/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* The JCE security manager.
*
* <p>The JCE security manager is responsible for determining the maximum
* allowable cryptographic strength for a given applet/application, for a given
* algorithm, by consulting the configured jurisdiction policy files and
* the cryptographic permissions bundled with the applet/application.
*
* <p>Note that this security manager is never installed, only instantiated.
*
* @author Jan Luehe
*
* @since 1.4
*/
new ConcurrentHashMap<>();
new CryptoPermissions();
// singleton instance
static {
return new JceSecurityManager();
}
});
}
private JceSecurityManager() {
// empty
}
/**
* Returns the maximum allowable crypto strength for the given
* applet/application, for the given algorithm.
*/
// Need to convert to uppercase since the crypto perm
// lookup is case sensitive.
// If CryptoAllPermission is granted by default, we return that.
// Otherwise, this will be the permission we return if anything goes
// wrong.
return defaultPerm;
}
// Determine the codebase of the caller of the JCE API.
// This is the codebase of the first class which is not in
// javax.crypto.* packages.
// NOTE: javax.crypto.* package maybe subject to package
// insertion, so need to check its classloader as well.
int i;
if (callerCodeBase != null) {
break;
} else {
// skip jce classes since they aren't the callers
continue;
}
// use default permission when the caller is system classes
return defaultPerm;
}
}
return defaultPerm;
}
// no match found in cache
synchronized (this.getClass()) {
}
}
}
return defaultPerm;
}
// If the app was granted the special CryptoAllPermission, return that.
return allPerm;
}
// Check if the crypto permissions granted to the app contain a
// crypto permission for the requested algorithm that does not require
// any exemption mechanism to be enforced.
// Return that permission, if present.
return defaultPerm;
}
while (enum_.hasMoreElements()) {
return cp;
}
}
// Check if the jurisdiction file for exempt applications contains
// any entries for the requested algorithm.
// If not, return the default permission.
return defaultPerm;
}
// In the jurisdiction file for exempt applications, go through the
// list of CryptoPermission entries for the requested algorithm, and
// stop at the first entry:
// - that is implied by the collection of crypto permissions granted
// to the app, and
// - whose exemption mechanism is available from one of the
// registered CSPs
while (enum_.hasMoreElements()) {
try {
if (cp.getCheckParam()) {
newCp = new CryptoPermission(
} else {
newCp = new CryptoPermission(
}
return newCp;
}
}
return cp;
}
} catch (Exception e) {
continue;
}
}
return defaultPerm;
}
// Check if app is exempt, and retrieve the permissions bundled with it
try {
} catch (Exception e) {
// Jar verification fails
return null;
}
}
/**
* Returns the default permission for the given algorithm.
*/
}
// See bug 4341369 & 4334690 for more info.
boolean isCallerTrusted() {
// Get the caller and its codebase.
int i;
if (callerCodeBase != null) {
break;
}
}
// The caller is in the JCE framework.
return true;
}
//The caller has been verified.
return true;
}
// Check whether the caller is a trusted provider.
try {
return false;
}
return true;
}
}