1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.eclipse.jetty.util.security;
20
21 import java.io.Serializable;
22 import java.nio.charset.StandardCharsets;
23 import java.security.MessageDigest;
24
25 import org.eclipse.jetty.util.TypeUtil;
26 import org.eclipse.jetty.util.log.Log;
27 import org.eclipse.jetty.util.log.Logger;
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44 public abstract class Credential implements Serializable
45 {
46 private static final Logger LOG = Log.getLogger(Credential.class);
47
48 private static final long serialVersionUID = -7760551052768181572L;
49
50
51
52
53
54
55
56
57
58
59
60 public abstract boolean check(Object credentials);
61
62
63
64
65
66
67
68
69
70
71 public static Credential getCredential(String credential)
72 {
73 if (credential.startsWith(Crypt.__TYPE)) return new Crypt(credential);
74 if (credential.startsWith(MD5.__TYPE)) return new MD5(credential);
75
76 return new Password(credential);
77 }
78
79
80
81
82
83 public static class Crypt extends Credential
84 {
85 private static final long serialVersionUID = -2027792997664744210L;
86
87 public static final String __TYPE = "CRYPT:";
88
89 private final String _cooked;
90
91 Crypt(String cooked)
92 {
93 _cooked = cooked.startsWith(Crypt.__TYPE) ? cooked.substring(__TYPE.length()) : cooked;
94 }
95
96 @Override
97 public boolean check(Object credentials)
98 {
99 if (credentials instanceof char[])
100 credentials=new String((char[])credentials);
101 if (!(credentials instanceof String) && !(credentials instanceof Password))
102 LOG.warn("Can't check " + credentials.getClass() + " against CRYPT");
103
104 String passwd = credentials.toString();
105 return _cooked.equals(UnixCrypt.crypt(passwd, _cooked));
106 }
107
108 public static String crypt(String user, String pw)
109 {
110 return "CRYPT:" + UnixCrypt.crypt(pw, user);
111 }
112 }
113
114
115
116
117
118 public static class MD5 extends Credential
119 {
120 private static final long serialVersionUID = 5533846540822684240L;
121
122 public static final String __TYPE = "MD5:";
123
124 public static final Object __md5Lock = new Object();
125
126 private static MessageDigest __md;
127
128 private final byte[] _digest;
129
130
131 MD5(String digest)
132 {
133 digest = digest.startsWith(__TYPE) ? digest.substring(__TYPE.length()) : digest;
134 _digest = TypeUtil.parseBytes(digest, 16);
135 }
136
137
138 public byte[] getDigest()
139 {
140 return _digest;
141 }
142
143
144 @Override
145 public boolean check(Object credentials)
146 {
147 try
148 {
149 byte[] digest = null;
150
151 if (credentials instanceof char[])
152 credentials=new String((char[])credentials);
153 if (credentials instanceof Password || credentials instanceof String)
154 {
155 synchronized (__md5Lock)
156 {
157 if (__md == null) __md = MessageDigest.getInstance("MD5");
158 __md.reset();
159 __md.update(credentials.toString().getBytes(StandardCharsets.ISO_8859_1));
160 digest = __md.digest();
161 }
162 if (digest == null || digest.length != _digest.length) return false;
163 for (int i = 0; i < digest.length; i++)
164 if (digest[i] != _digest[i]) return false;
165 return true;
166 }
167 else if (credentials instanceof MD5)
168 {
169 MD5 md5 = (MD5) credentials;
170 if (_digest.length != md5._digest.length) return false;
171 for (int i = 0; i < _digest.length; i++)
172 if (_digest[i] != md5._digest[i]) return false;
173 return true;
174 }
175 else if (credentials instanceof Credential)
176 {
177
178
179 return ((Credential) credentials).check(this);
180 }
181 else
182 {
183 LOG.warn("Can't check " + credentials.getClass() + " against MD5");
184 return false;
185 }
186 }
187 catch (Exception e)
188 {
189 LOG.warn(e);
190 return false;
191 }
192 }
193
194
195 public static String digest(String password)
196 {
197 try
198 {
199 byte[] digest;
200 synchronized (__md5Lock)
201 {
202 if (__md == null)
203 {
204 try
205 {
206 __md = MessageDigest.getInstance("MD5");
207 }
208 catch (Exception e)
209 {
210 LOG.warn(e);
211 return null;
212 }
213 }
214
215 __md.reset();
216 __md.update(password.getBytes(StandardCharsets.ISO_8859_1));
217 digest = __md.digest();
218 }
219
220 return __TYPE + TypeUtil.toString(digest, 16);
221 }
222 catch (Exception e)
223 {
224 LOG.warn(e);
225 return null;
226 }
227 }
228 }
229 }