/*

 * Copyright (c) 1999, 2013, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.provider;

import java.io.*;

import java.lang.reflect.*;

import java.net.URL;

import java.util.*;

import java.security.AccessController;

import java.security.CodeSource;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.Permission;

import java.security.Permissions;

import java.security.PermissionCollection;

import java.security.Principal;

import java.security.PrivilegedAction;

import java.security.UnresolvedPermission;

import java.security.Security;

import java.security.cert.Certificate;

import java.security.cert.X509Certificate;

import javax.security.auth.Subject;

import javax.security.auth.PrivateCredentialPermission;

import sun.security.provider.PolicyParser.GrantEntry;

import sun.security.provider.PolicyParser.PermissionEntry;

import sun.security.provider.PolicyParser.PrincipalEntry;

import sun.security.util.Debug;

import sun.security.util.PolicyUtil;

import sun.security.util.PropertyExpander;

/**

 * See {@code com.sun.security.auth.PolicyFile} for the class description.

 * This class is necessary in order to support a default

 * {@code javax.security.auth.Policy} implementation on the compact1 and

 * compact2 profiles.

 *

 * @deprecated As of JDK 1.4, replaced by

 *             {@code sun.security.provider.PolicyFile}.

 *             This class is entirely deprecated.

 */

@Deprecated

public class AuthPolicyFile extends javax.security.auth.Policy {

    static final ResourceBundle rb =

        AccessController.doPrivileged(new PrivilegedAction<ResourceBundle>() {

            @Override public ResourceBundle run() {

                return (ResourceBundle.getBundle

                        ("sun.security.util.AuthResources"));

            }

        });

    private static final Debug debug = Debug.getInstance("policy",

                                                         "\t[Auth Policy]");

    private static final String AUTH_POLICY = "java.security.auth.policy";

    private static final String SECURITY_MANAGER = "java.security.manager";

    private static final String AUTH_POLICY_URL = "auth.policy.url.";

    private Vector<PolicyEntry> policyEntries;

    private Hashtable<Object, Object> aliasMapping;

    private boolean initialized = false;

    private boolean expandProperties = true;

    private boolean ignoreIdentityScope = true;

    // for use with the reflection API

    private static final Class[] PARAMS = { String.class, String.class};

    /**

     * Initializes the Policy object and reads the default policy

     * configuration file(s) into the Policy object.

     */

    public AuthPolicyFile() {

        // initialize Policy if either the AUTH_POLICY or

        // SECURITY_MANAGER properties are set

        String prop = System.getProperty(AUTH_POLICY);

        if (prop == null) {

            prop = System.getProperty(SECURITY_MANAGER);

        }

        if (prop != null) {

            init();

        }

    }

    private synchronized void init() {

        if (initialized) {

            return;

        }

        policyEntries = new Vector<PolicyEntry>();

        aliasMapping = new Hashtable<Object, Object>(11);

        initPolicyFile();

        initialized = true;

    }

    @Override

    public synchronized void refresh() {

        java.lang.SecurityManager sm = System.getSecurityManager();

        if (sm != null) {

            sm.checkPermission(new javax.security.auth.AuthPermission

                                ("refreshPolicy"));

        }

        // XXX

        //

        // 1)   if code instantiates PolicyFile directly, then it will need

        //      all the permissions required for the PolicyFile initialization

        // 2)   if code calls Policy.getPolicy, then it simply needs

        //      AuthPermission(getPolicy), and the javax.security.auth.Policy

        //      implementation instantiates PolicyFile in a doPrivileged block

        // 3)   if after instantiating a Policy (either via #1 or #2),

        //      code calls refresh, it simply needs

        //      AuthPermission(refreshPolicy).  then PolicyFile wraps

        //      the refresh in a doPrivileged block.

        initialized = false;

        AccessController.doPrivileged(new PrivilegedAction<Void>() {

            @Override public Void run() {

                init();

                return null;

            }

        });

    }

    private KeyStore initKeyStore(URL policyUrl, String keyStoreName,

                                  String keyStoreType) {

        if (keyStoreName != null) {

            try {

                /*

                 * location of keystore is specified as absolute URL in policy

                 * file, or is relative to URL of policy file

                 */

                URL keyStoreUrl = null;

                try {

                    keyStoreUrl = new URL(keyStoreName);

                    // absolute URL

                } catch (java.net.MalformedURLException e) {

                    // relative URL

                    keyStoreUrl = new URL(policyUrl, keyStoreName);

                }

                if (debug != null) {

                    debug.println("reading keystore"+keyStoreUrl);

                }

                InputStream inStream = new BufferedInputStream(

                    PolicyUtil.getInputStream(keyStoreUrl));

                KeyStore ks;

                if (keyStoreType != null)

                    ks = KeyStore.getInstance(keyStoreType);

                else

                    ks = KeyStore.getInstance(KeyStore.getDefaultType());

                ks.load(inStream, null);

                inStream.close();

                return ks;

            } catch (Exception e) {

                // ignore, treat it like we have no keystore

                if (debug != null) {

                    e.printStackTrace();

                }

                return null;

            }

        }

        return null;

    }

    private void initPolicyFile() {

        String prop = Security.getProperty("policy.expandProperties");

        if (prop != null) {

            expandProperties = prop.equalsIgnoreCase("true");

        }

        String iscp = Security.getProperty("policy.ignoreIdentityScope");

        if (iscp != null) {

            ignoreIdentityScope = iscp.equalsIgnoreCase("true");

        }

        String allowSys = Security.getProperty("policy.allowSystemProperty");

        if (allowSys != null && allowSys.equalsIgnoreCase("true")) {

            String extra_policy = System.getProperty(AUTH_POLICY);

            if (extra_policy != null) {

                boolean overrideAll = false;

                if (extra_policy.startsWith("=")) {

                    overrideAll = true;

                    extra_policy = extra_policy.substring(1);

                }

                try {

                    extra_policy = PropertyExpander.expand(extra_policy);

                    URL policyURL;

                    File policyFile = new File(extra_policy);

                    if (policyFile.exists()) {

                        policyURL =

                            new URL("file:" + policyFile.getCanonicalPath());

                    } else {

                        policyURL = new URL(extra_policy);

                    }

                    if (debug != null) {

                        debug.println("reading " + policyURL);

                    }

                    init(policyURL);

                } catch (Exception e) {

                    // ignore.

                    if (debug != null) {

                        debug.println("caught exception: " + e);

                    }

                }

                if (overrideAll) {

                    if (debug != null) {

                        debug.println("overriding other policies!");

                    }

                    return;

                }

            }

        }

        int n = 1;

        boolean loaded_one = false;

        String policy_url;

        while ((policy_url = Security.getProperty(AUTH_POLICY_URL+n)) != null) {

            try {

                policy_url = PropertyExpander.expand(policy_url).replace

                                                (File.separatorChar, '/');

                if (debug != null) {

                    debug.println("reading " + policy_url);

                }

                init(new URL(policy_url));

                loaded_one = true;

            } catch (Exception e) {

                if (debug != null) {

                    debug.println("error reading policy " + e);

                    e.printStackTrace();

                }

                // ignore that policy

            }

            n++;

        }

        if (loaded_one == false) {

            // do not load a static policy

        }

    }

    /**

     * Checks public key. If it is marked as trusted in

     * the identity database, add it to the policy

     * with the AllPermission.

     */

    private boolean checkForTrustedIdentity(final Certificate cert) {

        return false;

    }

    /**

     * Reads a policy configuration into the Policy object using a

     * Reader object.

     *

     * @param policyFile the policy Reader object.

     */

    private void init(URL policy) {

        PolicyParser pp = new PolicyParser(expandProperties);

        try (InputStreamReader isr

                = new InputStreamReader(PolicyUtil.getInputStream(policy))) {

            pp.read(isr);

            KeyStore keyStore = initKeyStore(policy, pp.getKeyStoreUrl(),

                                             pp.getKeyStoreType());

            Enumeration<GrantEntry> enum_ = pp.grantElements();

            while (enum_.hasMoreElements()) {

                GrantEntry ge = enum_.nextElement();

                addGrantEntry(ge, keyStore);

            }

        } catch (PolicyParser.ParsingException pe) {

            System.err.println(AUTH_POLICY +

                               rb.getString(".error.parsing.") + policy);

            System.err.println(AUTH_POLICY + rb.getString("COLON") +

                               pe.getMessage());

            if (debug != null) {

                pe.printStackTrace();

            }

        } catch (Exception e) {

            if (debug != null) {

                debug.println("error parsing " + policy);

                debug.println(e.toString());

                e.printStackTrace();

            }

        }

    }

    /**

     * Given a PermissionEntry, create a codeSource.

     *

     * @return null if signedBy alias is not recognized

     */

    CodeSource getCodeSource(GrantEntry ge, KeyStore keyStore)

            throws java.net.MalformedURLException

    {

        Certificate[] certs = null;

        if (ge.signedBy != null) {

            certs = getCertificates(keyStore, ge.signedBy);

            if (certs == null) {

                // we don't have a key for this alias,

                // just return

                if (debug != null) {

                    debug.println(" no certs for alias " +

                                       ge.signedBy + ", ignoring.");

                }

                return null;

            }

        }

        URL location;

        if (ge.codeBase != null) {

            location = new URL(ge.codeBase);

        } else {

            location = null;

        }

        if (ge.principals == null || ge.principals.size() == 0) {

            return (canonicalizeCodebase

                        (new CodeSource(location, certs),

                        false));

        } else {

            return (canonicalizeCodebase

                (new SubjectCodeSource(null, ge.principals, location, certs),

                false));

        }

    }

    /**

     * Add one policy entry to the vector.

     */

    private void addGrantEntry(GrantEntry ge, KeyStore keyStore) {

        if (debug != null) {

            debug.println("Adding policy entry: ");

            debug.println("  signedBy " + ge.signedBy);

            debug.println("  codeBase " + ge.codeBase);

            if (ge.principals != null) {

                for (PrincipalEntry pppe : ge.principals) {

                    debug.println("  " + pppe.getPrincipalClass() +

                                        " " + pppe.getPrincipalName());

                }

            }

            debug.println();

        }

        try {

            CodeSource codesource = getCodeSource(ge, keyStore);

            // skip if signedBy alias was unknown...

            if (codesource == null) return;

            PolicyEntry entry = new PolicyEntry(codesource);

            Enumeration<PermissionEntry> enum_ = ge.permissionElements();

            while (enum_.hasMoreElements()) {

                PermissionEntry pe = enum_.nextElement();

                try {

                    // XXX special case PrivateCredentialPermission-SELF

                    Permission perm;

                    if (pe.permission.equals

                        ("javax.security.auth.PrivateCredentialPermission") &&

                        pe.name.endsWith(" self")) {

                        perm = getInstance(pe.permission,

                                         pe.name + " \"self\"",

                                         pe.action);

                    } else {

                        perm = getInstance(pe.permission,

                                         pe.name,

                                         pe.action);

                    }

                    entry.add(perm);

                    if (debug != null) {

                        debug.println("  "+perm);

                    }

                } catch (ClassNotFoundException cnfe) {

                    Certificate certs[];

                    if (pe.signedBy != null) {

                        certs = getCertificates(keyStore, pe.signedBy);

                    } else {

                        certs = null;

                    }

                    // only add if we had no signer or we had a

                    // a signer and found the keys for it.

                    if (certs != null || pe.signedBy == null) {

                            Permission perm = new UnresolvedPermission(

                                             pe.permission,

                                             pe.name,

                                             pe.action,

                                             certs);

                            entry.add(perm);

                            if (debug != null) {

                                debug.println("  "+perm);

                            }

                    }

                } catch (java.lang.reflect.InvocationTargetException ite) {

                    System.err.println

                        (AUTH_POLICY +

                        rb.getString(".error.adding.Permission.") +

                        pe.permission +

                        rb.getString("SPACE") +

                        ite.getTargetException());

                } catch (Exception e) {

                    System.err.println

                        (AUTH_POLICY +

                        rb.getString(".error.adding.Permission.") +

                        pe.permission +

                        rb.getString("SPACE") +

                        e);

                }

            }

            policyEntries.addElement(entry);

        } catch (Exception e) {

            System.err.println

                (AUTH_POLICY +

                rb.getString(".error.adding.Entry.") +

                ge +

                rb.getString("SPACE") +

                e);

        }

        if (debug != null) {

            debug.println();

        }

    }

    /**

     * Returns a new Permission object of the given Type. The Permission is

     * created by getting the

     * Class object using the <code>Class.forName</code> method, and using

     * the reflection API to invoke the (String name, String actions)

     * constructor on the

     * object.

     *

     * @param type the type of Permission being created.

     * @param name the name of the Permission being created.

     * @param actions the actions of the Permission being created.

     *

     * @exception  ClassNotFoundException  if the particular Permission

     *             class could not be found.

     *

     * @exception  IllegalAccessException  if the class or initializer is

     *               not accessible.

     *

     * @exception  InstantiationException  if getInstance tries to

     *               instantiate an abstract class or an interface, or if the

     *               instantiation fails for some other reason.

     *

     * @exception  NoSuchMethodException if the (String, String) constructor

     *               is not found.

     *

     * @exception  InvocationTargetException if the underlying Permission

     *               constructor throws an exception.

     *

     */

    private static final Permission getInstance(String type,

                                    String name,

                                    String actions)

        throws ClassNotFoundException,

               InstantiationException,

               IllegalAccessException,

               NoSuchMethodException,

               InvocationTargetException

    {

        //XXX we might want to keep a hash of created factories...

        Class<?> pc = Class.forName(type);

        Constructor<?> c = pc.getConstructor(PARAMS);

        return (Permission) c.newInstance(new Object[] { name, actions });

    }

    /**

     * Fetch all certs associated with this alias.

     */

    Certificate[] getCertificates(KeyStore keyStore, String aliases) {

        Vector<Certificate> vcerts = null;

        StringTokenizer st = new StringTokenizer(aliases, ",");

        int n = 0;

        while (st.hasMoreTokens()) {

            String alias = st.nextToken().trim();

            n++;

            Certificate cert = null;

            // See if this alias's cert has already been cached

            cert = (Certificate) aliasMapping.get(alias);

            if (cert == null && keyStore != null) {

                try {

                    cert = keyStore.getCertificate(alias);

                } catch (KeyStoreException kse) {

                    // never happens, because keystore has already been loaded

                    // when we call this

                }

                if (cert != null) {

                    aliasMapping.put(alias, cert);

                    aliasMapping.put(cert, alias);

                }

            }