mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-08-06 02:33:48 -05:00
83e5b3b0eb
Password salts and activation tokens were generated with the global SFMT RNG, which was seeded from a 32-bit timestamp, making registration salts and activation tokens predictable. The game RNG used the same timestamp seed across restarts. Add CryptoUtil backed by OpenSSL RAND_bytes and use it for salt/token generation and to seed RNG_SFMT with a 64-bit CSPRNG value in both the client and server. Link libcockatrice_utility against OpenSSL::Crypto.
46 lines
1.3 KiB
C++
46 lines
1.3 KiB
C++
#include "gtest/gtest.h"
|
|
#include <cstring>
|
|
#include <libcockatrice/utility/passwordhasher.h>
|
|
|
|
namespace
|
|
{
|
|
|
|
TEST(PasswordHashTest, RegressionTest)
|
|
{
|
|
QString salt = "saltsaltsaltsalt";
|
|
QString password = "password";
|
|
QString expected = "vmKoWv975yf+WT2QCXhW48JNzZ2ghGxdgNvuKLBU0h7s6AQHSG72J6QO4ZswuSeqvBbAXbmgJSRBaSJrgc55WA==";
|
|
QString hash = PasswordHasher::computeHash(password, salt);
|
|
ASSERT_EQ(hash, salt + expected) << "The computed hash value remains the same";
|
|
}
|
|
|
|
TEST(PasswordHashTest, SaltUsesAlphanumericCharset)
|
|
{
|
|
static const char alphanum[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
|
|
const QString salt = PasswordHasher::generateRandomSalt();
|
|
ASSERT_EQ(salt.size(), 16);
|
|
for (const QChar &c : salt) {
|
|
ASSERT_NE(strchr(alphanum, c.toLatin1()), nullptr);
|
|
}
|
|
}
|
|
|
|
TEST(PasswordHashTest, SaltsAreUnique)
|
|
{
|
|
const QString salt1 = PasswordHasher::generateRandomSalt();
|
|
const QString salt2 = PasswordHasher::generateRandomSalt();
|
|
ASSERT_NE(salt1, salt2);
|
|
}
|
|
|
|
TEST(PasswordHashTest, TokenHasExpectedLength)
|
|
{
|
|
const QString token = PasswordHasher::generateActivationToken();
|
|
ASSERT_EQ(token.size(), 16);
|
|
}
|
|
} // namespace
|
|
|
|
int main(int argc, char **argv)
|
|
{
|
|
::testing::InitGoogleTest(&argc, argv);
|
|
return RUN_ALL_TESTS();
|
|
}
|