libpam: add helper to compare strings in constant time

Add a helper function to compare two strings for equality, that performs
the same amount of operations based on the first argument, regardless of
the length of the second argument, or the position of the first
difference.
This can be used as defense-in-depth mitigation against timing attacks
of password comparisons.

1 files changed, 14 insertions, 0 deletions

diff --git a/libpam/include/pam_inline.h b/libpam/include/pam_inline.h
index cf04c9af..a5aceb8a 100644
--- a/libpam/include/pam_inline.h
+++ b/libpam/include/pam_inline.h
@@ -175,4 +175,18 @@ pam_read_passwords(int fd, int npass, char **passwords)
 	return i;
 }
 
+static inline int
+pam_consttime_streq(const char *userinput, const char *secret) {
+	volatile const char *u = userinput, *s = secret;
+	volatile int ret = 0;
+
+	do {
+		ret |= *u ^ *s;
+
+		s += !!*s;
+	} while (*u++ != '\0');
+
+	return ret == 0;
+}
+
 #endif /* PAM_INLINE_H */