jdk/src/share/classes/sun/security/ssl/JsseJce.java
author xuelei
Fri, 08 Apr 2011 02:00:09 -0700
changeset 9246 c459f79af46b
parent 5506 202f599c92aa
child 9691 98b26ecef4c0
permissions -rw-r--r--
6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled Summary: Reorg the SSLContext implementation Reviewed-by: weijun
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
/*
9246
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 5506
diff changeset
     2
 * Copyright (c) 2001, 2011, Oracle and/or its affiliates. All rights reserved.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
90ce3da70b43 Initial load
duke
parents:
diff changeset
     4
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
     5
 * This code is free software; you can redistribute it and/or modify it
90ce3da70b43 Initial load
duke
parents:
diff changeset
     6
 * under the terms of the GNU General Public License version 2 only, as
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 3957
diff changeset
     7
 * published by the Free Software Foundation.  Oracle designates this
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     8
 * particular file as subject to the "Classpath" exception as provided
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 3957
diff changeset
     9
 * by Oracle in the LICENSE file that accompanied this code.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    10
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    11
 * This code is distributed in the hope that it will be useful, but WITHOUT
90ce3da70b43 Initial load
duke
parents:
diff changeset
    12
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    13
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
90ce3da70b43 Initial load
duke
parents:
diff changeset
    14
 * version 2 for more details (a copy is included in the LICENSE file that
90ce3da70b43 Initial load
duke
parents:
diff changeset
    15
 * accompanied this code).
90ce3da70b43 Initial load
duke
parents:
diff changeset
    16
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    17
 * You should have received a copy of the GNU General Public License version
90ce3da70b43 Initial load
duke
parents:
diff changeset
    18
 * 2 along with this work; if not, write to the Free Software Foundation,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    19
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    20
 *
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 3957
diff changeset
    21
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 3957
diff changeset
    22
 * or visit www.oracle.com if you need additional information or have any
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 3957
diff changeset
    23
 * questions.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    24
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    25
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
package sun.security.ssl;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
import java.util.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
import java.math.BigInteger;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    30
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
import java.security.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
import java.security.interfaces.RSAPublicKey;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    33
import java.security.spec.RSAPublicKeySpec;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
import java.security.spec.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
90ce3da70b43 Initial load
duke
parents:
diff changeset
    36
import javax.crypto.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
90ce3da70b43 Initial load
duke
parents:
diff changeset
    38
// explicit import to override the Provider class in this package
90ce3da70b43 Initial load
duke
parents:
diff changeset
    39
import java.security.Provider;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
// need internal Sun classes for FIPS tricks
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
import sun.security.jca.Providers;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    43
import sun.security.jca.ProviderList;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    44
90ce3da70b43 Initial load
duke
parents:
diff changeset
    45
import sun.security.ec.ECParameters;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    46
import sun.security.ec.NamedCurve;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    47
90ce3da70b43 Initial load
duke
parents:
diff changeset
    48
import static sun.security.ssl.SunJSSE.cryptoProvider;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    49
90ce3da70b43 Initial load
duke
parents:
diff changeset
    50
/**
90ce3da70b43 Initial load
duke
parents:
diff changeset
    51
 * This class contains a few static methods for interaction with the JCA/JCE
90ce3da70b43 Initial load
duke
parents:
diff changeset
    52
 * to obtain implementations, etc.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    53
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    54
 * @author  Andreas Sterbenz
90ce3da70b43 Initial load
duke
parents:
diff changeset
    55
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
final class JsseJce {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
    private final static Debug debug = Debug.getInstance("ssl");
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
90ce3da70b43 Initial load
duke
parents:
diff changeset
    60
    private final static ProviderList fipsProviderList;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
    // Flag indicating whether EC crypto is available.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    63
    // If null, then we have not checked yet.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    64
    // If yes, then all the EC based crypto we need is available.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    65
    private static volatile Boolean ecAvailable;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    66
3957
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    67
    // Flag indicating whether Kerberos crypto is available.
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    68
    // If true, then all the Kerberos-based crypto we need is available.
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    69
    private final static boolean kerberosAvailable;
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    70
    static {
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    71
        boolean temp;
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    72
        try {
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    73
            AccessController.doPrivileged(
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    74
                new PrivilegedExceptionAction<Void>() {
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    75
                    public Void run() throws Exception {
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    76
                        // Test for Kerberos using the bootstrap class loader
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    77
                        Class.forName("sun.security.krb5.PrincipalName", true,
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    78
                                null);
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    79
                        return null;
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    80
                    }
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    81
                });
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    82
            temp = true;
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    83
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    84
        } catch (Exception e) {
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    85
            temp = false;
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    86
        }
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    87
        kerberosAvailable = temp;
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    88
    }
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
    89
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    90
    static {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    91
        // force FIPS flag initialization
90ce3da70b43 Initial load
duke
parents:
diff changeset
    92
        // Because isFIPS() is synchronized and cryptoProvider is not modified
90ce3da70b43 Initial load
duke
parents:
diff changeset
    93
        // after it completes, this also eliminates the need for any further
90ce3da70b43 Initial load
duke
parents:
diff changeset
    94
        // synchronization when accessing cryptoProvider
90ce3da70b43 Initial load
duke
parents:
diff changeset
    95
        if (SunJSSE.isFIPS() == false) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    96
            fipsProviderList = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    97
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    98
            // Setup a ProviderList that can be used by the trust manager
90ce3da70b43 Initial load
duke
parents:
diff changeset
    99
            // during certificate chain validation. All the crypto must be
90ce3da70b43 Initial load
duke
parents:
diff changeset
   100
            // from the FIPS provider, but we also allow the required
90ce3da70b43 Initial load
duke
parents:
diff changeset
   101
            // certificate related services from the SUN provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   102
            Provider sun = Security.getProvider("SUN");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   103
            if (sun == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   104
                throw new RuntimeException
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
                    ("FIPS mode: SUN provider must be installed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   106
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   107
            Provider sunCerts = new SunCertificates(sun);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   108
            fipsProviderList = ProviderList.newList(cryptoProvider, sunCerts);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   109
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   111
90ce3da70b43 Initial load
duke
parents:
diff changeset
   112
    private static final class SunCertificates extends Provider {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   113
        SunCertificates(final Provider p) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   114
            super("SunCertificates", 1.0d, "SunJSSE internal");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   115
            AccessController.doPrivileged(new PrivilegedAction<Object>() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   116
                public Object run() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   117
                    // copy certificate related services from the Sun provider
90ce3da70b43 Initial load
duke
parents:
diff changeset
   118
                    for (Map.Entry<Object,Object> entry : p.entrySet()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   119
                        String key = (String)entry.getKey();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   120
                        if (key.startsWith("CertPathValidator.")
90ce3da70b43 Initial load
duke
parents:
diff changeset
   121
                                || key.startsWith("CertPathBuilder.")
90ce3da70b43 Initial load
duke
parents:
diff changeset
   122
                                || key.startsWith("CertStore.")
90ce3da70b43 Initial load
duke
parents:
diff changeset
   123
                                || key.startsWith("CertificateFactory.")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   124
                            put(key, entry.getValue());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   125
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   126
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   127
                    return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   128
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   129
            });
90ce3da70b43 Initial load
duke
parents:
diff changeset
   130
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   132
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
     * JCE transformation string for RSA with PKCS#1 v1.5 padding.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
     * Can be used for encryption, decryption, signing, verifying.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   136
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
    final static String CIPHER_RSA_PKCS1 = "RSA/ECB/PKCS1Padding";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
     * JCE transformation string for the stream cipher RC4.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
    final static String CIPHER_RC4 = "RC4";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
     * JCE transformation string for DES in CBC mode without padding.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
    final static String CIPHER_DES = "DES/CBC/NoPadding";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
     * JCE transformation string for (3-key) Triple DES in CBC mode
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
     * without padding.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   150
    final static String CIPHER_3DES = "DESede/CBC/NoPadding";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   151
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   152
     * JCE transformation string for AES in CBC mode
90ce3da70b43 Initial load
duke
parents:
diff changeset
   153
     * without padding.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   154
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   155
    final static String CIPHER_AES = "AES/CBC/NoPadding";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   156
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   157
     * JCA identifier string for DSA, i.e. a DSA with SHA-1.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   158
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   159
    final static String SIGNATURE_DSA = "DSA";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   160
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   161
     * JCA identifier string for ECDSA, i.e. a ECDSA with SHA-1.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   162
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   163
    final static String SIGNATURE_ECDSA = "SHA1withECDSA";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   164
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   165
     * JCA identifier string for Raw DSA, i.e. a DSA signature without
90ce3da70b43 Initial load
duke
parents:
diff changeset
   166
     * hashing where the application provides the SHA-1 hash of the data.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   167
     * Note that the standard name is "NONEwithDSA" but we use "RawDSA"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   168
     * for compatibility.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   169
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   170
    final static String SIGNATURE_RAWDSA = "RawDSA";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   171
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   172
     * JCA identifier string for Raw ECDSA, i.e. a DSA signature without
90ce3da70b43 Initial load
duke
parents:
diff changeset
   173
     * hashing where the application provides the SHA-1 hash of the data.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   174
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   175
    final static String SIGNATURE_RAWECDSA = "NONEwithECDSA";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   176
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   177
     * JCA identifier string for Raw RSA, i.e. a RSA PKCS#1 v1.5 signature
90ce3da70b43 Initial load
duke
parents:
diff changeset
   178
     * without hashing where the application provides the hash of the data.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
     * Used for RSA client authentication with a 36 byte hash.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   180
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   181
    final static String SIGNATURE_RAWRSA = "NONEwithRSA";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   182
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   183
     * JCA identifier string for the SSL/TLS style RSA Signature. I.e.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   184
     * an signature using RSA with PKCS#1 v1.5 padding signing a
90ce3da70b43 Initial load
duke
parents:
diff changeset
   185
     * concatenation of an MD5 and SHA-1 digest.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   186
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   187
    final static String SIGNATURE_SSLRSA = "MD5andSHA1withRSA";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   188
90ce3da70b43 Initial load
duke
parents:
diff changeset
   189
    private JsseJce() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   190
        // no instantiation of this class
90ce3da70b43 Initial load
duke
parents:
diff changeset
   191
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   192
90ce3da70b43 Initial load
duke
parents:
diff changeset
   193
    static boolean isEcAvailable() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   194
        if (ecAvailable == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   195
            try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   196
                JsseJce.getSignature(SIGNATURE_ECDSA);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   197
                JsseJce.getSignature(SIGNATURE_RAWECDSA);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   198
                JsseJce.getKeyAgreement("ECDH");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   199
                JsseJce.getKeyFactory("EC");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   200
                JsseJce.getKeyPairGenerator("EC");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   201
                ecAvailable = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   202
            } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   203
                ecAvailable = false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   204
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   205
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   206
        return ecAvailable;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   207
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   208
90ce3da70b43 Initial load
duke
parents:
diff changeset
   209
    static void clearEcAvailable() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   210
        ecAvailable = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   211
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   212
3957
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
   213
    static boolean isKerberosAvailable() {
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
   214
        return kerberosAvailable;
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
   215
    }
c8fdb8fad795 6885204: JSSE should not require Kerberos to be present
vinnie
parents: 715
diff changeset
   216
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   217
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   218
     * Return an JCE cipher implementation for the specified algorithm.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   219
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   220
    static Cipher getCipher(String transformation)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   221
            throws NoSuchAlgorithmException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   222
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   223
            if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   224
                return Cipher.getInstance(transformation);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   225
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   226
                return Cipher.getInstance(transformation, cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   227
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   228
        } catch (NoSuchPaddingException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   229
            throw new NoSuchAlgorithmException(e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   230
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   231
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   232
90ce3da70b43 Initial load
duke
parents:
diff changeset
   233
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   234
     * Return an JCA signature implementation for the specified algorithm.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   235
     * The algorithm string should be one of the constants defined
90ce3da70b43 Initial load
duke
parents:
diff changeset
   236
     * in this class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   237
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   238
    static Signature getSignature(String algorithm)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   239
            throws NoSuchAlgorithmException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   240
        if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   241
            return Signature.getInstance(algorithm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   242
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   243
            // reference equality
90ce3da70b43 Initial load
duke
parents:
diff changeset
   244
            if (algorithm == SIGNATURE_SSLRSA) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   245
                // The SunPKCS11 provider currently does not support this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   246
                // special algorithm. We allow a fallback in this case because
90ce3da70b43 Initial load
duke
parents:
diff changeset
   247
                // the SunJSSE implementation does the actual crypto using
90ce3da70b43 Initial load
duke
parents:
diff changeset
   248
                // a NONEwithRSA signature obtained from the cryptoProvider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   249
                if (cryptoProvider.getService("Signature", algorithm) == null) {
9246
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 5506
diff changeset
   250
                    // Calling Signature.getInstance() and catching the
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 5506
diff changeset
   251
                    // exception would be cleaner, but exceptions are a little
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 5506
diff changeset
   252
                    // expensive. So we check directly via getService().
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   253
                    try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   254
                        return Signature.getInstance(algorithm, "SunJSSE");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   255
                    } catch (NoSuchProviderException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   256
                        throw new NoSuchAlgorithmException(e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   257
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   258
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   259
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   260
            return Signature.getInstance(algorithm, cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   261
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   262
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   263
90ce3da70b43 Initial load
duke
parents:
diff changeset
   264
    static KeyGenerator getKeyGenerator(String algorithm)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   265
            throws NoSuchAlgorithmException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   266
        if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   267
            return KeyGenerator.getInstance(algorithm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   268
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   269
            return KeyGenerator.getInstance(algorithm, cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   270
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   271
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   272
90ce3da70b43 Initial load
duke
parents:
diff changeset
   273
    static KeyPairGenerator getKeyPairGenerator(String algorithm)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   274
            throws NoSuchAlgorithmException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   275
        if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   276
            return KeyPairGenerator.getInstance(algorithm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   277
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   278
            return KeyPairGenerator.getInstance(algorithm, cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   279
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   280
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   281
90ce3da70b43 Initial load
duke
parents:
diff changeset
   282
    static KeyAgreement getKeyAgreement(String algorithm)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   283
            throws NoSuchAlgorithmException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   284
        if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   285
            return KeyAgreement.getInstance(algorithm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   286
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   287
            return KeyAgreement.getInstance(algorithm, cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   288
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   289
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   290
90ce3da70b43 Initial load
duke
parents:
diff changeset
   291
    static Mac getMac(String algorithm)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   292
            throws NoSuchAlgorithmException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   293
        if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   294
            return Mac.getInstance(algorithm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   295
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   296
            return Mac.getInstance(algorithm, cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   297
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   298
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   299
90ce3da70b43 Initial load
duke
parents:
diff changeset
   300
    static KeyFactory getKeyFactory(String algorithm)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   301
            throws NoSuchAlgorithmException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   302
        if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   303
            return KeyFactory.getInstance(algorithm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   304
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   305
            return KeyFactory.getInstance(algorithm, cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   306
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   307
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   308
90ce3da70b43 Initial load
duke
parents:
diff changeset
   309
    static SecureRandom getSecureRandom() throws KeyManagementException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   310
        if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   311
            return new SecureRandom();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   312
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   313
        // Try "PKCS11" first. If that is not supported, iterate through
90ce3da70b43 Initial load
duke
parents:
diff changeset
   314
        // the provider and return the first working implementation.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   315
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   316
            return SecureRandom.getInstance("PKCS11", cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   317
        } catch (NoSuchAlgorithmException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   318
            // ignore
90ce3da70b43 Initial load
duke
parents:
diff changeset
   319
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   320
        for (Provider.Service s : cryptoProvider.getServices()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   321
            if (s.getType().equals("SecureRandom")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   322
                try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   323
                    return SecureRandom.getInstance(s.getAlgorithm(), cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   324
                } catch (NoSuchAlgorithmException ee) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   325
                    // ignore
90ce3da70b43 Initial load
duke
parents:
diff changeset
   326
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   327
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   328
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   329
        throw new KeyManagementException("FIPS mode: no SecureRandom "
90ce3da70b43 Initial load
duke
parents:
diff changeset
   330
            + " implementation found in provider " + cryptoProvider.getName());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   331
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   332
90ce3da70b43 Initial load
duke
parents:
diff changeset
   333
    static MessageDigest getMD5() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   334
        return getMessageDigest("MD5");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   335
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   336
90ce3da70b43 Initial load
duke
parents:
diff changeset
   337
    static MessageDigest getSHA() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   338
        return getMessageDigest("SHA");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   339
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   340
90ce3da70b43 Initial load
duke
parents:
diff changeset
   341
    static MessageDigest getMessageDigest(String algorithm) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   342
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   343
            if (cryptoProvider == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   344
                return MessageDigest.getInstance(algorithm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   345
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   346
                return MessageDigest.getInstance(algorithm, cryptoProvider);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   347
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   348
        } catch (NoSuchAlgorithmException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   349
            throw new RuntimeException
90ce3da70b43 Initial load
duke
parents:
diff changeset
   350
                        ("Algorithm " + algorithm + " not available", e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   351
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   352
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   353
90ce3da70b43 Initial load
duke
parents:
diff changeset
   354
    static int getRSAKeyLength(PublicKey key) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   355
        BigInteger modulus;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   356
        if (key instanceof RSAPublicKey) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   357
            modulus = ((RSAPublicKey)key).getModulus();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   358
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   359
            RSAPublicKeySpec spec = getRSAPublicKeySpec(key);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   360
            modulus = spec.getModulus();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   361
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   362
        return modulus.bitLength();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   363
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   364
90ce3da70b43 Initial load
duke
parents:
diff changeset
   365
    static RSAPublicKeySpec getRSAPublicKeySpec(PublicKey key) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   366
        if (key instanceof RSAPublicKey) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   367
            RSAPublicKey rsaKey = (RSAPublicKey)key;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   368
            return new RSAPublicKeySpec(rsaKey.getModulus(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   369
                                        rsaKey.getPublicExponent());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   370
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   371
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   372
            KeyFactory factory = JsseJce.getKeyFactory("RSA");
51
6fe31bc95bbc 6600143: Remove another 450 unnecessary casts
martin
parents: 2
diff changeset
   373
            return factory.getKeySpec(key, RSAPublicKeySpec.class);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   374
        } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   375
            throw (RuntimeException)new RuntimeException().initCause(e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   376
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   377
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   378
90ce3da70b43 Initial load
duke
parents:
diff changeset
   379
    static ECParameterSpec getECParameterSpec(String namedCurveOid) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   380
        return NamedCurve.getECParameterSpec(namedCurveOid);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   381
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   382
90ce3da70b43 Initial load
duke
parents:
diff changeset
   383
    static String getNamedCurveOid(ECParameterSpec params) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   384
        return ECParameters.getCurveName(params);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   385
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   386
90ce3da70b43 Initial load
duke
parents:
diff changeset
   387
    static ECPoint decodePoint(byte[] encoded, EllipticCurve curve)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   388
            throws java.io.IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   389
        return ECParameters.decodePoint(encoded, curve);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   390
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   391
90ce3da70b43 Initial load
duke
parents:
diff changeset
   392
    static byte[] encodePoint(ECPoint point, EllipticCurve curve) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   393
        return ECParameters.encodePoint(point, curve);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   394
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   395
90ce3da70b43 Initial load
duke
parents:
diff changeset
   396
    // In FIPS mode, set thread local providers; otherwise a no-op.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   397
    // Must be paired with endFipsProvider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   398
    static Object beginFipsProvider() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   399
        if (fipsProviderList == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   400
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   401
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   402
            return Providers.beginThreadProviderList(fipsProviderList);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   403
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   404
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   405
90ce3da70b43 Initial load
duke
parents:
diff changeset
   406
    static void endFipsProvider(Object o) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   407
        if (fipsProviderList != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   408
            Providers.endThreadProviderList((ProviderList)o);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   409
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   410
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   411
90ce3da70b43 Initial load
duke
parents:
diff changeset
   412
}