mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
zeekay
8feb24ea1f
The server module named github.com/hanzoai/team/server/v8 — a path that resolves to the retired workspace's repository, not this one — while server/public still published github.com/mattermost/mattermost/server/public. Both are github.com/hanzoteam/server/... now, which is where this code actually lives. That second half is what made the binary unbootable. Upstream's public path stayed claimed by upstream, mattermost-plugin-ai imported it, and the build linked public/model twice; public/plugin's gob.Register then ran twice under one name and panicked at init, before main. Reverting the rename traded the brand for a working binary. Rebranding the plugin alongside it needs no such trade: the agents fork is github.com/hanzoteam/agents/v2 against our public module, so no module named mattermost/mattermost is in the graph at all. Measured: `go list -deps ./cmd/mattermost` names exactly one public/model, and it is ours.
111 lines
2.6 KiB
Go
111 lines
2.6 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package hashers
|
|
|
|
import (
|
|
"crypto/pbkdf2"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"math/rand"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/hanzoteam/server/server/public/model"
|
|
"github.com/hanzoteam/server/server/v8/channels/app/password/phcparser"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestPBKDF2Hash(t *testing.T) {
|
|
password := "^a v3ery c0mp_ex Passw∙rd$"
|
|
workFactor := 600000
|
|
keyLength := 32
|
|
|
|
hasher, err := NewPBKDF2(workFactor, keyLength)
|
|
require.NoError(t, err)
|
|
|
|
str, err := hasher.Hash(password)
|
|
require.NoError(t, err)
|
|
|
|
phc, err := phcparser.New(strings.NewReader(str)).Parse()
|
|
require.NoError(t, err)
|
|
require.Equal(t, "pbkdf2", phc.Id)
|
|
require.Equal(t, "", phc.Version)
|
|
require.Equal(t, map[string]string{
|
|
"f": "SHA256",
|
|
"w": "600000",
|
|
"l": "32",
|
|
}, phc.Params)
|
|
|
|
salt, err := base64.RawStdEncoding.DecodeString(phc.Salt)
|
|
require.NoError(t, err)
|
|
|
|
hash, err := pbkdf2.Key(sha256.New, password, salt, workFactor, keyLength)
|
|
require.NoError(t, err)
|
|
|
|
expectedHash := base64.RawStdEncoding.EncodeToString(hash)
|
|
require.Equal(t, expectedHash, phc.Hash)
|
|
}
|
|
|
|
func TestPBKDF2CompareHashAndPassword(t *testing.T) {
|
|
passwordTooLong := make([]byte, PasswordMaxLengthBytes+1)
|
|
_, err := rand.Read(passwordTooLong)
|
|
require.NoError(t, err)
|
|
|
|
testCases := []struct {
|
|
testName string
|
|
storedPwd string
|
|
inputPwd string
|
|
expectedErr error
|
|
skipFIPS bool
|
|
}{
|
|
{
|
|
testName: "empty password",
|
|
storedPwd: "",
|
|
inputPwd: "",
|
|
expectedErr: nil,
|
|
skipFIPS: true,
|
|
},
|
|
{
|
|
testName: "same password",
|
|
storedPwd: "one password!!!",
|
|
inputPwd: "one password!!!",
|
|
expectedErr: nil,
|
|
},
|
|
{
|
|
testName: "different password",
|
|
storedPwd: "one password!!!",
|
|
inputPwd: "another password",
|
|
expectedErr: ErrMismatchedHashAndPassword,
|
|
},
|
|
{
|
|
testName: "password too long",
|
|
storedPwd: "stored password",
|
|
inputPwd: string(passwordTooLong),
|
|
expectedErr: ErrPasswordTooLong,
|
|
},
|
|
}
|
|
|
|
hasher := DefaultPBKDF2()
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.testName, func(t *testing.T) {
|
|
if tc.skipFIPS && model.FIPSEnabled {
|
|
t.Skip("skipping under FIPS: PBKDF2 requires keys >= 14 bytes")
|
|
}
|
|
storedPHCStr, err := hasher.Hash(tc.storedPwd)
|
|
require.NoError(t, err)
|
|
|
|
storedPHC, err := phcparser.New(strings.NewReader(storedPHCStr)).Parse()
|
|
require.NoError(t, err)
|
|
|
|
err = hasher.CompareHashAndPassword(storedPHC, tc.inputPwd)
|
|
if tc.expectedErr != nil {
|
|
require.ErrorIs(t, err, tc.expectedErr)
|
|
} else {
|
|
require.NoError(t, err)
|
|
}
|
|
})
|
|
}
|
|
}
|