/*

 * Copyright (c) 1997, 2015, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.provider;

import java.io.*;

import java.lang.reflect.*;

import java.net.MalformedURLException;

import java.net.URL;

import java.net.URI;

import java.util.*;

import java.text.MessageFormat;

import java.security.*;

import java.security.cert.Certificate;

import java.security.cert.X509Certificate;

import javax.security.auth.Subject;

import javax.security.auth.x500.X500Principal;

import java.io.FilePermission;

import java.net.SocketPermission;

import java.net.NetPermission;

import java.util.concurrent.atomic.AtomicReference;

import sun.misc.JavaSecurityProtectionDomainAccess;

import static sun.misc.JavaSecurityProtectionDomainAccess.ProtectionDomainCache;

import sun.misc.SharedSecrets;

import sun.security.util.PolicyUtil;

import sun.security.util.PropertyExpander;

import sun.security.util.Debug;

import sun.security.util.ResourcesMgr;

import sun.security.util.SecurityConstants;

import sun.net.www.ParseUtil;

/**

 * This class represents a default implementation for

 * <code>java.security.Policy</code>.

 *

 * Note:

 * For backward compatibility with JAAS 1.0 it loads

 * both java.auth.policy and java.policy. However it

 * is recommended that java.auth.policy be not used

 * and the java.policy contain all grant entries including

 * that contain principal-based entries.

 *

 *

 * <p> This object stores the policy for entire Java runtime,

 * and is the amalgamation of multiple static policy

 * configurations that resides in files.

 * The algorithm for locating the policy file(s) and reading their

 * information into this <code>Policy</code> object is:

 *

 * <ol>

 * <li>

 *   Loop through the <code>java.security.Security</code> properties,

 *   <i>policy.url.1</i>, <i>policy.url.2</i>, ...,

 *   <i>policy.url.X</i>" and

 *   <i>auth.policy.url.1</i>, <i>auth.policy.url.2</i>, ...,

 *   <i>auth.policy.url.X</i>".  These properties are set

 *   in the Java security properties file, which is located in the file named

 *   <JAVA_HOME>/conf/security/java.security.

 *   <JAVA_HOME> refers to the value of the java.home system property,

 *   and specifies the directory where the JRE is installed.

 *   Each property value specifies a <code>URL</code> pointing to a

 *   policy file to be loaded.  Read in and load each policy.

 *

 *   <i>auth.policy.url</i> is supported only for backward compatibility.

 *

 * <li>

 *   The <code>java.lang.System</code> property <i>java.security.policy</i>

 *   may also be set to a <code>URL</code> pointing to another policy file

 *   (which is the case when a user uses the -D switch at runtime).

 *   If this property is defined, and its use is allowed by the

 *   security property file (the Security property,

 *   <i>policy.allowSystemProperty</i> is set to <i>true</i>),

 *   also load that policy.

 *

 * <li>

 *   The <code>java.lang.System</code> property

 *   <i>java.security.auth.policy</i> may also be set to a

 *   <code>URL</code> pointing to another policy file

 *   (which is the case when a user uses the -D switch at runtime).

 *   If this property is defined, and its use is allowed by the

 *   security property file (the Security property,

 *   <i>policy.allowSystemProperty</i> is set to <i>true</i>),

 *   also load that policy.

 *

 *   <i>java.security.auth.policy</i> is supported only for backward

 *   compatibility.

 *

 *   If the  <i>java.security.policy</i> or

 *   <i>java.security.auth.policy</i> property is defined using

 *   "==" (rather than "="), then ignore all other specified

 *   policies and only load this policy.

 * </ol>

 *

 * Each policy file consists of one or more grant entries, each of

 * which consists of a number of permission entries.

 *

 * <pre>

 *   grant signedBy "<b>alias</b>", codeBase "<b>URL</b>",

 *         principal <b>principalClass</b> "<b>principalName</b>",

 *         principal <b>principalClass</b> "<b>principalName</b>",

 *         ... {

 *

 *     permission <b>Type</b> "<b>name</b> "<b>action</b>",

 *         signedBy "<b>alias</b>";

 *     permission <b>Type</b> "<b>name</b> "<b>action</b>",

 *         signedBy "<b>alias</b>";

 *     ....

 *   };

 * </pre>

 *

 * All non-bold items above must appear as is (although case

 * doesn't matter and some are optional, as noted below).

 * principal entries are optional and need not be present.

 * Italicized items represent variable values.

 *

 * <p> A grant entry must begin with the word <code>grant</code>.

 * The <code>signedBy</code>,<code>codeBase</code> and <code>principal</code>

 * name/value pairs are optional.

 * If they are not present, then any signer (including unsigned code)

 * will match, and any codeBase will match.

 * Note that the <i>principalClass</i>

 * may be set to the wildcard value, *, which allows it to match

 * any <code>Principal</code> class.  In addition, the <i>principalName</i>

 * may also be set to the wildcard value, *, allowing it to match

 * any <code>Principal</code> name.  When setting the <i>principalName</i>

 * to the *, do not surround the * with quotes.

 *

 * <p> A permission entry must begin with the word <code>permission</code>.

 * The word <code><i>Type</i></code> in the template above is

 * a specific permission type, such as <code>java.io.FilePermission</code>

 * or <code>java.lang.RuntimePermission</code>.

 *

 * <p> The "<i>action</i>" is required for

 * many permission types, such as <code>java.io.FilePermission</code>

 * (where it specifies what type of file access that is permitted).

 * It is not required for categories such as

 * <code>java.lang.RuntimePermission</code>

 * where it is not necessary - you either have the

 * permission specified by the <code>"<i>name</i>"</code>

 * value following the type name or you don't.

 *

 * <p> The <code>signedBy</code> name/value pair for a permission entry

 * is optional. If present, it indicates a signed permission. That is,

 * the permission class itself must be signed by the given alias in

 * order for it to be granted. For example,

 * suppose you have the following grant entry:

 *

 * <pre>

 *   grant principal foo.com.Principal "Duke" {

 *     permission Foo "foobar", signedBy "FooSoft";

 *   }

 * </pre>

 *

 * <p> Then this permission of type <i>Foo</i> is granted if the

 * <code>Foo.class</code> permission has been signed by the

 * "FooSoft" alias, or if XXX <code>Foo.class</code> is a

 * system class (i.e., is found on the CLASSPATH).

 *

 *

 * <p> Items that appear in an entry must appear in the specified order

 * (<code>permission</code>, <i>Type</i>, "<i>name</i>", and

 * "<i>action</i>"). An entry is terminated with a semicolon.

 *

 * <p> Case is unimportant for the identifiers (<code>permission</code>,

 * <code>signedBy</code>, <code>codeBase</code>, etc.) but is

 * significant for the <i>Type</i>

 * or for any string that is passed in as a value.

 *

 * <p> An example of two entries in a policy configuration file is

 * <pre>

 *   // if the code is comes from "foo.com" and is running as "Duke",

 *   // grant it read/write to all files in /tmp.

 *

 *   grant codeBase "foo.com", principal foo.com.Principal "Duke" {

 *              permission java.io.FilePermission "/tmp/*", "read,write";

 *   };

 *

 *   // grant any code running as "Duke" permission to read

 *   // the "java.vendor" Property.

 *

 *   grant principal foo.com.Principal "Duke" {

 *         permission java.util.PropertyPermission "java.vendor";

 *

 *

 * </pre>

 *  This Policy implementation supports special handling of any

 *  permission that contains the string, "<b>${{self}}</b>", as part of

 *  its target name.  When such a permission is evaluated

 *  (such as during a security check), <b>${{self}}</b> is replaced

 *  with one or more Principal class/name pairs.  The exact

 *  replacement performed depends upon the contents of the

 *  grant clause to which the permission belongs.

 * <p>

 *

 *  If the grant clause does not contain any principal information,

 *  the permission will be ignored (permissions containing

 *  <b>${{self}}</b> in their target names are only valid in the context

 *  of a principal-based grant clause).  For example, BarPermission

 *  will always be ignored in the following grant clause:

 *

 * <pre>

 *    grant codebase "www.foo.com", signedby "duke" {

 *      permission BarPermission "... ${{self}} ...";

 *    };

 * </pre>

 *

 *  If the grant clause contains principal information, <b>${{self}}</b>

 *  will be replaced with that same principal information.

 *  For example, <b>${{self}}</b> in BarPermission will be replaced by

 *  <b>javax.security.auth.x500.X500Principal "cn=Duke"</b>

 *  in the following grant clause:

 *

 *  <pre>

 *    grant principal javax.security.auth.x500.X500Principal "cn=Duke" {

 *      permission BarPermission "... ${{self}} ...";

 *    };

 *  </pre>

 *

 *  If there is a comma-separated list of principals in the grant

 *  clause, then <b>${{self}}</b> will be replaced by the same

 *  comma-separated list or principals.

 *  In the case where both the principal class and name are

 *  wildcarded in the grant clause, <b>${{self}}</b> is replaced

 *  with all the principals associated with the <code>Subject</code>

 *  in the current <code>AccessControlContext</code>.

 *

 *

 * <p> For PrivateCredentialPermissions, you can also use "<b>self</b>"

 * instead of "<b>${{self}}</b>". However the use of "<b>self</b>" is

 * deprecated in favour of "<b>${{self}}</b>".

 *

 * @see java.security.CodeSource

 * @see java.security.Permissions

 * @see java.security.ProtectionDomain

 */

public class PolicyFile extends java.security.Policy {

    private static final Debug debug = Debug.getInstance("policy");

    private static final String NONE = "NONE";

    private static final String P11KEYSTORE = "PKCS11";

    private static final String SELF = "${{self}}";

    private static final String X500PRINCIPAL =

                        "javax.security.auth.x500.X500Principal";

    private static final String POLICY = "java.security.policy";

    private static final String SECURITY_MANAGER = "java.security.manager";

    private static final String POLICY_URL = "policy.url.";

    private static final String AUTH_POLICY = "java.security.auth.policy";

    private static final String AUTH_POLICY_URL = "auth.policy.url.";

    private static final int DEFAULT_CACHE_SIZE = 1;

    // contains the policy grant entries, PD cache, and alias mapping

    private AtomicReference<PolicyInfo> policyInfo = new AtomicReference<>();

    private boolean constructed = false;

    private boolean expandProperties = true;

    private boolean allowSystemProperties = true;

    private boolean notUtf8 = false;

    private URL url;

    // for use with the reflection API

    private static final Class<?>[] PARAMS0 = { };

    private static final Class<?>[] PARAMS1 = { String.class };

    private static final Class<?>[] PARAMS2 = { String.class, String.class };

    /**

     * Initializes the Policy object and reads the default policy

     * configuration file(s) into the Policy object.

     */

    public PolicyFile() {

        init((URL)null);

    }

    /**

     * Initializes the Policy object and reads the default policy

     * from the specified URL only.

     */

    public PolicyFile(URL url) {

        this.url = url;

        init(url);

    }

    /**

     * Initializes the Policy object and reads the default policy

     * configuration file(s) into the Policy object.

     *

     * The algorithm for locating the policy file(s) and reading their

     * information into the Policy object is:

     * <pre>

     *   loop through the Security Properties named "policy.url.1",

     *  ""policy.url.2", "auth.policy.url.1",  "auth.policy.url.2" etc, until

     *   you don't find one. Each of these specify a policy file.

     *

     *   if none of these could be loaded, use a builtin static policy

     *      equivalent to the default conf/security/java.policy file.

     *

     *   if the system property "java.policy" or "java.auth.policy" is defined

     * (which is the

     *      case when the user uses the -D switch at runtime), and

     *     its use is allowed by the security property file,

     *     also load it.

     * </pre>

     *

     * Each policy file consists of one or more grant entries, each of

     * which consists of a number of permission entries.

     * <pre>

     *   grant signedBy "<i>alias</i>", codeBase "<i>URL</i>" {

     *     permission <i>Type</i> "<i>name</i>", "<i>action</i>",

     *         signedBy "<i>alias</i>";

     *     ....

     *     permission <i>Type</i> "<i>name</i>", "<i>action</i>",

     *         signedBy "<i>alias</i>";

     *   };

     *

     * </pre>

     *

     * All non-italicized items above must appear as is (although case

     * doesn't matter and some are optional, as noted below).

     * Italicized items represent variable values.

     *

     * <p> A grant entry must begin with the word <code>grant</code>.

     * The <code>signedBy</code> and <code>codeBase</code> name/value

     * pairs are optional.

     * If they are not present, then any signer (including unsigned code)

     * will match, and any codeBase will match.

     *

     * <p> A permission entry must begin with the word <code>permission</code>.

     * The word <code><i>Type</i></code> in the template above would actually

     * be a specific permission type, such as

     * <code>java.io.FilePermission</code> or

     * <code>java.lang.RuntimePermission</code>.

     *

     * <p>The "<i>action</i>" is required for

     * many permission types, such as <code>java.io.FilePermission</code>

     * (where it specifies what type of file access is permitted).

     * It is not required for categories such as

     * <code>java.lang.RuntimePermission</code>

     * where it is not necessary - you either have the

     * permission specified by the <code>"<i>name</i>"</code>

     * value following the type name or you don't.

     *

     * <p>The <code>signedBy</code> name/value pair for a permission entry

     * is optional. If present, it indicates a signed permission. That is,

     * the permission class itself must be signed by the given alias in

     * order for it to be granted. For example,

     * suppose you have the following grant entry:

     *

     * <pre>

     *   grant {

     *     permission Foo "foobar", signedBy "FooSoft";

     *   }

     * </pre>

     *

     * <p>Then this permission of type <i>Foo</i> is granted if the

     * <code>Foo.class</code> permission has been signed by the

     * "FooSoft" alias, or if <code>Foo.class</code> is a

     * system class (i.e., is found on the CLASSPATH).

     *

     * <p>Items that appear in an entry must appear in the specified order

     * (<code>permission</code>, <i>Type</i>, "<i>name</i>", and

     * "<i>action</i>"). An entry is terminated with a semicolon.

     *

     * <p>Case is unimportant for the identifiers (<code>permission</code>,

     * <code>signedBy</code>, <code>codeBase</code>, etc.) but is

     * significant for the <i>Type</i>

     * or for any string that is passed in as a value.

     *

     * <p>An example of two entries in a policy configuration file is

     * <pre>

     *   //  if the code is signed by "Duke", grant it read/write to all

     *   // files in /tmp.

     *

     *   grant signedBy "Duke" {

     *          permission java.io.FilePermission "/tmp/*", "read,write";

     *   };

     *

     *   // grant everyone the following permission

     *

     *   grant {

     *     permission java.util.PropertyPermission "java.vendor";

     *   };

     *  </pre>

     */

    private void init(URL url) {

        // Properties are set once for each init(); ignore changes between

        // between diff invocations of initPolicyFile(policy, url, info).

        String numCacheStr =

          AccessController.doPrivileged(new PrivilegedAction<String>() {

            public String run() {

                expandProperties = "true".equalsIgnoreCase

                    (Security.getProperty("policy.expandProperties"));

                allowSystemProperties = "true".equalsIgnoreCase

                    (Security.getProperty("policy.allowSystemProperty"));

                notUtf8 = "false".equalsIgnoreCase

                    (System.getProperty("sun.security.policy.utf8"));

                return System.getProperty("sun.security.policy.numcaches");

            }});

        int numCaches;

        if (numCacheStr != null) {

            try {

                numCaches = Integer.parseInt(numCacheStr);

            } catch (NumberFormatException e) {

                numCaches = DEFAULT_CACHE_SIZE;

            }

        } else {

            numCaches = DEFAULT_CACHE_SIZE;

        }

        // System.out.println("number caches=" + numCaches);

        PolicyInfo newInfo = new PolicyInfo(numCaches);

        initPolicyFile(newInfo, url);

        policyInfo.set(newInfo);

    }

    private void initPolicyFile(final PolicyInfo newInfo, final URL url) {

        if (url != null) {

            /**

             * If the caller specified a URL via Policy.getInstance,

             * we only read from that URL

             */

            if (debug != null) {

                debug.println("reading "+url);

            }

            AccessController.doPrivileged(new PrivilegedAction<Void>() {

                public Void run() {

                    if (init(url, newInfo) == false) {

                        // use static policy if all else fails

                        initStaticPolicy(newInfo);

                    }

                    return null;

                }

            });

        } else {

            /**

             * Caller did not specify URL via Policy.getInstance.

             * Read from URLs listed in the java.security properties file.

             *

             * We call initPolicyFile with POLICY, POLICY_URL and then

             * call it with AUTH_POLICY and AUTH_POLICY_URL

             * So first we will process the JAVA standard policy

             * and then process the JAVA AUTH Policy.

             * This is for backward compatibility as well as to handle

             * cases where the user has a single unified policyfile

             * with both java policy entries and auth entries

             */

            boolean loaded_one = initPolicyFile(POLICY, POLICY_URL, newInfo);

            // To maintain strict backward compatibility

            // we load the static policy only if POLICY load failed

            if (!loaded_one) {

                // use static policy if all else fails

                initStaticPolicy(newInfo);

            }

            initPolicyFile(AUTH_POLICY, AUTH_POLICY_URL, newInfo);

        }

    }

    private boolean initPolicyFile(final String propname, final String urlname,

                                final PolicyInfo newInfo) {

        Boolean loadedPolicy =

            AccessController.doPrivileged(new PrivilegedAction<Boolean>() {

            public Boolean run() {

                boolean loaded_policy = false;

                if (allowSystemProperties) {

                    String extra_policy = System.getProperty(propname);

                    if (extra_policy != null) {

                        boolean overrideAll = false;

                        if (extra_policy.startsWith("=")) {

                            overrideAll = true;

                            extra_policy = extra_policy.substring(1);

                        }

                        try {

                            extra_policy =

                                PropertyExpander.expand(extra_policy);

                            URL policyURL;

                            File policyFile = new File(extra_policy);

                            if (policyFile.exists()) {

                                policyURL = ParseUtil.fileToEncodedURL

                                    (new File(policyFile.getCanonicalPath()));

                            } else {

                                policyURL = new URL(extra_policy);

                            }

                            if (debug != null)

                                debug.println("reading "+policyURL);

                            if (init(policyURL, newInfo))

                                loaded_policy = true;

                        } catch (Exception e) {

                            // ignore.

                            if (debug != null) {

                                debug.println("caught exception: "+e);

                            }

                        }