Adding test cases for Argon2i and Argon2d

Added Windows config.w32 changes
Updated constants in php_password.h

diff --git a/ext/standard/config.w32 b/ext/standard/config.w32
index adff3d8c878af497ab531bb2ec94c2d4ca25010c..431dd3e48471d409af041dd3c1fd9422880ae82e 100644 (file)
--- a/ext/standard/config.w32
+++ b/ext/standard/config.w32
@@ -20,10 +20,13 @@ EXTENSION("standard", "array.c base64.c basic_functions.c browscap.c \
        url_scanner_ex.c ftp_fopen_wrapper.c http_fopen_wrapper.c \
        php_fopen_wrapper.c credits.c css.c var_unserializer.c ftok.c sha1.c \
        user_filters.c uuencode.c filters.c proc_open.c password.c \
-       streamsfuncs.c http.c flock_compat.c random.c", false /* never shared */,
+       streamsfuncs.c http.c flock_compat.c random.c \
+       argon2lib/argon2.c argon2lib/core.c argon2lib/blake2/blake2b.c \
+    argon2lib/thread.c argon2lib/encoding.c argon2lib/ref.c", false /* never shared */,
        '/DZEND_ENABLE_STATIC_TSRMLS_CACHE=1');
        PHP_INSTALL_HEADERS("", "ext/standard");
 if (PHP_MBREGEX != "no") {
        CHECK_HEADER_ADD_INCLUDE("oniguruma.h", "CFLAGS_STANDARD", PHP_MBREGEX + ";ext\\mbstring\\oniguruma")   
 }
 PHP_INSTALL_HEADERS("", "ext/standard");
+PHP_INSTALL_HEADERS([ext/standard/argon2lib])

diff --git a/ext/standard/password.c b/ext/standard/password.c
index ca223dcc3e07b57df0de32be791785a072766cd5..f312df80301ebb2c24c3d9dacac05cbbf4578203 100644 (file)
--- a/ext/standard/password.c
+++ b/ext/standard/password.c
@@ -71,12 +71,12 @@ static char* php_password_get_algo_name(const php_password_algo algo)
 
 static php_password_algo php_password_determine_algo(const char *hash, const size_t len)
 {
-       if (hash[0] == '$' && strstr(hash, "argon2i")) {
+       if (len > 3 && hash[0] == '$' && hash[1] == '2' && hash[2] == 'y' && len == 60) {
+               return PHP_PASSWORD_BCRYPT;
+       } else if (hash[0] == '$' && strstr(hash, "argon2i")) {
                return PHP_PASSWORD_ARGON2I;
        } else if (hash[0] == '$' && strstr(hash, "argon2d")) {
                return PHP_PASSWORD_ARGON2D;
-       } else if (len > 3 && hash[0] == '$' && hash[1] == '2' && hash[2] == 'y' && len == 60) {
-               return PHP_PASSWORD_BCRYPT;
        }
 
        return PHP_PASSWORD_UNKNOWN;
@@ -300,7 +300,29 @@ PHP_FUNCTION(password_verify)
        algo = php_password_determine_algo(hash, (size_t) hash_len);
 
        switch(algo) {
+               case PHP_PASSWORD_ARGON2I:
+               case PHP_PASSWORD_ARGON2D:
+                       {
+                               argon2_type type = Argon2_i;
+
+                               if (strstr(hash, "argon2d")) {
+                                       type = Argon2_d;
+                               } else if (strstr(hash, "argon2i")) {
+                                       type = Argon2_i;
+                               }
+
+                               status = argon2_verify(hash, password, password_len, type);
+                               
+                               if (status == ARGON2_OK) {
+                                       RETURN_TRUE;
+                               }
+
+                               RETURN_FALSE;
+                       }
+                       break;
                case PHP_PASSWORD_BCRYPT:
+               case PHP_PASSWORD_UNKNOWN:
+               default:
                        {
                                if ((ret = php_crypt(password, (int)password_len, hash, (int)hash_len, 1)) == NULL) {
                                        RETURN_FALSE;
@@ -323,28 +345,6 @@ PHP_FUNCTION(password_verify)
 
                                RETURN_BOOL(status == 0);
                        }
-               case PHP_PASSWORD_ARGON2I:
-               case PHP_PASSWORD_ARGON2D:
-                       {
-                               argon2_type type = Argon2_i;
-
-                               if (strstr(hash, "argon2d")) {
-                                       type = Argon2_d;
-                               } else if (strstr(hash, "argon2i")) {
-                                       type = Argon2_i;
-                               }
-
-                               status = argon2_verify(hash, password, password_len, type);
-                               
-                               if (status == ARGON2_OK) {
-                                       RETURN_TRUE;
-                               }
-
-                               RETURN_FALSE;
-                       }
-               case PHP_PASSWORD_UNKNOWN:
-               default:
-                       RETURN_FALSE;
        }
 
        RETURN_FALSE;
@@ -362,7 +362,6 @@ PHP_FUNCTION(password_hash)
        size_t salt_len = 0, required_salt_len = 0, hash_format_len;
        HashTable *options = 0;
        zval *option_buffer;
-       zend_string *result;
 
        // Argon2 Options
        size_t t_cost = PHP_PASSWORD_ARGON2_TIME_COST; 
@@ -419,7 +418,7 @@ PHP_FUNCTION(password_hash)
                                }
 
                                if (threads > ARGON2_MAX_LANES || threads == 0) {
-                                       php_error_docref(NULL, E_WARNING, "Invalid numeric input for threads", threads);
+                                       php_error_docref(NULL, E_WARNING, "Invalid number of threads", threads);
                                        RETURN_NULL();
                                }
 
@@ -499,6 +498,7 @@ PHP_FUNCTION(password_hash)
        switch (algo) {
                case PHP_PASSWORD_BCRYPT:
                        {
+                               zend_string *result;
                                salt[salt_len] = 0;
 
                                hash = safe_emalloc(salt_len + hash_format_len, 1, 1);
@@ -532,7 +532,7 @@ PHP_FUNCTION(password_hash)
 
                                size_t out_len = 32;
                                size_t encoded_len;
-                               int result = 0;
+                               int status = 0;
 
                                encoded_len = argon2_encodedlen(
                                        t_cost,
@@ -545,7 +545,7 @@ PHP_FUNCTION(password_hash)
                                encoded = emalloc(encoded_len + 1);
                                out = emalloc(out_len + 1);
 
-                               result = argon2_hash(
+                               status = argon2_hash(
                                        t_cost,
                                        m_cost,
                                        threads,
@@ -567,8 +567,8 @@ PHP_FUNCTION(password_hash)
                                efree(salt);
                                efree(encoded);
 
-                               if (result != ARGON2_OK) {
-                                       php_error_docref(NULL, E_WARNING, argon2_error_message(result));
+                               if (status != ARGON2_OK) {
+                                       php_error_docref(NULL, E_WARNING, argon2_error_message(status));
                                        RETURN_FALSE;
                                }
                                        

diff --git a/ext/standard/php_password.h b/ext/standard/php_password.h
index 7c3c8821d90a641de1200f9554abbfff88125119..c71996dbf17f50b8b7501ad92ae8f915c2426bff 100644 (file)
--- a/ext/standard/php_password.h
+++ b/ext/standard/php_password.h
@@ -40,8 +40,8 @@ PHP_MINIT_FUNCTION(password);
 typedef enum {
        PHP_PASSWORD_UNKNOWN,
        PHP_PASSWORD_BCRYPT,
-    PHP_PASSWORD_ARGON2I,
-    PHP_PASSWORD_ARGON2D
+    PHP_PASSWORD_ARGON2D,
+    PHP_PASSWORD_ARGON2I
 } php_password_algo;
 
 #endif

diff --git a/ext/standard/tests/password/password_get_info.phpt b/ext/standard/tests/password/password_get_info.phpt
index bbe207dd60d2a37ec2761c4e25a51d154a3338a5..3e8b665ba276a057a22aea9a7b3de3568a6ed1e6 100644 (file)
--- a/ext/standard/tests/password/password_get_info.phpt
+++ b/ext/standard/tests/password/password_get_info.phpt
@@ -11,9 +11,10 @@ var_dump(password_get_info('$2y$11$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vj
 var_dump(password_get_info('$2y$11$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100'));
 // Test Non-Bcrypt
 var_dump(password_get_info('$1$rasmusle$rISCgZzpwk3UhDidwXvin0'));
-// Test Argon2
-//var_dump(password_get_info('$argon2i$v=19$m=65536,t=3,p=1$SWhIcG5MT21Pc01PbWdVZw$WagZELICsz7jlqOR2YzoEVTWb2oOX1tYdnhZYXxptbU'));
-
+// Test Argon2i
+var_dump(password_get_info('$argon2i$v=19$m=65536,t=3,p=1$SWhIcG5MT21Pc01PbWdVZw$WagZELICsz7jlqOR2YzoEVTWb2oOX1tYdnhZYXxptbU'));
+// Test Argon2d
+var_dump(password_get_info('$argon2d$v=19$m=32768,t=2,p=1$YWpxd0VYRW9MLmp6VjFPZw$pWV5IsbBfjEK5c0bHzvAo0FsDNHUyM4p6j8vf2cxzb8'));
 echo "OK!";
 ?>
 --EXPECT--
@@ -59,7 +60,7 @@ array(3) {
 }
 array(3) {
   ["algo"]=>
-  int(2)
+  int(3)
   ["algoName"]=>
   string(7) "argon2i"
   ["options"]=>
@@ -72,4 +73,19 @@ array(3) {
     int(1)
   }
 }
+array(3) {
+  ["algo"]=>
+  int(2)
+  ["algoName"]=>
+  string(7) "argon2d"
+  ["options"]=>
+  array(3) {
+    ["m_cost"]=>
+    int(32768)
+    ["t_cost"]=>
+    int(2)
+    ["threads"]=>
+    int(1)
+  }
+}
 OK!

diff --git a/ext/standard/tests/password/password_hash.phpt b/ext/standard/tests/password/password_hash.phpt
index ebb27292ea22767e627aa1b70ec84e085bb5408f..665ead92caa558f4641e37e00547f59346a264c9 100644 (file)
--- a/ext/standard/tests/password/password_hash.phpt
+++ b/ext/standard/tests/password/password_hash.phpt
@@ -10,9 +10,27 @@ $hash = password_hash("foo", PASSWORD_BCRYPT);
 
 var_dump($hash === crypt("foo", $hash));
 
+$hash = password_hash('foo', PASSWORD_ARGON2);
+var_dump(strlen($hash));
+var_dump(password_verify('foo', $hash));
+
+$hash = password_hash('foo', PASSWORD_ARGON2I);
+var_dump(strlen($hash));
+var_dump(password_verify('foo', $hash));
+
+$hash = password_hash('foo', PASSWORD_ARGON2D);
+var_dump(strlen($hash));
+var_dump(password_verify('foo', $hash));
+
 echo "OK!";
 ?>
 --EXPECT--
 int(60)
 bool(true)
-OK!
\ No newline at end of file
+int(99)
+bool(true)
+int(99)
+bool(true)
+int(99)
+bool(true)
+OK!

diff --git a/ext/standard/tests/password/password_hash_error.phpt b/ext/standard/tests/password/password_hash_error.phpt
index 8dc954649dba297a0455c448ad81ee1f89a54fb0..9207fb76efaf6bccd612744f1d019d5e2c83536e 100644 (file)
--- a/ext/standard/tests/password/password_hash_error.phpt
+++ b/ext/standard/tests/password/password_hash_error.phpt
@@ -21,6 +21,12 @@ var_dump(password_hash("123", PASSWORD_BCRYPT, array("salt" => array())));
 /* Non-string salt, checking for memory leaks */
 var_dump(password_hash('123', PASSWORD_BCRYPT, array('salt' => 1234)));
 
+var_dump(password_hash('test', PASSWORD_ARGON2, ['m_cost' => 0]));
+
+var_dump(password_hash('test', PASSWORD_ARGON2, ['t_cost' => 0]));
+
+var_dump(password_hash('test', PASSWORD_ARGON2, ['threads' => 0]));
+
 ?>
 --EXPECTF--
 Warning: password_hash() expects at least 2 parameters, 0 given in %s on line %d
@@ -50,3 +56,13 @@ Deprecated: password_hash(): Use of the 'salt' option to password_hash is deprec
 
 Warning: password_hash(): Provided salt is too short: 4 expecting 22 in %s on line %d
 NULL
+
+Warning: password_hash(): Memory cost is outside of allowed memory range in %s on line %d
+NULL
+
+Warning: password_hash(): Time cost is outside of allowed time range in %s on line %d
+NULL
+
+Warning: password_hash(): Invalid number of threads in %s on line %d
+NULL
+

diff --git a/ext/standard/tests/password/password_needs_rehash.phpt b/ext/standard/tests/password/password_needs_rehash.phpt
index 8efd0add8f32ee50d537c968e63d27a475a57ef4..b38c1dde20ab8be4e77e7e6b5b65eee24e91342e 100644 (file)
--- a/ext/standard/tests/password/password_needs_rehash.phpt
+++ b/ext/standard/tests/password/password_needs_rehash.phpt
@@ -29,8 +29,9 @@ var_dump(password_needs_rehash('$2y$'.$cost.'$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.o
 // Should Issue Needs Rehash, Since Foo is cast to 0...
 var_dump(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 'foo')));
 
-
-
+var_dump(password_needs_rehash('$argon2i$v=19$m=65536,t=3,p=1$YkprUktYN0lHQTd2bWRFeA$79aA+6IvgclpDAJVoezProlqzIPy7do/P0sBDXS9Nn0', PASSWORD_ARGON2, ['m_cost' => 1<<17]));
+var_dump(password_needs_rehash('$argon2i$v=19$m=65536,t=3,p=1$YkprUktYN0lHQTd2bWRFeA$79aA+6IvgclpDAJVoezProlqzIPy7do/P0sBDXS9Nn0', PASSWORD_ARGON2, ['t_cost' => 2]));
+var_dump(password_needs_rehash('$argon2i$v=19$m=65536,t=3,p=1$YkprUktYN0lHQTd2bWRFeA$79aA+6IvgclpDAJVoezProlqzIPy7do/P0sBDXS9Nn0', PASSWORD_ARGON2, ['threads' => 2]));
 echo "OK!";
 ?>
 --EXPECT--
@@ -42,4 +43,7 @@ bool(true)
 bool(true)
 bool(false)
 bool(true)
+bool(true)
+bool(true)
+bool(true)
 OK!

diff --git a/ext/standard/tests/password/password_verify.phpt b/ext/standard/tests/password/password_verify.phpt
index a196763c1362edd6a0276e73184dfdf4699b9952..0e85413a3523e4cfb4a249958ed79bf6d784e67c 100644 (file)
--- a/ext/standard/tests/password/password_verify.phpt
+++ b/ext/standard/tests/password/password_verify.phpt
@@ -18,6 +18,13 @@ var_dump(password_verify("rasmuslerdorf", "rl.3StKT.4T8M"));
 
 var_dump(password_verify("foo", "$1"));
 
+var_dump(password_verify('test', '$argon2d$v=19$m=32768,t=2,p=1$YWpxd0VYRW9MLmp6VjFPZw$pWV5IsbBfjEK5c0bHzvAo0FsDNHUyM4p6j8vf2cxzb8'));
+
+var_dump(password_verify('argon2', '$argon2d$v=19$m=32768,t=2,p=1$YWpxd0VYRW9MLmp6VjFPZw$pWV5IsbBfjEK5c0bHzvAo0FsDNHUyM4p6j8vf2cxzb8'));
+
+var_dump(password_verify('test', '$argon2i$v=19$m=65536,t=3,p=1$OEVjWWs2Z3YvWlNZQ0ZmNw$JKin7ahjmh8JYvMyFcXri0Ss/Uvd3uYpD7MG6C/5Cy0'));
+
+var_dump(password_verify('argon2', '$argon2i$v=19$m=65536,t=3,p=1$OEVjWWs2Z3YvWlNZQ0ZmNw$JKin7ahjmh8JYvMyFcXri0Ss/Uvd3uYpD7MG6C/5Cy0'));
 echo "OK!";
 ?>
 --EXPECT--
@@ -28,4 +35,8 @@ bool(true)
 bool(false)
 bool(true)
 bool(false)
-OK!
+bool(true)
+bool(false)
+bool(true)
+bool(false)
+OK!
\ No newline at end of file