ConsolePasswordManager

net.i2p.router.web.ConsolePasswordManager

public class ConsolePasswordManagerextends RouterPasswordManager

Manage both plaintext and salted/hashed password storage in router.config.

Field Summary
Fields inherited from class RouterPasswordManager
_context
Modifier and Type
Field
Description
protected final RouterContext
_context
The router context.
Fields inherited from class PasswordManager
PROP_B64, PROP_MD5, PROP_PW, PROP_SHASH, SALT_LENGTH, SHASH_LENGTH
Modifier and Type
Field
Description
protected static final String
PROP_B64
Stored obfuscated as b64 of the UTF-8 bytes.
protected static final String
PROP_MD5
Stored as the hex of the MD5 hash of the UTF-8 bytes.
protected static final String
PROP_PW
Stored as plain text.
protected static final String
PROP_SHASH
Stored as the b64 of the 16 byte salt + the 32 byte hash of the UTF-8 bytes.
protected static final int
SALT_LENGTH
Length of the random salt prefixed to each stored hash, in bytes.
protected static final int
SHASH_LENGTH
Stored hash length in bytes (salt + session key, 48).
Constructor Summary
Constructors
Constructor
Description
ConsolePasswordManager(RouterContext ctx)
Create a manager over the router's config store, migrating any legacy plaintext "consolePassword" entry to the salted/hash form on the way in.
Method Summary
Modifier and Type
Method
Description
boolean
checkMD5(String realm, String subrealm, String user, String pw)
Straight MD5.
Map<String,String>
getMD5(String realm)
Get all MD5 usernames and passwords.
Map<String,String>
getPBKDF2(String realm)
Get all users with PBKDF2 passwords.
(package private) static byte[]
HexDecode(String hex)
Decode a fixed-width hex string into exactly hex.length()/2 bytes.
(package private) static String
HexEncode(byte[] data)
Encode a byte array to a lowercase hex string.
boolean
saveMD5(String realm, String subrealm, String user, String pw)
Straight MD5, no salt Compatible with Jetty and RFC 2617.
Methods inherited from class RouterPasswordManager
migrate, remove, save, saveB64, saveHash, savePlain
Modifier and Type
Method
Description
protected boolean
migrate()
Migrate from plaintext to salt/hash.
boolean
remove(String realm, String user)
Remove password, any kind.
boolean
save(String realm, String user, String pw)
Same as RouterPasswordManager.saveHash(String, String, String).
boolean
saveB64(String realm, String user, String pw)
This will fail if if user contains '#' or '=' or starts with '!'.
boolean
saveHash(String realm, String user, String pw)
This will fail if user contains '#' or '=' or starts with '!'.
boolean
savePlain(String realm, String user, String pw)
This will fail if pw contains a '#' or if user contains '#' or '=' or starts with '!'.
Methods inherited from class PasswordManager
check, checkB64, checkHash, checkHash, checkPlain, createHash, get, getB64, getPlain, md5Hex, md5Hex, md5Sum, sha256Hex, sha256Hex, sha256Sum
Modifier and Type
Method
Description
boolean
check(String realm, String user, String pw)
Checks both plaintext and hash.
boolean
checkB64(String realm, String user, String pw)
Checks a password stored base64-encoded.
boolean
checkHash(String shash, String pw)
Check pw against b64 salt+hash, as generated by PasswordManager.createHash(String).
boolean
checkHash(String realm, String user, String pw)
With random salt.
boolean
checkPlain(String realm, String user, String pw)
Checks a password stored in plaintext.
String
createHash(String pw)
Create a salt+hash, to be saved and verified later by verifyHash().
String
get(String realm, String user)
Either plain or b64.
String
getB64(String realm, String user)
Retrieve the base64-stored password.
String
getPlain(String realm, String user)
Retrieve the plaintext-stored password.
static String
md5Hex(String fullpw)
Straight MD5, no salt Will return the MD5 sum of the data, compatible with Jetty and RFC 2617.
static String
md5Hex(String subrealm, String user, String pw)
Straight MD5, no salt Will return the MD5 sum of "user:subrealm:pw", compatible with Jetty and RFC 2617.
static byte[]
md5Sum(byte[] data)
Standard MD5 checksum.
static String
sha256Hex(String fullpw)
Return the SHA256 sum of the data, compatible with RFC 7616.
static String
sha256Hex(String subrealm, String user, String pw)
Straight SHA256, no salt Will return the SHA256 sum of "user:subrealm:pw", compatible with RFC 7616.
static byte[]
sha256Sum(byte[] data)
Standard SHA-256 checksum.
Methods inherited from class Object
clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details
- ConsolePasswordManager
  public ConsolePasswordManager(RouterContext ctx)
  Create a manager over the router's config store, migrating any legacy plaintext "consolePassword" entry to the salted/hash form on the way in.
  Parameters:
  ctx - the router context whose config store holds the passwords
Method Details
- checkMD5
  public boolean checkMD5(String realm, String subrealm, String user, String pw)
  Straight MD5. Compatible with Jetty.
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  subrealm - the HTTP digest subrealm, hashed between the user and the password
  user - null or "" for no user, already trimmed
  pw - plain text, already trimmed
  Returns:
  if pw verified
- HexDecode
  static byte[] HexDecode(String hex)
  Decode a fixed-width hex string into exactly hex.length()/2 bytes.
  DELIBERATE DEVIATION from the DataHelper canonical-source rule: DataHelper.fromHexString(String) decodes via BigInteger and returns the minimum-length, sign-aware representation - a leading '0' nibble is stripped and a first nibble of 8-f gains an extra 0x00 byte. Password salts and hashes must round-trip at their exact stored width; using fromHexString here corrupted ~15/16 of PBKDF2 credentials and locked users out of the console.
  Parameters:
  hex - even-length hex string, either case, no prefix
  Returns:
  decoded bytes, always exactly hex.length()/2 long
  Throws:
  IllegalArgumentException - on odd length or non-hex character
- getMD5
  public Map<String,String> getMD5(String realm)
  Get all MD5 usernames and passwords. Compatible with Jetty. Any "null" user is NOT included..
  Parameters:
  realm - e.g. i2cp, routerconsole, etc.
  Returns:
  Map of usernames to passwords (hex with leading zeros, 32 characters)
- getPBKDF2
  public Map<String,String> getPBKDF2(String realm)
  Get all users with PBKDF2 passwords.
  Parameters:
  realm - e.g. routerconsole.auth.i2prouter
  Returns:
  Map of usernames to PBKDF2 hashes
- saveMD5
  public boolean saveMD5(String realm, String subrealm, String user, String pw)
  Straight MD5, no salt Compatible with Jetty and RFC 2617.
  Upgrades to PBKDF2 on save (subrealm is unused for PBKDF2).
  Parameters:
  realm - The full realm, e.g. routerconsole.auth.i2prouter, etc.
  subrealm - unused (for backward compatibility)
  user - non-null, non-empty, already trimmed
  pw - the plain text password to hash
  Returns:
  true if the PBKDF2 entry reached router.config; false if the JCE provider rejects PBKDF2 or the key spec
- HexEncode
  static String HexEncode(byte[] data)
  Encode a byte array to a lowercase hex string. Two hex characters per byte with leading zeros.
  Parameters:
  data - the byte array to encode
  Returns:
  lowercase hex string

Field Summary

Fields inherited from class RouterPasswordManager

Fields inherited from class PasswordManager

Constructor Summary

Method Summary

Methods inherited from class RouterPasswordManager

Methods inherited from class PasswordManager

Methods inherited from class Object

Constructor Details

Method Details

checkMD5

HexDecode

getMD5

getPBKDF2

saveMD5

HexEncode