From 39f3683a06aea3d6aed85c611b0db0f6ea21052a Mon Sep 17 00:00:00 2001 From: Lain Soykaf Date: Thu, 14 Jan 2021 15:06:16 +0100 Subject: [PATCH] Pbkdf2: Use it everywhere. --- benchmarks/load_testing/users.ex | 2 +- lib/pleroma/mfa.ex | 2 +- lib/pleroma/password.ex | 55 ------------------- lib/pleroma/password/pbkdf2.ex | 2 +- lib/pleroma/user.ex | 2 +- lib/pleroma/web/plugs/authentication_plug.ex | 2 +- test/pleroma/mfa_test.exs | 4 +- test/pleroma/password/pbkdf2_test.exs | 14 ++--- test/pleroma/password_test.exs | 35 ------------ test/pleroma/web/auth/basic_auth_test.exs | 2 +- .../web/auth/pleroma_authenticator_test.exs | 2 +- .../web/auth/totp_authenticator_test.exs | 2 +- .../web/mongoose_im_controller_test.exs | 4 +- .../web/o_auth/ldap_authorization_test.exs | 4 +- .../web/o_auth/mfa_controller_test.exs | 4 +- .../web/o_auth/o_auth_controller_test.exs | 18 +++--- .../web/plugs/authentication_plug_test.exs | 2 +- .../twitter_api/password_controller_test.exs | 2 +- .../web/twitter_api/util_controller_test.exs | 2 +- test/support/builders/user_builder.ex | 2 +- test/support/factory.ex | 2 +- 21 files changed, 37 insertions(+), 127 deletions(-) delete mode 100644 lib/pleroma/password.ex delete mode 100644 test/pleroma/password_test.exs diff --git a/benchmarks/load_testing/users.ex b/benchmarks/load_testing/users.ex index 1815490a4..0a33cbfdb 100644 --- a/benchmarks/load_testing/users.ex +++ b/benchmarks/load_testing/users.ex @@ -55,7 +55,7 @@ defp generate_user(i) do name: "Test テスト User #{i}", email: "user#{i}@example.com", nickname: "nick#{i}", - password_hash: Pleroma.Password.hash_pwd_salt("test"), + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("test"), bio: "Tester Number #{i}", local: !remote } diff --git a/lib/pleroma/mfa.ex b/lib/pleroma/mfa.ex index 29488c876..02dce7d49 100644 --- a/lib/pleroma/mfa.ex +++ b/lib/pleroma/mfa.ex @@ -71,7 +71,7 @@ def invalidate_backup_code(%User{} = user, hash_code) do @spec generate_backup_codes(User.t()) :: {:ok, list(binary)} | {:error, String.t()} def generate_backup_codes(%User{} = user) do with codes <- BackupCodes.generate(), - hashed_codes <- Enum.map(codes, &Pleroma.Password.hash_pwd_salt/1), + hashed_codes <- Enum.map(codes, &Pleroma.Password.Pbkdf2.hash_pwd_salt/1), changeset <- Changeset.cast_backup_codes(user, hashed_codes), {:ok, _} <- User.update_and_set_cache(changeset) do {:ok, codes} diff --git a/lib/pleroma/password.ex b/lib/pleroma/password.ex deleted file mode 100644 index e96249650..000000000 --- a/lib/pleroma/password.ex +++ /dev/null @@ -1,55 +0,0 @@ -# Pleroma: A lightweight social networking server -# Copyright © 2017-2021 Pleroma Authors -# SPDX-License-Identifier: AGPL-3.0-only - -defmodule Pleroma.Password do - @moduledoc """ - This module implements Pleroma.Password passwords in terms of Plug.Crypto. - """ - - alias Plug.Crypto.KeyGenerator - - def decode64(str) do - str - |> String.replace(".", "+") - |> Base.decode64!(padding: false) - end - - def encode64(bin) do - bin - |> Base.encode64(padding: false) - |> String.replace("+", ".") - end - - def verify_pass(password, hash) do - ["pbkdf2-" <> digest, iterations, salt, hash] = String.split(hash, "$", trim: true) - - salt = decode64(salt) - - iterations = String.to_integer(iterations) - - digest = String.to_atom(digest) - - binary_hash = - KeyGenerator.generate(password, salt, digest: digest, iterations: iterations, length: 64) - - encode64(binary_hash) == hash - end - - def hash_pwd_salt(password, opts \\ []) do - salt = - Keyword.get_lazy(opts, :salt, fn -> - :crypto.strong_rand_bytes(16) - end) - - digest = Keyword.get(opts, :digest, :sha512) - - iterations = - Keyword.get(opts, :iterations, Pleroma.Config.get([:password, :iterations], 160_000)) - - binary_hash = - KeyGenerator.generate(password, salt, digest: digest, iterations: iterations, length: 64) - - "$pbkdf2-#{digest}$#{iterations}$#{encode64(salt)}$#{encode64(binary_hash)}" - end -end diff --git a/lib/pleroma/password/pbkdf2.ex b/lib/pleroma/password/pbkdf2.ex index 747bc1d1d..2fd5f4491 100644 --- a/lib/pleroma/password/pbkdf2.ex +++ b/lib/pleroma/password/pbkdf2.ex @@ -4,7 +4,7 @@ defmodule Pleroma.Password.Pbkdf2 do @moduledoc """ - This module implements Pleroma.Password.Pbkdf2 passwords in terms of Plug.Crypto. + This module implements Pbkdf2 passwords in terms of Plug.Crypto. """ alias Plug.Crypto.KeyGenerator diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex index 04e6ffd51..6a81adfd6 100644 --- a/lib/pleroma/user.ex +++ b/lib/pleroma/user.ex @@ -2187,7 +2187,7 @@ def get_ap_ids_by_nicknames(nicknames) do defp put_password_hash( %Ecto.Changeset{valid?: true, changes: %{password: password}} = changeset ) do - change(changeset, password_hash: Pleroma.Password.hash_pwd_salt(password)) + change(changeset, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password)) end defp put_password_hash(changeset), do: changeset diff --git a/lib/pleroma/web/plugs/authentication_plug.ex b/lib/pleroma/web/plugs/authentication_plug.ex index f7a2a3ab7..8d58169cf 100644 --- a/lib/pleroma/web/plugs/authentication_plug.ex +++ b/lib/pleroma/web/plugs/authentication_plug.ex @@ -48,7 +48,7 @@ def checkpw(password, "$2" <> _ = password_hash) do end def checkpw(password, "$pbkdf2" <> _ = password_hash) do - Pleroma.Password.verify_pass(password, password_hash) + Pleroma.Password.Pbkdf2.verify_pass(password, password_hash) end def checkpw(_password, _password_hash) do diff --git a/test/pleroma/mfa_test.exs b/test/pleroma/mfa_test.exs index db68fc1ca..76ba1a99d 100644 --- a/test/pleroma/mfa_test.exs +++ b/test/pleroma/mfa_test.exs @@ -30,8 +30,8 @@ test "returns backup codes" do {:ok, [code1, code2]} = MFA.generate_backup_codes(user) updated_user = refresh_record(user) [hash1, hash2] = updated_user.multi_factor_authentication_settings.backup_codes - assert Pleroma.Password.verify_pass(code1, hash1) - assert Pleroma.Password.verify_pass(code2, hash2) + assert Pleroma.Password.Pbkdf2.verify_pass(code1, hash1) + assert Pleroma.Password.Pbkdf2.verify_pass(code2, hash2) end end diff --git a/test/pleroma/password/pbkdf2_test.exs b/test/pleroma/password/pbkdf2_test.exs index 4acbda939..e55348f9a 100644 --- a/test/pleroma/password/pbkdf2_test.exs +++ b/test/pleroma/password/pbkdf2_test.exs @@ -5,10 +5,10 @@ defmodule Pleroma.Password.Pbkdf2Test do use Pleroma.DataCase, async: true - alias Pleroma.Password.Pbkdf2 + alias Pleroma.Password.Pbkdf2, as: Password test "it generates the same hash as pbkd2_elixir" do - # hash = Pleroma.Password.Pbkdf2.hash_pwd_salt("password") + # hash = Pbkdf2.hash_pwd_salt("password") hash = "$pbkdf2-sha512$1$QJpEYw8iBKcnY.4Rm0eCVw$UBPeWQ91RxSv3snxsb/ZzMeG/2aa03c541bbo8vQudREGNta5t8jBQrd00fyJp8RjaqfvgdZxy2rhSwljyu21g" @@ -19,14 +19,14 @@ test "it generates the same hash as pbkd2_elixir" do end @tag skip: "Works when Pbkd2 is present. Source: trust me bro" - test "Pleroma.Password.Pbkdf2 can verify passwords generated with it" do - hash = Password.hash_pwd_salt("password") - - assert Pleroma.Password.Pbkdf2.verify_pass("password", hash) + test "Pbkdf2 can verify passwords generated with it" do + # Commented to prevent warnings. + # hash = Password.hash_pwd_salt("password") + # assert Pbkdf2.verify_pass("password", hash) end test "it verifies pbkdf2_elixir hashes" do - # hash = Pleroma.Password.Pbkdf2.hash_pwd_salt("password") + # hash = Pbkdf2.hash_pwd_salt("password") hash = "$pbkdf2-sha512$1$QJpEYw8iBKcnY.4Rm0eCVw$UBPeWQ91RxSv3snxsb/ZzMeG/2aa03c541bbo8vQudREGNta5t8jBQrd00fyJp8RjaqfvgdZxy2rhSwljyu21g" diff --git a/test/pleroma/password_test.exs b/test/pleroma/password_test.exs deleted file mode 100644 index 6ed0ca826..000000000 --- a/test/pleroma/password_test.exs +++ /dev/null @@ -1,35 +0,0 @@ -# Pleroma: A lightweight social networking server -# Copyright © 2017-2021 Pleroma Authors -# SPDX-License-Identifier: AGPL-3.0-only - -defmodule Pleroma.PasswordTest do - use Pleroma.DataCase, async: true - - alias Pleroma.Password - - test "it generates the same hash as pbkd2_elixir" do - # hash = Pleroma.Password.hash_pwd_salt("password") - hash = - "$pbkdf2-sha512$1$QJpEYw8iBKcnY.4Rm0eCVw$UBPeWQ91RxSv3snxsb/ZzMeG/2aa03c541bbo8vQudREGNta5t8jBQrd00fyJp8RjaqfvgdZxy2rhSwljyu21g" - - # Use the same randomly generated salt - salt = Password.decode64("QJpEYw8iBKcnY.4Rm0eCVw") - - assert hash == Password.hash_pwd_salt("password", salt: salt) - end - - @tag skip: "Works when Pbkd2 is present. Source: trust me bro" - test "Pleroma.Password can verify passwords generated with it" do - hash = Password.hash_pwd_salt("password") - - assert Pleroma.Password.verify_pass("password", hash) - end - - test "it verifies pbkdf2_elixir hashes" do - # hash = Pleroma.Password.hash_pwd_salt("password") - hash = - "$pbkdf2-sha512$1$QJpEYw8iBKcnY.4Rm0eCVw$UBPeWQ91RxSv3snxsb/ZzMeG/2aa03c541bbo8vQudREGNta5t8jBQrd00fyJp8RjaqfvgdZxy2rhSwljyu21g" - - assert Password.verify_pass("password", hash) - end -end diff --git a/test/pleroma/web/auth/basic_auth_test.exs b/test/pleroma/web/auth/basic_auth_test.exs index b74516dd6..2816aae4c 100644 --- a/test/pleroma/web/auth/basic_auth_test.exs +++ b/test/pleroma/web/auth/basic_auth_test.exs @@ -11,7 +11,7 @@ test "with HTTP Basic Auth used, grants access to OAuth scope-restricted endpoin conn: conn } do user = insert(:user) - assert Pleroma.Password.verify_pass("test", user.password_hash) + assert Pleroma.Password.Pbkdf2.verify_pass("test", user.password_hash) basic_auth_contents = (URI.encode_www_form(user.nickname) <> ":" <> URI.encode_www_form("test")) diff --git a/test/pleroma/web/auth/pleroma_authenticator_test.exs b/test/pleroma/web/auth/pleroma_authenticator_test.exs index ec63e2d41..edaf9eecb 100644 --- a/test/pleroma/web/auth/pleroma_authenticator_test.exs +++ b/test/pleroma/web/auth/pleroma_authenticator_test.exs @@ -11,7 +11,7 @@ defmodule Pleroma.Web.Auth.PleromaAuthenticatorTest do setup do password = "testpassword" name = "AgentSmith" - user = insert(:user, nickname: name, password_hash: Pleroma.Password.hash_pwd_salt(password)) + user = insert(:user, nickname: name, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password)) {:ok, [user: user, name: name, password: password]} end diff --git a/test/pleroma/web/auth/totp_authenticator_test.exs b/test/pleroma/web/auth/totp_authenticator_test.exs index 6d2646b61..ac4209f2d 100644 --- a/test/pleroma/web/auth/totp_authenticator_test.exs +++ b/test/pleroma/web/auth/totp_authenticator_test.exs @@ -34,7 +34,7 @@ test "checks backup codes" do hashed_codes = backup_codes - |> Enum.map(&Pleroma.Password.hash_pwd_salt(&1)) + |> Enum.map(&Pleroma.Password.Pbkdf2.hash_pwd_salt(&1)) user = insert(:user, diff --git a/test/pleroma/web/mongoose_im_controller_test.exs b/test/pleroma/web/mongoose_im_controller_test.exs index 183a17a02..a7225d45c 100644 --- a/test/pleroma/web/mongoose_im_controller_test.exs +++ b/test/pleroma/web/mongoose_im_controller_test.exs @@ -41,13 +41,13 @@ test "/user_exists", %{conn: conn} do end test "/check_password", %{conn: conn} do - user = insert(:user, password_hash: Pleroma.Password.hash_pwd_salt("cool")) + user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("cool")) _deactivated_user = insert(:user, nickname: "konata", deactivated: true, - password_hash: Pleroma.Password.hash_pwd_salt("cool") + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("cool") ) res = diff --git a/test/pleroma/web/o_auth/ldap_authorization_test.exs b/test/pleroma/web/o_auth/ldap_authorization_test.exs index 9ebd084a5..61b9ce6b7 100644 --- a/test/pleroma/web/o_auth/ldap_authorization_test.exs +++ b/test/pleroma/web/o_auth/ldap_authorization_test.exs @@ -18,7 +18,7 @@ defmodule Pleroma.Web.OAuth.LDAPAuthorizationTest do @tag @skip test "authorizes the existing user using LDAP credentials" do password = "testpassword" - user = insert(:user, password_hash: Pleroma.Password.hash_pwd_salt(password)) + user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password)) app = insert(:oauth_app, scopes: ["read", "write"]) host = Pleroma.Config.get([:ldap, :host]) |> to_charlist @@ -101,7 +101,7 @@ test "creates a new user after successful LDAP authorization" do @tag @skip test "disallow authorization for wrong LDAP credentials" do password = "testpassword" - user = insert(:user, password_hash: Pleroma.Password.hash_pwd_salt(password)) + user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password)) app = insert(:oauth_app, scopes: ["read", "write"]) host = Pleroma.Config.get([:ldap, :host]) |> to_charlist diff --git a/test/pleroma/web/o_auth/mfa_controller_test.exs b/test/pleroma/web/o_auth/mfa_controller_test.exs index dacf03b2b..17bbde85b 100644 --- a/test/pleroma/web/o_auth/mfa_controller_test.exs +++ b/test/pleroma/web/o_auth/mfa_controller_test.exs @@ -20,7 +20,7 @@ defmodule Pleroma.Web.OAuth.MFAControllerTest do insert(:user, multi_factor_authentication_settings: %MFA.Settings{ enabled: true, - backup_codes: [Pleroma.Password.hash_pwd_salt("test-code")], + backup_codes: [Pleroma.Password.Pbkdf2.hash_pwd_salt("test-code")], totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true} } ) @@ -246,7 +246,7 @@ test "returns access token with valid code", %{conn: conn, app: app} do hashed_codes = backup_codes - |> Enum.map(&Pleroma.Password.hash_pwd_salt(&1)) + |> Enum.map(&Pleroma.Password.Pbkdf2.hash_pwd_salt(&1)) user = insert(:user, diff --git a/test/pleroma/web/o_auth/o_auth_controller_test.exs b/test/pleroma/web/o_auth/o_auth_controller_test.exs index c6ee7b7e8..bf47afed8 100644 --- a/test/pleroma/web/o_auth/o_auth_controller_test.exs +++ b/test/pleroma/web/o_auth/o_auth_controller_test.exs @@ -316,7 +316,7 @@ test "with valid params, POST /oauth/register?op=connect redirects to `redirect_ app: app, conn: conn } do - user = insert(:user, password_hash: Pleroma.Password.hash_pwd_salt("testpassword")) + user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("testpassword")) registration = insert(:registration, user: nil) redirect_uri = OAuthController.default_redirect_uri(app) @@ -347,7 +347,7 @@ test "with unlisted `redirect_uri`, POST /oauth/register?op=connect results in H app: app, conn: conn } do - user = insert(:user, password_hash: Pleroma.Password.hash_pwd_salt("testpassword")) + user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("testpassword")) registration = insert(:registration, user: nil) unlisted_redirect_uri = "http://cross-site-request.com" @@ -790,7 +790,7 @@ test "issues a token for an all-body request" do test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do password = "testpassword" - user = insert(:user, password_hash: Pleroma.Password.hash_pwd_salt(password)) + user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password)) app = insert(:oauth_app, scopes: ["read", "write"]) @@ -818,7 +818,7 @@ test "issues a mfa token for `password` grant_type, when MFA enabled" do user = insert(:user, - password_hash: Pleroma.Password.hash_pwd_salt(password), + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password), multi_factor_authentication_settings: %MFA.Settings{ enabled: true, totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true} @@ -927,7 +927,7 @@ test "rejects token exchange for valid credentials belonging to unconfirmed user password = "testpassword" {:ok, user} = - insert(:user, password_hash: Pleroma.Password.hash_pwd_salt(password)) + insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password)) |> User.confirmation_changeset(need_confirmation: true) |> User.update_and_set_cache() @@ -955,7 +955,7 @@ test "rejects token exchange for valid credentials belonging to deactivated user user = insert(:user, - password_hash: Pleroma.Password.hash_pwd_salt(password), + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password), deactivated: true ) @@ -983,7 +983,7 @@ test "rejects token exchange for user with password_reset_pending set to true" d user = insert(:user, - password_hash: Pleroma.Password.hash_pwd_salt(password), + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password), password_reset_pending: true ) @@ -1012,7 +1012,7 @@ test "rejects token exchange for user with confirmation_pending set to true" do user = insert(:user, - password_hash: Pleroma.Password.hash_pwd_salt(password), + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password), confirmation_pending: true ) @@ -1040,7 +1040,7 @@ test "rejects token exchange for valid credentials belonging to an unapproved us user = insert(:user, - password_hash: Pleroma.Password.hash_pwd_salt(password), + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password), approval_pending: true ) diff --git a/test/pleroma/web/plugs/authentication_plug_test.exs b/test/pleroma/web/plugs/authentication_plug_test.exs index 4a0ff6710..118ab302a 100644 --- a/test/pleroma/web/plugs/authentication_plug_test.exs +++ b/test/pleroma/web/plugs/authentication_plug_test.exs @@ -17,7 +17,7 @@ defmodule Pleroma.Web.Plugs.AuthenticationPlugTest do user = %User{ id: 1, name: "dude", - password_hash: Pleroma.Password.hash_pwd_salt("guy") + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("guy") } conn = diff --git a/test/pleroma/web/twitter_api/password_controller_test.exs b/test/pleroma/web/twitter_api/password_controller_test.exs index 880f097cb..cf99e2434 100644 --- a/test/pleroma/web/twitter_api/password_controller_test.exs +++ b/test/pleroma/web/twitter_api/password_controller_test.exs @@ -92,7 +92,7 @@ test "it returns HTTP 200", %{conn: conn} do assert response =~ "

Password changed!

" user = refresh_record(user) - assert Pleroma.Password.verify_pass("test", user.password_hash) + assert Pleroma.Password.Pbkdf2.verify_pass("test", user.password_hash) assert Enum.empty?(Token.get_user_tokens(user)) end diff --git a/test/pleroma/web/twitter_api/util_controller_test.exs b/test/pleroma/web/twitter_api/util_controller_test.exs index 923be8fae..6d007ab66 100644 --- a/test/pleroma/web/twitter_api/util_controller_test.exs +++ b/test/pleroma/web/twitter_api/util_controller_test.exs @@ -397,7 +397,7 @@ test "with proper permissions, valid password and matching new password and conf assert json_response(conn, 200) == %{"status" => "success"} fetched_user = User.get_cached_by_id(user.id) - assert Pleroma.Password.verify_pass("newpass", fetched_user.password_hash) == true + assert Pleroma.Password.Pbkdf2.verify_pass("newpass", fetched_user.password_hash) == true end end diff --git a/test/support/builders/user_builder.ex b/test/support/builders/user_builder.ex index 27470498d..6bccbb35a 100644 --- a/test/support/builders/user_builder.ex +++ b/test/support/builders/user_builder.ex @@ -7,7 +7,7 @@ def build(data \\ %{}) do email: "test@example.org", name: "Test Name", nickname: "testname", - password_hash: Pleroma.Password.hash_pwd_salt("test"), + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("test"), bio: "A tester.", ap_id: "some id", last_digest_emailed_at: NaiveDateTime.truncate(NaiveDateTime.utc_now(), :second), diff --git a/test/support/factory.ex b/test/support/factory.ex index 53b1dfd09..bf9592064 100644 --- a/test/support/factory.ex +++ b/test/support/factory.ex @@ -29,7 +29,7 @@ def user_factory(attrs \\ %{}) do name: sequence(:name, &"Test テスト User #{&1}"), email: sequence(:email, &"user#{&1}@example.com"), nickname: sequence(:nickname, &"nick#{&1}"), - password_hash: Pleroma.Password.hash_pwd_salt("test"), + password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("test"), bio: sequence(:bio, &"Tester Number #{&1}"), is_discoverable: true, last_digest_emailed_at: NaiveDateTime.utc_now(),