RouterPasswordManager

java.lang.Object

net.i2p.util.PasswordManager

net.i2p.router.util.RouterPasswordManager

Direct Known Subclasses:: ConsolePasswordManager

public class RouterPasswordManagerextends PasswordManager

Comprehensive password management for router configuration with migration support.

Manages both plaintext and salted/hashed password storage in router configuration. Provides migration utilities for transitioning from legacy plaintext passwords to modern hashed authentication.

Supports multiple authentication realms including i2cp, routerconsole, and keystore-based authentication. Includes validation, migration, and obfuscation utilities for secure password handling.

Handles password migration between different storage formats while maintaining backward compatibility and security best practices. Includes comprehensive logging and error handling for authentication operations.

Field Summary
Fields
Modifier and Type
Field
Description
protected final RouterContext
_context
The router context.
private static final String
PROP_I2CP_NEW
Property the migrated I2CP credentials live under.
private static final String
PROP_I2CP_OLD_PW
Old I2CP password property, migrated to per-destination properties.
private static final String
PROP_I2CP_OLD_USER
Old I2CP username property, migrated to the new store.
private static final String
PROP_MIGRATED
Property marking the old passwords as already moved.
Fields inherited from class PasswordManager
PROP_B64, PROP_MD5, PROP_PW, PROP_SHASH, SALT_LENGTH, SHASH_LENGTH
Modifier and Type
Field
Description
protected static final String
PROP_B64
Stored obfuscated as b64 of the UTF-8 bytes.
protected static final String
PROP_MD5
Stored as the hex of the MD5 hash of the UTF-8 bytes.
protected static final String
PROP_PW
Stored as plain text.
protected static final String
PROP_SHASH
Stored as the b64 of the 16 byte salt + the 32 byte hash of the UTF-8 bytes.
protected static final int
SALT_LENGTH
Length of the random salt prefixed to each stored hash, in bytes.
protected static final int
SHASH_LENGTH
Stored hash length in bytes (salt + session key, 48).
Constructor Summary
Constructors
Constructor
Description
RouterPasswordManager(RouterContext ctx)
Password manager for the given router context.
Method Summary
Public Methods
Modifier and Type
Method
Description
protected boolean
migrate()
Migrate from plaintext to salt/hash.
boolean
remove(String realm, String user)
Remove password, any kind.
boolean
save(String realm, String user, String pw)
Same as saveHash(String, String, String).
boolean
saveB64(String realm, String user, String pw)
This will fail if if user contains '#' or '=' or starts with '!'.
boolean
saveHash(String realm, String user, String pw)
This will fail if user contains '#' or '=' or starts with '!'.
boolean
savePlain(String realm, String user, String pw)
This will fail if pw contains a '#' or if user contains '#' or '=' or starts with '!'.
Methods inherited from class PasswordManager
check, checkB64, checkHash, checkHash, checkPlain, createHash, get, getB64, getPlain, md5Hex, md5Hex, md5Sum, sha256Hex, sha256Hex, sha256Sum
Modifier and Type
Method
Description
boolean
check(String realm, String user, String pw)
Checks both plaintext and hash.
boolean
checkB64(String realm, String user, String pw)
Checks a password stored base64-encoded.
boolean
checkHash(String shash, String pw)
Check pw against b64 salt+hash, as generated by PasswordManager.createHash(String).
boolean
checkHash(String realm, String user, String pw)
With random salt.
boolean
checkPlain(String realm, String user, String pw)
Checks a password stored in plaintext.
String
createHash(String pw)
Create a salt+hash, to be saved and verified later by verifyHash().
String
get(String realm, String user)
Either plain or b64.
String
getB64(String realm, String user)
Retrieve the base64-stored password.
String
getPlain(String realm, String user)
Retrieve the plaintext-stored password.
static String
md5Hex(String fullpw)
Straight MD5, no salt Will return the MD5 sum of the data, compatible with Jetty and RFC 2617.
static String
md5Hex(String subrealm, String user, String pw)
Straight MD5, no salt Will return the MD5 sum of "user:subrealm:pw", compatible with Jetty and RFC 2617.
static byte[]
md5Sum(byte[] data)
Standard MD5 checksum.
static String
sha256Hex(String fullpw)
Return the SHA256 sum of the data, compatible with RFC 7616.
static String
sha256Hex(String subrealm, String user, String pw)
Straight SHA256, no salt Will return the SHA256 sum of "user:subrealm:pw", compatible with RFC 7616.
static byte[]
sha256Sum(byte[] data)
Standard SHA-256 checksum.
Methods inherited from class Object
clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details
- _context
  protected final RouterContext _context
  The router context.
- PROP_MIGRATED
  private static final String PROP_MIGRATED
  Property marking the old passwords as already moved.
  See Also:
  Constant Field Values
- PROP_I2CP_OLD_PW
  private static final String PROP_I2CP_OLD_PW
  Old I2CP password property, migrated to per-destination properties.
  See Also:
  Constant Field Values
- PROP_I2CP_OLD_USER
  private static final String PROP_I2CP_OLD_USER
  Old I2CP username property, migrated to the new store.
  See Also:
  Constant Field Values
- PROP_I2CP_NEW
  private static final String PROP_I2CP_NEW
  Property the migrated I2CP credentials live under.
  See Also:
  Constant Field Values
Constructor Details
- RouterPasswordManager
  public RouterPasswordManager(RouterContext ctx)
  Password manager for the given router context.
  Parameters:
  ctx - the router context
Method Details
- migrate
  protected boolean migrate()
  Migrate from plaintext to salt/hash.
  Returns:
  success or nothing to migrate
- save
  public boolean save(String realm, String user, String pw)
  Same as saveHash(String, String, String).
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  true if the hashed entry was written to router.config
- savePlain
  public boolean savePlain(String realm, String user, String pw)
  This will fail if pw contains a '#' or if user contains '#' or '=' or starts with '!'.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  true if the plain entry was written to router.config
- saveB64
  public boolean saveB64(String realm, String user, String pw)
  This will fail if if user contains '#' or '=' or starts with '!'.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  true if the base64 entry was written to router.config
- saveHash
  public boolean saveHash(String realm, String user, String pw)
  This will fail if user contains '#' or '=' or starts with '!'.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  true if the hashed entry was written to router.config
- remove
  public boolean remove(String realm, String user)
  Remove password, any kind.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  Returns:
  true if every stored password form for the prefix was deleted

Field Summary

Fields inherited from class PasswordManager

Constructor Summary

Method Summary

Methods inherited from class PasswordManager

Methods inherited from class Object

Field Details

_context

PROP_MIGRATED

PROP_I2CP_OLD_PW

PROP_I2CP_OLD_USER

PROP_I2CP_NEW

Constructor Details

Method Details

migrate

save

savePlain

saveB64

saveHash

remove