/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* The Secmod class defines the interface to the native NSS
* library and the configuration information it stores in its
* secmod.db file.
*
* <p>Example code:
* <pre>
* Secmod secmod = Secmod.getInstance();
* if (secmod.isInitialized() == false) {
* }
*
* Provider p = secmod.getModule(ModuleType.KEYSTORE).getProvider();
* KeyStore ks = KeyStore.getInstance("PKCS11", p);
* ks.load(null, password);
* </pre>
*
* @since 1.6
* @author Andreas Sterbenz
*/
public final class Secmod {
private final static boolean DEBUG = false;
static {
}
// handle to be passed to the native code, 0 means not initialized
private long nssHandle;
// whether this is a supported version of NSS
private boolean supported;
// list of the modules
private Secmod() {
// empty
}
/**
* Return the singleton Secmod instance.
*/
return INSTANCE;
}
private boolean isLoaded() {
if (nssHandle == 0) {
if (nssHandle != 0) {
}
}
return (nssHandle != 0);
}
private void fetchVersions() {
}
/**
* Test whether this Secmod has been initialized. Returns true
* if NSS has been initialized using either the initialize() method
* or by directly calling the native NSS APIs. The latter may be
* the case if the current process contains components that use
* NSS directly.
*
* @throws IOException if an incompatible version of NSS
* has been loaded
*/
// NSS does not allow us to check if it is initialized already
// assume that if it is loaded it is also initialized
if (isLoaded() == false) {
return false;
}
if (supported == false) {
throw new IOException
("An incompatible version of NSS is already loaded, "
+ "3.7 or later required");
}
return true;
}
return configDir;
}
return nssLibDir;
}
/**
* Initialize this Secmod.
*
* @param configDir the directory containing the NSS configuration
* files such as secmod.db
* @param nssLibDir the directory containing the NSS libraries
* (libnss3.so or nss3.dll) or null if the library is on
* the system default shared library path
*
* @throws IOException if NSS has already been initialized,
* the specified directories are invalid, or initialization
* fails for any other reason
*/
throws IOException {
}
throws IOException {
if (isInitialized()) {
throw new IOException("NSS is already initialized");
}
throw new NullPointerException();
}
throw new NullPointerException();
}
} else {
if (base.isDirectory() == false) {
}
if (platformFile.isFile() == false) {
}
}
if (configBase.isDirectory() == false ) {
}
if (secmodFile.isFile() == false) {
}
}
if (supported == false) {
throw new IOException
("The specified version of NSS is incompatible, "
+ "3.7 or later required");
}
if (initok == false) {
throw new IOException("NSS initialization failed");
}
}
/**
* Return an immutable list of all available modules.
*
* @throws IllegalStateException if this Secmod is misconfigured
* or not initialized
*/
try {
if (isInitialized() == false) {
throw new IllegalStateException("NSS not initialized");
}
} catch (IOException e) {
// IOException if misconfigured
throw new IllegalStateException(e);
}
}
return modules;
}
try {
} catch (GeneralSecurityException e) {
throw new ProviderException(e);
}
}
}
}
}
return t;
}
/**
* Constants describing the different types of NSS modules.
* For this API, NSS modules are classified as either one
* of the internal modules delivered as part of NSS or
* as an external module provided by a 3rd party.
*/
public static enum ModuleType {
/**
* The NSS Softtoken crypto module. This is the first
* slot of the softtoken object.
* This module provides
* implementations for cryptographic algorithms but no KeyStore.
*/
/**
* The NSS Softtoken KeyStore module. This is the second
* slot of the softtoken object.
* This module provides
* implementations for cryptographic algorithms (after login)
* and the KeyStore.
*/
/**
* The NSS Softtoken module in FIPS mode. Note that in FIPS mode the
* softtoken presents only one slot, not separate CRYPTO and KEYSTORE
* slots as in non-FIPS mode.
*/
FIPS,
/**
* The NSS builtin trust anchor module. This is the
* NSSCKBI object. It provides no crypto functions.
*/
/**
* An external module.
*/
}
/**
* Returns the first module of the specified type. If no such
* module exists, this method returns null.
*
* @throws IllegalStateException if this Secmod is misconfigured
* or not initialized
*/
return module;
}
}
return null;
}
"library = %s\n"
+ "name = \"%s\"\n"
+ "slotListIndex = %d\n";
"library = %s\n"
+ "name = \"NSS Trust Anchors\"\n"
+ "slotListIndex = 0\n"
+ "enabledMechanisms = { KeyStore }\n"
+ "nssUseSecmodTrust = true\n";
"library = %s\n"
+ "name = \"NSS SoftToken Crypto\"\n"
+ "slotListIndex = 0\n"
+ "disabledMechanisms = { KeyStore }\n";
"library = %s\n"
+ "name = \"NSS SoftToken KeyStore\"\n"
+ "slotListIndex = 1\n"
+ "nssUseSecmodTrust = true\n";
"library = %s\n"
+ "name = \"NSS FIPS SoftToken\"\n"
+ "slotListIndex = 0\n"
+ "nssUseSecmodTrust = true\n";
/**
* A representation of one PKCS#11 slot in a PKCS#11 module.
*/
public static final class Module {
// path of the native library
// descriptive name used by NSS
final int slot;
// trust attributes. Used for the KEYSTORE and TRUSTANCHOR modules only
// must be softtoken
if (fips == false) {
} else {
if (slot != 0) {
throw new RuntimeException
("Slot index should be 0 for FIPS slot");
}
}
} else {
} else {
}
if (fips) {
throw new RuntimeException("FIPS flag set for non-internal "
}
}
this.commonName = commonName;
}
private void initConfiguration() {
switch (type) {
case EXTERNAL:
break;
case CRYPTO:
break;
case KEYSTORE:
break;
case FIPS:
break;
case TRUSTANCHOR:
break;
default:
}
}
/**
* Get the configuration for this module. This is a string
* in the SunPKCS11 configuration format. It can be
* customized with additional options and then made
* current using the setConfiguration() method.
*/
return config;
}
/**
* Set the configuration for this module.
*
* @throws IllegalStateException if the associated provider
* instance has already been created.
*/
throw new IllegalStateException("Provider instance already created");
}
}
/**
* Return the pathname of the native library that implements
* this module. For example, /usr/lib/libpkcs11.so.
*/
return libraryName;
}
/**
* Returns the type of this module.
*/
return type;
}
/**
* Returns the provider instance that is associated with this
* module. The first call to this method creates the provider
* instance.
*/
provider = newProvider();
}
return provider;
}
synchronized boolean hasInitializedProvider() {
}
throw new ProviderException("Secmod provider already initialized");
}
provider = p;
}
try {
} catch (Exception e) {
// XXX
throw new ProviderException(e);
}
}
} else {
// does it already have the correct trust settings?
// XXX not yet implemented
throw new ProviderException("Cannot change existing trust attributes");
}
}
}
// If provider is not set, create a temporary provider to
// retrieve the trust information. This can happen if we need
// to get the trust information for the trustanchor module
// because we need to look for user customized settings in the
// keystore module (which may not have a provider created yet).
// Creating a temporary provider and then dropping it on the
// floor immediately is flawed, but it's the best we can do
// for now.
synchronized (this) {
if (p == null) {
p = newProvider();
}
try {
} catch (PKCS11Exception e) {
throw new RuntimeException(e);
}
}
}
}
return
}
}
/**
* Constants representing NSS trust categories.
*/
public static enum TrustType {
/** Trusted for all purposes */
ALL,
/** Trusted for SSL client authentication */
/** Trusted for SSL server authentication */
/** Trusted for code signing */
/** Trusted for email protection */
}
public static enum DbMode {
this.functionName = functionName;
}
}
/**
* A LoadStoreParameter for use with the NSS Softtoken or
* NSS TrustAnchor KeyStores.
* <p>
* It allows the set of trusted certificates that are returned by
* the KeyStore to be specified.
*/
}
throw new NullPointerException("trustType must not be null");
}
this.protection = prot;
}
return protection;
}
return trustType;
}
}
static class TrustAttributes {
final long handle;
final byte[] shaHash;
try {
// XXX use KeyStore TrustType settings to determine which
// attributes to set
new CK_ATTRIBUTE(CKA_TOKEN, true),
// XXX per PKCS#11 spec, the serial number should be in ASN.1
};
} catch (PKCS11Exception e) {
throw new ProviderException("Could not create trust object", e);
} finally {
}
}
throws PKCS11Exception {
};
attrs = new CK_ATTRIBUTE[] {
};
long c;
try {
} catch (PKCS11Exception e) {
// trust anchor module does not support this attribute
c = serverAuth;
}
clientAuth = c;
}
}
switch (type) {
case CLIENT_AUTH:
return isTrusted(clientAuth);
case SERVER_AUTH:
return isTrusted(serverAuth);
case CODE_SIGNING:
return isTrusted(codeSigning);
case EMAIL_PROTECTION:
return isTrusted(emailProtection);
case ALL:
default:
return false;
}
}
private boolean isTrusted(long l) {
// XXX CKT_TRUSTED?
return (l == CKT_NETSCAPE_TRUSTED_DELEGATOR);
}
}
private static class Bytes {
final byte[] b;
Bytes(byte[] b) {
this.b = b;
}
public int hashCode() {
}
if (this == o) {
return true;
}
if (o instanceof Bytes == false) {
return false;
}
}
}
throws PKCS11Exception {
try {
int MAX_NUM = 8192;
};
}
} finally {
}
return trustMap;
}
}