0N/A/*
2362N/A * Copyright (c) 2000, 2009, Oracle and/or its affiliates. All rights reserved.
0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
0N/A *
0N/A * This code is free software; you can redistribute it and/or modify it
0N/A * under the terms of the GNU General Public License version 2 only, as
2362N/A * published by the Free Software Foundation. Oracle designates this
0N/A * particular file as subject to the "Classpath" exception as provided
2362N/A * by Oracle in the LICENSE file that accompanied this code.
0N/A *
0N/A * This code is distributed in the hope that it will be useful, but WITHOUT
0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
0N/A * version 2 for more details (a copy is included in the LICENSE file that
0N/A * accompanied this code).
0N/A *
0N/A * You should have received a copy of the GNU General Public License version
0N/A * 2 along with this work; if not, write to the Free Software Foundation,
0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
0N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
0N/A */
0N/A
0N/Apackage sun.security.jgss;
0N/A
0N/Aimport java.lang.reflect.InvocationTargetException;
0N/Aimport org.ietf.jgss.*;
0N/Aimport java.security.AccessController;
0N/Aimport java.security.Provider;
0N/Aimport java.security.Security;
0N/Aimport java.util.ArrayList;
0N/Aimport java.util.HashSet;
0N/Aimport java.util.HashMap;
0N/Aimport java.util.Enumeration;
0N/Aimport java.util.Iterator;
0N/Aimport sun.security.jgss.spi.*;
0N/Aimport sun.security.jgss.wrapper.NativeGSSFactory;
0N/Aimport sun.security.jgss.wrapper.SunNativeProvider;
0N/Aimport sun.security.action.GetPropertyAction;
0N/A
0N/A/**
0N/A * This class stores the list of providers that this
0N/A * GSS-Implementation is configured to use. The GSSManagerImpl class
0N/A * queries this class whenever it needs a mechanism's factory.<p>
0N/A *
0N/A * This class stores an ordered list of pairs of the form
0N/A * <provider, oid>. When it attempts to instantiate a mechanism
0N/A * defined by oid o, it steps through the list looking for an entry
0N/A * with oid=o, or with oid=null. (An entry with oid=null matches all
0N/A * mechanisms.) When it finds such an entry, the corresponding
0N/A * provider is approached for the mechanism's factory class.
0N/A * At instantiation time this list in initialized to contain those
0N/A * system wide providers that contain a property of the form
0N/A * "GssApiMechanism.x.y.z..." where "x.y.z..." is a numeric object
0N/A * identifier with numbers x, y, z, etc. Such a property is defined
0N/A * to map to that provider's implementation of the MechanismFactory
0N/A * interface for the mechanism x.y.z...
0N/A * As and when a MechanismFactory is instantiated, it is
0N/A * cached for future use. <p>
0N/A *
0N/A * An application can cause more providers to be added by means of
0N/A * the addProviderAtFront and addProviderAtEnd methods on
0N/A * GSSManager which get delegated to this class. The
0N/A * addProviderAtFront method can also cause a change in the ordering
0N/A * of the providers without adding any new providers, by causing a
0N/A * provider to move up in a list. The method addProviderAtEnd can
0N/A * only add providers at the end of the list if they are not already
0N/A * in the list. The rationale is that an application will call
0N/A * addProviderAtFront when it wants a provider to be used in
0N/A * preference over the default ones. And it will call
0N/A * addProviderAtEnd when it wants a provider to be used in case
0N/A * the system ones don't suffice.<p>
0N/A *
0N/A * If a mechanism's factory is being obtained from a provider as a
0N/A * result of encountering a entryof the form <provider, oid> where
0N/A * oid is non-null, then the assumption is that the application added
0N/A * this entry and it wants this mechanism to be obtained from this
0N/A * provider. Thus is the provider does not actually contain the
0N/A * requested mechanism, an exception will be thrown. However, if the
0N/A * entry were of the form <provider, null>, then it is viewed more
0N/A * liberally and is simply skipped over if the provider does not claim to
0N/A * support the requested mechanism.
0N/A */
0N/A
0N/Apublic final class ProviderList {
0N/A
0N/A private static final String PROV_PROP_PREFIX = "GssApiMechanism.";
0N/A private static final int PROV_PROP_PREFIX_LEN =
0N/A PROV_PROP_PREFIX.length();
0N/A
0N/A private static final String SPI_MECH_FACTORY_TYPE
0N/A = "sun.security.jgss.spi.MechanismFactory";
0N/A
0N/A // Undocumented property?
0N/A private static final String DEFAULT_MECH_PROP =
0N/A "sun.security.jgss.mechanism";
0N/A
0N/A public static final Oid DEFAULT_MECH_OID;
0N/A
0N/A static {
0N/A /*
0N/A * Set the default mechanism. Kerberos v5 is the default
0N/A * mechanism unless it is overridden by a system property.
0N/A * with a valid OID value
0N/A */
0N/A Oid defOid = null;
0N/A String defaultOidStr = AccessController.doPrivileged
0N/A (new GetPropertyAction(DEFAULT_MECH_PROP));
0N/A if (defaultOidStr != null) {
0N/A defOid = GSSUtil.createOid(defaultOidStr);
0N/A }
0N/A DEFAULT_MECH_OID =
0N/A (defOid == null ? GSSUtil.GSS_KRB5_MECH_OID : defOid);
0N/A }
0N/A
0N/A private ArrayList<PreferencesEntry> preferences =
0N/A new ArrayList<PreferencesEntry>(5);
0N/A private HashMap<PreferencesEntry, MechanismFactory> factories =
0N/A new HashMap<PreferencesEntry, MechanismFactory>(5);
0N/A private HashSet<Oid> mechs = new HashSet<Oid>(5);
0N/A
1266N/A final private GSSCaller caller;
0N/A
1266N/A public ProviderList(GSSCaller caller, boolean useNative) {
0N/A this.caller = caller;
0N/A Provider[] provList;
0N/A if (useNative) {
0N/A provList = new Provider[1];
0N/A provList[0] = new SunNativeProvider();
0N/A } else {
0N/A provList = Security.getProviders();
0N/A }
0N/A
0N/A for (int i = 0; i < provList.length; i++) {
0N/A Provider prov = provList[i];
0N/A try {
0N/A addProviderAtEnd(prov, null);
0N/A } catch (GSSException ge) {
0N/A // Move on to the next provider
0N/A GSSUtil.debug("Error in adding provider " +
0N/A prov.getName() + ": " + ge);
0N/A }
0N/A } // End of for loop
0N/A }
0N/A
0N/A /**
0N/A * Determines if the given provider property represents a GSS-API
0N/A * Oid to MechanismFactory mapping.
0N/A * @return true if this is a GSS-API property, false otherwise.
0N/A */
0N/A private boolean isMechFactoryProperty(String prop) {
0N/A return (prop.startsWith(PROV_PROP_PREFIX) ||
0N/A prop.regionMatches(true, 0, // Try ignoring case
0N/A PROV_PROP_PREFIX, 0,
0N/A PROV_PROP_PREFIX_LEN));
0N/A }
0N/A
0N/A private Oid getOidFromMechFactoryProperty(String prop)
0N/A throws GSSException {
0N/A
0N/A String oidPart = prop.substring(PROV_PROP_PREFIX_LEN);
0N/A return new Oid(oidPart);
0N/A }
0N/A
0N/A // So the existing code do not have to be changed
0N/A synchronized public MechanismFactory getMechFactory(Oid mechOid)
0N/A throws GSSException {
0N/A if (mechOid == null) mechOid = ProviderList.DEFAULT_MECH_OID;
0N/A return getMechFactory(mechOid, null);
0N/A }
0N/A
0N/A /**
0N/A * Obtains a MechanismFactory for a given mechanism. If the
0N/A * specified provider is not null, then the impl from the
0N/A * provider is used. Otherwise, the most preferred impl based
0N/A * on the configured preferences is used.
0N/A * @param mechOid the oid of the desired mechanism
0N/A * @return a MechanismFactory for the desired mechanism.
0N/A * @throws GSSException when the specified provider does not
0N/A * support the desired mechanism, or when no provider supports
0N/A * the desired mechanism.
0N/A */
0N/A synchronized public MechanismFactory getMechFactory(Oid mechOid,
0N/A Provider p)
0N/A throws GSSException {
0N/A
0N/A if (mechOid == null) mechOid = ProviderList.DEFAULT_MECH_OID;
0N/A
0N/A if (p == null) {
0N/A // Iterate thru all preferences to find right provider
0N/A String className;
0N/A PreferencesEntry entry;
0N/A
0N/A Iterator<PreferencesEntry> list = preferences.iterator();
0N/A while (list.hasNext()) {
0N/A entry = list.next();
0N/A if (entry.impliesMechanism(mechOid)) {
0N/A MechanismFactory retVal = getMechFactory(entry, mechOid);
0N/A if (retVal != null) return retVal;
0N/A }
0N/A } // end of while loop
0N/A throw new GSSExceptionImpl(GSSException.BAD_MECH, mechOid);
0N/A } else {
0N/A // Use the impl from the specified provider; return null if the
0N/A // the mech is unsupported by the specified provider.
0N/A PreferencesEntry entry = new PreferencesEntry(p, mechOid);
0N/A return getMechFactory(entry, mechOid);
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Helper routine that uses a preferences entry to obtain an
0N/A * implementation of a MechanismFactory from it.
0N/A * @param e the preferences entry that contains the provider and
0N/A * either a null of an explicit oid that matched the oid of the
0N/A * desired mechanism.
0N/A * @param mechOid the oid of the desired mechanism
0N/A * @throws GSSException If the application explicitly requested
0N/A * this entry's provider to be used for the desired mechanism but
0N/A * some problem is encountered
0N/A */
0N/A private MechanismFactory getMechFactory(PreferencesEntry e, Oid mechOid)
0N/A throws GSSException {
0N/A Provider p = e.getProvider();
0N/A
0N/A /*
0N/A * See if a MechanismFactory was previously instantiated for
0N/A * this provider and mechanism combination.
0N/A */
0N/A PreferencesEntry searchEntry = new PreferencesEntry(p, mechOid);
0N/A MechanismFactory retVal = factories.get(searchEntry);
0N/A if (retVal == null) {
0N/A /*
0N/A * Apparently not. Now try to instantiate this class from
0N/A * the provider.
0N/A */
0N/A String prop = PROV_PROP_PREFIX + mechOid.toString();
0N/A String className = p.getProperty(prop);
0N/A if (className != null) {
0N/A retVal = getMechFactoryImpl(p, className, mechOid, caller);
0N/A factories.put(searchEntry, retVal);
0N/A } else {
0N/A /*
0N/A * This provider does not support this mechanism.
0N/A * If the application explicitly requested that
0N/A * this provider be used for this mechanism, then
0N/A * throw an exception
0N/A */
0N/A if (e.getOid() != null) {
0N/A throw new GSSExceptionImpl(GSSException.BAD_MECH,
0N/A "Provider " + p.getName() +
0N/A " does not support mechanism " + mechOid);
0N/A }
0N/A }
0N/A }
0N/A return retVal;
0N/A }
0N/A
0N/A /**
0N/A * Helper routine to obtain a MechanismFactory implementation
0N/A * from the same class loader as the provider of this
0N/A * implementation.
0N/A * @param p the provider whose classloader must be used for
0N/A * instantiating the desired MechanismFactory
0N/A * @ param className the name of the MechanismFactory class
0N/A * @throws GSSException If some error occurs when trying to
0N/A * instantiate this MechanismFactory.
0N/A */
0N/A private static MechanismFactory getMechFactoryImpl(Provider p,
0N/A String className,
0N/A Oid mechOid,
1266N/A GSSCaller caller)
0N/A throws GSSException {
0N/A
0N/A try {
0N/A Class<?> baseClass = Class.forName(SPI_MECH_FACTORY_TYPE);
0N/A
0N/A /*
0N/A * Load the implementation class with the same class loader
0N/A * that was used to load the provider.
0N/A * In order to get the class loader of a class, the
0N/A * caller's class loader must be the same as or an ancestor of
0N/A * the class loader being returned. Otherwise, the caller must
0N/A * have "getClassLoader" permission, or a SecurityException
0N/A * will be thrown.
0N/A */
0N/A
0N/A ClassLoader cl = p.getClass().getClassLoader();
0N/A Class<?> implClass;
0N/A if (cl != null) {
0N/A implClass = cl.loadClass(className);
0N/A } else {
0N/A implClass = Class.forName(className);
0N/A }
0N/A
0N/A if (baseClass.isAssignableFrom(implClass)) {
0N/A
0N/A java.lang.reflect.Constructor<?> c =
1266N/A implClass.getConstructor(GSSCaller.class);
0N/A MechanismFactory mf = (MechanismFactory) (c.newInstance(caller));
0N/A
0N/A if (mf instanceof NativeGSSFactory) {
0N/A ((NativeGSSFactory) mf).setMech(mechOid);
0N/A }
0N/A return mf;
0N/A } else {
0N/A throw createGSSException(p, className, "is not a " +
0N/A SPI_MECH_FACTORY_TYPE, null);
0N/A }
0N/A } catch (ClassNotFoundException e) {
0N/A throw createGSSException(p, className, "cannot be created", e);
0N/A } catch (NoSuchMethodException e) {
0N/A throw createGSSException(p, className, "cannot be created", e);
0N/A } catch (InvocationTargetException e) {
0N/A throw createGSSException(p, className, "cannot be created", e);
0N/A } catch (InstantiationException e) {
0N/A throw createGSSException(p, className, "cannot be created", e);
0N/A } catch (IllegalAccessException e) {
0N/A throw createGSSException(p, className, "cannot be created", e);
0N/A } catch (SecurityException e) {
0N/A throw createGSSException(p, className, "cannot be created", e);
0N/A }
0N/A }
0N/A
0N/A // Only used by getMechFactoryImpl
0N/A private static GSSException createGSSException(Provider p,
0N/A String className,
0N/A String trailingMsg,
0N/A Exception cause) {
0N/A String errClassInfo = className + " configured by " +
0N/A p.getName() + " for GSS-API Mechanism Factory ";
0N/A return new GSSExceptionImpl(GSSException.BAD_MECH,
0N/A errClassInfo + trailingMsg,
0N/A cause);
0N/A }
0N/A
0N/A public Oid[] getMechs() {
0N/A return mechs.toArray(new Oid[] {});
0N/A }
0N/A
0N/A synchronized public void addProviderAtFront(Provider p, Oid mechOid)
0N/A throws GSSException {
0N/A
0N/A PreferencesEntry newEntry = new PreferencesEntry(p, mechOid);
0N/A PreferencesEntry oldEntry;
0N/A boolean foundSomeMech;
0N/A
0N/A Iterator<PreferencesEntry> list = preferences.iterator();
0N/A while (list.hasNext()) {
0N/A oldEntry = list.next();
0N/A if (newEntry.implies(oldEntry))
0N/A list.remove();
0N/A }
0N/A
0N/A if (mechOid == null) {
0N/A foundSomeMech = addAllMechsFromProvider(p);
0N/A } else {
0N/A String oidStr = mechOid.toString();
0N/A if (p.getProperty(PROV_PROP_PREFIX + oidStr) == null)
0N/A throw new GSSExceptionImpl(GSSException.BAD_MECH,
0N/A "Provider " + p.getName()
0N/A + " does not support "
0N/A + oidStr);
0N/A mechs.add(mechOid);
0N/A foundSomeMech = true;
0N/A }
0N/A
0N/A if (foundSomeMech) {
0N/A preferences.add(0, newEntry);
0N/A }
0N/A }
0N/A
0N/A synchronized public void addProviderAtEnd(Provider p, Oid mechOid)
0N/A throws GSSException {
0N/A
0N/A PreferencesEntry newEntry = new PreferencesEntry(p, mechOid);
0N/A PreferencesEntry oldEntry;
0N/A boolean foundSomeMech;
0N/A
0N/A Iterator<PreferencesEntry> list = preferences.iterator();
0N/A while (list.hasNext()) {
0N/A oldEntry = list.next();
0N/A if (oldEntry.implies(newEntry))
0N/A return;
0N/A }
0N/A
0N/A // System.out.println("addProviderAtEnd: No it is not redundant");
0N/A
0N/A if (mechOid == null)
0N/A foundSomeMech = addAllMechsFromProvider(p);
0N/A else {
0N/A String oidStr = mechOid.toString();
0N/A if (p.getProperty(PROV_PROP_PREFIX + oidStr) == null)
0N/A throw new GSSExceptionImpl(GSSException.BAD_MECH,
0N/A "Provider " + p.getName()
0N/A + " does not support "
0N/A + oidStr);
0N/A mechs.add(mechOid);
0N/A foundSomeMech = true;
0N/A }
0N/A
0N/A if (foundSomeMech) {
0N/A preferences.add(newEntry);
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Helper routine to go through all properties contined in a
0N/A * provider and add its mechanisms to the list of supported
0N/A * mechanisms. If no default mechanism has been assinged so far,
0N/A * it sets the default MechanismFactory and Oid as well.
0N/A * @param p the provider to query
0N/A * @return true if there is at least one mechanism that this
0N/A * provider contributed, false otherwise
0N/A */
0N/A private boolean addAllMechsFromProvider(Provider p) {
0N/A
0N/A String prop;
0N/A boolean retVal = false;
0N/A
0N/A // Get all props for this provider
0N/A Enumeration<Object> props = p.keys();
0N/A
0N/A // See if there are any GSS prop's
0N/A while (props.hasMoreElements()) {
0N/A prop = (String) props.nextElement();
0N/A if (isMechFactoryProperty(prop)) {
0N/A // Ok! This is a GSS provider!
0N/A try {
0N/A Oid mechOid = getOidFromMechFactoryProperty(prop);
0N/A mechs.add(mechOid);
0N/A retVal = true;
0N/A } catch (GSSException e) {
0N/A // Skip to next property
0N/A GSSUtil.debug("Ignore the invalid property " +
0N/A prop + " from provider " + p.getName());
0N/A }
0N/A } // Processed GSS property
0N/A } // while loop
0N/A
0N/A return retVal;
0N/A
0N/A }
0N/A
0N/A /**
0N/A * Stores a provider and a mechanism oid indicating that the
0N/A * provider should be used for the mechanism. If the mechanism
0N/A * Oid is null, then it indicates that this preference holds for
0N/A * any mechanism.<p>
0N/A *
0N/A * The ProviderList maintains an ordered list of
0N/A * PreferencesEntry's and iterates thru them as it tries to
0N/A * instantiate MechanismFactory's.
0N/A */
0N/A private static final class PreferencesEntry {
0N/A private Provider p;
0N/A private Oid oid;
0N/A PreferencesEntry(Provider p, Oid oid) {
0N/A this.p = p;
0N/A this.oid = oid;
0N/A }
0N/A
0N/A public boolean equals(Object other) {
0N/A if (this == other) {
0N/A return true;
0N/A }
0N/A
0N/A if (!(other instanceof PreferencesEntry)) {
0N/A return false;
0N/A }
0N/A
0N/A PreferencesEntry that = (PreferencesEntry)other;
0N/A if (this.p.getName().equals(that.p.getName())) {
0N/A if (this.oid != null && that.oid != null) {
0N/A return this.oid.equals(that.oid);
0N/A } else {
0N/A return (this.oid == null && that.oid == null);
0N/A }
0N/A }
0N/A
0N/A return false;
0N/A }
0N/A
0N/A public int hashCode() {
0N/A int result = 17;
0N/A
0N/A result = 37 * result + p.getName().hashCode();
0N/A if (oid != null) {
0N/A result = 37 * result + oid.hashCode();
0N/A }
0N/A
0N/A return result;
0N/A }
0N/A
0N/A /**
0N/A * Determines if a preference implies another. A preference
0N/A * implies another if the latter is subsumed by the
0N/A * former. e.g., <Provider1, null> implies <Provider1, OidX>
0N/A * because the null in the former indicates that it should
0N/A * be used for all mechanisms.
0N/A */
0N/A boolean implies(Object other) {
0N/A
0N/A if (other instanceof PreferencesEntry) {
0N/A PreferencesEntry temp = (PreferencesEntry) other;
0N/A return (equals(temp) ||
0N/A p.getName().equals(temp.p.getName()) &&
0N/A oid == null);
0N/A } else {
0N/A return false;
0N/A }
0N/A }
0N/A
0N/A Provider getProvider() {
0N/A return p;
0N/A }
0N/A
0N/A Oid getOid() {
0N/A return oid;
0N/A }
0N/A
0N/A /**
0N/A * Determines if this entry is applicable to the desired
0N/A * mechanism. The entry is applicable to the desired mech if
0N/A * it contains the same oid or if it contains a null oid
0N/A * indicating that it is applicable to all mechs.
0N/A * @param mechOid the desired mechanism
0N/A * @return true if the provider in this entry should be
0N/A * queried for this mechanism.
0N/A */
0N/A boolean impliesMechanism(Oid oid) {
0N/A return (this.oid == null || this.oid.equals(oid));
0N/A }
0N/A
0N/A // For debugging
0N/A public String toString() {
0N/A StringBuffer buf = new StringBuffer("<");
0N/A buf.append(p.getName());
0N/A buf.append(", ");
0N/A buf.append(oid);
0N/A buf.append(">");
0N/A return buf.toString();
0N/A }
0N/A }
0N/A}