth credentials in constant time

2026-08-28 11:53:43 -07:00