HasherTest.php 9.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * Copyright (c) 2014 Lukas Reschke <lukas@owncloud.com>
  5. * This file is licensed under the Affero General Public License version 3 or
  6. * later.
  7. * See the COPYING-README file.
  8. */
  9. namespace Test\Security;
  10. use OC\Security\Hasher;
  11. use OCP\IConfig;
  12. /**
  13. * Class HasherTest
  14. */
  15. class HasherTest extends \Test\TestCase {
  16. /**
  17. * @return array
  18. */
  19. public function versionHashProvider() {
  20. return [
  21. ['asf32äà$$a.|3', null],
  22. ['asf32äà$$a.|3|5', null],
  23. ['1|2|3|4', ['version' => 1, 'hash' => '2|3|4']],
  24. ['1|我看|这本书。 我看這本書', ['version' => 1, 'hash' => '我看|这本书。 我看這本書']],
  25. ['2|newhash', ['version' => 2, 'hash' => 'newhash']],
  26. ];
  27. }
  28. public function hashProviders70_71(): array {
  29. return [
  30. // Valid SHA1 strings
  31. ['password', '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8', true],
  32. ['owncloud.com', '27a4643e43046c3569e33b68c1a4b15d31306d29', true],
  33. // Invalid SHA1 strings
  34. ['InvalidString', '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8', false],
  35. ['AnotherInvalidOne', '27a4643e43046c3569e33b68c1a4b15d31306d29', false],
  36. // Valid legacy password string with password salt "6Wow67q1wZQZpUUeI6G2LsWUu4XKx"
  37. ['password', '$2a$08$emCpDEl.V.QwPWt5gPrqrOhdpH6ailBmkj2Hd2vD5U8qIy20HBe7.', true],
  38. ['password', '$2a$08$yjaLO4ev70SaOsWZ9gRS3eRSEpHVsmSWTdTms1949mylxJ279hzo2', true],
  39. ['password', '$2a$08$.jNRG/oB4r7gHJhAyb.mDupNUAqTnBIW/tWBqFobaYflKXiFeG0A6', true],
  40. ['owncloud.com', '$2a$08$YbEsyASX/hXVNMv8hXQo7ezreN17T8Jl6PjecGZvpX.Ayz2aUyaZ2', true],
  41. ['owncloud.com', '$2a$11$cHdDA2IkUP28oNGBwlL7jO/U3dpr8/0LIjTZmE8dMPA7OCUQsSTqS', true],
  42. ['owncloud.com', '$2a$08$GH.UoIfJ1e.qeZ85KPqzQe6NR8XWRgJXWIUeE1o/j1xndvyTA1x96', true],
  43. // Invalid legacy passwords
  44. ['password', '$2a$08$oKAQY5IhnZocP.61MwP7xu7TNeOb7Ostvk3j6UpacvaNMs.xRj7O2', false],
  45. // Valid passwords "6Wow67q1wZQZpUUeI6G2LsWUu4XKx"
  46. ['password', '1|$2a$05$ezAE0dkwk57jlfo6z5Pql.gcIK3ReXT15W7ITNxVS0ksfhO/4E4Kq', true],
  47. ['password', '1|$2a$05$4OQmloFW4yTVez2MEWGIleDO9Z5G9tWBXxn1vddogmKBQq/Mq93pe', true],
  48. ['password', '1|$2a$11$yj0hlp6qR32G9exGEXktB.yW2rgt2maRBbPgi3EyxcDwKrD14x/WO', true],
  49. ['owncloud.com', '1|$2a$10$Yiss2WVOqGakxuuqySv5UeOKpF8d8KmNjuAPcBMiRJGizJXjA2bKm', true],
  50. ['owncloud.com', '1|$2a$10$v9mh8/.mF/Ut9jZ7pRnpkuac3bdFCnc4W/gSumheQUi02Sr.xMjPi', true],
  51. ['owncloud.com', '1|$2a$05$ST5E.rplNRfDCzRpzq69leRzsTGtY7k88h9Vy2eWj0Ug/iA9w5kGK', true],
  52. // Invalid passwords
  53. ['password', '0|$2a$08$oKAQY5IhnZocP.61MwP7xu7TNeOb7Ostvk3j6UpacvaNMs.xRj7O2', false],
  54. ['password', '1|$2a$08$oKAQY5IhnZocP.61MwP7xu7TNeOb7Ostvk3j6UpacvaNMs.xRj7O2', false],
  55. ['password', '2|$2a$08$oKAQY5IhnZocP.61MwP7xu7TNeOb7Ostvk3j6UpacvaNMs.xRj7O2', false],
  56. ];
  57. }
  58. public function hashProviders72(): array {
  59. return [
  60. // Valid ARGON2 hashes
  61. ['password', '2|$argon2i$v=19$m=1024,t=2,p=2$T3JGcEkxVFNOVktNSjZUcg$4/hyLtSejxNgAuzSFFV/HLM3qRQKBwEtKw61qPN4zWA', true],
  62. ['password', '2|$argon2i$v=19$m=1024,t=2,p=2$Zk52V24yNjMzTkhyYjJKOQ$vmqHkCaOD6SiiiFKD1GeKLg/D1ynWpyZbx4XA2yed34', true],
  63. ['password', '2|$argon2i$v=19$m=1024,t=2,p=2$R1pRcUZKamVlNndBc3l5ag$ToRhR8SiZc7fGMpOYfSc5haS5t9+Y00rljPJV7+qLkM', true],
  64. ['nextcloud.com', '2|$argon2i$v=19$m=1024,t=2,p=2$NC9xM0FFaDlzM01QM3kudg$fSfndwtO2mKMZlKdsT8XAtPY51cSS6pLSGS3xMqeJhg', true],
  65. ['nextcloud.com', '2|$argon2i$v=19$m=1024,t=2,p=2$UjkvUjEuL042WWl1cmdHOA$FZivLkBdZnloQsW6qq/jqWK95JSYUHW9rwQC4Ff9GN0', true],
  66. ['nextcloud.com', '2|$argon2i$v=19$m=1024,t=2,p=2$ZnpNdUlzMEpUTW40OVpiMQ$c+yHT9dtSYsjtVGsa7UKOsxxgQAMiUc781d9WsFACqs', true],
  67. //Invalid ARGON2 hashes
  68. ['password', '2|$argon2i$v=19$m=1024,t=2,p=2$UjFDUDg3cjBvM3FkbXVOWQ$7Y5xqFxSERnYn+2+7WChUpWZWMa5BEIhSHWnDgJ71Jk', false],
  69. ['password', '2|$argon2i$v=19$m=1024,t=2,p=2$ZUxSUi5aQklXdkcyMG1uVA$sYjoSvXg/CS/aS6Xnas/o9a/OPVcGKldzzmuiCD1Fxo', false],
  70. ['password', '2|$argon2i$v=19$m=1024,t=2,p=2$ZHQ5V0xMOFNmUC52by44Sg$DzQFk3bJTX0J4PVGwW6rMvtnBJRalBkbtpDIXR+d4A0', false],
  71. ];
  72. }
  73. public function hashProviders73(): array {
  74. return [
  75. // Valid ARGON2ID hashes
  76. ['password', '2|$argon2id$v=19$m=65536,t=4,p=1$TEtIMnhUczliQzI0Y01WeA$BpMUDrApy25iagIogUAnlc0rNTPJmGs8lOEeVHujJ9Q', true],
  77. ['password', '2|$argon2id$v=19$m=65536,t=4,p=1$RzdUdDNvbHhZalVQa2VIcQ$Wo8CGasVCBcSe69ldPdoVKTWEDQkET2cgQJSUiKcIzs', true],
  78. ['password', '2|$argon2id$v=19$m=65536,t=4,p=1$djlDMTVkL3VnMlNZNWZPeg$PCMpdAjB+OtwGpM75IGWmYHh1h2I7l5P8YabYtKubWg', true],
  79. ['nextcloud.com', '2|$argon2id$v=19$m=65536,t=4,p=1$VGhGL05rcUI3d3k3WVhibQ$CSy0ShUnamZQhu8oeZfUTTd/S3z966zuQ/uz1Y80Rss', true],
  80. ['nextcloud.com', '2|$argon2id$v=19$m=65536,t=4,p=1$ZVlZTVlCaTZhRlZHOGFpYQ$xd1TtMz1Mi0SuZrP+VWB3v/hwoC7HfSVsUYmzOo2DUU', true],
  81. ['nextcloud.com', '2|$argon2id$v=19$m=65536,t=4,p=1$OG1wZUtzZ0tnLjF2MUZVMA$CBluq8W8ISmZ9QumeWsVhaVREP0Zcq8rwk2NrA9d4YE', true],
  82. //Invalid ARGON2ID hashes
  83. ['password', '2|$argon2id$v=19$m=65536,t=4,p=1$V3ovTHlvc0Eyb24xenVRNQ$iY/A0Yf24c2DToedj2rj9+KeoJBGsJYQOlJMoa0SFXk', false],
  84. ['password', '2|$argon2id$v=19$m=65536,t=4,p=1$NlYuMlQ0ODIudTRkZDhYUw$/Z71ckOIuydujedUGK73iXC9vbLzlH/iXkG9+gGgn+c', false],
  85. ['password', '2|$argon2id$v=19$m=65536,t=4,p=1$b09kNFZTZWFjS05aTkl6ZA$llE4TnIYYrC0H7wkTL1JsIwAAgoMJERlqtFcHHQcXTs', false],
  86. ];
  87. }
  88. /** @var Hasher */
  89. protected $hasher;
  90. /** @var IConfig */
  91. protected $config;
  92. protected function setUp(): void {
  93. parent::setUp();
  94. $this->config = $this->createMock(IConfig::class);
  95. $this->config->method('getSystemValueInt')
  96. ->willReturnCallback(function ($name, $default) {
  97. return $default;
  98. });
  99. $this->hasher = new Hasher($this->config);
  100. }
  101. public function testHash() {
  102. $hash = $this->hasher->hash('String To Hash');
  103. $this->assertNotNull($hash);
  104. }
  105. /**
  106. * @dataProvider versionHashProvider
  107. */
  108. public function testSplitHash($hash, $expected) {
  109. $relativePath = self::invokePrivate($this->hasher, 'splitHash', [$hash]);
  110. $this->assertSame($expected, $relativePath);
  111. }
  112. /**
  113. * @dataProvider hashProviders70_71
  114. */
  115. public function testVerify($password, $hash, $expected) {
  116. $this->config
  117. ->expects($this->any())
  118. ->method('getSystemValue')
  119. ->willReturnCallback(function ($key, $default) {
  120. if ($key === 'passwordsalt') {
  121. return '6Wow67q1wZQZpUUeI6G2LsWUu4XKx';
  122. }
  123. return $default;
  124. });
  125. $result = $this->hasher->verify($password, $hash);
  126. $this->assertSame($expected, $result);
  127. }
  128. /**
  129. * @dataProvider hashProviders72
  130. */
  131. public function testVerifyArgon2i($password, $hash, $expected) {
  132. if (!\defined('PASSWORD_ARGON2I')) {
  133. $this->markTestSkipped('Need ARGON2 support to test ARGON2 hashes');
  134. }
  135. $result = $this->hasher->verify($password, $hash);
  136. $this->assertSame($expected, $result);
  137. }
  138. /**
  139. * @dataProvider hashProviders73
  140. */
  141. public function testVerifyArgon2id(string $password, string $hash, bool $expected) {
  142. if (!\defined('PASSWORD_ARGON2ID')) {
  143. $this->markTestSkipped('Need ARGON2ID support to test ARGON2ID hashes');
  144. }
  145. $result = $this->hasher->verify($password, $hash);
  146. $this->assertSame($expected, $result);
  147. }
  148. public function testUpgradeHashBlowFishToArgon2() {
  149. if (!\defined('PASSWORD_ARGON2I')) {
  150. $this->markTestSkipped('Need ARGON2 support to test ARGON2 hashes');
  151. }
  152. $message = 'mysecret';
  153. $blowfish = 1 . '|' . password_hash($message, PASSWORD_BCRYPT, []);
  154. $argon2 = 2 . '|' . password_hash($message, PASSWORD_ARGON2I, []);
  155. $newAlg = PASSWORD_ARGON2I;
  156. if (\defined('PASSWORD_ARGON2ID')) {
  157. $newAlg = PASSWORD_ARGON2ID;
  158. $argon2 = 2 . '|' . password_hash($message, PASSWORD_ARGON2ID, []);
  159. }
  160. $this->assertTrue($this->hasher->verify($message, $blowfish, $newHash));
  161. $this->assertTrue($this->hasher->verify($message, $argon2));
  162. $relativePath = self::invokePrivate($this->hasher, 'splitHash', [$newHash]);
  163. $this->assertFalse(password_needs_rehash($relativePath['hash'], $newAlg, []));
  164. }
  165. public function testUsePasswordDefaultArgon2iVerify() {
  166. if (!\defined('PASSWORD_ARGON2I')) {
  167. $this->markTestSkipped('Need ARGON2 support to test ARGON2 hashes');
  168. }
  169. $this->config->method('getSystemValueBool')
  170. ->with('hashing_default_password')
  171. ->willReturn(true);
  172. $message = 'mysecret';
  173. $argon2i = 2 . '|' . password_hash($message, PASSWORD_ARGON2I, []);
  174. $newHash = null;
  175. $this->assertTrue($this->hasher->verify($message, $argon2i, $newHash));
  176. $this->assertNotNull($newHash);
  177. $relativePath = self::invokePrivate($this->hasher, 'splitHash', [$newHash]);
  178. $this->assertEquals(1, $relativePath['version']);
  179. $this->assertEquals(PASSWORD_BCRYPT, password_get_info($relativePath['hash'])['algo']);
  180. $this->assertFalse(password_needs_rehash($relativePath['hash'], PASSWORD_BCRYPT));
  181. $this->assertTrue(password_verify($message, $relativePath['hash']));
  182. }
  183. public function testDoNotUsePasswordDefaultArgon2idVerify() {
  184. if (!\defined('PASSWORD_ARGON2ID')) {
  185. $this->markTestSkipped('Need ARGON2ID support to test ARGON2ID hashes');
  186. }
  187. $this->config->method('getSystemValueBool')
  188. ->with('hashing_default_password')
  189. ->willReturn(false);
  190. $message = 'mysecret';
  191. $argon2id = 3 . '|' . password_hash($message, PASSWORD_ARGON2ID, []);
  192. $newHash = null;
  193. $this->assertTrue($this->hasher->verify($message, $argon2id, $newHash));
  194. $this->assertNull($newHash);
  195. }
  196. public function testHashUsePasswordDefault() {
  197. if (!\defined('PASSWORD_ARGON2I')) {
  198. $this->markTestSkipped('Need ARGON2 support to test ARGON2 hashes');
  199. }
  200. $this->config->method('getSystemValueBool')
  201. ->with('hashing_default_password')
  202. ->willReturn(true);
  203. $message = 'mysecret';
  204. $hash = $this->hasher->hash($message);
  205. $relativePath = self::invokePrivate($this->hasher, 'splitHash', [$hash]);
  206. $this->assertSame(1, $relativePath['version']);
  207. $info = password_get_info($relativePath['hash']);
  208. $this->assertEquals(PASSWORD_BCRYPT, $info['algo']);
  209. }
  210. }