/*

 * Copyright (c) 2003, 2016, Oracle and/or its affiliates. All rights reserved.

 */

/* Copyright  (c) 2002 Graz University of Technology. All rights reserved.

 *

 * Redistribution and use in  source and binary forms, with or without

 * modification, are permitted  provided that the following conditions are met:

 *

 * 1. Redistributions of  source code must retain the above copyright notice,

 *    this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in  binary form must reproduce the above copyright notice,

 *    this list of conditions and the following disclaimer in the documentation

 *    and/or other materials provided with the distribution.

 *

 * 3. The end-user documentation included with the redistribution, if any, must

 *    include the following acknowledgment:

 *

 *    "This product includes software developed by IAIK of Graz University of

 *     Technology."

 *

 *    Alternately, this acknowledgment may appear in the software itself, if

 *    and wherever such third-party acknowledgments normally appear.

 *

 * 4. The names "Graz University of Technology" and "IAIK of Graz University of

 *    Technology" must not be used to endorse or promote products derived from

 *    this software without prior written permission.

 *

 * 5. Products derived from this software may not be called

 *    "IAIK PKCS Wrapper", nor may "IAIK" appear in their name, without prior

 *    written permission of Graz University of Technology.

 *

 *  THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR IMPLIED

 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

 *  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 *  PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE LICENSOR BE

 *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,

 *  OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

 *  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,

 *  OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON

 *  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,

 *  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

 *  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

 *  POSSIBILITY  OF SUCH DAMAGE.

 */

package sun.security.pkcs11.wrapper;

import java.io.File;

import java.io.IOException;

import java.util.*;

import java.security.AccessController;

import java.security.PrivilegedAction;

import sun.security.util.Debug;

import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

/**

 * This is the default implementation of the PKCS11 interface. IT connects to

 * the pkcs11wrapper.dll file, which is the native part of this library.

 * The strange and awkward looking initialization was chosen to avoid calling

 * loadLibrary from a static initialization block, because this would complicate

 * the use in applets.

 *

 * @author Karl Scheibelhofer <Karl.Scheibelhofer@iaik.at>

 * @author Martin Schlaeffer <schlaeff@sbox.tugraz.at>

 * @invariants (pkcs11ModulePath_ <> null)

 */

public class PKCS11 {

    /**

     * The name of the native part of the wrapper; i.e. the filename without

     * the extension (e.g. ".DLL" or ".so").

     */

    private static final String PKCS11_WRAPPER = "j2pkcs11";

    static {

        // cannot use LoadLibraryAction because that would make the native

        // library available to the bootclassloader, but we run in the

        // extension classloader.

        AccessController.doPrivileged(new PrivilegedAction<Object>() {

            public Object run() {

                System.loadLibrary(PKCS11_WRAPPER);

                return null;

            }

        });

        boolean enableDebug = Debug.getInstance("sunpkcs11") != null;

        initializeLibrary(enableDebug);

    }

    public static void loadNative() {

        // dummy method that can be called to make sure the native

        // portion has been loaded. actual loading happens in the

        // static initializer, hence this method is empty.

    }

    /**

     * The PKCS#11 module to connect to. This is the PKCS#11 driver of the token;

     * e.g. pk2priv.dll.

     */

    private final String pkcs11ModulePath;

    private long pNativeData;

    /**

     * This method does the initialization of the native library. It is called

     * exactly once for this class.

     *

     * @preconditions

     * @postconditions

     */

    private static native void initializeLibrary(boolean debug);

    // XXX

    /**

     * This method does the finalization of the native library. It is called

     * exactly once for this class. The library uses this method for a clean-up

     * of any resources.

     *

     * @preconditions

     * @postconditions

     */

    private static native void finalizeLibrary();

    private static final Map<String,PKCS11> moduleMap =

        new HashMap<String,PKCS11>();

    /**

     * Connects to the PKCS#11 driver given. The filename must contain the

     * path, if the driver is not in the system's search path.

     *

     * @param pkcs11ModulePath the PKCS#11 library path

     * @preconditions (pkcs11ModulePath <> null)

     * @postconditions

     */

    PKCS11(String pkcs11ModulePath, String functionListName)

            throws IOException {

        connect(pkcs11ModulePath, functionListName);

        this.pkcs11ModulePath = pkcs11ModulePath;

    }

    public static synchronized PKCS11 getInstance(String pkcs11ModulePath,

            String functionList, CK_C_INITIALIZE_ARGS pInitArgs,

            boolean omitInitialize) throws IOException, PKCS11Exception {

        // we may only call C_Initialize once per native .so/.dll

        // so keep a cache using the (non-canonicalized!) path

        PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath);

        if (pkcs11 == null) {

            if ((pInitArgs != null)

                    && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) {

                pkcs11 = new PKCS11(pkcs11ModulePath, functionList);

            } else {

                pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);

            }

            if (omitInitialize == false) {

                try {

                    pkcs11.C_Initialize(pInitArgs);

                } catch (PKCS11Exception e) {

                    // ignore already-initialized error code

                    // rethrow all other errors

                    if (e.getErrorCode() != CKR_CRYPTOKI_ALREADY_INITIALIZED) {

                        throw e;

                    }

                }

            }

            moduleMap.put(pkcs11ModulePath, pkcs11);

        }

        return pkcs11;

    }

    /**

     * Connects this object to the specified PKCS#11 library. This method is for

     * internal use only.

     * Declared private, because incorrect handling may result in errors in the

     * native part.

     *

     * @param pkcs11ModulePath The PKCS#11 library path.

     * @preconditions (pkcs11ModulePath <> null)

     * @postconditions

     */

    private native void connect(String pkcs11ModulePath, String functionListName)

            throws IOException;

    /**

     * Disconnects the PKCS#11 library from this object. After calling this

     * method, this object is no longer connected to a native PKCS#11 module

     * and any subsequent calls to C_ methods will fail. This method is for

     * internal use only.

     * Declared private, because incorrect handling may result in errors in the

     * native part.

     *

     * @preconditions

     * @postconditions

     */

    private native void disconnect();

    // Implementation of PKCS11 methods delegated to native pkcs11wrapper library

/* *****************************************************************************

 * General-purpose

 ******************************************************************************/

    /**

     * C_Initialize initializes the Cryptoki library.

     * (General-purpose)

     *

     * @param pInitArgs if pInitArgs is not NULL it gets casted to

     *         CK_C_INITIALIZE_ARGS_PTR and dereferenced

     *         (PKCS#11 param: CK_VOID_PTR pInitArgs)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

    native void C_Initialize(Object pInitArgs) throws PKCS11Exception;

    /**

     * C_Finalize indicates that an application is done with the

     * Cryptoki library

     * (General-purpose)

     *

     * @param pReserved is reserved. Should be NULL_PTR

     *         (PKCS#11 param: CK_VOID_PTR pReserved)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions (pReserved == null)

     * @postconditions

     */

    public native void C_Finalize(Object pReserved) throws PKCS11Exception;

    /**

     * C_GetInfo returns general information about Cryptoki.

     * (General-purpose)

     *

     * @return the information.

     *         (PKCS#11 param: CK_INFO_PTR pInfo)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions (result <> null)

     */

    public native CK_INFO C_GetInfo() throws PKCS11Exception;

/* *****************************************************************************

 * Slot and token management

 ******************************************************************************/

    /**

     * C_GetSlotList obtains a list of slots in the system.

     * (Slot and token management)

     *

     * @param tokenPresent if true only Slot IDs with a token are returned

     *         (PKCS#11 param: CK_BBOOL tokenPresent)

     * @return a long array of slot IDs and number of Slot IDs

     *         (PKCS#11 param: CK_SLOT_ID_PTR pSlotList, CK_ULONG_PTR pulCount)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions (result <> null)

     */

    public native long[] C_GetSlotList(boolean tokenPresent)

            throws PKCS11Exception;

    /**

     * C_GetSlotInfo obtains information about a particular slot in

     * the system.

     * (Slot and token management)

     *

     * @param slotID the ID of the slot

     *         (PKCS#11 param: CK_SLOT_ID slotID)

     * @return the slot information

     *         (PKCS#11 param: CK_SLOT_INFO_PTR pInfo)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions (result <> null)

     */

    public native CK_SLOT_INFO C_GetSlotInfo(long slotID) throws PKCS11Exception;

    /**

     * C_GetTokenInfo obtains information about a particular token

     * in the system.

     * (Slot and token management)

     *

     * @param slotID ID of the token's slot

     *         (PKCS#11 param: CK_SLOT_ID slotID)

     * @return the token information

     *         (PKCS#11 param: CK_TOKEN_INFO_PTR pInfo)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions (result <> null)

     */

    public native CK_TOKEN_INFO C_GetTokenInfo(long slotID)

            throws PKCS11Exception;

    /**

     * C_GetMechanismList obtains a list of mechanism types

     * supported by a token.

     * (Slot and token management)

     *

     * @param slotID ID of the token's slot

     *         (PKCS#11 param: CK_SLOT_ID slotID)

     * @return a long array of mechanism types and number of mechanism types

     *         (PKCS#11 param: CK_MECHANISM_TYPE_PTR pMechanismList,

     *                         CK_ULONG_PTR pulCount)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions (result <> null)

     */

    public native long[] C_GetMechanismList(long slotID) throws PKCS11Exception;

    /**

     * C_GetMechanismInfo obtains information about a particular

     * mechanism possibly supported by a token.

     * (Slot and token management)

     *

     * @param slotID ID of the token's slot

     *         (PKCS#11 param: CK_SLOT_ID slotID)

     * @param type type of mechanism

     *         (PKCS#11 param: CK_MECHANISM_TYPE type)

     * @return the mechanism info

     *         (PKCS#11 param: CK_MECHANISM_INFO_PTR pInfo)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions (result <> null)

     */

    public native CK_MECHANISM_INFO C_GetMechanismInfo(long slotID, long type)

            throws PKCS11Exception;

    /**

     * C_InitToken initializes a token.

     * (Slot and token management)

     *

     * @param slotID ID of the token's slot

     *         (PKCS#11 param: CK_SLOT_ID slotID)

     * @param pPin the SO's initial PIN and the length in bytes of the PIN

     *         (PKCS#11 param: CK_CHAR_PTR pPin, CK_ULONG ulPinLen)

     * @param pLabel 32-byte token label (blank padded)

     *         (PKCS#11 param: CK_UTF8CHAR_PTR pLabel)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

//    public native void C_InitToken(long slotID, char[] pPin, char[] pLabel)

//            throws PKCS11Exception;

    /**

     * C_InitPIN initializes the normal user's PIN.

     * (Slot and token management)

     *

     * @param hSession the session's handle

     *         (PKCS#11 param: CK_SESSION_HANDLE hSession)

     * @param pPin the normal user's PIN and the length in bytes of the PIN

     *         (PKCS#11 param: CK_CHAR_PTR pPin, CK_ULONG ulPinLen)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

//    public native void C_InitPIN(long hSession, char[] pPin)

//            throws PKCS11Exception;

    /**

     * C_SetPIN modifies the PIN of the user who is logged in.

     * (Slot and token management)

     *

     * @param hSession the session's handle

     *         (PKCS#11 param: CK_SESSION_HANDLE hSession)

     * @param pOldPin the old PIN and the length of the old PIN

     *         (PKCS#11 param: CK_CHAR_PTR pOldPin, CK_ULONG ulOldLen)

     * @param pNewPin the new PIN and the length of the new PIN

     *         (PKCS#11 param: CK_CHAR_PTR pNewPin, CK_ULONG ulNewLen)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

//    public native void C_SetPIN(long hSession, char[] pOldPin, char[] pNewPin)

//            throws PKCS11Exception;

/* *****************************************************************************

 * Session management

 ******************************************************************************/

    /**

     * C_OpenSession opens a session between an application and a

     * token.

     * (Session management)

     *

     * @param slotID the slot's ID

     *         (PKCS#11 param: CK_SLOT_ID slotID)

     * @param flags of CK_SESSION_INFO

     *         (PKCS#11 param: CK_FLAGS flags)

     * @param pApplication passed to callback

     *         (PKCS#11 param: CK_VOID_PTR pApplication)

     * @param Notify the callback function

     *         (PKCS#11 param: CK_NOTIFY Notify)

     * @return the session handle

     *         (PKCS#11 param: CK_SESSION_HANDLE_PTR phSession)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

    public native long C_OpenSession(long slotID, long flags,

            Object pApplication, CK_NOTIFY Notify) throws PKCS11Exception;

    /**

     * C_CloseSession closes a session between an application and a

     * token.

     * (Session management)

     *

     * @param hSession the session's handle

     *         (PKCS#11 param: CK_SESSION_HANDLE hSession)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

    public native void C_CloseSession(long hSession) throws PKCS11Exception;

    /**

     * C_CloseAllSessions closes all sessions with a token.

     * (Session management)

     *

     * @param slotID the ID of the token's slot

     *         (PKCS#11 param: CK_SLOT_ID slotID)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

//    public native void C_CloseAllSessions(long slotID) throws PKCS11Exception;

    /**

     * C_GetSessionInfo obtains information about the session.

     * (Session management)

     *

     * @param hSession the session's handle

     *         (PKCS#11 param: CK_SESSION_HANDLE hSession)

     * @return the session info

     *         (PKCS#11 param: CK_SESSION_INFO_PTR pInfo)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions (result <> null)

     */

    public native CK_SESSION_INFO C_GetSessionInfo(long hSession)

            throws PKCS11Exception;

    /**

     * C_GetOperationState obtains the state of the cryptographic operation

     * in a session.

     * (Session management)

     *

     * @param hSession session's handle

     *         (PKCS#11 param: CK_SESSION_HANDLE hSession)

     * @return the state and the state length

     *         (PKCS#11 param: CK_BYTE_PTR pOperationState,

     *                         CK_ULONG_PTR pulOperationStateLen)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions (result <> null)

     */

    public native byte[] C_GetOperationState(long hSession)

            throws PKCS11Exception;

    /**

     * C_SetOperationState restores the state of the cryptographic

     * operation in a session.

     * (Session management)

     *

     * @param hSession session's handle

     *         (PKCS#11 param: CK_SESSION_HANDLE hSession)

     * @param pOperationState the state and the state length

     *         (PKCS#11 param: CK_BYTE_PTR pOperationState,

     *                         CK_ULONG ulOperationStateLen)

     * @param hEncryptionKey en/decryption key

     *         (PKCS#11 param: CK_OBJECT_HANDLE hEncryptionKey)

     * @param hAuthenticationKey sign/verify key

     *         (PKCS#11 param: CK_OBJECT_HANDLE hAuthenticationKey)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

    public native void C_SetOperationState(long hSession, byte[] pOperationState,

            long hEncryptionKey, long hAuthenticationKey) throws PKCS11Exception;

    /**

     * C_Login logs a user into a token.

     * (Session management)

     *

     * @param hSession the session's handle

     *         (PKCS#11 param: CK_SESSION_HANDLE hSession)

     * @param userType the user type

     *         (PKCS#11 param: CK_USER_TYPE userType)

     * @param pPin the user's PIN and the length of the PIN

     *         (PKCS#11 param: CK_CHAR_PTR pPin, CK_ULONG ulPinLen)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions

     * @postconditions

     */

    public native void C_Login(long hSession, long userType, char[] pPin)

            throws PKCS11Exception;

    /**

     * C_Logout logs a user out from a token.

     * (Session management)

     *

     * @param hSession the session's handle

     *         (PKCS#11 param: CK_SESSION_HANDLE hSession)

     * @exception PKCS11Exception If function returns other value than CKR_OK.

     * @preconditions