java.lang.Object
net.i2p.i2pcontrol.security.SecurityManager
public class SecurityManagerextends Object
Manage the password storing for I2PControl.

  • Field Details

    • DEFAULT_AUTH_PASSWORD

      public static final String DEFAULT_AUTH_PASSWORD
      Seed password stored when no auth.password has been configured yet.
      See Also:

    • authTokens

      private final HashMap<String, AuthToken> authTokens
      Live tokens, by token string.

    • timer

      private final SimpleTimer2.TimedEvent timer
      Expires the tokens as they age out.

    • _log

      private final Log _log
      Logger for this class.

    • _conf

      private final ConfigurationManager _conf
      Supplies the configured passwords.

    • _context

      private final I2PAppContext _context
      The context the manager runs in.

  • Constructor Details

    • SecurityManager

      public SecurityManager(I2PAppContext ctx, KeyStoreProvider ksp, ConfigurationManager conf)
      Create the security manager and start the sweeper that expires auth tokens; no token store is loaded here.
      Parameters:
      ctx - the application context supplying the logger, random source and SHA-256 generator
      ksp - may be null (if webapp); currently unused, kept for the API
      conf - the configuration manager holding the persisted salt and password hash

  • Method Details

    • stopTimedEvents

      public void stopTimedEvents()
      Stop the periodic auth token cleanup timer and clear all tokens

    • getPasswdHash

      public String getPasswdHash(String pwd)
      Hash pwd with using BCrypt with the default salt.
      Parameters:
      pwd - the plaintext password to hash; it is combined with the persisted BCrypt salt, never stored in the clear
      Returns:
      BCrypt hash of salt and input string

    • getSavedPasswdHash

      private String getSavedPasswdHash()
      Get saved password hash. Stores if not previously set.
      Returns:
      BCrypt hash of salt and password

    • getHash

      public String getHash(String string)
      Hash input one time with SHA-256, return Base64 encoded string.
      Parameters:
      string - the value to hash, read as UTF-8 bytes before hashing
      Returns:
      Base64 encoded string

    • isValid

      public boolean isValid(String pwd)
      Is this password correct?
      Parameters:
      pwd - the plaintext password to compare against the stored BCrypt hash
      Returns:
      true if password is valid.

    • isDefaultPasswordValid

      public boolean isDefaultPasswordValid()
      Is this password correct?
      Returns:
      true if password is valid.

    • validatePasswd

      public AuthToken validatePasswd(String pwd)
      Add a Authentication Token if the provided password is valid. The token will be valid for one day.
      Parameters:
      pwd - the plaintext password to check; if it matches, a one-day token is issued
      Returns:
      AuthToken if password is valid. If password is invalid null will be returned.

    • setPasswd

      public boolean setPasswd(String newPasswd)
      Set new password. Old tokens will NOT remain valid, to encourage the new password being tested.
      Parameters:
      newPasswd - the replacement plaintext password, hashed and stored through the same BCrypt path as the existing one
      Returns:
      Returns true if a new password was set.

    • verifyToken

      public void verifyToken(String tokenID) throws InvalidAuthTokenException, ExpiredAuthTokenException
      Checks whether the AuthToken with the given ID exists and if it does whether is has expired.
      Parameters:
      tokenID - - The token to validate
      Throws:
      InvalidAuthTokenException - if no token with that ID is known
      ExpiredAuthTokenException - if the token is known but past its expiry, in which case it is also removed from the store