| /* |
| * Copyright (c) 1997, 2015, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package java.security; |
| |
| import java.io.IOException; |
| import java.io.ByteArrayInputStream; |
| import java.util.ArrayList; |
| import java.util.Hashtable; |
| import java.lang.reflect.*; |
| import java.security.cert.*; |
| |
| /** |
| * The UnresolvedPermission class is used to hold Permissions that |
| * were "unresolved" when the Policy was initialized. |
| * An unresolved permission is one whose actual Permission class |
| * does not yet exist at the time the Policy is initialized (see below). |
| * |
| * <p>The policy for a Java runtime (specifying |
| * which permissions are available for code from various principals) |
| * is represented by a Policy object. |
| * Whenever a Policy is initialized or refreshed, Permission objects of |
| * appropriate classes are created for all permissions |
| * allowed by the Policy. |
| * |
| * <p>Many permission class types |
| * referenced by the policy configuration are ones that exist |
| * locally (i.e., ones that can be found on CLASSPATH). |
| * Objects for such permissions can be instantiated during |
| * Policy initialization. For example, it is always possible |
| * to instantiate a java.io.FilePermission, since the |
| * FilePermission class is found on the CLASSPATH. |
| * |
| * <p>Other permission classes may not yet exist during Policy |
| * initialization. For example, a referenced permission class may |
| * be in a JAR file that will later be loaded. |
| * For each such class, an UnresolvedPermission is instantiated. |
| * Thus, an UnresolvedPermission is essentially a "placeholder" |
| * containing information about the permission. |
| * |
| * <p>Later, when code calls AccessController.checkPermission |
| * on a permission of a type that was previously unresolved, |
| * but whose class has since been loaded, previously-unresolved |
| * permissions of that type are "resolved". That is, |
| * for each such UnresolvedPermission, a new object of |
| * the appropriate class type is instantiated, based on the |
| * information in the UnresolvedPermission. |
| * |
| * <p> To instantiate the new class, UnresolvedPermission assumes |
| * the class provides a zero, one, and/or two-argument constructor. |
| * The zero-argument constructor would be used to instantiate |
| * a permission without a name and without actions. |
| * A one-arg constructor is assumed to take a {@code String} |
| * name as input, and a two-arg constructor is assumed to take a |
| * {@code String} name and {@code String} actions |
| * as input. UnresolvedPermission may invoke a |
| * constructor with a {@code null} name and/or actions. |
| * If an appropriate permission constructor is not available, |
| * the UnresolvedPermission is ignored and the relevant permission |
| * will not be granted to executing code. |
| * |
| * <p> The newly created permission object replaces the |
| * UnresolvedPermission, which is removed. |
| * |
| * <p> Note that the {@code getName} method for an |
| * {@code UnresolvedPermission} returns the |
| * {@code type} (class name) for the underlying permission |
| * that has not been resolved. |
| * |
| * @see java.security.Permission |
| * @see java.security.Permissions |
| * @see java.security.PermissionCollection |
| * @see java.security.Policy |
| * |
| * |
| * @author Roland Schemers |
| * @since 1.2 |
| */ |
| |
| public final class UnresolvedPermission extends Permission |
| implements java.io.Serializable |
| { |
| |
| private static final long serialVersionUID = -4821973115467008846L; |
| |
| private static final sun.security.util.Debug debug = |
| sun.security.util.Debug.getInstance |
| ("policy,access", "UnresolvedPermission"); |
| |
| /** |
| * The class name of the Permission class that will be |
| * created when this unresolved permission is resolved. |
| * |
| * @serial |
| */ |
| private String type; |
| |
| /** |
| * The permission name. |
| * |
| * @serial |
| */ |
| private String name; |
| |
| /** |
| * The actions of the permission. |
| * |
| * @serial |
| */ |
| private String actions; |
| |
| private transient java.security.cert.Certificate[] certs; |
| |
| /** |
| * Creates a new UnresolvedPermission containing the permission |
| * information needed later to actually create a Permission of the |
| * specified class, when the permission is resolved. |
| * |
| * @param type the class name of the Permission class that will be |
| * created when this unresolved permission is resolved. |
| * @param name the name of the permission. |
| * @param actions the actions of the permission. |
| * @param certs the certificates the permission's class was signed with. |
| * This is a list of certificate chains, where each chain is composed of a |
| * signer certificate and optionally its supporting certificate chain. |
| * Each chain is ordered bottom-to-top (i.e., with the signer certificate |
| * first and the (root) certificate authority last). The signer |
| * certificates are copied from the array. Subsequent changes to |
| * the array will not affect this UnsolvedPermission. |
| */ |
| public UnresolvedPermission(String type, |
| String name, |
| String actions, |
| java.security.cert.Certificate[] certs) |
| { |
| super(type); |
| |
| if (type == null) |
| throw new NullPointerException("type can't be null"); |
| |
| this.type = type; |
| this.name = name; |
| this.actions = actions; |
| if (certs != null) { |
| // Extract the signer certs from the list of certificates. |
| for (int i=0; i<certs.length; i++) { |
| if (!(certs[i] instanceof X509Certificate)) { |
| // there is no concept of signer certs, so we store the |
| // entire cert array |
| this.certs = certs.clone(); |
| break; |
| } |
| } |
| |
| if (this.certs == null) { |
| // Go through the list of certs and see if all the certs are |
| // signer certs. |
| int i = 0; |
| int count = 0; |
| while (i < certs.length) { |
| count++; |
| while (((i+1) < certs.length) && |
| ((X509Certificate)certs[i]).getIssuerDN().equals( |
| ((X509Certificate)certs[i+1]).getSubjectDN())) { |
| i++; |
| } |
| i++; |
| } |
| if (count == certs.length) { |
| // All the certs are signer certs, so we store the entire |
| // array |
| this.certs = certs.clone(); |
| } |
| |
| if (this.certs == null) { |
| // extract the signer certs |
| ArrayList<java.security.cert.Certificate> signerCerts = |
| new ArrayList<>(); |
| i = 0; |
| while (i < certs.length) { |
| signerCerts.add(certs[i]); |
| while (((i+1) < certs.length) && |
| ((X509Certificate)certs[i]).getIssuerDN().equals( |
| ((X509Certificate)certs[i+1]).getSubjectDN())) { |
| i++; |
| } |
| i++; |
| } |
| this.certs = |
| new java.security.cert.Certificate[signerCerts.size()]; |
| signerCerts.toArray(this.certs); |
| } |
| } |
| } |
| } |
| |
| |
| private static final Class<?>[] PARAMS0 = { }; |
| private static final Class<?>[] PARAMS1 = { String.class }; |
| private static final Class<?>[] PARAMS2 = { String.class, String.class }; |
| |
| /** |
| * try and resolve this permission using the class loader of the permission |
| * that was passed in. |
| */ |
| Permission resolve(Permission p, java.security.cert.Certificate[] certs) { |
| if (this.certs != null) { |
| // if p wasn't signed, we don't have a match |
| if (certs == null) { |
| return null; |
| } |
| |
| // all certs in this.certs must be present in certs |
| boolean match; |
| for (int i = 0; i < this.certs.length; i++) { |
| match = false; |
| for (int j = 0; j < certs.length; j++) { |
| if (this.certs[i].equals(certs[j])) { |
| match = true; |
| break; |
| } |
| } |
| if (!match) return null; |
| } |
| } |
| try { |
| Class<?> pc = p.getClass(); |
| |
| if (name == null && actions == null) { |
| try { |
| Constructor<?> c = pc.getConstructor(PARAMS0); |
| return (Permission)c.newInstance(new Object[] {}); |
| } catch (NoSuchMethodException ne) { |
| try { |
| Constructor<?> c = pc.getConstructor(PARAMS1); |
| return (Permission) c.newInstance( |
| new Object[] { name}); |
| } catch (NoSuchMethodException ne1) { |
| Constructor<?> c = pc.getConstructor(PARAMS2); |
| return (Permission) c.newInstance( |
| new Object[] { name, actions }); |
| } |
| } |
| } else { |
| if (name != null && actions == null) { |
| try { |
| Constructor<?> c = pc.getConstructor(PARAMS1); |
| return (Permission) c.newInstance( |
| new Object[] { name}); |
| } catch (NoSuchMethodException ne) { |
| Constructor<?> c = pc.getConstructor(PARAMS2); |
| return (Permission) c.newInstance( |
| new Object[] { name, actions }); |
| } |
| } else { |
| Constructor<?> c = pc.getConstructor(PARAMS2); |
| return (Permission) c.newInstance( |
| new Object[] { name, actions }); |
| } |
| } |
| } catch (NoSuchMethodException nsme) { |
| if (debug != null ) { |
| debug.println("NoSuchMethodException:\n could not find " + |
| "proper constructor for " + type); |
| nsme.printStackTrace(); |
| } |
| return null; |
| } catch (Exception e) { |
| if (debug != null ) { |
| debug.println("unable to instantiate " + name); |
| e.printStackTrace(); |
| } |
| return null; |
| } |
| } |
| |
| /** |
| * This method always returns false for unresolved permissions. |
| * That is, an UnresolvedPermission is never considered to |
| * imply another permission. |
| * |
| * @param p the permission to check against. |
| * |
| * @return false. |
| */ |
| public boolean implies(Permission p) { |
| return false; |
| } |
| |
| /** |
| * Checks two UnresolvedPermission objects for equality. |
| * Checks that {@code obj} is an UnresolvedPermission, and has |
| * the same type (class) name, permission name, actions, and |
| * certificates as this object. |
| * |
| * <p> To determine certificate equality, this method only compares |
| * actual signer certificates. Supporting certificate chains |
| * are not taken into consideration by this method. |
| * |
| * @param obj the object we are testing for equality with this object. |
| * |
| * @return true if obj is an UnresolvedPermission, and has the same |
| * type (class) name, permission name, actions, and |
| * certificates as this object. |
| */ |
| public boolean equals(Object obj) { |
| if (obj == this) |
| return true; |
| |
| if (! (obj instanceof UnresolvedPermission)) |
| return false; |
| UnresolvedPermission that = (UnresolvedPermission) obj; |
| |
| // check type |
| if (!this.type.equals(that.type)) { |
| return false; |
| } |
| |
| // check name |
| if (this.name == null) { |
| if (that.name != null) { |
| return false; |
| } |
| } else if (!this.name.equals(that.name)) { |
| return false; |
| } |
| |
| // check actions |
| if (this.actions == null) { |
| if (that.actions != null) { |
| return false; |
| } |
| } else { |
| if (!this.actions.equals(that.actions)) { |
| return false; |
| } |
| } |
| |
| // check certs |
| if ((this.certs == null && that.certs != null) || |
| (this.certs != null && that.certs == null) || |
| (this.certs != null && that.certs != null && |
| this.certs.length != that.certs.length)) { |
| return false; |
| } |
| |
| int i,j; |
| boolean match; |
| |
| for (i = 0; this.certs != null && i < this.certs.length; i++) { |
| match = false; |
| for (j = 0; j < that.certs.length; j++) { |
| if (this.certs[i].equals(that.certs[j])) { |
| match = true; |
| break; |
| } |
| } |
| if (!match) return false; |
| } |
| |
| for (i = 0; that.certs != null && i < that.certs.length; i++) { |
| match = false; |
| for (j = 0; j < this.certs.length; j++) { |
| if (that.certs[i].equals(this.certs[j])) { |
| match = true; |
| break; |
| } |
| } |
| if (!match) return false; |
| } |
| return true; |
| } |
| |
| /** |
| * Returns the hash code value for this object. |
| * |
| * @return a hash code value for this object. |
| */ |
| |
| public int hashCode() { |
| int hash = type.hashCode(); |
| if (name != null) |
| hash ^= name.hashCode(); |
| if (actions != null) |
| hash ^= actions.hashCode(); |
| return hash; |
| } |
| |
| /** |
| * Returns the canonical string representation of the actions, |
| * which currently is the empty string "", since there are no actions for |
| * an UnresolvedPermission. That is, the actions for the |
| * permission that will be created when this UnresolvedPermission |
| * is resolved may be non-null, but an UnresolvedPermission |
| * itself is never considered to have any actions. |
| * |
| * @return the empty string "". |
| */ |
| public String getActions() |
| { |
| return ""; |
| } |
| |
| /** |
| * Get the type (class name) of the underlying permission that |
| * has not been resolved. |
| * |
| * @return the type (class name) of the underlying permission that |
| * has not been resolved |
| * |
| * @since 1.5 |
| */ |
| public String getUnresolvedType() { |
| return type; |
| } |
| |
| /** |
| * Get the target name of the underlying permission that |
| * has not been resolved. |
| * |
| * @return the target name of the underlying permission that |
| * has not been resolved, or {@code null}, |
| * if there is no target name |
| * |
| * @since 1.5 |
| */ |
| public String getUnresolvedName() { |
| return name; |
| } |
| |
| /** |
| * Get the actions for the underlying permission that |
| * has not been resolved. |
| * |
| * @return the actions for the underlying permission that |
| * has not been resolved, or {@code null} |
| * if there are no actions |
| * |
| * @since 1.5 |
| */ |
| public String getUnresolvedActions() { |
| return actions; |
| } |
| |
| /** |
| * Get the signer certificates (without any supporting chain) |
| * for the underlying permission that has not been resolved. |
| * |
| * @return the signer certificates for the underlying permission that |
| * has not been resolved, or null, if there are no signer certificates. |
| * Returns a new array each time this method is called. |
| * |
| * @since 1.5 |
| */ |
| public java.security.cert.Certificate[] getUnresolvedCerts() { |
| return (certs == null) ? null : certs.clone(); |
| } |
| |
| /** |
| * Returns a string describing this UnresolvedPermission. The convention |
| * is to specify the class name, the permission name, and the actions, in |
| * the following format: '(unresolved "ClassName" "name" "actions")'. |
| * |
| * @return information about this UnresolvedPermission. |
| */ |
| public String toString() { |
| return "(unresolved " + type + " " + name + " " + actions + ")"; |
| } |
| |
| /** |
| * Returns a new PermissionCollection object for storing |
| * UnresolvedPermission objects. |
| * |
| * @return a new PermissionCollection object suitable for |
| * storing UnresolvedPermissions. |
| */ |
| |
| public PermissionCollection newPermissionCollection() { |
| return new UnresolvedPermissionCollection(); |
| } |
| |
| /** |
| * Writes this object out to a stream (i.e., serializes it). |
| * |
| * @serialData An initial {@code String} denoting the |
| * {@code type} is followed by a {@code String} denoting the |
| * {@code name} is followed by a {@code String} denoting the |
| * {@code actions} is followed by an {@code int} indicating the |
| * number of certificates to follow |
| * (a value of "zero" denotes that there are no certificates associated |
| * with this object). |
| * Each certificate is written out starting with a {@code String} |
| * denoting the certificate type, followed by an |
| * {@code int} specifying the length of the certificate encoding, |
| * followed by the certificate encoding itself which is written out as an |
| * array of bytes. |
| */ |
| private void writeObject(java.io.ObjectOutputStream oos) |
| throws IOException |
| { |
| oos.defaultWriteObject(); |
| |
| if (certs==null || certs.length==0) { |
| oos.writeInt(0); |
| } else { |
| // write out the total number of certs |
| oos.writeInt(certs.length); |
| // write out each cert, including its type |
| for (int i=0; i < certs.length; i++) { |
| java.security.cert.Certificate cert = certs[i]; |
| try { |
| oos.writeUTF(cert.getType()); |
| byte[] encoded = cert.getEncoded(); |
| oos.writeInt(encoded.length); |
| oos.write(encoded); |
| } catch (CertificateEncodingException cee) { |
| throw new IOException(cee.getMessage()); |
| } |
| } |
| } |
| } |
| |
| /** |
| * Restores this object from a stream (i.e., deserializes it). |
| */ |
| private void readObject(java.io.ObjectInputStream ois) |
| throws IOException, ClassNotFoundException |
| { |
| CertificateFactory cf; |
| Hashtable<String, CertificateFactory> cfs = null; |
| |
| ois.defaultReadObject(); |
| |
| if (type == null) |
| throw new NullPointerException("type can't be null"); |
| |
| // process any new-style certs in the stream (if present) |
| int size = ois.readInt(); |
| if (size > 0) { |
| // we know of 3 different cert types: X.509, PGP, SDSI, which |
| // could all be present in the stream at the same time |
| cfs = new Hashtable<>(3); |
| this.certs = new java.security.cert.Certificate[size]; |
| } |
| |
| for (int i=0; i<size; i++) { |
| // read the certificate type, and instantiate a certificate |
| // factory of that type (reuse existing factory if possible) |
| String certType = ois.readUTF(); |
| if (cfs.containsKey(certType)) { |
| // reuse certificate factory |
| cf = cfs.get(certType); |
| } else { |
| // create new certificate factory |
| try { |
| cf = CertificateFactory.getInstance(certType); |
| } catch (CertificateException ce) { |
| throw new ClassNotFoundException |
| ("Certificate factory for "+certType+" not found"); |
| } |
| // store the certificate factory so we can reuse it later |
| cfs.put(certType, cf); |
| } |
| // parse the certificate |
| byte[] encoded=null; |
| try { |
| encoded = new byte[ois.readInt()]; |
| } catch (OutOfMemoryError oome) { |
| throw new IOException("Certificate too big"); |
| } |
| ois.readFully(encoded); |
| ByteArrayInputStream bais = new ByteArrayInputStream(encoded); |
| try { |
| this.certs[i] = cf.generateCertificate(bais); |
| } catch (CertificateException ce) { |
| throw new IOException(ce.getMessage()); |
| } |
| bais.close(); |
| } |
| } |
| } |