/* Security.java --- Java base security class implementation Copyright (C) 1999, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc. This file is part of GNU Classpath. GNU Classpath is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. GNU Classpath is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GNU Classpath; see the file COPYING. If not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Linking this library statically or dynamically with other modules is making a combined work based on this library. Thus, the terms and conditions of the GNU General Public License cover the whole combination. As a special exception, the copyright holders of this library give you permission to link this library with independent modules to produce an executable, regardless of the license terms of these independent modules, and to copy and distribute the resulting executable under terms of your choice, provided that you also meet, for each linked independent module, the terms and conditions of the license of that module. An independent module is a module which is not derived from or based on this library. If you modify this library, you may extend this exception to your version of the library, but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. */ package java.security; import gnu.classpath.SystemProperties; import gnu.classpath.Configuration; import gnu.classpath.VMStackWalker; import java.io.IOException; import java.io.InputStream; import java.net.URL; import java.util.Collections; import java.util.Enumeration; import java.util.HashMap; import java.util.HashSet; import java.util.Iterator; import java.util.LinkedHashSet; import java.util.Map; import java.util.Properties; import java.util.Set; import java.util.Vector; /** * This class centralizes all security properties and common security methods. * One of its primary uses is to manage security providers. * * @author Mark Benvenuto (ivymccough@worldnet.att.net) */ public final class Security { private static final String ALG_ALIAS = "Alg.Alias."; private static Vector providers = new Vector(); private static Properties secprops = new Properties(); static { String base = SystemProperties.getProperty("gnu.classpath.home.url"); String vendor = SystemProperties.getProperty("gnu.classpath.vm.shortname"); // Try VM specific security file boolean loaded = loadProviders (base, vendor); // Append classpath standard provider if possible if (!loadProviders (base, "classpath") && !loaded && providers.size() == 0) { if (Configuration.DEBUG) { /* No providers found and both security files failed to * load properly. Give a warning in case of DEBUG is * enabled. Could be done with java.util.logging later. */ System.err.println ("WARNING: could not properly read security provider files:"); System.err.println (" " + base + "/security/" + vendor + ".security"); System.err.println (" " + base + "/security/" + "classpath" + ".security"); System.err.println (" Falling back to standard GNU security provider"); } // Note that this matches our classpath.security file. providers.addElement (new gnu.java.security.provider.Gnu()); providers.addElement(new gnu.javax.crypto.jce.GnuCrypto()); providers.addElement(new gnu.javax.crypto.jce.GnuSasl()); providers.addElement(new gnu.javax.net.ssl.provider.Jessie()); providers.addElement(new gnu.javax.security.auth.callback.GnuCallbacks()); } } // This class can't be instantiated. private Security() { } /** * Tries to load the vender specific security providers from the given base * URL. Returns true if the resource could be read and completely parsed * successfully, false otherwise. */ private static boolean loadProviders(String baseUrl, String vendor) { if (baseUrl == null || vendor == null) return false; boolean result = true; String secfilestr = baseUrl + "/security/" + vendor + ".security"; try { InputStream fin = new URL(secfilestr).openStream(); secprops.load(fin); int i = 1; String name; while ((name = secprops.getProperty("security.provider." + i)) != null) { Exception exception = null; try { ClassLoader sys = ClassLoader.getSystemClassLoader(); providers.addElement(Class.forName(name, true, sys).newInstance()); } catch (ClassNotFoundException x) { exception = x; } catch (InstantiationException x) { exception = x; } catch (IllegalAccessException x) { exception = x; } if (exception != null) { System.err.println ("WARNING: Error loading security provider " + name + ": " + exception); result = false; } i++; } } catch (IOException ignored) { result = false; } return result; } /** * Returns the value associated to a designated property name for a given * algorithm. * * @param algName * the algorithm name. * @param propName * the name of the property to return. * @return the value of the specified property or null if none * found. * @deprecated Use the provider-based and algorithm-independent * {@link AlgorithmParameters} and {@link KeyFactory} engine * classes instead. */ public static String getAlgorithmProperty(String algName, String propName) { if (algName == null || propName == null) return null; String property = String.valueOf(propName) + "." + String.valueOf(algName); Provider p; for (Iterator i = providers.iterator(); i.hasNext(); ) { p = (Provider) i.next(); for (Iterator j = p.keySet().iterator(); j.hasNext(); ) { String key = (String) j.next(); if (key.equalsIgnoreCase(property)) return p.getProperty(key); } } return null; } /** * Inserts a new designated {@link Provider} at a designated (1-based) * position in the current list of installed {@link Provider}s, * * @param provider * the new {@link Provider} to add. * @param position * the position (starting from 1) of where to install * provider. * @return the actual position, in the list of installed Providers. Returns * -1 if provider was laready in the * list. The actual position may be different than the desired * position. * @throws SecurityException * if a {@link SecurityManager} is installed and it disallows this * operation. * @see #getProvider(String) * @see #removeProvider(String) * @see SecurityPermission */ public static int insertProviderAt(Provider provider, int position) { SecurityManager sm = System.getSecurityManager(); if (sm != null) sm.checkSecurityAccess("insertProvider." + provider.getName()); position--; int max = providers.size (); for (int i = 0; i < max; i++) { if (((Provider) providers.elementAt(i)).getName().equals(provider.getName())) return -1; } if (position < 0) position = 0; if (position > max) position = max; providers.insertElementAt(provider, position); return position + 1; } /** * Appends the designated new {@link Provider} to the current list of * installed {@link Provider}s. * * @param provider * the new {@link Provider} to append. * @return the position (starting from 1) of provider in the * current list of {@link Provider}s, or -1 if * provider was already there. * @throws SecurityException * if a {@link SecurityManager} is installed and it disallows this * operation. * @see #getProvider(String) * @see #removeProvider(String) * @see SecurityPermission */ public static int addProvider(Provider provider) { return insertProviderAt (provider, providers.size () + 1); } /** * Removes an already installed {@link Provider}, given its name, from the * current list of installed {@link Provider}s. * * @param name * the name of an already installed {@link Provider} to remove. * @throws SecurityException * if a {@link SecurityManager} is installed and it disallows this * operation. * @see #getProvider(String) * @see #addProvider(Provider) */ public static void removeProvider(String name) { SecurityManager sm = System.getSecurityManager(); if (sm != null) sm.checkSecurityAccess("removeProvider." + name); int max = providers.size (); for (int i = 0; i < max; i++) { if (((Provider) providers.elementAt(i)).getName().equals(name)) { providers.remove(i); break; } } } /** * Returns the current list of installed {@link Provider}s as an array * ordered according to their installation preference order. * * @return an array of all the installed providers. */ public static Provider[] getProviders() { Provider[] array = new Provider[providers.size ()]; providers.copyInto (array); return array; } /** * Returns an already installed {@link Provider} given its name. * * @param name * the name of an already installed {@link Provider}. * @return the {@link Provider} known by name. Returns * null if the current list of {@link Provider}s does * not include one named name. * @see #removeProvider(String) * @see #addProvider(Provider) */ public static Provider getProvider(String name) { if (name == null) return null; else { name = name.trim(); if (name.length() == 0) return null; } Provider p; int max = providers.size (); for (int i = 0; i < max; i++) { p = (Provider) providers.elementAt(i); if (p.getName().equals(name)) return p; } return null; } /** * Returns the value associated with a Security propery. * * @param key * the key of the property to fetch. * @return the value of the Security property associated with * key. Returns null if no such property * was found. * @throws SecurityException * if a {@link SecurityManager} is installed and it disallows this * operation. * @see #setProperty(String, String) * @see SecurityPermission */ public static String getProperty(String key) { // XXX To prevent infinite recursion when the SecurityManager calls us, // don't do a security check if the caller is trusted (by virtue of having // been loaded by the bootstrap class loader). SecurityManager sm = System.getSecurityManager(); if (sm != null && VMStackWalker.getCallingClassLoader() != null) sm.checkSecurityAccess("getProperty." + key); return secprops.getProperty(key); } /** * Sets or changes a designated Security property to a designated value. * * @param key * the name of the property to set. * @param datum * the new value of the property. * @throws SecurityException * if a {@link SecurityManager} is installed and it disallows this * operation. * @see #getProperty(String) * @see SecurityPermission */ public static void setProperty(String key, String datum) { SecurityManager sm = System.getSecurityManager(); if (sm != null) sm.checkSecurityAccess("setProperty." + key); if (datum == null) secprops.remove(key); else secprops.put(key, datum); } /** * For a given service (e.g. Signature, MessageDigest, etc...) this * method returns the {@link Set} of all available algorithm names (instances * of {@link String}, from all currently installed {@link Provider}s. * * @param serviceName * the case-insensitive name of a service (e.g. Signature, * MessageDigest, etc). * @return a {@link Set} of {@link String}s containing the names of all * algorithm names provided by all of the currently installed * {@link Provider}s. * @since 1.4 */ public static Set getAlgorithms(String serviceName) { HashSet result = new HashSet(); if (serviceName == null || serviceName.length() == 0) return result; serviceName = serviceName.trim(); if (serviceName.length() == 0) return result; serviceName = serviceName.toUpperCase()+"."; Provider[] providers = getProviders(); int ndx; for (int i = 0; i < providers.length; i++) for (Enumeration e = providers[i].propertyNames(); e.hasMoreElements(); ) { String service = ((String) e.nextElement()).trim(); if (service.toUpperCase().startsWith(serviceName)) { service = service.substring(serviceName.length()).trim(); ndx = service.indexOf(' '); // get rid of attributes if (ndx != -1) service = service.substring(0, ndx); result.add(service); } } return Collections.unmodifiableSet(result); } /** * Returns an array of currently installed {@link Provider}s, ordered * according to their installation preference order, which satisfy a given * selection criterion. * *

This implementation recognizes a selection criterion written in * one of two following forms:

* *
    *
  • <crypto_service>.<algorithm_or_type>: Where * crypto_service is a case-insensitive string, similar to what has * been described in the {@link #getAlgorithms(String)} method, and * algorithm_or_type is a known case-insensitive name of an * Algorithm, or one of its aliases. * *

    For example, "CertificateFactory.X.509" would return all the installed * {@link Provider}s which provide a CertificateFactory * implementation of X.509.

  • * *
  • <crypto_service>.<algorithm_or_type> <attribute_name>:<value>: * Where crypto_service is a case-insensitive string, similar to what * has been described in the {@link #getAlgorithms(String)} method, * algorithm_or_type is a case-insensitive known name of an Algorithm * or one of its aliases, attribute_name is a case-insensitive * property name with no whitespace characters, and no dots, in-between, and * value is a {@link String} with no whitespace characters in-between. * *

    For example, "Signature.Sha1WithDSS KeySize:1024" would return all the * installed {@link Provider}s which declared their ability to provide * Signature services, using the Sha1WithDSS algorithm with * key sizes of 1024.

  • *
* * @param filter * the selection criterion for selecting among the installed * {@link Provider}s. * @return all the installed {@link Provider}s which satisfy the selection * criterion. Returns null if no installed * {@link Provider}s were found which satisfy the selection * criterion. Returns ALL installed {@link Provider}s if * filter is null or is an empty string. * @throws InvalidParameterException * if an exception occurs while parsing the filter. * @see #getProviders(Map) */ public static Provider[] getProviders(String filter) { if (providers == null || providers.isEmpty()) return null; if (filter == null || filter.length() == 0) return getProviders(); HashMap map = new HashMap(1); int i = filter.indexOf(':'); if (i == -1) // . map.put(filter, ""); else // . : map.put(filter.substring(0, i), filter.substring(i+1)); return getProviders(map); } /** * Returns an array of currently installed {@link Provider}s which satisfy a * set of selection criteria. * *

The selection criteria are defined in a {@link Map} where each * element specifies a selection querry. The Keys in this * {@link Map} must be in one of the two following forms:

* *
    *
  • <crypto_service>.<algorithm_or_type>: Where * crypto_service is a case-insensitive string, similar to what has * been described in the {@link #getAlgorithms(String)} method, and * algorithm_or_type is a case-insensitive known name of an * Algorithm, or one of its aliases. The value of the entry in the * {@link Map} for such a Key MUST be the empty string. * {@link Provider}s which provide an implementation for the designated * service algorithm are included in the result.
  • * *
  • <crypto_service>.<algorithm_or_type> <attribute_name>: * Where crypto_service is a case-insensitive string, similar to what * has been described in the {@link #getAlgorithms(String)} method, * algorithm_or_type is a case-insensitive known name of an Algorithm * or one of its aliases, and attribute_name is a case-insensitive * property name with no whitespace characters, and no dots, in-between. The * value of the entry in this {@link Map} for such a Key MUST * NOT be null or an empty string. {@link Provider}s which * declare the designated attribute_name and value for the * designated service algorithm are included in the result.
  • *
* * @param filter * a {@link Map} of selection querries. * @return all currently installed {@link Provider}s which satisfy ALL the * selection criteria defined in filter. * Returns ALL installed {@link Provider}s if filter * is null or empty. * @throws InvalidParameterException * if an exception is encountered while parsing the syntax of the * {@link Map}'s keys. * @see #getProviders(String) */ public static Provider[] getProviders(Map filter) { if (providers == null || providers.isEmpty()) return null; if (filter == null) return getProviders(); Set querries = filter.keySet(); if (querries == null || querries.isEmpty()) return getProviders(); LinkedHashSet result = new LinkedHashSet(providers); // assume all int dot, ws; String querry, service, algorithm, attribute, value; LinkedHashSet serviceProviders = new LinkedHashSet(); // preserve insertion order for (Iterator i = querries.iterator(); i.hasNext(); ) { querry = (String) i.next(); if (querry == null) // all providers continue; querry = querry.trim(); if (querry.length() == 0) // all providers continue; dot = querry.indexOf('.'); if (dot == -1) // syntax error throw new InvalidParameterException( "missing dot in '" + String.valueOf(querry)+"'"); value = filter.get(querry); // deconstruct querry into [service, algorithm, attribute] if (value == null || value.trim().length() == 0) // . { value = null; attribute = null; service = querry.substring(0, dot).trim(); algorithm = querry.substring(dot+1).trim(); } else // . { ws = querry.indexOf(' '); if (ws == -1) throw new InvalidParameterException( "value (" + String.valueOf(value) + ") is not empty, but querry (" + String.valueOf(querry) + ") is missing at least one space character"); value = value.trim(); attribute = querry.substring(ws+1).trim(); // was the dot in the attribute? if (attribute.indexOf('.') != -1) throw new InvalidParameterException( "attribute_name (" + String.valueOf(attribute) + ") in querry (" + String.valueOf(querry) + ") contains a dot"); querry = querry.substring(0, ws).trim(); service = querry.substring(0, dot).trim(); algorithm = querry.substring(dot+1).trim(); } // service and algorithm must not be empty if (service.length() == 0) throw new InvalidParameterException( " in querry (" + String.valueOf(querry) + ") is empty"); if (algorithm.length() == 0) throw new InvalidParameterException( " in querry (" + String.valueOf(querry) + ") is empty"); selectProviders(service, algorithm, attribute, value, result, serviceProviders); result.retainAll(serviceProviders); // eval next retaining found providers if (result.isEmpty()) // no point continuing break; } if (result.isEmpty()) return null; return (Provider[]) result.toArray(new Provider[result.size()]); } private static void selectProviders(String svc, String algo, String attr, String val, LinkedHashSet providerSet, LinkedHashSet result) { result.clear(); // ensure we start with an empty result set for (Iterator i = providerSet.iterator(); i.hasNext(); ) { Provider p = (Provider) i.next(); if (provides(p, svc, algo, attr, val)) result.add(p); } } private static boolean provides(Provider p, String svc, String algo, String attr, String val) { Iterator it; String serviceDotAlgorithm = null; String key = null; String realVal; boolean found = false; // if . is in the set then so is . // but it may be stored under an alias . resolve outer: for (int r = 0; r < 3; r++) // guard against circularity { serviceDotAlgorithm = (svc+"."+String.valueOf(algo)).trim(); for (it = p.keySet().iterator(); it.hasNext(); ) { key = (String) it.next(); if (key.equalsIgnoreCase(serviceDotAlgorithm)) // eureka { found = true; break outer; } // it may be there but as an alias if (key.equalsIgnoreCase(ALG_ALIAS + serviceDotAlgorithm)) { algo = p.getProperty(key); continue outer; } // else continue inner } } if (!found) return false; // found a candidate for the querry. do we have an attr to match? if (val == null) // . querry return true; // . ; find the key entry that match String realAttr; int limit = serviceDotAlgorithm.length() + 1; for (it = p.keySet().iterator(); it.hasNext(); ) { key = (String) it.next(); if (key.length() <= limit) continue; if (key.substring(0, limit).equalsIgnoreCase(serviceDotAlgorithm+" ")) { realAttr = key.substring(limit).trim(); if (! realAttr.equalsIgnoreCase(attr)) continue; // eveything matches so far. do the value realVal = p.getProperty(key); if (realVal == null) return false; realVal = realVal.trim(); // is it a string value? if (val.equalsIgnoreCase(realVal)) return true; // assume value is a number. cehck for greater-than-or-equal return (new Integer(val).intValue() >= new Integer(realVal).intValue()); } } return false; } }