src/auth/test-libpassword.c

	test-libpassword.c revision 66db268d57e782c952c8c0e5b1127ee6b69aeceb
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen#include "test-lib.h"
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen#include "password-scheme.h"
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen#ifdef HAVE_LIBSODIUM
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen#include <sodium.h>
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen#endif
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainenstatic struct {
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const char *scheme_generated;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const char *scheme_detected;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen} known_non_aliases[] = {
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    { "MD5", "CRYPT" },
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    { "MD5-CRYPT", "CRYPT" },
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    { "SKEY", "OTP" },
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    { "ARGON2ID", "ARGON2I" },
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen};
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen/* some algorithms are detected as something other, because they are compatible
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen   but not considered aliases by dovecot. treat those here to avoid false errors. */
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainenstatic bool schemes_are_known_non_alias(const char *generated, const char *detected)
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainen{
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    for(size_t i = 0; i < N_ELEMENTS(known_non_aliases); i++) {
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen        if (strcmp(known_non_aliases[i].scheme_generated, generated) == 0 &&
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen            strcmp(known_non_aliases[i].scheme_detected, detected) == 0)
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen            return TRUE;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    }
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    return FALSE;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen}
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainenstatic void
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainentest_password_scheme(const char *scheme, const char *crypted,
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen             const char *plaintext)
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainen{
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    struct password_generate_params params = {
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen        .user = "testuser1",
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen        .rounds = 0,
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    };
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const unsigned char *raw_password;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    size_t siz;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const char *error, *scheme2;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_begin(t_strdup_printf("password scheme(%s)", scheme));
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(strcmp(password_get_scheme(&crypted), scheme) == 0);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_decode(crypted, scheme, &raw_password, &siz, &error) == 1);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_verify(plaintext, &params, scheme, raw_password, siz, &error) == 1);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_generate_encoded(plaintext, &params, scheme, &crypted));
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    crypted = t_strdup_printf("{%s}%s", scheme, crypted);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(strcmp(password_get_scheme(&crypted), scheme) == 0);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_decode(crypted, scheme, &raw_password, &siz, &error) == 1);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_verify(plaintext, &params, scheme, raw_password, siz, &error) == 1);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    scheme2 = password_scheme_detect(plaintext, crypted, &params);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(scheme2 != NULL &&
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen            (password_scheme_is_alias(scheme, scheme2) ||
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen             schemes_are_known_non_alias(scheme, scheme2)));
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_end();
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainen}
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainenstatic void test_password_failures(void)
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen{
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const char *scheme = "PLAIN";
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const char *crypted = "{PLAIN}invalid";
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const char *plaintext = "test";
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    struct password_generate_params params = {
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen        .user = "testuser1",
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen        .rounds = 0,
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    };
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const unsigned char *raw_password;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    size_t siz;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    const char *error;
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_begin("password scheme failures");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    /* wrong password */
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(strcmp(password_get_scheme(&crypted), scheme) == 0);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_decode(crypted, scheme, &raw_password, &siz, &error) == 1);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_verify(plaintext, &params, scheme, raw_password, siz, &error) == 0);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    /* unknown scheme */
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    crypted = "{INVALID}invalid";
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    scheme = password_get_scheme(&crypted);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_decode(crypted, scheme, &raw_password, &siz, &error) == 0);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    /* crypt with empty value */
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_assert(password_verify(plaintext, &params, "CRYPT", NULL, 0, &error) == 0);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_end();
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen}
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainenstatic void test_password_schemes(void)
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen{
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("PLAIN", "{PLAIN}test", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("CRYPT", "{CRYPT}//EsnG9FLTKjo", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("PLAIN-MD4", "{PLAIN-MD4}db346d691d7acc4dc2625db19f9e3f52", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("MD5", "{MD5}$1$wmyrgRuV$kImF6.9MAFQNHe23kq5vI/", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("SHA1", "{SHA1}qUqP5cyxm6YcTAhz05Hph5gvu9M=", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("LANMAN", "{LANMAN}01fc5a6be7bc6929aad3b435b51404ee", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("NTLM", "{NTLM}0cb6948805f797bf2a82807973b89537", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("SMD5", "{SMD5}JTu1KRwptKZJg/RLd+6Vn5GUd0M=", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("LDAP-MD5", "{LDAP-MD5}CY9rzUYh03PK3k6DJie09g==", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("SHA256", "{SHA256}n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("SHA512", "{SHA512}7iaw3Ur350mqGo7jwQrpkj9hiYB3Lkc/iBml1JQODbJ6wYX4oOHV+E+IvIh/1nsUNzLDBMxfqa2Ob1f1ACio/w==", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("SSHA", "{SSHA}H/zrDv8FXUu1JmwvVYijfrYEF34jVZcO", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("MD5-CRYPT", "{MD5-CRYPT}$1$GgvxyNz8$OjZhLh4P.gF1lxYEbLZ3e/", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("OTP", "{OTP}sha1 1024 ae6b49aa481f7233 f69fc7f98b8fbf54", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("PBKDF2", "{PBKDF2}$1$bUnT4Pl7yFtYX0KU$5000$50a83cafdc517b9f46519415e53c6a858908680a", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("RPA", "{RPA}f89cb77d46507afe985d80822b6b6c39", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("SKEY", "{SKEY}md4 1024 ce20d20fae368ff2 689aea1b24ed6438", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("CRAM-MD5", "{CRAM-MD5}e02d374fde0dc75a17a557039a3a5338c7743304777dccd376f332bee68d2cf6", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("DIGEST-MD5", "{DIGEST-MD5}77c1a8c437c9b08ba2f460fe5d58db5d", "test");
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainen    test_password_scheme("SCRAM-SHA-1", "{SCRAM-SHA-1}4096,GetyLXdBuHzf1FWf8SLz2Q==,NA/OqmF4hhrsrB9KR7po+dliTGM=,QBiURvQaE6H6qYTmeghDHLANBFQ=", "test");
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainen    test_password_scheme("BLF-CRYPT", "{BLF-CRYPT}$2y$05$11ipvo5dR6CwkzwmhwM26OXgzXwhV2PyPuLV.Qi31ILcRcThQpEiW", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen#ifdef HAVE_LIBSODIUM
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("ARGON2I", "{ARGON2I}$argon2i$v=19$m=32768,t=4,p=1$f2iuP4aUeNMrgu34fhOkkg$1XSZZMWlIs0zmE+snlUIcLADO3GXbA2O/hsQmmc317k", "test");
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen#ifdef crypto_pwhash_ALG_ARGON2ID13
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    test_password_scheme("ARGON2ID", "{ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$vBb99oJ12p3WAdYlaMHz1A$jtFOtbo/sYV9OSlTxDo/nVNq3uArHd5GJSEx0ty85Cc", "test");
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainen#endif
049da065aa64c1a5ed46eed6cde7382b011612a9Timo Sirainen#endif
049da065aa64c1a5ed46eed6cde7382b011612a9Timo Sirainen}
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainenint main(void)
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen{
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainen    static void (*const test_functions[])(void) = {
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen        test_password_schemes,
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen        test_password_failures,
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen        NULL
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    };
b10c3f9ed997748fdbb03b9daadc8c31eed02120Timo Sirainen    password_schemes_init();
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen    return test_run(test_functions);
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen}
c8593b070319d0ff83f8d6c4b5ed5abf2d578a06Timo Sirainen