RouterPasswordManager

java.lang.Object

net.i2p.util.PasswordManager

net.i2p.router.util.RouterPasswordManager

Direct Known Subclasses:: ConsolePasswordManager

public class RouterPasswordManagerextends PasswordManager

Comprehensive password management for router configuration with migration support.

Manages both plaintext and salted/hashed password storage in router configuration. Provides migration utilities for transitioning from legacy plaintext passwords to modern hashed authentication.

Supports multiple authentication realms including i2cp, routerconsole, and keystore-based authentication. Includes validation, migration, and obfuscation utilities for secure password handling.

Handles password migration between different storage formats while maintaining backward compatibility and security best practices. Includes comprehensive logging and error handling for authentication operations.

Field Summary
Fields
Modifier and Type
Field
Description
protected final RouterContext
_context
The router context.
Fields inherited from class PasswordManager
PROP_B64, PROP_MD5, PROP_PW, PROP_SHASH, SALT_LENGTH, SHASH_LENGTH
Modifier and Type
Field
Description
protected static final String
PROP_B64
Stored obfuscated as b64 of the UTF-8 bytes.
protected static final String
PROP_MD5
Stored as the hex of the MD5 hash of the UTF-8 bytes.
protected static final String
PROP_PW
Stored as plain text.
protected static final String
PROP_SHASH
Stored as the b64 of the 16 byte salt + the 32 byte hash of the UTF-8 bytes.
protected static final int
SALT_LENGTH
Length of the random salt prefixed to each stored hash, in bytes.
protected static final int
SHASH_LENGTH
Stored hash length in bytes (salt + session key, 48).
Constructor Summary
Constructors
Constructor
Description
RouterPasswordManager(RouterContext ctx)
Password manager for the given router context.
Method Summary
All Methods
Modifier and Type
Method
Description
protected boolean
migrate()
Migrate from plaintext to salt/hash.
boolean
remove(String realm, String user)
Remove password, any kind.
boolean
save(String realm, String user, String pw)
Same as saveHash().
boolean
saveB64(String realm, String user, String pw)
This will fail if if user contains '#' or '=' or starts with '!'.
boolean
saveHash(String realm, String user, String pw)
This will fail if user contains '#' or '=' or starts with '!'.
boolean
savePlain(String realm, String user, String pw)
This will fail if pw contains a '#' or if user contains '#' or '=' or starts with '!'.
Methods inherited from class PasswordManager
check, checkB64, checkHash, checkHash, checkPlain, createHash, get, getB64, getPlain, md5Hex, md5Hex, md5Sum, sha256Hex, sha256Hex, sha256Sum
Modifier and Type
Method
Description
boolean
check(String realm, String user, String pw)
Checks both plaintext and hash.
boolean
checkB64(String realm, String user, String pw)
Checks a password stored base64-encoded.
boolean
checkHash(String shash, String pw)
Check pw against b64 salt+hash, as generated by createHash().
boolean
checkHash(String realm, String user, String pw)
With random salt.
boolean
checkPlain(String realm, String user, String pw)
Checks a password stored in plaintext.
String
createHash(String pw)
Create a salt+hash, to be saved and verified later by verifyHash().
String
get(String realm, String user)
Either plain or b64.
String
getB64(String realm, String user)
Retrieve the base64-stored password.
String
getPlain(String realm, String user)
Retrieve the plaintext-stored password.
static String
md5Hex(String fullpw)
Straight MD5, no salt Will return the MD5 sum of the data, compatible with Jetty and RFC 2617.
static String
md5Hex(String subrealm, String user, String pw)
Straight MD5, no salt Will return the MD5 sum of "user:subrealm:pw", compatible with Jetty and RFC 2617.
static byte[]
md5Sum(byte[] data)
Standard MD5 checksum.
static String
sha256Hex(String fullpw)
Return the SHA256 sum of the data, compatible with RFC 7616.
static String
sha256Hex(String subrealm, String user, String pw)
Straight SHA256, no salt Will return the SHA256 sum of "user:subrealm:pw", compatible with RFC 7616.
static byte[]
sha256Sum(byte[] data)
Standard SHA-256 checksum.
Methods inherited from class Object
clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details
- _context
  protected final RouterContext _context
  The router context.
Constructor Details
- RouterPasswordManager
  public RouterPasswordManager(RouterContext ctx)
  Password manager for the given router context.
  Parameters:
  ctx - the router context
Method Details
- migrate
  protected boolean migrate()
  Migrate from plaintext to salt/hash.
  Returns:
  success or nothing to migrate
- save
  public boolean save(String realm, String user, String pw)
  Same as saveHash().
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  true if the hashed entry was written to router.config
- savePlain
  public boolean savePlain(String realm, String user, String pw)
  This will fail if pw contains a '#' or if user contains '#' or '=' or starts with '!'.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  true if the plain entry was written to router.config
- saveB64
  public boolean saveB64(String realm, String user, String pw)
  This will fail if if user contains '#' or '=' or starts with '!'.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  true if the base64 entry was written to router.config
- saveHash
  public boolean saveHash(String realm, String user, String pw)
  This will fail if user contains '#' or '=' or starts with '!'.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  true if the hashed entry was written to router.config
- remove
  public boolean remove(String realm, String user)
  Remove password, any kind.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  user - null or "" for no user, already trimmed
  Returns:
  true if every stored password form for the prefix was deleted

Field Summary

Fields inherited from class PasswordManager

Constructor Summary

Method Summary

Methods inherited from class PasswordManager

Methods inherited from class Object

Field Details

_context

Constructor Details

Method Details

migrate

save

savePlain

saveB64

saveHash

remove