auth_test.go

package pgsrv

import (
	"bytes"
	"crypto/md5"
	"github.com/panoplyio/pgsrv/protocol"
	"github.com/stretchr/testify/require"
	"testing"
)

var authOKMessage = protocol.Message{'R', 0, 0, 0, 8, 0, 0, 0, 0}
var fatalMarker = []byte{
	83, 70, 65, 84, 65, 76,
}

func TestAuthOKMsg(t *testing.T) {
	actualResult := authOKMsg()
	expectedResult := authOKMessage

	require.Equal(t, expectedResult, actualResult)
}

func TestNoPassword_authenticate(t *testing.T) {
	rw := &mockMessageReadWriter{output: []protocol.Message{}}
	args := map[string]interface{}{
		"user": "this-is-user",
	}

	np := &noPasswordAuthenticator{}
	err := np.authenticate(rw, args)

	require.NoError(t, err)
	require.Equal(t, []protocol.Message{authOKMessage}, rw.messages)
}

func TestAuthenticationClearText_authenticate(t *testing.T) {
	passwordRequest := protocol.Message{
		'R',
		0, 0, 0, 8, // length
		0, 0, 0, 3, // clear text auth type
	}
	passwordMessage := protocol.Message{
		'p',
		0, 0, 0, 8,
		109, 101, 104, 0, // 'meh'
	}
	rw := &mockMessageReadWriter{output: []protocol.Message{passwordMessage}}
	args := map[string]interface{}{
		"user": "this-is-user",
	}
	pp := &constantPasswordProvider{password: []byte("meh")}

	a := &clearTextAuthenticator{pp}

	t.Run("valid password", func(t *testing.T) {
		defer rw.Reset()
		err := a.authenticate(rw, args)

		require.NoError(t, err)
		expectedMessages := []protocol.Message{
			passwordRequest,
			authOKMessage,
		}
		require.Equal(t, expectedMessages, rw.messages)
	})

	t.Run("invalid password", func(t *testing.T) {
		defer rw.Reset()
		pp.password = []byte("shtoot")
		err := a.authenticate(rw, args)

		require.Equal(t, passwordRequest, rw.messages[0])
		require.True(t, bytes.Contains(rw.messages[1], fatalMarker))
		require.EqualError(t, err, "password does not match for user \"this-is-user\"")
	})

	t.Run("invalid message type", func(t *testing.T) {
		defer rw.Reset()
		rw = &mockMessageReadWriter{output: []protocol.Message{
			{'q', 0, 0, 0, 5, 1},
		}}
		err := a.authenticate(rw, args)

		require.Equal(t, passwordRequest, rw.messages[0])
		require.True(t, bytes.Contains(rw.messages[1], fatalMarker))
		require.EqualError(t, err, "expected password response, got message type 'q'")
	})
}

func TestAuthenticationMD5_authenticate(t *testing.T) {
	passwordRequest := protocol.Message{
		'R',
		0, 0, 0, 12, // length
		0, 0, 0, 5, // md5 auth type
	}
	rw := &mockMD5MessageReadWriter{
		user: "postgres",
		pass: []byte("test"),
		salt: []byte{},
	}
	args := map[string]interface{}{
		"user": "postgres",
	}
	pp := &md5ConstantPasswordProvider{password: []byte("test")}

	a := &md5Authenticator{pp}

	t.Run("valid password", func(t *testing.T) {
		defer rw.Reset()
		err := a.authenticate(rw, args)

		require.NoError(t, err)
		require.True(t, bytes.Contains(rw.messages[0], passwordRequest))
		require.Equal(t, authOKMessage, rw.messages[1])
	})

	t.Run("invalid password", func(t *testing.T) {
		defer rw.Read()
		pp.password = []byte("shtoot")
		err := a.authenticate(rw, args)

		require.True(t, bytes.Contains(rw.messages[0], passwordRequest))
		require.True(t, bytes.Contains(rw.messages[1], fatalMarker))
		require.EqualError(t, err, "password does not match for user \"postgres\"")
	})

	t.Run("invalid message type", func(t *testing.T) {
		defer rw.Reset()
		rw := &mockMessageReadWriter{output: []protocol.Message{
			{'q', 0, 0, 0, 5, 1},
		}}
		err := a.authenticate(rw, args)

		require.True(t, bytes.Contains(rw.messages[0], passwordRequest))
		require.True(t, bytes.Contains(rw.messages[1], fatalMarker))
		require.EqualError(t, err, "expected password response, got message type 'q'")
	})
}

func TestHashWithSalt(t *testing.T) {
	user := "postgres"
	pass := []byte("test")
	salt := []byte{196, 53, 49, 235}
	hash := md5.Sum(append(pass, []byte(user)...))

	// actual hash received from psql using the above variables
	expectedHash := []byte{
		109, 100, 53, 97, 97, 51, 102, 56, 98, 56,
		55, 97, 57, 51, 52, 97, 52, 53, 48, 52,
		52, 101, 49, 102, 98, 50, 100, 57, 48, 55,
		48, 99, 98, 56, 48,
	}

	actualHash := hashWithSalt(hash[:], salt)
	require.Equal(t, expectedHash, actualHash)
}

func TestGetRandomSalt(t *testing.T) {
	var lastSalt []byte
	for i := 0; i < 100; i++ {
		salt := getRandomSalt()
		require.Equal(t, len(salt), 4)
		require.NotEqual(t, lastSalt, salt)
		lastSalt = salt
	}
}

func TestExtractPassword(t *testing.T) {
	t.Run("regular password", func(t *testing.T) {
		passwordMessage := protocol.Message{
			'p',
			0, 0, 0, 9,
			42, 42, 42, 42,
			0,
		}

		expectedResult := []byte{42, 42, 42, 42}
		actualResult := extractPassword(passwordMessage)
		require.Equal(t, expectedResult, actualResult)
	})

	t.Run("empty password", func(t *testing.T) {
		passwordMessage := protocol.Message{
			'p',
			0, 0, 0, 5,
			0,
		}

		expectedResult := []byte{}
		actualResult := extractPassword(passwordMessage)
		require.Equal(t, expectedResult, actualResult)
	})
}

// mockMessageReadWriter implements messageReadWriter and outputs the provided output
// message by message, looped.
type mockMessageReadWriter struct {
	output        []protocol.Message
	currentOutput int
	messages      []protocol.Message
}

func (rw *mockMessageReadWriter) Read() (protocol.Message, error) {
	return rw.output[rw.currentOutput%len(rw.output)], nil
}

func (rw *mockMessageReadWriter) Write(m protocol.Message) error {
	rw.messages = append(rw.messages, m)
	return nil
}

func (rw *mockMessageReadWriter) Reset() {
	rw.messages = make([]protocol.Message, 0)
}

// mockMD5MessageReadWriter implements messageReadWriter and outputs password
// hashed with the salt received in Write() method
type mockMD5MessageReadWriter struct {
	user     string
	pass     []byte
	salt     []byte
	messages []protocol.Message
}

func (rw *mockMD5MessageReadWriter) Read() (protocol.Message, error) {
	message := protocol.Message{
		'p',
		0, 0, 0, 25,
	}
	hash := md5.Sum(append(rw.pass, []byte(rw.user)...))
	message = append(message, hashWithSalt(hash[:], rw.salt)...)
	message = append(message, 0)
	return message, nil
}

func (rw *mockMD5MessageReadWriter) Write(m protocol.Message) error {
	rw.salt = m[9:]
	rw.messages = append(rw.messages, m)
	return nil
}

func (rw *mockMD5MessageReadWriter) Reset() {
	rw.messages = make([]protocol.Message, 0)
}