Files
greptimedb/src/auth/common.rs.html
T

664 lines
68 KiB
HTML

<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="generator" content="rustdoc"><meta name="description" content="Source of the Rust file `src/auth/src/common.rs`."><title>common.rs - source</title><script>if(window.location.protocol!=="file:")document.head.insertAdjacentHTML("beforeend","SourceSerif4-Regular-6b053e98.ttf.woff2,FiraSans-Italic-81dc35de.woff2,FiraSans-Regular-0fe48ade.woff2,FiraSans-MediumItalic-ccf7e434.woff2,FiraSans-Medium-e1aa3f0a.woff2,SourceCodePro-Regular-8badfe75.ttf.woff2,SourceCodePro-Semibold-aa29a496.ttf.woff2".split(",").map(f=>`<link rel="preload" as="font" type="font/woff2"href="../../static.files/${f}">`).join(""))</script><link rel="stylesheet" href="../../static.files/normalize-9960930a.css"><link rel="stylesheet" href="../../static.files/rustdoc-17e0aaed.css"><meta name="rustdoc-vars" data-root-path="../../" data-static-root-path="../../static.files/" data-current-crate="auth" data-themes="" data-resource-suffix="" data-rustdoc-version="1.96.1 (31fca3adb 2026-06-26)" data-channel="1.96.1" data-search-js="search-b5634cc7.js" data-stringdex-js="stringdex-2da4960a.js" data-settings-js="settings-170eb4bf.js" ><script src="../../static.files/storage-41dd4d93.js"></script><script defer src="../../static.files/src-script-813739b1.js"></script><script defer src="../../src-files.js"></script><script defer src="../../static.files/main-5013f961.js"></script><noscript><link rel="stylesheet" href="../../static.files/noscript-f7c3ffd8.css"></noscript><link rel="alternate icon" type="image/png" href="../../static.files/favicon-32x32-eab170b8.png"><link rel="icon" type="image/svg+xml" href="../../static.files/favicon-044be391.svg"></head><body class="rustdoc src"><a class="skip-main-content" href="#main-content">Skip to main content</a><!--[if lte IE 11]><div class="warning">This old browser is unsupported and will most likely display funky things.</div><![endif]--><nav class="sidebar"><div class="src-sidebar-title"><h2>Files</h2></div></nav><div class="sidebar-resizer" title="Drag to resize sidebar"></div><main><section id="main-content" class="content" tabindex="-1"><div class="main-heading"><h1><div class="sub-heading">auth/</div>common.rs</h1><rustdoc-toolbar></rustdoc-toolbar></div><div class="example-wrap digits-3"><pre class="rust"><code><a href=#1 id=1 data-nosnippet>1</a><span class="comment">// Copyright 2023 Greptime Team
<a href=#2 id=2 data-nosnippet>2</a>//
<a href=#3 id=3 data-nosnippet>3</a>// Licensed under the Apache License, Version 2.0 (the "License");
<a href=#4 id=4 data-nosnippet>4</a>// you may not use this file except in compliance with the License.
<a href=#5 id=5 data-nosnippet>5</a>// You may obtain a copy of the License at
<a href=#6 id=6 data-nosnippet>6</a>//
<a href=#7 id=7 data-nosnippet>7</a>// http://www.apache.org/licenses/LICENSE-2.0
<a href=#8 id=8 data-nosnippet>8</a>//
<a href=#9 id=9 data-nosnippet>9</a>// Unless required by applicable law or agreed to in writing, software
<a href=#10 id=10 data-nosnippet>10</a>// distributed under the License is distributed on an "AS IS" BASIS,
<a href=#11 id=11 data-nosnippet>11</a>// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
<a href=#12 id=12 data-nosnippet>12</a>// See the License for the specific language governing permissions and
<a href=#13 id=13 data-nosnippet>13</a>// limitations under the License.
<a href=#14 id=14 data-nosnippet>14</a>
<a href=#15 id=15 data-nosnippet>15</a></span><span class="kw">use </span>std::sync::{Arc, LazyLock};
<a href=#16 id=16 data-nosnippet>16</a>
<a href=#17 id=17 data-nosnippet>17</a><span class="kw">use </span>common_base::secrets::SecretString;
<a href=#18 id=18 data-nosnippet>18</a><span class="kw">use </span>digest::Digest;
<a href=#19 id=19 data-nosnippet>19</a><span class="kw">use </span>hmac::{Hmac, Mac};
<a href=#20 id=20 data-nosnippet>20</a><span class="kw">use </span>pbkdf2::pbkdf2_hmac;
<a href=#21 id=21 data-nosnippet>21</a><span class="kw">use </span>sha1::Sha1;
<a href=#22 id=22 data-nosnippet>22</a><span class="kw">use </span>sha2::Sha256;
<a href=#23 id=23 data-nosnippet>23</a><span class="kw">use </span>snafu::{OptionExt, ensure};
<a href=#24 id=24 data-nosnippet>24</a><span class="kw">use </span>subtle::ConstantTimeEq;
<a href=#25 id=25 data-nosnippet>25</a>
<a href=#26 id=26 data-nosnippet>26</a><span class="kw">use </span><span class="kw">crate</span>::error::{IllegalParamSnafu, InvalidConfigSnafu, <span class="prelude-ty">Result</span>, UserPasswordMismatchSnafu};
<a href=#27 id=27 data-nosnippet>27</a><span class="kw">use </span><span class="kw">crate</span>::user_info::DefaultUserInfo;
<a href=#28 id=28 data-nosnippet>28</a><span class="kw">use </span><span class="kw">crate</span>::user_provider::static_user_provider::{STATIC_USER_PROVIDER, StaticUserProvider};
<a href=#29 id=29 data-nosnippet>29</a><span class="kw">use </span><span class="kw">crate</span>::user_provider::watch_file_user_provider::{
<a href=#30 id=30 data-nosnippet>30</a> WATCH_FILE_USER_PROVIDER, WatchFileUserProvider,
<a href=#31 id=31 data-nosnippet>31</a>};
<a href=#32 id=32 data-nosnippet>32</a><span class="kw">use </span>crate::{UserInfoRef, UserProviderRef};
<a href=#33 id=33 data-nosnippet>33</a>
<a href=#34 id=34 data-nosnippet>34</a><span class="kw">pub</span>(<span class="kw">crate</span>) <span class="kw">const </span>DEFAULT_USERNAME: <span class="kw-2">&amp;</span>str = <span class="string">"greptime"</span>;
<a href=#35 id=35 data-nosnippet>35</a><span class="kw">pub const </span>DEFAULT_PBKDF2_SHA256_ITERATIONS: u32 = <span class="number">4096</span>;
<a href=#36 id=36 data-nosnippet>36</a><span class="kw">pub const </span>DEFAULT_PBKDF2_SHA256_SALT_LEN: usize = <span class="number">16</span>;
<a href=#37 id=37 data-nosnippet>37</a><span class="kw">pub const </span>PBKDF2_SHA256_HASH_LEN: usize = <span class="number">32</span>;
<a href=#38 id=38 data-nosnippet>38</a><span class="kw">pub const </span>MAX_PBKDF2_SHA256_ITERATIONS: u32 = <span class="number">1_000_000</span>;
<a href=#39 id=39 data-nosnippet>39</a><span class="kw">pub const </span>MAX_PBKDF2_SHA256_SALT_LEN: usize = <span class="number">1024</span>;
<a href=#40 id=40 data-nosnippet>40</a><span class="kw">pub const </span>PG_SCRAM_SHA256_KEY_LEN: usize = <span class="number">32</span>;
<a href=#41 id=41 data-nosnippet>41</a>
<a href=#42 id=42 data-nosnippet>42</a><span class="kw">type </span>HmacSha256 = Hmac&lt;Sha256&gt;;
<a href=#43 id=43 data-nosnippet>43</a>
<a href=#44 id=44 data-nosnippet>44</a><span class="doccomment">/// Process-wide secret used to derive a stable mock salt for unknown users, so
<a href=#45 id=45 data-nosnippet>45</a>/// the SCRAM `server-first-message` can't be used to enumerate usernames.
<a href=#46 id=46 data-nosnippet>46</a></span><span class="kw">static </span>PG_SCRAM_MOCK_SECRET: LazyLock&lt;[u8; PG_SCRAM_SHA256_KEY_LEN]&gt; = LazyLock::new(rand::random);
<a href=#47 id=47 data-nosnippet>47</a>
<a href=#48 id=48 data-nosnippet>48</a><span class="doccomment">/// construct a [`UserInfo`](crate::user_info::UserInfo) impl with name
<a href=#49 id=49 data-nosnippet>49</a>/// use default username `greptime` if None is provided
<a href=#50 id=50 data-nosnippet>50</a></span><span class="kw">pub fn </span>userinfo_by_name(username: <span class="prelude-ty">Option</span>&lt;String&gt;) -&gt; UserInfoRef {
<a href=#51 id=51 data-nosnippet>51</a> DefaultUserInfo::with_name(username.unwrap_or_else(|| DEFAULT_USERNAME.to_string()))
<a href=#52 id=52 data-nosnippet>52</a>}
<a href=#53 id=53 data-nosnippet>53</a>
<a href=#54 id=54 data-nosnippet>54</a><span class="kw">pub fn </span>user_provider_from_option(opt: <span class="kw-2">&amp;</span>str) -&gt; <span class="prelude-ty">Result</span>&lt;UserProviderRef&gt; {
<a href=#55 id=55 data-nosnippet>55</a> <span class="kw">let </span>(name, content) = opt.split_once(<span class="string">':'</span>).with_context(|| InvalidConfigSnafu {
<a href=#56 id=56 data-nosnippet>56</a> value: opt.to_string(),
<a href=#57 id=57 data-nosnippet>57</a> msg: <span class="string">"UserProviderOption must be in format `&lt;option&gt;:&lt;value&gt;`"</span>,
<a href=#58 id=58 data-nosnippet>58</a> })<span class="question-mark">?</span>;
<a href=#59 id=59 data-nosnippet>59</a> <span class="kw">match </span>name {
<a href=#60 id=60 data-nosnippet>60</a> STATIC_USER_PROVIDER =&gt; {
<a href=#61 id=61 data-nosnippet>61</a> <span class="kw">let </span>provider =
<a href=#62 id=62 data-nosnippet>62</a> StaticUserProvider::new(content).map(|p| Arc::new(p) <span class="kw">as </span>UserProviderRef)<span class="question-mark">?</span>;
<a href=#63 id=63 data-nosnippet>63</a> <span class="prelude-val">Ok</span>(provider)
<a href=#64 id=64 data-nosnippet>64</a> }
<a href=#65 id=65 data-nosnippet>65</a> WATCH_FILE_USER_PROVIDER =&gt; {
<a href=#66 id=66 data-nosnippet>66</a> WatchFileUserProvider::new(content).map(|p| Arc::new(p) <span class="kw">as </span>UserProviderRef)
<a href=#67 id=67 data-nosnippet>67</a> }
<a href=#68 id=68 data-nosnippet>68</a> <span class="kw">_ </span>=&gt; InvalidConfigSnafu {
<a href=#69 id=69 data-nosnippet>69</a> value: name.to_string(),
<a href=#70 id=70 data-nosnippet>70</a> msg: <span class="string">"Invalid UserProviderOption"</span>,
<a href=#71 id=71 data-nosnippet>71</a> }
<a href=#72 id=72 data-nosnippet>72</a> .fail(),
<a href=#73 id=73 data-nosnippet>73</a> }
<a href=#74 id=74 data-nosnippet>74</a>}
<a href=#75 id=75 data-nosnippet>75</a>
<a href=#76 id=76 data-nosnippet>76</a><span class="kw">pub fn </span>static_user_provider_from_option(opt: <span class="kw-2">&amp;</span>str) -&gt; <span class="prelude-ty">Result</span>&lt;StaticUserProvider&gt; {
<a href=#77 id=77 data-nosnippet>77</a> <span class="kw">let </span>(name, content) = opt.split_once(<span class="string">':'</span>).with_context(|| InvalidConfigSnafu {
<a href=#78 id=78 data-nosnippet>78</a> value: opt.to_string(),
<a href=#79 id=79 data-nosnippet>79</a> msg: <span class="string">"UserProviderOption must be in format `&lt;option&gt;:&lt;value&gt;`"</span>,
<a href=#80 id=80 data-nosnippet>80</a> })<span class="question-mark">?</span>;
<a href=#81 id=81 data-nosnippet>81</a> <span class="kw">match </span>name {
<a href=#82 id=82 data-nosnippet>82</a> STATIC_USER_PROVIDER =&gt; {
<a href=#83 id=83 data-nosnippet>83</a> <span class="kw">let </span>provider = StaticUserProvider::new(content)<span class="question-mark">?</span>;
<a href=#84 id=84 data-nosnippet>84</a> <span class="prelude-val">Ok</span>(provider)
<a href=#85 id=85 data-nosnippet>85</a> }
<a href=#86 id=86 data-nosnippet>86</a> <span class="kw">_ </span>=&gt; InvalidConfigSnafu {
<a href=#87 id=87 data-nosnippet>87</a> value: name.to_string(),
<a href=#88 id=88 data-nosnippet>88</a> msg: <span class="macro">format!</span>(<span class="string">"Invalid UserProviderOption, expect only {STATIC_USER_PROVIDER}"</span>),
<a href=#89 id=89 data-nosnippet>89</a> }
<a href=#90 id=90 data-nosnippet>90</a> .fail(),
<a href=#91 id=91 data-nosnippet>91</a> }
<a href=#92 id=92 data-nosnippet>92</a>}
<a href=#93 id=93 data-nosnippet>93</a>
<a href=#94 id=94 data-nosnippet>94</a><span class="kw">type </span>Username&lt;<span class="lifetime">'a</span>&gt; = <span class="kw-2">&amp;</span><span class="lifetime">'a </span>str;
<a href=#95 id=95 data-nosnippet>95</a><span class="kw">type </span>HostOrIp&lt;<span class="lifetime">'a</span>&gt; = <span class="kw-2">&amp;</span><span class="lifetime">'a </span>str;
<a href=#96 id=96 data-nosnippet>96</a>
<a href=#97 id=97 data-nosnippet>97</a><span class="attr">#[derive(Debug, Clone)]
<a href=#98 id=98 data-nosnippet>98</a></span><span class="kw">pub enum </span>Identity&lt;<span class="lifetime">'a</span>&gt; {
<a href=#99 id=99 data-nosnippet>99</a> UserId(Username&lt;<span class="lifetime">'a</span>&gt;, <span class="prelude-ty">Option</span>&lt;HostOrIp&lt;<span class="lifetime">'a</span>&gt;&gt;),
<a href=#100 id=100 data-nosnippet>100</a>}
<a href=#101 id=101 data-nosnippet>101</a>
<a href=#102 id=102 data-nosnippet>102</a><span class="kw">pub type </span>HashedPassword&lt;<span class="lifetime">'a</span>&gt; = <span class="kw-2">&amp;</span><span class="lifetime">'a </span>[u8];
<a href=#103 id=103 data-nosnippet>103</a><span class="kw">pub type </span>Salt&lt;<span class="lifetime">'a</span>&gt; = <span class="kw-2">&amp;</span><span class="lifetime">'a </span>[u8];
<a href=#104 id=104 data-nosnippet>104</a>
<a href=#105 id=105 data-nosnippet>105</a><span class="doccomment">/// Authentication information sent by the client.
<a href=#106 id=106 data-nosnippet>106</a></span><span class="kw">pub enum </span>Password&lt;<span class="lifetime">'a</span>&gt; {
<a href=#107 id=107 data-nosnippet>107</a> PlainText(SecretString),
<a href=#108 id=108 data-nosnippet>108</a> MysqlNativePassword(HashedPassword&lt;<span class="lifetime">'a</span>&gt;, Salt&lt;<span class="lifetime">'a</span>&gt;),
<a href=#109 id=109 data-nosnippet>109</a> PgMD5(HashedPassword&lt;<span class="lifetime">'a</span>&gt;, Salt&lt;<span class="lifetime">'a</span>&gt;),
<a href=#110 id=110 data-nosnippet>110</a>}
<a href=#111 id=111 data-nosnippet>111</a>
<a href=#112 id=112 data-nosnippet>112</a><span class="kw">impl </span>Password&lt;<span class="lifetime">'_</span>&gt; {
<a href=#113 id=113 data-nosnippet>113</a> <span class="kw">pub fn </span>r#type(<span class="kw-2">&amp;</span><span class="self">self</span>) -&gt; <span class="kw-2">&amp;</span>str {
<a href=#114 id=114 data-nosnippet>114</a> <span class="kw">match </span><span class="self">self </span>{
<a href=#115 id=115 data-nosnippet>115</a> Password::PlainText(<span class="kw">_</span>) =&gt; <span class="string">"plain_text"</span>,
<a href=#116 id=116 data-nosnippet>116</a> Password::MysqlNativePassword(<span class="kw">_</span>, <span class="kw">_</span>) =&gt; <span class="string">"mysql_native_password"</span>,
<a href=#117 id=117 data-nosnippet>117</a> Password::PgMD5(<span class="kw">_</span>, <span class="kw">_</span>) =&gt; <span class="string">"pg_md5"</span>,
<a href=#118 id=118 data-nosnippet>118</a> }
<a href=#119 id=119 data-nosnippet>119</a> }
<a href=#120 id=120 data-nosnippet>120</a>}
<a href=#121 id=121 data-nosnippet>121</a>
<a href=#122 id=122 data-nosnippet>122</a><span class="kw">pub fn </span>auth_mysql(
<a href=#123 id=123 data-nosnippet>123</a> auth_data: HashedPassword,
<a href=#124 id=124 data-nosnippet>124</a> salt: Salt,
<a href=#125 id=125 data-nosnippet>125</a> username: <span class="kw-2">&amp;</span>str,
<a href=#126 id=126 data-nosnippet>126</a> save_pwd: <span class="kw-2">&amp;</span>[u8],
<a href=#127 id=127 data-nosnippet>127</a>) -&gt; <span class="prelude-ty">Result</span>&lt;()&gt; {
<a href=#128 id=128 data-nosnippet>128</a> <span class="kw">let </span>hash_stage_2 = mysql_native_password_hash(save_pwd);
<a href=#129 id=129 data-nosnippet>129</a> auth_mysql_with_hash_stage_2(auth_data, salt, username, <span class="kw-2">&amp;</span>hash_stage_2)
<a href=#130 id=130 data-nosnippet>130</a>}
<a href=#131 id=131 data-nosnippet>131</a>
<a href=#132 id=132 data-nosnippet>132</a><span class="doccomment">/// Authenticates a MySQL native password response against an encoded verifier.
<a href=#133 id=133 data-nosnippet>133</a></span><span class="kw">pub fn </span>auth_mysql_with_verifier(
<a href=#134 id=134 data-nosnippet>134</a> auth_data: HashedPassword,
<a href=#135 id=135 data-nosnippet>135</a> salt: Salt,
<a href=#136 id=136 data-nosnippet>136</a> username: <span class="kw-2">&amp;</span>str,
<a href=#137 id=137 data-nosnippet>137</a> verifier: <span class="kw-2">&amp;</span>str,
<a href=#138 id=138 data-nosnippet>138</a>) -&gt; <span class="prelude-ty">Result</span>&lt;()&gt; {
<a href=#139 id=139 data-nosnippet>139</a> <span class="kw">let </span>hash_stage_2 = parse_mysql_native_password_verifier(verifier)<span class="question-mark">?</span>;
<a href=#140 id=140 data-nosnippet>140</a> auth_mysql_with_hash_stage_2(auth_data, salt, username, <span class="kw-2">&amp;</span>hash_stage_2)
<a href=#141 id=141 data-nosnippet>141</a>}
<a href=#142 id=142 data-nosnippet>142</a>
<a href=#143 id=143 data-nosnippet>143</a><span class="kw">pub fn </span>validate_mysql_native_password_verifier(verifier: <span class="kw-2">&amp;</span>str) -&gt; <span class="prelude-ty">Result</span>&lt;()&gt; {
<a href=#144 id=144 data-nosnippet>144</a> parse_mysql_native_password_verifier(verifier).map(|<span class="kw">_</span>| ())
<a href=#145 id=145 data-nosnippet>145</a>}
<a href=#146 id=146 data-nosnippet>146</a>
<a href=#147 id=147 data-nosnippet>147</a><span class="kw">pub</span>(<span class="kw">crate</span>) <span class="kw">fn </span>parse_mysql_native_password_verifier(verifier: <span class="kw-2">&amp;</span>str) -&gt; <span class="prelude-ty">Result</span>&lt;Vec&lt;u8&gt;&gt; {
<a href=#148 id=148 data-nosnippet>148</a> <span class="kw">let </span><span class="prelude-val">Some</span>(verifier) = verifier.strip_prefix(<span class="string">"mysql_native_password:"</span>) <span class="kw">else </span>{
<a href=#149 id=149 data-nosnippet>149</a> <span class="kw">return </span>InvalidConfigSnafu {
<a href=#150 id=150 data-nosnippet>150</a> value: <span class="string">"mysql_native_password"</span>.to_string(),
<a href=#151 id=151 data-nosnippet>151</a> msg: <span class="string">"Invalid mysql native password verifier format"</span>,
<a href=#152 id=152 data-nosnippet>152</a> }
<a href=#153 id=153 data-nosnippet>153</a> .fail();
<a href=#154 id=154 data-nosnippet>154</a> };
<a href=#155 id=155 data-nosnippet>155</a> <span class="kw">let </span><span class="prelude-val">Ok</span>(hash_stage_2) = hex::decode(verifier) <span class="kw">else </span>{
<a href=#156 id=156 data-nosnippet>156</a> <span class="kw">return </span>InvalidConfigSnafu {
<a href=#157 id=157 data-nosnippet>157</a> value: <span class="string">"mysql_native_password"</span>.to_string(),
<a href=#158 id=158 data-nosnippet>158</a> msg: <span class="string">"Invalid mysql native password verifier encoding"</span>,
<a href=#159 id=159 data-nosnippet>159</a> }
<a href=#160 id=160 data-nosnippet>160</a> .fail();
<a href=#161 id=161 data-nosnippet>161</a> };
<a href=#162 id=162 data-nosnippet>162</a> <span class="macro">ensure!</span>(
<a href=#163 id=163 data-nosnippet>163</a> hash_stage_2.len() == <span class="number">20</span>,
<a href=#164 id=164 data-nosnippet>164</a> InvalidConfigSnafu {
<a href=#165 id=165 data-nosnippet>165</a> value: <span class="string">"mysql_native_password"</span>.to_string(),
<a href=#166 id=166 data-nosnippet>166</a> msg: <span class="string">"Illegal mysql native password verifier length"</span>,
<a href=#167 id=167 data-nosnippet>167</a> }
<a href=#168 id=168 data-nosnippet>168</a> );
<a href=#169 id=169 data-nosnippet>169</a> <span class="prelude-val">Ok</span>(hash_stage_2)
<a href=#170 id=170 data-nosnippet>170</a>}
<a href=#171 id=171 data-nosnippet>171</a>
<a href=#172 id=172 data-nosnippet>172</a><span class="kw">pub</span>(<span class="kw">crate</span>) <span class="kw">fn </span>auth_mysql_with_hash_stage_2(
<a href=#173 id=173 data-nosnippet>173</a> auth_data: HashedPassword,
<a href=#174 id=174 data-nosnippet>174</a> salt: Salt,
<a href=#175 id=175 data-nosnippet>175</a> username: <span class="kw-2">&amp;</span>str,
<a href=#176 id=176 data-nosnippet>176</a> hash_stage_2: <span class="kw-2">&amp;</span>[u8],
<a href=#177 id=177 data-nosnippet>177</a>) -&gt; <span class="prelude-ty">Result</span>&lt;()&gt; {
<a href=#178 id=178 data-nosnippet>178</a> <span class="macro">ensure!</span>(
<a href=#179 id=179 data-nosnippet>179</a> auth_data.len() == <span class="number">20</span>,
<a href=#180 id=180 data-nosnippet>180</a> IllegalParamSnafu {
<a href=#181 id=181 data-nosnippet>181</a> msg: <span class="string">"Illegal mysql password length"
<a href=#182 id=182 data-nosnippet>182</a> </span>}
<a href=#183 id=183 data-nosnippet>183</a> );
<a href=#184 id=184 data-nosnippet>184</a> <span class="macro">ensure!</span>(
<a href=#185 id=185 data-nosnippet>185</a> hash_stage_2.len() == <span class="number">20</span>,
<a href=#186 id=186 data-nosnippet>186</a> InvalidConfigSnafu {
<a href=#187 id=187 data-nosnippet>187</a> value: hash_stage_2.len().to_string(),
<a href=#188 id=188 data-nosnippet>188</a> msg: <span class="string">"Illegal mysql native password verifier length"</span>,
<a href=#189 id=189 data-nosnippet>189</a> }
<a href=#190 id=190 data-nosnippet>190</a> );
<a href=#191 id=191 data-nosnippet>191</a> <span class="comment">// ref: https://github.com/mysql/mysql-server/blob/a246bad76b9271cb4333634e954040a970222e0a/sql/auth/password.cc#L62
<a href=#192 id=192 data-nosnippet>192</a> </span><span class="kw">let </span>tmp = sha1_two(salt, hash_stage_2);
<a href=#193 id=193 data-nosnippet>193</a> <span class="comment">// xor auth_data and tmp
<a href=#194 id=194 data-nosnippet>194</a> </span><span class="kw">let </span><span class="kw-2">mut </span>xor_result = [<span class="number">0u8</span>; <span class="number">20</span>];
<a href=#195 id=195 data-nosnippet>195</a> <span class="kw">for </span>i <span class="kw">in </span><span class="number">0</span>..<span class="number">20 </span>{
<a href=#196 id=196 data-nosnippet>196</a> xor_result[i] = auth_data[i] ^ tmp[i];
<a href=#197 id=197 data-nosnippet>197</a> }
<a href=#198 id=198 data-nosnippet>198</a> <span class="kw">let </span>candidate_stage_2 = sha1_one(<span class="kw-2">&amp;</span>xor_result);
<a href=#199 id=199 data-nosnippet>199</a> <span class="kw">if </span>candidate_stage_2 == hash_stage_2 {
<a href=#200 id=200 data-nosnippet>200</a> <span class="prelude-val">Ok</span>(())
<a href=#201 id=201 data-nosnippet>201</a> } <span class="kw">else </span>{
<a href=#202 id=202 data-nosnippet>202</a> UserPasswordMismatchSnafu {
<a href=#203 id=203 data-nosnippet>203</a> username: username.to_string(),
<a href=#204 id=204 data-nosnippet>204</a> }
<a href=#205 id=205 data-nosnippet>205</a> .fail()
<a href=#206 id=206 data-nosnippet>206</a> }
<a href=#207 id=207 data-nosnippet>207</a>}
<a href=#208 id=208 data-nosnippet>208</a>
<a href=#209 id=209 data-nosnippet>209</a><span class="kw">pub fn </span>mysql_native_password_hash(save_pwd: <span class="kw-2">&amp;</span>[u8]) -&gt; Vec&lt;u8&gt; {
<a href=#210 id=210 data-nosnippet>210</a> double_sha1(save_pwd)
<a href=#211 id=211 data-nosnippet>211</a>}
<a href=#212 id=212 data-nosnippet>212</a>
<a href=#213 id=213 data-nosnippet>213</a><span class="kw">pub fn </span>format_mysql_native_password_verifier(password: <span class="kw-2">&amp;</span>[u8]) -&gt; String {
<a href=#214 id=214 data-nosnippet>214</a> <span class="macro">format!</span>(
<a href=#215 id=215 data-nosnippet>215</a> <span class="string">"mysql_native_password:{}"</span>,
<a href=#216 id=216 data-nosnippet>216</a> hex::encode(mysql_native_password_hash(password))
<a href=#217 id=217 data-nosnippet>217</a> )
<a href=#218 id=218 data-nosnippet>218</a>}
<a href=#219 id=219 data-nosnippet>219</a>
<a href=#220 id=220 data-nosnippet>220</a><span class="kw">pub fn </span>format_pbkdf2_sha256_password_verifier(
<a href=#221 id=221 data-nosnippet>221</a> password: <span class="kw-2">&amp;</span>[u8],
<a href=#222 id=222 data-nosnippet>222</a> salt: <span class="kw-2">&amp;</span>[u8],
<a href=#223 id=223 data-nosnippet>223</a> iterations: u32,
<a href=#224 id=224 data-nosnippet>224</a>) -&gt; <span class="prelude-ty">Result</span>&lt;String&gt; {
<a href=#225 id=225 data-nosnippet>225</a> <span class="macro">ensure!</span>(
<a href=#226 id=226 data-nosnippet>226</a> iterations &gt; <span class="number">0 </span>&amp;&amp; iterations &lt;= MAX_PBKDF2_SHA256_ITERATIONS,
<a href=#227 id=227 data-nosnippet>227</a> IllegalParamSnafu {
<a href=#228 id=228 data-nosnippet>228</a> msg: <span class="macro">format!</span>(
<a href=#229 id=229 data-nosnippet>229</a> <span class="string">"pbkdf2_sha256 iterations must be in 1..={}"</span>,
<a href=#230 id=230 data-nosnippet>230</a> MAX_PBKDF2_SHA256_ITERATIONS
<a href=#231 id=231 data-nosnippet>231</a> )
<a href=#232 id=232 data-nosnippet>232</a> }
<a href=#233 id=233 data-nosnippet>233</a> );
<a href=#234 id=234 data-nosnippet>234</a> <span class="macro">ensure!</span>(
<a href=#235 id=235 data-nosnippet>235</a> !salt.is_empty() &amp;&amp; salt.len() &lt;= MAX_PBKDF2_SHA256_SALT_LEN,
<a href=#236 id=236 data-nosnippet>236</a> IllegalParamSnafu {
<a href=#237 id=237 data-nosnippet>237</a> msg: <span class="macro">format!</span>(
<a href=#238 id=238 data-nosnippet>238</a> <span class="string">"pbkdf2_sha256 salt length must be in 1..={}"</span>,
<a href=#239 id=239 data-nosnippet>239</a> MAX_PBKDF2_SHA256_SALT_LEN
<a href=#240 id=240 data-nosnippet>240</a> )
<a href=#241 id=241 data-nosnippet>241</a> }
<a href=#242 id=242 data-nosnippet>242</a> );
<a href=#243 id=243 data-nosnippet>243</a>
<a href=#244 id=244 data-nosnippet>244</a> <span class="kw">let </span><span class="kw-2">mut </span>hash = [<span class="number">0u8</span>; PBKDF2_SHA256_HASH_LEN];
<a href=#245 id=245 data-nosnippet>245</a> pbkdf2_hmac::&lt;Sha256&gt;(password, salt, iterations, <span class="kw-2">&amp;mut </span>hash);
<a href=#246 id=246 data-nosnippet>246</a> <span class="prelude-val">Ok</span>(<span class="macro">format!</span>(
<a href=#247 id=247 data-nosnippet>247</a> <span class="string">"pbkdf2_sha256:{iterations}:{}:{}"</span>,
<a href=#248 id=248 data-nosnippet>248</a> hex::encode(salt),
<a href=#249 id=249 data-nosnippet>249</a> hex::encode(hash)
<a href=#250 id=250 data-nosnippet>250</a> ))
<a href=#251 id=251 data-nosnippet>251</a>}
<a href=#252 id=252 data-nosnippet>252</a>
<a href=#253 id=253 data-nosnippet>253</a><span class="attr">#[derive(Clone, PartialEq, Eq)]
<a href=#254 id=254 data-nosnippet>254</a></span><span class="kw">pub struct </span>PgScramSha256Verifier {
<a href=#255 id=255 data-nosnippet>255</a> iterations: u32,
<a href=#256 id=256 data-nosnippet>256</a> salt: Vec&lt;u8&gt;,
<a href=#257 id=257 data-nosnippet>257</a> stored_key: Vec&lt;u8&gt;,
<a href=#258 id=258 data-nosnippet>258</a> server_key: Vec&lt;u8&gt;,
<a href=#259 id=259 data-nosnippet>259</a>}
<a href=#260 id=260 data-nosnippet>260</a>
<a href=#261 id=261 data-nosnippet>261</a><span class="kw">impl </span>std::fmt::Debug <span class="kw">for </span>PgScramSha256Verifier {
<a href=#262 id=262 data-nosnippet>262</a> <span class="kw">fn </span>fmt(<span class="kw-2">&amp;</span><span class="self">self</span>, f: <span class="kw-2">&amp;mut </span>std::fmt::Formatter&lt;<span class="lifetime">'_</span>&gt;) -&gt; std::fmt::Result {
<a href=#263 id=263 data-nosnippet>263</a> f.debug_struct(<span class="string">"PgScramSha256Verifier"</span>)
<a href=#264 id=264 data-nosnippet>264</a> .field(<span class="string">"iterations"</span>, <span class="kw-2">&amp;</span><span class="self">self</span>.iterations)
<a href=#265 id=265 data-nosnippet>265</a> .field(<span class="string">"salt"</span>, <span class="kw-2">&amp;</span><span class="string">"&lt;REDACTED&gt;"</span>)
<a href=#266 id=266 data-nosnippet>266</a> .field(<span class="string">"stored_key"</span>, <span class="kw-2">&amp;</span><span class="string">"&lt;REDACTED&gt;"</span>)
<a href=#267 id=267 data-nosnippet>267</a> .field(<span class="string">"server_key"</span>, <span class="kw-2">&amp;</span><span class="string">"&lt;REDACTED&gt;"</span>)
<a href=#268 id=268 data-nosnippet>268</a> .finish()
<a href=#269 id=269 data-nosnippet>269</a> }
<a href=#270 id=270 data-nosnippet>270</a>}
<a href=#271 id=271 data-nosnippet>271</a>
<a href=#272 id=272 data-nosnippet>272</a><span class="kw">impl </span>PgScramSha256Verifier {
<a href=#273 id=273 data-nosnippet>273</a> <span class="kw">pub fn </span>new(
<a href=#274 id=274 data-nosnippet>274</a> iterations: u32,
<a href=#275 id=275 data-nosnippet>275</a> salt: Vec&lt;u8&gt;,
<a href=#276 id=276 data-nosnippet>276</a> stored_key: Vec&lt;u8&gt;,
<a href=#277 id=277 data-nosnippet>277</a> server_key: Vec&lt;u8&gt;,
<a href=#278 id=278 data-nosnippet>278</a> ) -&gt; <span class="prelude-ty">Result</span>&lt;<span class="self">Self</span>&gt; {
<a href=#279 id=279 data-nosnippet>279</a> <span class="macro">ensure!</span>(
<a href=#280 id=280 data-nosnippet>280</a> iterations &gt; <span class="number">0 </span>&amp;&amp; iterations &lt;= MAX_PBKDF2_SHA256_ITERATIONS,
<a href=#281 id=281 data-nosnippet>281</a> IllegalParamSnafu {
<a href=#282 id=282 data-nosnippet>282</a> msg: <span class="macro">format!</span>(
<a href=#283 id=283 data-nosnippet>283</a> <span class="string">"pg_scram_sha256 iterations must be in 1..={}"</span>,
<a href=#284 id=284 data-nosnippet>284</a> MAX_PBKDF2_SHA256_ITERATIONS
<a href=#285 id=285 data-nosnippet>285</a> )
<a href=#286 id=286 data-nosnippet>286</a> }
<a href=#287 id=287 data-nosnippet>287</a> );
<a href=#288 id=288 data-nosnippet>288</a> <span class="macro">ensure!</span>(
<a href=#289 id=289 data-nosnippet>289</a> !salt.is_empty() &amp;&amp; salt.len() &lt;= MAX_PBKDF2_SHA256_SALT_LEN,
<a href=#290 id=290 data-nosnippet>290</a> IllegalParamSnafu {
<a href=#291 id=291 data-nosnippet>291</a> msg: <span class="macro">format!</span>(
<a href=#292 id=292 data-nosnippet>292</a> <span class="string">"pg_scram_sha256 salt length must be in 1..={}"</span>,
<a href=#293 id=293 data-nosnippet>293</a> MAX_PBKDF2_SHA256_SALT_LEN
<a href=#294 id=294 data-nosnippet>294</a> )
<a href=#295 id=295 data-nosnippet>295</a> }
<a href=#296 id=296 data-nosnippet>296</a> );
<a href=#297 id=297 data-nosnippet>297</a> <span class="macro">ensure!</span>(
<a href=#298 id=298 data-nosnippet>298</a> stored_key.len() == PG_SCRAM_SHA256_KEY_LEN,
<a href=#299 id=299 data-nosnippet>299</a> IllegalParamSnafu {
<a href=#300 id=300 data-nosnippet>300</a> msg: <span class="string">"pg_scram_sha256 stored key must be 32 bytes"
<a href=#301 id=301 data-nosnippet>301</a> </span>}
<a href=#302 id=302 data-nosnippet>302</a> );
<a href=#303 id=303 data-nosnippet>303</a> <span class="macro">ensure!</span>(
<a href=#304 id=304 data-nosnippet>304</a> server_key.len() == PG_SCRAM_SHA256_KEY_LEN,
<a href=#305 id=305 data-nosnippet>305</a> IllegalParamSnafu {
<a href=#306 id=306 data-nosnippet>306</a> msg: <span class="string">"pg_scram_sha256 server key must be 32 bytes"
<a href=#307 id=307 data-nosnippet>307</a> </span>}
<a href=#308 id=308 data-nosnippet>308</a> );
<a href=#309 id=309 data-nosnippet>309</a>
<a href=#310 id=310 data-nosnippet>310</a> <span class="prelude-val">Ok</span>(<span class="self">Self </span>{
<a href=#311 id=311 data-nosnippet>311</a> iterations,
<a href=#312 id=312 data-nosnippet>312</a> salt,
<a href=#313 id=313 data-nosnippet>313</a> stored_key,
<a href=#314 id=314 data-nosnippet>314</a> server_key,
<a href=#315 id=315 data-nosnippet>315</a> })
<a href=#316 id=316 data-nosnippet>316</a> }
<a href=#317 id=317 data-nosnippet>317</a>
<a href=#318 id=318 data-nosnippet>318</a> <span class="kw">pub fn </span>from_password(password: <span class="kw-2">&amp;</span>[u8], salt: <span class="kw-2">&amp;</span>[u8], iterations: u32) -&gt; <span class="prelude-ty">Result</span>&lt;<span class="self">Self</span>&gt; {
<a href=#319 id=319 data-nosnippet>319</a> <span class="kw">let </span>salted_password = pg_scram_sha256_salted_password(password, salt, iterations)<span class="question-mark">?</span>;
<a href=#320 id=320 data-nosnippet>320</a> <span class="self">Self</span>::from_salted_password(salted_password, salt.to_vec(), iterations)
<a href=#321 id=321 data-nosnippet>321</a> }
<a href=#322 id=322 data-nosnippet>322</a>
<a href=#323 id=323 data-nosnippet>323</a> <span class="kw">pub fn </span>from_salted_password(
<a href=#324 id=324 data-nosnippet>324</a> salted_password: Vec&lt;u8&gt;,
<a href=#325 id=325 data-nosnippet>325</a> salt: Vec&lt;u8&gt;,
<a href=#326 id=326 data-nosnippet>326</a> iterations: u32,
<a href=#327 id=327 data-nosnippet>327</a> ) -&gt; <span class="prelude-ty">Result</span>&lt;<span class="self">Self</span>&gt; {
<a href=#328 id=328 data-nosnippet>328</a> <span class="macro">ensure!</span>(
<a href=#329 id=329 data-nosnippet>329</a> salted_password.len() == PG_SCRAM_SHA256_KEY_LEN,
<a href=#330 id=330 data-nosnippet>330</a> IllegalParamSnafu {
<a href=#331 id=331 data-nosnippet>331</a> msg: <span class="string">"pg_scram_sha256 salted password must be 32 bytes"
<a href=#332 id=332 data-nosnippet>332</a> </span>}
<a href=#333 id=333 data-nosnippet>333</a> );
<a href=#334 id=334 data-nosnippet>334</a> <span class="kw">let </span>client_key = hmac_sha256(<span class="kw-2">&amp;</span>salted_password, <span class="string">b"Client Key"</span>);
<a href=#335 id=335 data-nosnippet>335</a> <span class="kw">let </span>stored_key = sha256(<span class="kw-2">&amp;</span>client_key);
<a href=#336 id=336 data-nosnippet>336</a> <span class="kw">let </span>server_key = hmac_sha256(<span class="kw-2">&amp;</span>salted_password, <span class="string">b"Server Key"</span>);
<a href=#337 id=337 data-nosnippet>337</a> <span class="self">Self</span>::new(iterations, salt, stored_key, server_key)
<a href=#338 id=338 data-nosnippet>338</a> }
<a href=#339 id=339 data-nosnippet>339</a>
<a href=#340 id=340 data-nosnippet>340</a> <span class="doccomment">/// Builds a throwaway verifier for an unknown user. The salt is derived
<a href=#341 id=341 data-nosnippet>341</a> /// deterministically from the username and a process-wide secret, so the
<a href=#342 id=342 data-nosnippet>342</a> /// SCRAM `server-first-message` (salt + iterations) stays stable per
<a href=#343 id=343 data-nosnippet>343</a> /// username and indistinguishable from a real user across reconnects. No
<a href=#344 id=344 data-nosnippet>344</a> /// PBKDF2 is run (avoids a CPU-exhaustion DoS keyed on unknown usernames),
<a href=#345 id=345 data-nosnippet>345</a> /// and the random keys guarantee the client proof never matches.
<a href=#346 id=346 data-nosnippet>346</a> </span><span class="kw">pub fn </span>mock_for_unknown_user(username: <span class="kw-2">&amp;</span>[u8]) -&gt; <span class="self">Self </span>{
<a href=#347 id=347 data-nosnippet>347</a> <span class="kw">let </span>mock_salt = hmac_sha256(PG_SCRAM_MOCK_SECRET.as_slice(), username);
<a href=#348 id=348 data-nosnippet>348</a> <span class="self">Self </span>{
<a href=#349 id=349 data-nosnippet>349</a> iterations: DEFAULT_PBKDF2_SHA256_ITERATIONS,
<a href=#350 id=350 data-nosnippet>350</a> salt: mock_salt[..DEFAULT_PBKDF2_SHA256_SALT_LEN].to_vec(),
<a href=#351 id=351 data-nosnippet>351</a> stored_key: rand::random::&lt;[u8; PG_SCRAM_SHA256_KEY_LEN]&gt;().to_vec(),
<a href=#352 id=352 data-nosnippet>352</a> server_key: rand::random::&lt;[u8; PG_SCRAM_SHA256_KEY_LEN]&gt;().to_vec(),
<a href=#353 id=353 data-nosnippet>353</a> }
<a href=#354 id=354 data-nosnippet>354</a> }
<a href=#355 id=355 data-nosnippet>355</a>
<a href=#356 id=356 data-nosnippet>356</a> <span class="kw">pub fn </span>iterations(<span class="kw-2">&amp;</span><span class="self">self</span>) -&gt; u32 {
<a href=#357 id=357 data-nosnippet>357</a> <span class="self">self</span>.iterations
<a href=#358 id=358 data-nosnippet>358</a> }
<a href=#359 id=359 data-nosnippet>359</a>
<a href=#360 id=360 data-nosnippet>360</a> <span class="kw">pub fn </span>salt(<span class="kw-2">&amp;</span><span class="self">self</span>) -&gt; <span class="kw-2">&amp;</span>[u8] {
<a href=#361 id=361 data-nosnippet>361</a> <span class="kw-2">&amp;</span><span class="self">self</span>.salt
<a href=#362 id=362 data-nosnippet>362</a> }
<a href=#363 id=363 data-nosnippet>363</a>
<a href=#364 id=364 data-nosnippet>364</a> <span class="kw">pub fn </span>verify_plain_password(<span class="kw-2">&amp;</span><span class="self">self</span>, password: <span class="kw-2">&amp;</span>[u8]) -&gt; <span class="prelude-ty">Result</span>&lt;bool&gt; {
<a href=#365 id=365 data-nosnippet>365</a> <span class="kw">let </span>salted_password =
<a href=#366 id=366 data-nosnippet>366</a> pg_scram_sha256_salted_password(password, <span class="kw-2">&amp;</span><span class="self">self</span>.salt, <span class="self">self</span>.iterations)<span class="question-mark">?</span>;
<a href=#367 id=367 data-nosnippet>367</a> <span class="kw">let </span>client_key = hmac_sha256(<span class="kw-2">&amp;</span>salted_password, <span class="string">b"Client Key"</span>);
<a href=#368 id=368 data-nosnippet>368</a> <span class="kw">let </span>stored_key = sha256(<span class="kw-2">&amp;</span>client_key);
<a href=#369 id=369 data-nosnippet>369</a> <span class="prelude-val">Ok</span>(<span class="self">self</span>.stored_key.ct_eq(<span class="kw-2">&amp;</span>stored_key).into())
<a href=#370 id=370 data-nosnippet>370</a> }
<a href=#371 id=371 data-nosnippet>371</a>
<a href=#372 id=372 data-nosnippet>372</a> <span class="kw">pub fn </span>verify_client_proof(
<a href=#373 id=373 data-nosnippet>373</a> <span class="kw-2">&amp;</span><span class="self">self</span>,
<a href=#374 id=374 data-nosnippet>374</a> auth_message: <span class="kw-2">&amp;</span>[u8],
<a href=#375 id=375 data-nosnippet>375</a> client_proof: <span class="kw-2">&amp;</span>[u8],
<a href=#376 id=376 data-nosnippet>376</a> ) -&gt; <span class="prelude-ty">Result</span>&lt;<span class="prelude-ty">Option</span>&lt;Vec&lt;u8&gt;&gt;&gt; {
<a href=#377 id=377 data-nosnippet>377</a> <span class="kw">if </span>client_proof.len() != PG_SCRAM_SHA256_KEY_LEN {
<a href=#378 id=378 data-nosnippet>378</a> <span class="kw">return </span><span class="prelude-val">Ok</span>(<span class="prelude-val">None</span>);
<a href=#379 id=379 data-nosnippet>379</a> }
<a href=#380 id=380 data-nosnippet>380</a>
<a href=#381 id=381 data-nosnippet>381</a> <span class="kw">let </span>client_signature = hmac_sha256(<span class="kw-2">&amp;</span><span class="self">self</span>.stored_key, auth_message);
<a href=#382 id=382 data-nosnippet>382</a> <span class="kw">let </span>client_key = xor(client_proof, <span class="kw-2">&amp;</span>client_signature);
<a href=#383 id=383 data-nosnippet>383</a> <span class="kw">let </span>stored_key = sha256(<span class="kw-2">&amp;</span>client_key);
<a href=#384 id=384 data-nosnippet>384</a> <span class="kw">if </span><span class="self">self</span>.stored_key.ct_eq(<span class="kw-2">&amp;</span>stored_key).into() {
<a href=#385 id=385 data-nosnippet>385</a> <span class="prelude-val">Ok</span>(<span class="prelude-val">Some</span>(hmac_sha256(<span class="kw-2">&amp;</span><span class="self">self</span>.server_key, auth_message)))
<a href=#386 id=386 data-nosnippet>386</a> } <span class="kw">else </span>{
<a href=#387 id=387 data-nosnippet>387</a> <span class="prelude-val">Ok</span>(<span class="prelude-val">None</span>)
<a href=#388 id=388 data-nosnippet>388</a> }
<a href=#389 id=389 data-nosnippet>389</a> }
<a href=#390 id=390 data-nosnippet>390</a>}
<a href=#391 id=391 data-nosnippet>391</a>
<a href=#392 id=392 data-nosnippet>392</a><span class="kw">pub fn </span>format_pg_scram_sha256_password_verifier(
<a href=#393 id=393 data-nosnippet>393</a> password: <span class="kw-2">&amp;</span>[u8],
<a href=#394 id=394 data-nosnippet>394</a> salt: <span class="kw-2">&amp;</span>[u8],
<a href=#395 id=395 data-nosnippet>395</a> iterations: u32,
<a href=#396 id=396 data-nosnippet>396</a>) -&gt; <span class="prelude-ty">Result</span>&lt;String&gt; {
<a href=#397 id=397 data-nosnippet>397</a> <span class="kw">let </span>verifier = PgScramSha256Verifier::from_password(password, salt, iterations)<span class="question-mark">?</span>;
<a href=#398 id=398 data-nosnippet>398</a> <span class="prelude-val">Ok</span>(<span class="macro">format!</span>(
<a href=#399 id=399 data-nosnippet>399</a> <span class="string">"pg_scram_sha256:{iterations}:{}:{}:{}"</span>,
<a href=#400 id=400 data-nosnippet>400</a> hex::encode(verifier.salt),
<a href=#401 id=401 data-nosnippet>401</a> hex::encode(verifier.stored_key),
<a href=#402 id=402 data-nosnippet>402</a> hex::encode(verifier.server_key)
<a href=#403 id=403 data-nosnippet>403</a> ))
<a href=#404 id=404 data-nosnippet>404</a>}
<a href=#405 id=405 data-nosnippet>405</a>
<a href=#406 id=406 data-nosnippet>406</a><span class="doccomment">/// Parses and validates an encoded PostgreSQL SCRAM-SHA-256 verifier.
<a href=#407 id=407 data-nosnippet>407</a></span><span class="kw">pub fn </span>parse_pg_scram_sha256_password_verifier(verifier: <span class="kw-2">&amp;</span>str) -&gt; <span class="prelude-ty">Result</span>&lt;PgScramSha256Verifier&gt; {
<a href=#408 id=408 data-nosnippet>408</a> <span class="kw">let </span><span class="prelude-val">Some</span>(verifier) = verifier.strip_prefix(<span class="string">"pg_scram_sha256:"</span>) <span class="kw">else </span>{
<a href=#409 id=409 data-nosnippet>409</a> <span class="kw">return </span>InvalidConfigSnafu {
<a href=#410 id=410 data-nosnippet>410</a> value: <span class="string">"pg_scram_sha256"</span>.to_string(),
<a href=#411 id=411 data-nosnippet>411</a> msg: <span class="string">"Invalid pg scram sha256 verifier format"</span>,
<a href=#412 id=412 data-nosnippet>412</a> }
<a href=#413 id=413 data-nosnippet>413</a> .fail();
<a href=#414 id=414 data-nosnippet>414</a> };
<a href=#415 id=415 data-nosnippet>415</a> <span class="kw">let </span><span class="kw-2">mut </span>parts = verifier.split(<span class="string">':'</span>);
<a href=#416 id=416 data-nosnippet>416</a> <span class="kw">let </span>(<span class="prelude-val">Some</span>(iterations), <span class="prelude-val">Some</span>(salt), <span class="prelude-val">Some</span>(stored_key), <span class="prelude-val">Some</span>(server_key), <span class="prelude-val">None</span>) = (
<a href=#417 id=417 data-nosnippet>417</a> parts.next(),
<a href=#418 id=418 data-nosnippet>418</a> parts.next(),
<a href=#419 id=419 data-nosnippet>419</a> parts.next(),
<a href=#420 id=420 data-nosnippet>420</a> parts.next(),
<a href=#421 id=421 data-nosnippet>421</a> parts.next(),
<a href=#422 id=422 data-nosnippet>422</a> ) <span class="kw">else </span>{
<a href=#423 id=423 data-nosnippet>423</a> <span class="kw">return </span>InvalidConfigSnafu {
<a href=#424 id=424 data-nosnippet>424</a> value: <span class="string">"pg_scram_sha256"</span>.to_string(),
<a href=#425 id=425 data-nosnippet>425</a> msg: <span class="string">"Invalid pg scram sha256 verifier format"</span>,
<a href=#426 id=426 data-nosnippet>426</a> }
<a href=#427 id=427 data-nosnippet>427</a> .fail();
<a href=#428 id=428 data-nosnippet>428</a> };
<a href=#429 id=429 data-nosnippet>429</a> <span class="kw">let </span>(<span class="prelude-val">Ok</span>(iterations), <span class="prelude-val">Ok</span>(salt), <span class="prelude-val">Ok</span>(stored_key), <span class="prelude-val">Ok</span>(server_key)) = (
<a href=#430 id=430 data-nosnippet>430</a> iterations.parse::&lt;u32&gt;(),
<a href=#431 id=431 data-nosnippet>431</a> hex::decode(salt),
<a href=#432 id=432 data-nosnippet>432</a> hex::decode(stored_key),
<a href=#433 id=433 data-nosnippet>433</a> hex::decode(server_key),
<a href=#434 id=434 data-nosnippet>434</a> ) <span class="kw">else </span>{
<a href=#435 id=435 data-nosnippet>435</a> <span class="kw">return </span>InvalidConfigSnafu {
<a href=#436 id=436 data-nosnippet>436</a> value: <span class="string">"pg_scram_sha256"</span>.to_string(),
<a href=#437 id=437 data-nosnippet>437</a> msg: <span class="string">"Invalid pg scram sha256 verifier encoding"</span>,
<a href=#438 id=438 data-nosnippet>438</a> }
<a href=#439 id=439 data-nosnippet>439</a> .fail();
<a href=#440 id=440 data-nosnippet>440</a> };
<a href=#441 id=441 data-nosnippet>441</a>
<a href=#442 id=442 data-nosnippet>442</a> PgScramSha256Verifier::new(iterations, salt, stored_key, server_key)
<a href=#443 id=443 data-nosnippet>443</a>}
<a href=#444 id=444 data-nosnippet>444</a>
<a href=#445 id=445 data-nosnippet>445</a><span class="kw">fn </span>pg_scram_sha256_salted_password(
<a href=#446 id=446 data-nosnippet>446</a> password: <span class="kw-2">&amp;</span>[u8],
<a href=#447 id=447 data-nosnippet>447</a> salt: <span class="kw-2">&amp;</span>[u8],
<a href=#448 id=448 data-nosnippet>448</a> iterations: u32,
<a href=#449 id=449 data-nosnippet>449</a>) -&gt; <span class="prelude-ty">Result</span>&lt;Vec&lt;u8&gt;&gt; {
<a href=#450 id=450 data-nosnippet>450</a> <span class="macro">ensure!</span>(
<a href=#451 id=451 data-nosnippet>451</a> iterations &gt; <span class="number">0 </span>&amp;&amp; iterations &lt;= MAX_PBKDF2_SHA256_ITERATIONS,
<a href=#452 id=452 data-nosnippet>452</a> IllegalParamSnafu {
<a href=#453 id=453 data-nosnippet>453</a> msg: <span class="macro">format!</span>(
<a href=#454 id=454 data-nosnippet>454</a> <span class="string">"pg_scram_sha256 iterations must be in 1..={}"</span>,
<a href=#455 id=455 data-nosnippet>455</a> MAX_PBKDF2_SHA256_ITERATIONS
<a href=#456 id=456 data-nosnippet>456</a> )
<a href=#457 id=457 data-nosnippet>457</a> }
<a href=#458 id=458 data-nosnippet>458</a> );
<a href=#459 id=459 data-nosnippet>459</a> <span class="macro">ensure!</span>(
<a href=#460 id=460 data-nosnippet>460</a> !salt.is_empty() &amp;&amp; salt.len() &lt;= MAX_PBKDF2_SHA256_SALT_LEN,
<a href=#461 id=461 data-nosnippet>461</a> IllegalParamSnafu {
<a href=#462 id=462 data-nosnippet>462</a> msg: <span class="macro">format!</span>(
<a href=#463 id=463 data-nosnippet>463</a> <span class="string">"pg_scram_sha256 salt length must be in 1..={}"</span>,
<a href=#464 id=464 data-nosnippet>464</a> MAX_PBKDF2_SHA256_SALT_LEN
<a href=#465 id=465 data-nosnippet>465</a> )
<a href=#466 id=466 data-nosnippet>466</a> }
<a href=#467 id=467 data-nosnippet>467</a> );
<a href=#468 id=468 data-nosnippet>468</a>
<a href=#469 id=469 data-nosnippet>469</a> <span class="kw">let </span>prepared_password = std::str::from_utf8(password)
<a href=#470 id=470 data-nosnippet>470</a> .ok()
<a href=#471 id=471 data-nosnippet>471</a> .and_then(|password| stringprep::saslprep(password).ok());
<a href=#472 id=472 data-nosnippet>472</a> <span class="kw">let </span>password = prepared_password
<a href=#473 id=473 data-nosnippet>473</a> .as_deref()
<a href=#474 id=474 data-nosnippet>474</a> .map(str::as_bytes)
<a href=#475 id=475 data-nosnippet>475</a> .unwrap_or(password);
<a href=#476 id=476 data-nosnippet>476</a>
<a href=#477 id=477 data-nosnippet>477</a> <span class="kw">let </span><span class="kw-2">mut </span>salted_password = [<span class="number">0u8</span>; PG_SCRAM_SHA256_KEY_LEN];
<a href=#478 id=478 data-nosnippet>478</a> pbkdf2_hmac::&lt;Sha256&gt;(password, salt, iterations, <span class="kw-2">&amp;mut </span>salted_password);
<a href=#479 id=479 data-nosnippet>479</a> <span class="prelude-val">Ok</span>(salted_password.to_vec())
<a href=#480 id=480 data-nosnippet>480</a>}
<a href=#481 id=481 data-nosnippet>481</a>
<a href=#482 id=482 data-nosnippet>482</a><span class="kw">fn </span>hmac_sha256(key: <span class="kw-2">&amp;</span>[u8], msg: <span class="kw-2">&amp;</span>[u8]) -&gt; Vec&lt;u8&gt; {
<a href=#483 id=483 data-nosnippet>483</a> <span class="kw">let </span><span class="kw-2">mut </span>mac = HmacSha256::new_from_slice(key).expect(<span class="string">"HMAC accepts any key length"</span>);
<a href=#484 id=484 data-nosnippet>484</a> mac.update(msg);
<a href=#485 id=485 data-nosnippet>485</a> mac.finalize().into_bytes().to_vec()
<a href=#486 id=486 data-nosnippet>486</a>}
<a href=#487 id=487 data-nosnippet>487</a>
<a href=#488 id=488 data-nosnippet>488</a><span class="kw">fn </span>sha256(data: <span class="kw-2">&amp;</span>[u8]) -&gt; Vec&lt;u8&gt; {
<a href=#489 id=489 data-nosnippet>489</a> <span class="kw">let </span><span class="kw-2">mut </span>hasher = Sha256::new();
<a href=#490 id=490 data-nosnippet>490</a> hasher.update(data);
<a href=#491 id=491 data-nosnippet>491</a> hasher.finalize().to_vec()
<a href=#492 id=492 data-nosnippet>492</a>}
<a href=#493 id=493 data-nosnippet>493</a>
<a href=#494 id=494 data-nosnippet>494</a><span class="kw">fn </span>xor(lhs: <span class="kw-2">&amp;</span>[u8], rhs: <span class="kw-2">&amp;</span>[u8]) -&gt; Vec&lt;u8&gt; {
<a href=#495 id=495 data-nosnippet>495</a> lhs.iter().zip(rhs).map(|(l, r)| l ^ r).collect()
<a href=#496 id=496 data-nosnippet>496</a>}
<a href=#497 id=497 data-nosnippet>497</a>
<a href=#498 id=498 data-nosnippet>498</a><span class="kw">fn </span>sha1_two(input_1: <span class="kw-2">&amp;</span>[u8], input_2: <span class="kw-2">&amp;</span>[u8]) -&gt; Vec&lt;u8&gt; {
<a href=#499 id=499 data-nosnippet>499</a> <span class="kw">let </span><span class="kw-2">mut </span>hasher = Sha1::new();
<a href=#500 id=500 data-nosnippet>500</a> hasher.update(input_1);
<a href=#501 id=501 data-nosnippet>501</a> hasher.update(input_2);
<a href=#502 id=502 data-nosnippet>502</a> hasher.finalize().to_vec()
<a href=#503 id=503 data-nosnippet>503</a>}
<a href=#504 id=504 data-nosnippet>504</a>
<a href=#505 id=505 data-nosnippet>505</a><span class="kw">fn </span>sha1_one(data: <span class="kw-2">&amp;</span>[u8]) -&gt; Vec&lt;u8&gt; {
<a href=#506 id=506 data-nosnippet>506</a> <span class="kw">let </span><span class="kw-2">mut </span>hasher = Sha1::new();
<a href=#507 id=507 data-nosnippet>507</a> hasher.update(data);
<a href=#508 id=508 data-nosnippet>508</a> hasher.finalize().to_vec()
<a href=#509 id=509 data-nosnippet>509</a>}
<a href=#510 id=510 data-nosnippet>510</a>
<a href=#511 id=511 data-nosnippet>511</a><span class="kw">fn </span>double_sha1(data: <span class="kw-2">&amp;</span>[u8]) -&gt; Vec&lt;u8&gt; {
<a href=#512 id=512 data-nosnippet>512</a> sha1_one(<span class="kw-2">&amp;</span>sha1_one(data))
<a href=#513 id=513 data-nosnippet>513</a>}
<a href=#514 id=514 data-nosnippet>514</a>
<a href=#515 id=515 data-nosnippet>515</a><span class="attr">#[cfg(test)]
<a href=#516 id=516 data-nosnippet>516</a></span><span class="kw">mod </span>tests {
<a href=#517 id=517 data-nosnippet>517</a> <span class="kw">use </span>super::<span class="kw-2">*</span>;
<a href=#518 id=518 data-nosnippet>518</a>
<a href=#519 id=519 data-nosnippet>519</a> <span class="kw">fn </span>mysql_native_password_auth_data(password: <span class="kw-2">&amp;</span>[u8], salt: <span class="kw-2">&amp;</span>[u8]) -&gt; Vec&lt;u8&gt; {
<a href=#520 id=520 data-nosnippet>520</a> <span class="kw">let </span>hash_stage_1 = sha1_one(password);
<a href=#521 id=521 data-nosnippet>521</a> <span class="kw">let </span>hash_stage_2 = mysql_native_password_hash(password);
<a href=#522 id=522 data-nosnippet>522</a> <span class="kw">let </span>scramble = sha1_two(salt, <span class="kw-2">&amp;</span>hash_stage_2);
<a href=#523 id=523 data-nosnippet>523</a> hash_stage_1
<a href=#524 id=524 data-nosnippet>524</a> .iter()
<a href=#525 id=525 data-nosnippet>525</a> .zip(scramble)
<a href=#526 id=526 data-nosnippet>526</a> .map(|(lhs, rhs)| lhs ^ rhs)
<a href=#527 id=527 data-nosnippet>527</a> .collect()
<a href=#528 id=528 data-nosnippet>528</a> }
<a href=#529 id=529 data-nosnippet>529</a>
<a href=#530 id=530 data-nosnippet>530</a> <span class="attr">#[test]
<a href=#531 id=531 data-nosnippet>531</a> </span><span class="kw">fn </span>test_sha() {
<a href=#532 id=532 data-nosnippet>532</a> <span class="kw">let </span>sha_1_answer: Vec&lt;u8&gt; = <span class="macro">vec!</span>[
<a href=#533 id=533 data-nosnippet>533</a> <span class="number">124</span>, <span class="number">74</span>, <span class="number">141</span>, <span class="number">9</span>, <span class="number">202</span>, <span class="number">55</span>, <span class="number">98</span>, <span class="number">175</span>, <span class="number">97</span>, <span class="number">229</span>, <span class="number">149</span>, <span class="number">32</span>, <span class="number">148</span>, <span class="number">61</span>, <span class="number">194</span>, <span class="number">100</span>, <span class="number">148</span>, <span class="number">248</span>, <span class="number">148</span>,
<a href=#534 id=534 data-nosnippet>534</a> <span class="number">27</span>,
<a href=#535 id=535 data-nosnippet>535</a> ];
<a href=#536 id=536 data-nosnippet>536</a> <span class="kw">let </span>sha_1 = sha1_one(<span class="string">"123456"</span>.as_bytes());
<a href=#537 id=537 data-nosnippet>537</a> <span class="macro">assert_eq!</span>(sha_1, sha_1_answer);
<a href=#538 id=538 data-nosnippet>538</a>
<a href=#539 id=539 data-nosnippet>539</a> <span class="kw">let </span>double_sha1_answer: Vec&lt;u8&gt; = <span class="macro">vec!</span>[
<a href=#540 id=540 data-nosnippet>540</a> <span class="number">107</span>, <span class="number">180</span>, <span class="number">131</span>, <span class="number">126</span>, <span class="number">183</span>, <span class="number">67</span>, <span class="number">41</span>, <span class="number">16</span>, <span class="number">94</span>, <span class="number">228</span>, <span class="number">86</span>, <span class="number">141</span>, <span class="number">218</span>, <span class="number">125</span>, <span class="number">198</span>, <span class="number">126</span>, <span class="number">210</span>, <span class="number">202</span>,
<a href=#541 id=541 data-nosnippet>541</a> <span class="number">42</span>, <span class="number">217</span>,
<a href=#542 id=542 data-nosnippet>542</a> ];
<a href=#543 id=543 data-nosnippet>543</a> <span class="kw">let </span>double_sha1 = double_sha1(<span class="string">"123456"</span>.as_bytes());
<a href=#544 id=544 data-nosnippet>544</a> <span class="macro">assert_eq!</span>(double_sha1, double_sha1_answer);
<a href=#545 id=545 data-nosnippet>545</a>
<a href=#546 id=546 data-nosnippet>546</a> <span class="kw">let </span>sha1_2_answer: Vec&lt;u8&gt; = <span class="macro">vec!</span>[
<a href=#547 id=547 data-nosnippet>547</a> <span class="number">132</span>, <span class="number">115</span>, <span class="number">215</span>, <span class="number">211</span>, <span class="number">99</span>, <span class="number">186</span>, <span class="number">164</span>, <span class="number">206</span>, <span class="number">168</span>, <span class="number">152</span>, <span class="number">217</span>, <span class="number">192</span>, <span class="number">117</span>, <span class="number">47</span>, <span class="number">240</span>, <span class="number">252</span>, <span class="number">142</span>, <span class="number">244</span>,
<a href=#548 id=548 data-nosnippet>548</a> <span class="number">37</span>, <span class="number">204</span>,
<a href=#549 id=549 data-nosnippet>549</a> ];
<a href=#550 id=550 data-nosnippet>550</a> <span class="kw">let </span>sha1_2 = sha1_two(<span class="string">"123456"</span>.as_bytes(), <span class="string">"654321"</span>.as_bytes());
<a href=#551 id=551 data-nosnippet>551</a> <span class="macro">assert_eq!</span>(sha1_2, sha1_2_answer);
<a href=#552 id=552 data-nosnippet>552</a> }
<a href=#553 id=553 data-nosnippet>553</a>
<a href=#554 id=554 data-nosnippet>554</a> <span class="attr">#[test]
<a href=#555 id=555 data-nosnippet>555</a> </span><span class="kw">fn </span>test_format_mysql_native_password_verifier() {
<a href=#556 id=556 data-nosnippet>556</a> <span class="kw">let </span>verifier = format_mysql_native_password_verifier(<span class="string">"123456"</span>.as_bytes());
<a href=#557 id=557 data-nosnippet>557</a> <span class="macro">assert_eq!</span>(
<a href=#558 id=558 data-nosnippet>558</a> <span class="string">"mysql_native_password:6bb4837eb74329105ee4568dda7dc67ed2ca2ad9"</span>,
<a href=#559 id=559 data-nosnippet>559</a> verifier
<a href=#560 id=560 data-nosnippet>560</a> );
<a href=#561 id=561 data-nosnippet>561</a> <span class="macro">assert_eq!</span>(
<a href=#562 id=562 data-nosnippet>562</a> mysql_native_password_hash(<span class="string">b"123456"</span>),
<a href=#563 id=563 data-nosnippet>563</a> parse_mysql_native_password_verifier(<span class="kw-2">&amp;</span>verifier).unwrap()
<a href=#564 id=564 data-nosnippet>564</a> );
<a href=#565 id=565 data-nosnippet>565</a> <span class="macro">assert!</span>(parse_mysql_native_password_verifier(<span class="string">"mysql_native_password:00"</span>).is_err());
<a href=#566 id=566 data-nosnippet>566</a>
<a href=#567 id=567 data-nosnippet>567</a> <span class="kw">let </span>salt = <span class="string">b"01234567890123456789"</span>;
<a href=#568 id=568 data-nosnippet>568</a> <span class="kw">let </span>auth_data = mysql_native_password_auth_data(<span class="string">b"123456"</span>, salt);
<a href=#569 id=569 data-nosnippet>569</a> auth_mysql_with_verifier(<span class="kw-2">&amp;</span>auth_data, salt, <span class="string">"greptime"</span>, <span class="kw-2">&amp;</span>verifier).unwrap();
<a href=#570 id=570 data-nosnippet>570</a> <span class="macro">assert!</span>(
<a href=#571 id=571 data-nosnippet>571</a> auth_mysql_with_verifier(
<a href=#572 id=572 data-nosnippet>572</a> <span class="kw-2">&amp;</span>auth_data,
<a href=#573 id=573 data-nosnippet>573</a> salt,
<a href=#574 id=574 data-nosnippet>574</a> <span class="string">"greptime"</span>,
<a href=#575 id=575 data-nosnippet>575</a> <span class="kw-2">&amp;</span>format_mysql_native_password_verifier(<span class="string">b"wrong"</span>)
<a href=#576 id=576 data-nosnippet>576</a> )
<a href=#577 id=577 data-nosnippet>577</a> .is_err()
<a href=#578 id=578 data-nosnippet>578</a> );
<a href=#579 id=579 data-nosnippet>579</a> }
<a href=#580 id=580 data-nosnippet>580</a>
<a href=#581 id=581 data-nosnippet>581</a> <span class="attr">#[test]
<a href=#582 id=582 data-nosnippet>582</a> </span><span class="kw">fn </span>test_format_pbkdf2_sha256_password_verifier() {
<a href=#583 id=583 data-nosnippet>583</a> <span class="kw">let </span>verifier =
<a href=#584 id=584 data-nosnippet>584</a> format_pbkdf2_sha256_password_verifier(<span class="string">"password"</span>.as_bytes(), <span class="string">b"salt"</span>, <span class="number">4096</span>).unwrap();
<a href=#585 id=585 data-nosnippet>585</a> <span class="macro">assert_eq!</span>(
<a href=#586 id=586 data-nosnippet>586</a> <span class="string">"pbkdf2_sha256:4096:73616c74:c5e478d59288c841aa530db6845c4c8d962893a001ce4e11a4963873aa98134a"</span>,
<a href=#587 id=587 data-nosnippet>587</a> verifier
<a href=#588 id=588 data-nosnippet>588</a> );
<a href=#589 id=589 data-nosnippet>589</a>
<a href=#590 id=590 data-nosnippet>590</a> <span class="macro">assert!</span>(format_pbkdf2_sha256_password_verifier(<span class="string">b"password"</span>, <span class="string">b""</span>, <span class="number">4096</span>).is_err());
<a href=#591 id=591 data-nosnippet>591</a> <span class="macro">assert!</span>(format_pbkdf2_sha256_password_verifier(<span class="string">b"password"</span>, <span class="string">b"salt"</span>, <span class="number">0</span>).is_err());
<a href=#592 id=592 data-nosnippet>592</a> <span class="macro">assert!</span>(
<a href=#593 id=593 data-nosnippet>593</a> format_pbkdf2_sha256_password_verifier(
<a href=#594 id=594 data-nosnippet>594</a> <span class="string">b"password"</span>,
<a href=#595 id=595 data-nosnippet>595</a> <span class="string">b"salt"</span>,
<a href=#596 id=596 data-nosnippet>596</a> MAX_PBKDF2_SHA256_ITERATIONS + <span class="number">1</span>,
<a href=#597 id=597 data-nosnippet>597</a> )
<a href=#598 id=598 data-nosnippet>598</a> .is_err()
<a href=#599 id=599 data-nosnippet>599</a> );
<a href=#600 id=600 data-nosnippet>600</a> }
<a href=#601 id=601 data-nosnippet>601</a>
<a href=#602 id=602 data-nosnippet>602</a> <span class="attr">#[test]
<a href=#603 id=603 data-nosnippet>603</a> </span><span class="kw">fn </span>test_format_pg_scram_sha256_password_verifier() {
<a href=#604 id=604 data-nosnippet>604</a> <span class="kw">let </span>verifier =
<a href=#605 id=605 data-nosnippet>605</a> format_pg_scram_sha256_password_verifier(<span class="string">"password"</span>.as_bytes(), <span class="string">b"salt"</span>, <span class="number">4096</span>).unwrap();
<a href=#606 id=606 data-nosnippet>606</a> <span class="macro">assert_eq!</span>(
<a href=#607 id=607 data-nosnippet>607</a> <span class="string">"pg_scram_sha256:4096:73616c74:945e1c466fc9932efadc23781edc5d1e78d5e10f005933652af1a6105154f084:b9bf0e811b1fb6793671c0cc3adedf7c75cd72291191092ad65878c5a02aad2c"</span>,
<a href=#608 id=608 data-nosnippet>608</a> verifier
<a href=#609 id=609 data-nosnippet>609</a> );
<a href=#610 id=610 data-nosnippet>610</a> <span class="kw">let </span>parsed = parse_pg_scram_sha256_password_verifier(<span class="kw-2">&amp;</span>verifier).unwrap();
<a href=#611 id=611 data-nosnippet>611</a> <span class="macro">assert_eq!</span>(<span class="number">4096</span>, parsed.iterations());
<a href=#612 id=612 data-nosnippet>612</a> <span class="macro">assert_eq!</span>(<span class="string">b"salt"</span>, parsed.salt());
<a href=#613 id=613 data-nosnippet>613</a> <span class="macro">assert!</span>(parse_pg_scram_sha256_password_verifier(<span class="string">"pg_scram_sha256:bad"</span>).is_err());
<a href=#614 id=614 data-nosnippet>614</a> }
<a href=#615 id=615 data-nosnippet>615</a>
<a href=#616 id=616 data-nosnippet>616</a> <span class="attr">#[test]
<a href=#617 id=617 data-nosnippet>617</a> </span><span class="kw">fn </span>test_pg_scram_sha256_applies_saslprep() {
<a href=#618 id=618 data-nosnippet>618</a> <span class="kw">let </span>normalized = PgScramSha256Verifier::from_password(<span class="string">b"pass word"</span>, <span class="string">b"salt"</span>, <span class="number">4096</span>).unwrap();
<a href=#619 id=619 data-nosnippet>619</a> <span class="kw">let </span>non_breaking_space =
<a href=#620 id=620 data-nosnippet>620</a> PgScramSha256Verifier::from_password(<span class="string">"pass\u{00a0}word"</span>.as_bytes(), <span class="string">b"salt"</span>, <span class="number">4096</span>)
<a href=#621 id=621 data-nosnippet>621</a> .unwrap();
<a href=#622 id=622 data-nosnippet>622</a>
<a href=#623 id=623 data-nosnippet>623</a> <span class="macro">assert_eq!</span>(normalized, non_breaking_space);
<a href=#624 id=624 data-nosnippet>624</a> <span class="macro">assert!</span>(
<a href=#625 id=625 data-nosnippet>625</a> non_breaking_space
<a href=#626 id=626 data-nosnippet>626</a> .verify_plain_password(<span class="string">b"pass word"</span>)
<a href=#627 id=627 data-nosnippet>627</a> .unwrap()
<a href=#628 id=628 data-nosnippet>628</a> );
<a href=#629 id=629 data-nosnippet>629</a> }
<a href=#630 id=630 data-nosnippet>630</a>
<a href=#631 id=631 data-nosnippet>631</a> <span class="attr">#[test]
<a href=#632 id=632 data-nosnippet>632</a> </span><span class="kw">fn </span>test_pg_scram_sha256_uses_original_bytes_when_saslprep_is_not_possible() {
<a href=#633 id=633 data-nosnippet>633</a> <span class="kw">let </span>invalid_utf8 = <span class="string">b"password\xff"</span>;
<a href=#634 id=634 data-nosnippet>634</a> <span class="kw">let </span>prohibited = <span class="string">b"password\x07"</span>;
<a href=#635 id=635 data-nosnippet>635</a>
<a href=#636 id=636 data-nosnippet>636</a> <span class="kw">for </span>password <span class="kw">in </span>[invalid_utf8.as_slice(), prohibited.as_slice()] {
<a href=#637 id=637 data-nosnippet>637</a> <span class="kw">let </span>verifier = PgScramSha256Verifier::from_password(password, <span class="string">b"salt"</span>, <span class="number">4096</span>).unwrap();
<a href=#638 id=638 data-nosnippet>638</a> <span class="macro">assert!</span>(verifier.verify_plain_password(password).unwrap());
<a href=#639 id=639 data-nosnippet>639</a> }
<a href=#640 id=640 data-nosnippet>640</a> }
<a href=#641 id=641 data-nosnippet>641</a>
<a href=#642 id=642 data-nosnippet>642</a> <span class="attr">#[test]
<a href=#643 id=643 data-nosnippet>643</a> </span><span class="kw">fn </span>test_mock_verifier_is_stable_per_username() {
<a href=#644 id=644 data-nosnippet>644</a> <span class="kw">let </span>alice = PgScramSha256Verifier::mock_for_unknown_user(<span class="string">b"alice"</span>);
<a href=#645 id=645 data-nosnippet>645</a> <span class="kw">let </span>alice_again = PgScramSha256Verifier::mock_for_unknown_user(<span class="string">b"alice"</span>);
<a href=#646 id=646 data-nosnippet>646</a> <span class="kw">let </span>bob = PgScramSha256Verifier::mock_for_unknown_user(<span class="string">b"bob"</span>);
<a href=#647 id=647 data-nosnippet>647</a>
<a href=#648 id=648 data-nosnippet>648</a> <span class="comment">// Same username must yield the same salt and iterations across reconnects,
<a href=#649 id=649 data-nosnippet>649</a> // otherwise the SCRAM server-first message leaks user (non-)existence.
<a href=#650 id=650 data-nosnippet>650</a> </span><span class="macro">assert_eq!</span>(alice.salt(), alice_again.salt());
<a href=#651 id=651 data-nosnippet>651</a> <span class="macro">assert_ne!</span>(alice.salt(), bob.salt());
<a href=#652 id=652 data-nosnippet>652</a> <span class="macro">assert_eq!</span>(alice.iterations(), DEFAULT_PBKDF2_SHA256_ITERATIONS);
<a href=#653 id=653 data-nosnippet>653</a> <span class="macro">assert_eq!</span>(alice.salt().len(), DEFAULT_PBKDF2_SHA256_SALT_LEN);
<a href=#654 id=654 data-nosnippet>654</a>
<a href=#655 id=655 data-nosnippet>655</a> <span class="comment">// The mock verifier must never accept a client proof.
<a href=#656 id=656 data-nosnippet>656</a> </span><span class="macro">assert!</span>(
<a href=#657 id=657 data-nosnippet>657</a> alice
<a href=#658 id=658 data-nosnippet>658</a> .verify_client_proof(<span class="string">b"auth-message"</span>, <span class="kw-2">&amp;</span>[<span class="number">0u8</span>; PG_SCRAM_SHA256_KEY_LEN])
<a href=#659 id=659 data-nosnippet>659</a> .unwrap()
<a href=#660 id=660 data-nosnippet>660</a> .is_none()
<a href=#661 id=661 data-nosnippet>661</a> );
<a href=#662 id=662 data-nosnippet>662</a> }
<a href=#663 id=663 data-nosnippet>663</a>}
</code></pre></div></section></main></body></html>