webconsole/src/main/java/org/apache/felix/webconsole/internal/servlet/Password.java - felix - Git at Google

 /*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
  * regarding copyright ownership.  The ASF licenses this file
  * to you under the Apache License, Version 2.0 (the
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  *
  *   http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing,
  * software distributed under the License is distributed on an
  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  * KIND, either express or implied.  See the License for the
  * specific language governing permissions and limitations
  * under the License.
  */
 package org.apache.felix.webconsole.internal.servlet;


 import java.math.BigInteger;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;

 /**
  * The <code>Password</code> class encapsulates encoding and decoding
  * operations on plain text and hashed passwords.
  * <p>
  * Encoded hashed passwords are strings of the form
  * <code>{hashAlgorithm}base64-encoded-password-hash</code> where
  * <i>hashAlgorithm</i> is the name of the hash algorithm used to hash
  * the password and <i>password</i> is the password
  * hashed with the indicated hash algorithm.
  */
 class Password
 {

     // the default hash algorithm (part of the Java Platform since 1.4)
     private static final String DEFAULT_HASH_ALGO = "SHA-256";

     private static final char DELIMITER = '-';

     private static final int NO_ITERATIONS = 1;

     private static final int DEFAULT_ITERATIONS = 1000;

     public static final int DEFAULT_SALT_SIZE = 8;

     // the hash algorithm used to hash the password or null
     // if the password is not hashed at all
     private final String hashAlgo;

     // the hashed or plain password
     private final String password;


     /**
      * Returns {@code true} if the given {@code textPassword} is hashed
      * and encoded as described in the class comment.
      *
      * @param textPassword
      * @return
      * @throws NullPointerException if {@code textPassword} is {@code null}.
      */
     static boolean isPasswordHashed( final String textPassword )
     {
         return getEndOfHashAlgorithm( textPassword ) >= 0;
     }


     /**
      * Returns the given plain {@code textPassword} as an encoded hashed
      * password string as described in the class comment.
      *
      * @param textPassword
      * @return
      * @throws NullPointerException if {@code textPassword} is {@code null}.
      */
     static String hashPassword( final String textPassword )
     {
         String salt = generateSalt(DEFAULT_SALT_SIZE);
         return hashPassword( DEFAULT_HASH_ALGO, DEFAULT_ITERATIONS, salt, textPassword  );
     }

     Password( String textPassword )
     {
         this.hashAlgo = getPasswordHashAlgorithm( textPassword );
         this.password = getPassword(textPassword);
     }

     /**
      * Returns {@code true} if this password matches the password
      * {@code toCompare}. If this password is hashed, the {@code toCompare}
      * password is hashed, too, with the same hash algorithm before
      * comparison.
      *
      * @param toCompare
      * @return
      * @throws NullPointerException if {@code toCompare} is {@code null}.
      */
     boolean matches( final byte[] toCompare )
     {
         if (this.hashAlgo != null)
         {
             int startPos = 0;
             String salt = extractSalt(this.password, startPos);
             int iterations = NO_ITERATIONS;
             if (salt != null)
             {
                 startPos += salt.length()+1;
                 iterations = extractIterations(this.password, startPos);

             }
             String hash = hashPassword(this.hashAlgo, iterations, salt, new String(toCompare));
             final StringBuilder buf = new StringBuilder();
             return compareSecure(buf.append("{").append(this.hashAlgo).append("}").append(password).toString(), hash);
         } else {
             return compareSecure(password, new String(toCompare));
         }

     }

     private static String hashPassword( final String hashAlgorithm, final int iterations, final  String salt, final String password )
     {

         final StringBuilder buf = new StringBuilder();
         buf.append( '{' ).append( hashAlgorithm.toLowerCase() ).append( '}' );
         if (salt != null && !salt.isEmpty()) {
             buf.append(salt).append(DELIMITER);
             if (iterations > NO_ITERATIONS) {
                 buf.append(iterations).append(DELIMITER);
             }
             final byte[] hashedPassword = hashPassword( password, salt,iterations, hashAlgorithm );
             buf.append( Base64.newStringUtf8( Base64.encodeBase64( hashedPassword ) ) );
         } else {
             // backwards compatible to previous version: no salt, no iterations
             final byte[] hashedPassword = hashPassword( password, null, NO_ITERATIONS, hashAlgorithm );
             buf.append( Base64.newStringUtf8( Base64.encodeBase64( hashedPassword ) ) );
         }

         return buf.toString();
     }

     private static String getPasswordHashAlgorithm( final String textPassword )
     {
         final int endHash = getEndOfHashAlgorithm( textPassword );
         if ( endHash >= 0 )
         {
             return textPassword.substring( 1, endHash );
         }

         // password is plain text, hence no algorithm
         return null;
     }

     private static String getPassword( final String textPassword )
     {
         final int endHash = getEndOfHashAlgorithm( textPassword );
         if ( endHash >= 0 )
         {
             final String encodedPassword = textPassword.substring( endHash + 1 );
             return  encodedPassword;
         }

         return textPassword;
     }


     private static int getEndOfHashAlgorithm( final String textPassword )
     {
         if ( textPassword.startsWith( "{" ) )
         {
             final int endHash = textPassword.indexOf( "}" );
             if ( endHash > 0 )
             {
                 return endHash;
             }
         }

         return -1;
     }

     private static byte[] hashPassword( final String pwd, final String salt, final int iterations, final String hashAlg )
     {
         try
         {
             StringBuilder data = new StringBuilder();
             if (salt != null)
             {
                 data.append(salt);
             }
             data.append(pwd);
             byte[] bytes =  Base64.getBytesUtf8( data.toString());
             final MessageDigest md = MessageDigest.getInstance( hashAlg );
             for (int i = 0; i < iterations; i++)
             {
                 md.reset();
                 bytes = md.digest(bytes);
             }
             return bytes;
         }
         catch ( NoSuchAlgorithmException e )
         {
             throw new IllegalStateException( "Cannot hash the password: " + e );
         }
     }

     private static boolean compareSecure( final String a,final String b )
     {
         int len = a.length();
         if (len != b.length())
         {
             return false;
         }
         if (len == 0)
         {
             return true;
         }
         // don't use conditional operations inside the loop
         int bits = 0;
         for (int i = 0; i < len; i++)
         {
             // this will never reset any bits
             bits |= a.charAt(i) ^ b.charAt(i);
         }
         return bits == 0;
     }

     private static String generateSalt( final  int saltSize )
     {
         SecureRandom random = new SecureRandom();
         byte[] salt = new byte[saltSize];
         random.nextBytes(salt);
         return toHex(salt);
     }

     private static String toHex( final byte[] array )
     {
         BigInteger bi = new BigInteger(1, array);
         String hex = bi.toString(16);
         int paddingLength = (array.length * 2) - hex.length();
         if(paddingLength > 0)
         {
             return String.format("%0" + paddingLength + "d", 0) + hex;
         }
         else
         {
             return hex;
         }
     }

     private static String extractSalt( final String hashedPwd, final int start )
     {
         if (hashedPwd != null)
         {
             int end = hashedPwd.indexOf(DELIMITER, start);
             if (end > -1)
             {
                 return hashedPwd.substring(start, end);
             }
         }
         // no salt
         return null;
     }

     private static int extractIterations( final String hashedPwd, int start )
     {
         if (hashedPwd != null)
         {
             int end = hashedPwd.indexOf(DELIMITER, start);
             if (end > -1)
             {
                 String str = hashedPwd.substring(start, end);
                 try
                 {
                     return Integer.parseInt(str);
                 } catch (NumberFormatException e)
                 {
                     //nothing to do
                 }
             }
         }
         // no extra iterations
         return NO_ITERATIONS;
     }

 }
	/*
	* Licensed to the Apache Software Foundation (ASF) under one
	* or more contributor license agreements. See the NOTICE file
	* distributed with this work for additional information
	* regarding copyright ownership. The ASF licenses this file
	* to you under the Apache License, Version 2.0 (the
	* "License"); you may not use this file except in compliance
	* with the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing,
	* software distributed under the License is distributed on an
	* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
	* KIND, either express or implied. See the License for the
	* specific language governing permissions and limitations
	* under the License.
	*/
	package org.apache.felix.webconsole.internal.servlet;


	import java.math.BigInteger;
	import java.security.MessageDigest;
	import java.security.NoSuchAlgorithmException;
	import java.security.SecureRandom;

	/**
	* The <code>Password</code> class encapsulates encoding and decoding
	* operations on plain text and hashed passwords.
	* <p>
	* Encoded hashed passwords are strings of the form
	* <code>{hashAlgorithm}base64-encoded-password-hash</code> where
	* <i>hashAlgorithm</i> is the name of the hash algorithm used to hash
	* the password and <i>password</i> is the password
	* hashed with the indicated hash algorithm.
	*/
	class Password
	{

	// the default hash algorithm (part of the Java Platform since 1.4)
	private static final String DEFAULT_HASH_ALGO = "SHA-256";

	private static final char DELIMITER = '-';

	private static final int NO_ITERATIONS = 1;

	private static final int DEFAULT_ITERATIONS = 1000;

	public static final int DEFAULT_SALT_SIZE = 8;

	// the hash algorithm used to hash the password or null
	// if the password is not hashed at all
	private final String hashAlgo;

	// the hashed or plain password
	private final String password;


	/**
	* Returns {@code true} if the given {@code textPassword} is hashed
	* and encoded as described in the class comment.
	*
	* @param textPassword
	* @return
	* @throws NullPointerException if {@code textPassword} is {@code null}.
	*/
	static boolean isPasswordHashed( final String textPassword )
	{
	return getEndOfHashAlgorithm( textPassword ) >= 0;
	}


	/**
	* Returns the given plain {@code textPassword} as an encoded hashed
	* password string as described in the class comment.
	*
	* @param textPassword
	* @return
	* @throws NullPointerException if {@code textPassword} is {@code null}.
	*/
	static String hashPassword( final String textPassword )
	{
	String salt = generateSalt(DEFAULT_SALT_SIZE);
	return hashPassword( DEFAULT_HASH_ALGO, DEFAULT_ITERATIONS, salt, textPassword );
	}

	Password( String textPassword )
	{
	this.hashAlgo = getPasswordHashAlgorithm( textPassword );
	this.password = getPassword(textPassword);
	}

	/**
	* Returns {@code true} if this password matches the password
	* {@code toCompare}. If this password is hashed, the {@code toCompare}
	* password is hashed, too, with the same hash algorithm before
	* comparison.
	*
	* @param toCompare
	* @return
	* @throws NullPointerException if {@code toCompare} is {@code null}.
	*/
	boolean matches( final byte[] toCompare )
	{
	if (this.hashAlgo != null)
	{
	int startPos = 0;
	String salt = extractSalt(this.password, startPos);
	int iterations = NO_ITERATIONS;
	if (salt != null)
	{
	startPos += salt.length()+1;
	iterations = extractIterations(this.password, startPos);

	}
	String hash = hashPassword(this.hashAlgo, iterations, salt, new String(toCompare));
	final StringBuilder buf = new StringBuilder();
	return compareSecure(buf.append("{").append(this.hashAlgo).append("}").append(password).toString(), hash);
	} else {
	return compareSecure(password, new String(toCompare));
	}

	}

	private static String hashPassword( final String hashAlgorithm, final int iterations, final String salt, final String password )
	{

	final StringBuilder buf = new StringBuilder();
	buf.append( '{' ).append( hashAlgorithm.toLowerCase() ).append( '}' );
	if (salt != null && !salt.isEmpty()) {
	buf.append(salt).append(DELIMITER);
	if (iterations > NO_ITERATIONS) {
	buf.append(iterations).append(DELIMITER);
	}
	final byte[] hashedPassword = hashPassword( password, salt,iterations, hashAlgorithm );
	buf.append( Base64.newStringUtf8( Base64.encodeBase64( hashedPassword ) ) );
	} else {
	// backwards compatible to previous version: no salt, no iterations
	final byte[] hashedPassword = hashPassword( password, null, NO_ITERATIONS, hashAlgorithm );
	buf.append( Base64.newStringUtf8( Base64.encodeBase64( hashedPassword ) ) );
	}

	return buf.toString();
	}

	private static String getPasswordHashAlgorithm( final String textPassword )
	{
	final int endHash = getEndOfHashAlgorithm( textPassword );
	if ( endHash >= 0 )
	{
	return textPassword.substring( 1, endHash );
	}

	// password is plain text, hence no algorithm
	return null;
	}

	private static String getPassword( final String textPassword )
	{
	final int endHash = getEndOfHashAlgorithm( textPassword );
	if ( endHash >= 0 )
	{
	final String encodedPassword = textPassword.substring( endHash + 1 );
	return encodedPassword;
	}

	return textPassword;
	}


	private static int getEndOfHashAlgorithm( final String textPassword )
	{
	if ( textPassword.startsWith( "{" ) )
	{
	final int endHash = textPassword.indexOf( "}" );
	if ( endHash > 0 )
	{
	return endHash;
	}
	}

	return -1;
	}

	private static byte[] hashPassword( final String pwd, final String salt, final int iterations, final String hashAlg )
	{
	try
	{
	StringBuilder data = new StringBuilder();
	if (salt != null)
	{
	data.append(salt);
	}
	data.append(pwd);
	byte[] bytes = Base64.getBytesUtf8( data.toString());
	final MessageDigest md = MessageDigest.getInstance( hashAlg );
	for (int i = 0; i < iterations; i++)
	{
	md.reset();
	bytes = md.digest(bytes);
	}
	return bytes;
	}
	catch ( NoSuchAlgorithmException e )
	{
	throw new IllegalStateException( "Cannot hash the password: " + e );
	}
	}

	private static boolean compareSecure( final String a,final String b )
	{
	int len = a.length();
	if (len != b.length())
	{
	return false;
	}
	if (len == 0)
	{
	return true;
	}
	// don't use conditional operations inside the loop
	int bits = 0;
	for (int i = 0; i < len; i++)
	{
	// this will never reset any bits
	bits \|= a.charAt(i) ^ b.charAt(i);
	}
	return bits == 0;
	}

	private static String generateSalt( final int saltSize )
	{
	SecureRandom random = new SecureRandom();
	byte[] salt = new byte[saltSize];
	random.nextBytes(salt);
	return toHex(salt);
	}

	private static String toHex( final byte[] array )
	{
	BigInteger bi = new BigInteger(1, array);
	String hex = bi.toString(16);
	int paddingLength = (array.length * 2) - hex.length();
	if(paddingLength > 0)
	{
	return String.format("%0" + paddingLength + "d", 0) + hex;
	}
	else
	{
	return hex;
	}
	}

	private static String extractSalt( final String hashedPwd, final int start )
	{
	if (hashedPwd != null)
	{
	int end = hashedPwd.indexOf(DELIMITER, start);
	if (end > -1)
	{
	return hashedPwd.substring(start, end);
	}
	}
	// no salt
	return null;
	}

	private static int extractIterations( final String hashedPwd, int start )
	{
	if (hashedPwd != null)
	{
	int end = hashedPwd.indexOf(DELIMITER, start);
	if (end > -1)
	{
	String str = hashedPwd.substring(start, end);
	try
	{
	return Integer.parseInt(str);
	} catch (NumberFormatException e)
	{
	//nothing to do
	}
	}
	}
	// no extra iterations
	return NO_ITERATIONS;
	}

	}