Meishin/LoginSystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

#358 Create encryption method supertypes, add new methods

Browse Source
This commit is contained in:
ljacqu
2015-12-28 20:10:45 +01:00
parent 31730699ac
commit 48d0a65724
43 changed files with 551 additions and 524 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/fr/xephi/authme/security/crypts/AbstractEncryptionMethodTest.java
+20 -58
View File
@@ -1,9 +1,7 @@
package fr.xephi.authme.security.crypts;
import fr.xephi.authme.security.PasswordSecurity;
import org.junit.Test;
import java.security.NoSuchAlgorithmException;
import java.util.HashMap;
import java.util.Map;
@@ -11,6 +9,7 @@ import static org.hamcrest.Matchers.equalTo;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertThat;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
/**
* Test for implementations of {@link EncryptionMethod}.
@@ -98,15 +97,13 @@ public abstract class AbstractEncryptionMethodTest {
}
@Test
public void testPasswordEquality() throws NoSuchAlgorithmException {
// TODO #358: Remove "throws NoSuchAlgorithmException" on method declaration
public void testPasswordEquality() {
// TODO #358: Remove instanceof and use this code always
if (method instanceof NewEncrMethod) {
NewEncrMethod method1 = (NewEncrMethod) method;
for (String password : INTERNAL_PASSWORDS) {
HashResult result = method1.computeHash(password, USERNAME);
final String hash = result.getHash();
final String salt = result.getSalt();
final String salt = method1.generateSalt();
final String hash = method1.computeHash(password, salt, USERNAME);
// Check that the computeHash(password, salt, name) method has the same output for the returned salt
assertThat(hash, equalTo(method1.computeHash(password, salt, USERNAME)));
@@ -125,23 +122,7 @@ public abstract class AbstractEncryptionMethodTest {
return;
}
for (String password : INTERNAL_PASSWORDS) {
try {
String hash = method.computeHash(password, getSalt(method), USERNAME);
assertTrue("Generated hash for '" + password + "' should match password (hash = '" + hash + "')",
method.comparePassword(hash, password, USERNAME));
if (!password.equals(password.toLowerCase())) {
assertFalse("Lower-case of '" + password + "' should not match generated hash '" + hash + "'",
method.comparePassword(hash, password.toLowerCase(), USERNAME));
}
if (!password.equals(password.toUpperCase())) {
assertFalse("Upper-case of '" + password + "' should not match generated hash '" + hash + "'",
method.comparePassword(hash, password.toUpperCase(), USERNAME));
}
} catch (NoSuchAlgorithmException e) {
throw new IllegalStateException("EncryptionMethod '" + method + "' threw exception", e);
}
}
fail("No longer supporting old EncryptionMethod implementations");
}
private boolean doesGivenHashMatch(String password, EncryptionMethod method) {
@@ -154,11 +135,8 @@ public abstract class AbstractEncryptionMethodTest {
}
try {
return method.comparePassword(hashes.get(password), password, USERNAME);
} catch (NoSuchAlgorithmException e) {
throw new IllegalStateException("EncryptionMethod '" + method + "' threw exception", e);
}
// TODO #358: Remove line below
return method.comparePassword(hashes.get(password), password, USERNAME);
}
// @org.junit.Test public void a() { AbstractEncryptionMethodTest.generateTest(); }
@@ -170,45 +148,29 @@ public abstract class AbstractEncryptionMethodTest {
System.out.println("\n\tpublic " + className + "Test() {");
System.out.println("\t\tsuper(new " + className + "(),");
NewEncrMethod method1 = null;
if (method instanceof NewEncrMethod) {
method1 = (NewEncrMethod) method;
if (!method1.hasSeparateSalt()) method1 = null;
}
String delim = ", ";
for (String password : GIVEN_PASSWORDS) {
if (password.equals(GIVEN_PASSWORDS[GIVEN_PASSWORDS.length - 1])) {
delim = "); ";
}
try {
System.out.println("\t\t\"" + method.computeHash(password, getSalt(method), USERNAME)
if (method1 != null) {
HashResult hashResult = method1.computeHash(password, USERNAME);
System.out.println(String.format("\t\tnew HashResult(\"%s\", \"%s\")%s// %s",
hashResult.getHash(), hashResult.getSalt(), delim, password));
} else {
System.out.println("\t\t\"" + method.computeHash(password, null, USERNAME)
+ "\"" + delim + "// " + password);
} catch (NoSuchAlgorithmException e) {
throw new IllegalStateException("Could not generate hash", e);
}
}
System.out.println("\t}");
System.out.println("\n}");
}
// TODO #358: Remove this method and use the new salt method on the interface
private static String getSalt(EncryptionMethod method) {
if (method instanceof BCRYPT) {
return BCRYPT.gensalt();
} else if (method instanceof MD5 || method instanceof WORDPRESS || method instanceof SMF
|| method instanceof SHA512 || method instanceof SHA1 || method instanceof ROYALAUTH
|| method instanceof DOUBLEMD5 || method instanceof CRAZYCRYPT1) {
return "";
} else if (method instanceof JOOMLA || method instanceof SALTEDSHA512) {
return PasswordSecurity.createSalt(32);
} else if (method instanceof SHA256 || method instanceof PHPBB || method instanceof WHIRLPOOL
|| method instanceof MD5VB || method instanceof BCRYPT2Y) {
return PasswordSecurity.createSalt(16);
} else if (method instanceof WBB3) {
return PasswordSecurity.createSalt(40);
} else if (method instanceof XAUTH || method instanceof CryptPBKDF2Django
|| method instanceof CryptPBKDF2) {
return PasswordSecurity.createSalt(12);
} else if (method instanceof WBB4) {
return BCRYPT.gensalt(8);
}
System.out.println("Note: Cannot generate salt for unknown encryption method '" + method + "'");
return "";
}
}
src/test/java/fr/xephi/authme/security/crypts/BcryptTest.java
+10
View File
@@ -1,10 +1,20 @@
package fr.xephi.authme.security.crypts;
import fr.xephi.authme.settings.Settings;
import fr.xephi.authme.util.WrapperMock;
import org.junit.Before;
/**
* Test for {@link BCRYPT}.
*/
public class BcryptTest extends AbstractEncryptionMethodTest {
@Before
public void setUpSettings() {
WrapperMock.createInstance();
Settings.bCryptLog2Rounds = 8;
}
public BcryptTest() {
super(new BCRYPT(),
"$2a$10$6iATmYgwJVc3YONhVcZFve3Cfb5GnwvKhJ20r.hMjmcNkIT9.Uh9K", // password
src/test/java/fr/xephi/authme/security/crypts/IPB3Test.java
+16
View File
@@ -0,0 +1,16 @@
package fr.xephi.authme.security.crypts;
/**
* Test for {@link IPB3}.
*/
public class IPB3Test extends AbstractEncryptionMethodTest {
public IPB3Test() {
super(new IPB3(),
new HashResult("f8ecea1ce42b5babef369ff7692dbe3f", "1715b"), //password
new HashResult("40a93731a931352e0619cdf09b975040", "ba91c"), //PassWord1
new HashResult("a77ca982373946d5800430bd2947ba11", "a7725"), //&^%te$t?Pw@_
new HashResult("383d7b9e2b707d6e894ec7b30e3032c3", "fa9fd")); //âË_3(íù*
}
}
src/test/java/fr/xephi/authme/security/crypts/MYBBTest.java
+16
View File
@@ -0,0 +1,16 @@
package fr.xephi.authme.security.crypts;
/**
* Test for {@link MYBB}.
*/
public class MYBBTest extends AbstractEncryptionMethodTest {
public MYBBTest() {
super(new MYBB(),
new HashResult("57c7a16d860833db5030738f5a465d2b", "acdc14e6"), //password
new HashResult("08fbdf721f2c42d9780b7d66df0ba830", "792fd7fb"), //PassWord1
new HashResult("d602f38fb59ad9e185d5604f5d4ddb36", "4b5534a4"), //&^%te$t?Pw@_
new HashResult("b3c39410d0ab8ae2a65c257820797fad", "e5a6cb14")); //âË_3(íù*
}
}
src/test/java/fr/xephi/authme/security/crypts/Md5Test.java
+4 -5
View File
@@ -7,11 +7,10 @@ public class Md5Test extends AbstractEncryptionMethodTest {
public Md5Test() {
super(new MD5(),
"5f4dcc3b5aa765d61d8327deb882cf99", // password
"f2126d405f46ed603ff5b2950f062c96", // PassWord1
"0833dcd2bc741f90c46bbac5498fd08f", // &^%te$t?Pw@_
"d1accd961cb7b688c87278191c1dfed3" // âË_3(íù*
);
"5f4dcc3b5aa765d61d8327deb882cf99", // password
"f2126d405f46ed603ff5b2950f062c96", // PassWord1
"0833dcd2bc741f90c46bbac5498fd08f", // &^%te$t?Pw@_
"d1accd961cb7b688c87278191c1dfed3"); // âË_3(íù*
}
}
src/test/java/fr/xephi/authme/security/crypts/PHPFUSIONTest.java
+20
View File
@@ -0,0 +1,20 @@
package fr.xephi.authme.security.crypts;
import org.junit.Ignore;
/**
* Test for {@link PHPFUSION}.
*/
@Ignore
// TODO #364: Need to skip lowercase/uppercase password test for the non-ASCII one
public class PHPFUSIONTest extends AbstractEncryptionMethodTest {
public PHPFUSIONTest() {
super(new PHPFUSION(),
new HashResult("f7a606c4eb3fcfbc382906476e05b06f21234a77d1a4eacc0f93f503deb69e70", "6cd1c97c55cb"), // password
new HashResult("8a9b7bb706a3347e5f684a7cb905bfb26b9a0d099358064139ab3ed1a66aeb2b", "d6012370b73f"), // PassWord1
new HashResult("43f2f23f44c8f89e2dbf06050bc8c77dbcdf71a7b5d28c87ec657d474e63d62d", "f75400a209a4"), // &^%te$t?Pw@_
new HashResult("4e7f4eb7e3653d7460f1cf590def4153c6fcdf8b8e16fb95538fdf9e54a95245", "d552e0f5b23a")); // âË_3(íù*
}
}
src/test/java/fr/xephi/authme/security/crypts/SALTEDSHA512Test.java
+4 -8
View File
@@ -1,20 +1,16 @@
package fr.xephi.authme.security.crypts;
import org.junit.Ignore;
/**
* Test for {@link SALTEDSHA512}.
*/
@Ignore
// TODO ljacqu 20151220: Currently cannot test because of closely coupled database call inside of class
public class SALTEDSHA512Test extends AbstractEncryptionMethodTest {
public SALTEDSHA512Test() {
super(new SALTEDSHA512(),
"c8efe95e1ab02d9a0e7c7d11d4ac3cc068a8405b5810aac3a1b8b01927ab059563438131dc995156739daf74db40ffdc79b78f6aec9b2a468fe106b88c66c204", // password
"74c61af1bcbb3293cdc0959c7323d50be28c167eddc7a1b7eb029e38263c2cfb6eb090f41370a65249752aa316fa851091c2bd8420302e87d383529beea735b4", // PassWord1
"08eefcca4a17876441ebe61a02e8bc62cab7502dd87f8ec3b7f82edb2adace791b8dad31e74c5513cf99be502b732f5c5efffb239f4590d5c600d066a7037908", // &^%te$t?Pw@_
"a122490c4c7c18ad665b5ac9617c948741468a787a2ba42c6fd2530ea1d7874681b8575ee9a8907c42ff65dac69e4ada2852789759c17d51865ca915b259a65a"); // âË_3(íù*
new HashResult("dea7a37cecf5384ae8e347fd1411efb51364b6ba1b328695de3b354612c1d7010807e8b7051c40f740e498490e1f133e2c2408327d13fbdd68e1b1f6d548e624", "29f8a3c52147f987fee7ba3e0fb311bd"), // password
new HashResult("7c06225aac574d2dc7c81a2ed306637adf025715f52083e05bdab014faaa234e24a97d0e69ea0108dfa77cc9228e58be319ee677e679b5d1ad168d40e50a42f6", "8ea37b85d020b98f60c0fe9b8ec9296c"), // PassWord1
new HashResult("55711adbe03c9616f3505f0d57077fdd528c32243eb6f9840c1a6ff9e553940d6b89790750ebd52ebda63ca793fbe9980d54057af40836820c648750fe22d49c", "9f58079631ef21d32b4710694f1f461b"), // &^%te$t?Pw@_
new HashResult("29dc5be8702975ea4563ed3de5b145e2d2f1c37ae661bbe0d3e94d964402cf09d539d65f3b90ff6921ea3d40727f76fb38fb34d1e5c2d62238c4e0203efc372f", "048bb76168265d906f1fd1f81d0616a9")); // âË_3(íù*
}
}
src/test/java/fr/xephi/authme/security/crypts/WBB3Test.java
+4 -8
View File
@@ -1,20 +1,16 @@
package fr.xephi.authme.security.crypts;
import org.junit.Ignore;
/**
* Test for {@link WBB3}.
*/
@Ignore
// TODO #364 ljacqu 20151220: Unignore test after fixing closely coupled DB dependency
public class WBB3Test extends AbstractEncryptionMethodTest {
public WBB3Test() {
super(new WBB3(),
"ca426c4d20a82cd24c7bb07d94d69f3757e3d07d", // password
"72d59d27674a3cace2600ff152ba8b46274e27e9", // PassWord1
"23daf26602e52591156968a14c2a6592b5be4743", // &^%te$t?Pw@_
"d3908efe4a15314066391dd8572883c70b16fd8a"); // âË_3(íù*
new HashResult("8df818ef7d56075ab2744f74b98ad68a375ccac4", "b7415b355492ea60314f259a35733a3092c03e3f"), // password
new HashResult("106da5cf5df92cb845e12cf62cbdb5235b6dc693", "6110f19b2b52910dccf592a19c59126873f42e69"), // PassWord1
new HashResult("940a9fb7acec0178c6691e8b3c14bd7d789078b1", "f9dd501ff3d1bf74904f9e89649e378429af56e7"), // &^%te$t?Pw@_
new HashResult("0fa12e8d96c9e95f73aa91f3b76f8cdc815ec8a5", "736be8669f6159ddb2d5b47a3e6428cdb8b324de")); // âË_3(íù*
}
}
src/test/java/fr/xephi/authme/security/crypts/WORDPRESSTest.java
+4
View File
@@ -1,8 +1,12 @@
package fr.xephi.authme.security.crypts;
import org.junit.Ignore;
/**
* Test for {@link WORDPRESS}.
*/
@Ignore
// TODO #364: Need to skip an assertion due to the "internal salt" of Wordpress
public class WORDPRESSTest extends AbstractEncryptionMethodTest {
public WORDPRESSTest() {
src/test/java/fr/xephi/authme/security/crypts/XFTest.java
+17
View File
@@ -0,0 +1,17 @@
package fr.xephi.authme.security.crypts;
import org.junit.Ignore;
import org.junit.Test;
/**
* Test for {@link XF}.
*/
@Ignore
// TODO #369: XF needs to generate a salt it is expecting
public class XFTest {
@Test
public void shouldComputeHash() {
System.out.println(new XF().computeHash("Test", "name"));
}
}