impostor
Class Impostor

java.lang.Object
  |
  +--java.lang.Thread
        |
        +--impostor.Impostor

All Implemented Interfaces:

java.lang.Runnable

public final class Impostor

extends java.lang.Thread

This class implements a simple HTTP proxy daemon with Single Sign-On functionality into websites. If it is instantiated properly, it recognizes HTTP requests that constitute a user's login request into a website. The Impostor daemon then invokes a Challenge-Response authentication mechanism in order to authenticate the user. If successful, it automatically fills in the username and password of the authenticated user for the website that is being visited. In this way the user will not have to remember multiple usernames and passwords for different websites, and will also be able to log into the websites without having to type his/her password into the access device he/she is using (this could be, for example, an untrusted device in an Internet cafe) . The Impostor daemon also "intercepts" SSL/TLS connections by setting up two separate SSL connections between the user's browser and the visited website. This way the daemon is able to extract the HTTP requests that are sent over the SSL/TLS connection.

The daemon needs to have an asymmetric keypair and a certificate for its public key in order to be able to set up SSL connections. This data is expected to be found in a keystore file named prvkey and the keystore password (as well as the alias password) is expected to be "secret". An easy way to create this keystore file is using the command keytool -genkey -keyalg RSA -keysize 1024 -keystore prvkey and typing secret whenever asked for a password.

The daemon also needs access to two html pages, which are expected to be found in files named login.html and error.html. These pages need to be constructed according to some simple guidelines and will serve as the Impostor login and error pages respectively.

This class extends the Thread class, which means that the start method should be called in order for the web proxy daemon to actually start serving incoming connections. If it is desired to stop the daemon, the shutdown method should be used.

Author:

Andreas Pashalidis

Field Summary

protected static java.lang.String	NAME
protected java.util.Vector	replacementStrings
protected java.util.Vector	sensitiveStrings

Fields inherited from class java.lang.Thread

MAX_PRIORITY, MIN_PRIORITY, NORM_PRIORITY

Constructor Summary

Impostor()
Creates an Impostor web proxy that will run on port 8080 and has no extra functionality.

Impostor(int port)
Creates an Impostor web proxy that will run on the specified port but no extra functionality.

Impostor(int port, java.io.PrintWriter log)
Creates an Impostor web proxy that will run on the specified port but no extra functionality.

Impostor(int port, java.io.PrintWriter log, ContentFilter cf)
Creates an Impostor web proxy that will run on the specified port, send log messages to the specified PrintWriter and will use the specified ContentFilter.

Impostor(int port, java.io.PrintWriter log, UserManager um, ChallengeResponseManager crm, ContentFilter cf)
This is the full constructor that provides the maximum flexibility and functionality.

Method Summary

protected ChallengeResponseManager	getChallengeResponseManager()
protected ContentFilter	getContentFilter()
protected javax.net.ssl.SSLContext	getSSLContext()
protected javax.net.ssl.SSLServerSocketFactory	getSSLServerSocketFactory()
protected javax.net.ssl.SSLSocketFactory	getSSLSocketFactory()
protected UserManager	getUserManager()
protected void	log(java.lang.String s)
protected static java.lang.String	readInputStream(java.io.InputStream is)
void	run() This method has to be called in order for the Impostor web proxy to start.
void	shutdown() As the stop method in Thread is deprecated, this method should be called in order to properly stop a running Impostor web proxy.

Methods inherited from class java.lang.Thread

activeCount, checkAccess, countStackFrames, currentThread, destroy, dumpStack, enumerate, getContextClassLoader, getName, getPriority, getThreadGroup, holdsLock, interrupt, interrupted, isAlive, isDaemon, isInterrupted, join, join, join, resume, setContextClassLoader, setDaemon, setName, setPriority, sleep, sleep, start, stop, stop, suspend, toString, yield

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

NAME

protected static final java.lang.String NAME

See Also:

Constant Field Values

sensitiveStrings

protected java.util.Vector sensitiveStrings

replacementStrings

protected java.util.Vector replacementStrings

Constructor Detail

Impostor

public Impostor()
         throws java.lang.Exception

Creates an Impostor web proxy that will run on port 8080 and has no extra functionality. Log messages will be sent to standard output.

Impostor

public Impostor(int port)
         throws java.lang.Exception

Creates an Impostor web proxy that will run on the specified port but no extra functionality. Log messages will be sent to standard output.

Impostor

public Impostor(int port,
                java.io.PrintWriter log)
         throws java.lang.Exception

Creates an Impostor web proxy that will run on the specified port but no extra functionality. Log messages will be sent to the specified PrintWriter.

Impostor

public Impostor(int port,
                java.io.PrintWriter log,
                ContentFilter cf)
         throws java.lang.Exception

Creates an Impostor web proxy that will run on the specified port, send log messages to the specified PrintWriter and will use the specified ContentFilter.

Impostor

public Impostor(int port,
                java.io.PrintWriter log,
                UserManager um,
                ChallengeResponseManager crm,
                ContentFilter cf)
         throws java.lang.Exception

This is the full constructor that provides the maximum flexibility and functionality. It creates an Impostor web proxy that will run on the specified port and sent log messages to the specified PrintWriter. It also allows the caller to specify implementations of a UserManager, a ChallengeResponseManager and a ContentFilter.

Parameters:

port - the port the Impostor proxy shall run on

log - the PrintWriter log messages shall be sent to

um - the UserManager implementation the Impostor shall use

crm - the ChallengeResponseManager implementation the Impostor shall use

cf - the ContentFilter implementation the Impostor shall use

Method Detail

run

public final void run()

This method has to be called in order for the Impostor web proxy to start.

Specified by:

run in interface java.lang.Runnable

Overrides:

run in class java.lang.Thread

shutdown

public final void shutdown()
                    throws java.lang.Exception

As the stop method in Thread is deprecated, this method should be called in order to properly stop a running Impostor web proxy.

java.lang.Exception

log

protected final void log(java.lang.String s)

getSSLContext

protected final javax.net.ssl.SSLContext getSSLContext()

getSSLSocketFactory

protected final javax.net.ssl.SSLSocketFactory getSSLSocketFactory()

getSSLServerSocketFactory

protected final javax.net.ssl.SSLServerSocketFactory getSSLServerSocketFactory()

getChallengeResponseManager

protected final ChallengeResponseManager getChallengeResponseManager()

getUserManager

protected final UserManager getUserManager()

getContentFilter

protected final ContentFilter getContentFilter()

readInputStream

protected static final java.lang.String readInputStream(java.io.InputStream is)
                                                 throws java.io.IOException

java.io.IOException