/*

 * Copyright 1999-2006 Sun Microsystems, Inc.  All Rights Reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Sun designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Sun in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,

 * CA 95054 USA or visit www.sun.com if you need additional information or

 * have any questions.

 */

package com.sun.security.auth;

import java.io.*;

import java.lang.RuntimePermission;

import java.lang.reflect.*;

import java.net.MalformedURLException;

import java.net.URL;

import java.util.*;

import java.security.AccessController;

import java.security.CodeSource;

import java.security.Identity;

import java.security.IdentityScope;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.Permission;

import java.security.Permissions;

import java.security.PermissionCollection;

import java.security.Principal;

import java.security.UnresolvedPermission;

import java.security.Security;

import java.security.cert.Certificate;

import java.security.cert.X509Certificate;

import javax.security.auth.Subject;

import javax.security.auth.PrivateCredentialPermission;

import sun.security.util.PropertyExpander;

/**

 * This class represents a default implementation for

 * <code>javax.security.auth.Policy</code>.

 *

 * <p> This object stores the policy for entire Java runtime,

 * and is the amalgamation of multiple static policy

 * configurations that resides in files.

 * The algorithm for locating the policy file(s) and reading their

 * information into this <code>Policy</code> object is:

 *

 * <ol>

 * <li>

 *   Loop through the <code>java.security.Security</code> properties,

 *   <i>auth.policy.url.1</i>, <i>auth.policy.url.2</i>, ...,

 *   <i>auth.policy.url.X</i>".  These properties are set

 *   in the Java security properties file, which is located in the file named

 *   <JAVA_HOME>/lib/security/java.security.

 *   <JAVA_HOME> refers to the value of the java.home system property,

 *   and specifies the directory where the JRE is installed.

 *   Each property value specifies a <code>URL</code> pointing to a

 *   policy file to be loaded.  Read in and load each policy.

 *

 * <li>

 *   The <code>java.lang.System</code> property <i>java.security.auth.policy</i>

 *   may also be set to a <code>URL</code> pointing to another policy file

 *   (which is the case when a user uses the -D switch at runtime).

 *   If this property is defined, and its use is allowed by the

 *   security property file (the Security property,

 *   <i>policy.allowSystemProperty</i> is set to <i>true</i>),

 *   also load that policy.

 *

 * <li>

 *   If the <i>java.security.auth.policy</i> property is defined using

 *   "==" (rather than "="), then ignore all other specified

 *   policies and only load this policy.

 * </ol>

 *

 * Each policy file consists of one or more grant entries, each of

 * which consists of a number of permission entries.

 *

 * <pre>

 *   grant signedBy "<b>alias</b>", codeBase "<b>URL</b>",

 *         principal <b>principalClass</b> "<b>principalName</b>",

 *         principal <b>principalClass</b> "<b>principalName</b>",

 *         ... {

 *

 *     permission <b>Type</b> "<b>name</b> "<b>action</b>",

 *         signedBy "<b>alias</b>";

 *     permission <b>Type</b> "<b>name</b> "<b>action</b>",

 *         signedBy "<b>alias</b>";

 *     ....

 *   };

 * </pre>

 *

 * All non-bold items above must appear as is (although case

 * doesn't matter and some are optional, as noted below).

 * Italicized items represent variable values.

 *

 * <p> A grant entry must begin with the word <code>grant</code>.

 * The <code>signedBy</code> and <code>codeBase</code>

 * name/value pairs are optional.

 * If they are not present, then any signer (including unsigned code)

 * will match, and any codeBase will match.  Note that the

 * <code>principal</code> name/value pair is not optional.

 * This <code>Policy</code> implementation only permits

 * Principal-based grant entries.  Note that the <i>principalClass</i>

 * may be set to the wildcard value, *, which allows it to match

 * any <code>Principal</code> class.  In addition, the <i>principalName</i>

 * may also be set to the wildcard value, *, allowing it to match

 * any <code>Principal</code> name.  When setting the <i>principalName</i>

 * to the *, do not surround the * with quotes.

 *

 * <p> A permission entry must begin with the word <code>permission</code>.

 * The word <code><i>Type</i></code> in the template above is

 * a specific permission type, such as <code>java.io.FilePermission</code>

 * or <code>java.lang.RuntimePermission</code>.

 *

 * <p> The "<i>action</i>" is required for

 * many permission types, such as <code>java.io.FilePermission</code>

 * (where it specifies what type of file access that is permitted).

 * It is not required for categories such as

 * <code>java.lang.RuntimePermission</code>

 * where it is not necessary - you either have the

 * permission specified by the <code>"<i>name</i>"</code>

 * value following the type name or you don't.

 *

 * <p> The <code>signedBy</code> name/value pair for a permission entry

 * is optional. If present, it indicates a signed permission. That is,

 * the permission class itself must be signed by the given alias in

 * order for it to be granted. For example,

 * suppose you have the following grant entry:

 *

 * <pre>

 *   grant principal foo.com.Principal "Duke" {

 *     permission Foo "foobar", signedBy "FooSoft";

 *   }

 * </pre>

 *

 * <p> Then this permission of type <i>Foo</i> is granted if the

 * <code>Foo.class</code> permission has been signed by the

 * "FooSoft" alias, or if <code>Foo.class</code> is a

 * system class (i.e., is found on the CLASSPATH).

 *

 * <p> Items that appear in an entry must appear in the specified order

 * (<code>permission</code>, <i>Type</i>, "<i>name</i>", and

 * "<i>action</i>"). An entry is terminated with a semicolon.

 *

 * <p> Case is unimportant for the identifiers (<code>permission</code>,

 * <code>signedBy</code>, <code>codeBase</code>, etc.) but is

 * significant for the <i>Type</i>

 * or for any string that is passed in as a value. <p>

 *

 * <p> An example of two entries in a policy configuration file is

 * <pre>

 *   // if the code is comes from "foo.com" and is running as "Duke",

 *   // grant it read/write to all files in /tmp.

 *

 *   grant codeBase "foo.com", principal foo.com.Principal "Duke" {

 *              permission java.io.FilePermission "/tmp/*", "read,write";

 *   };

 *

 *   // grant any code running as "Duke" permission to read

 *   // the "java.vendor" Property.

 *

 *   grant principal foo.com.Principal "Duke" {

 *         permission java.util.PropertyPermission "java.vendor";

 * </pre>

 *

 * <p> This <code>Policy</code> implementation supports

 * special handling for PrivateCredentialPermissions.

 * If a grant entry is configured with a

 * <code>PrivateCredentialPermission</code>,

 * and the "Principal Class/Principal Name" for that

 * <code>PrivateCredentialPermission</code> is "self",

 * then the entry grants the specified <code>Subject</code> permission to

 * access its own private Credential.  For example,

 * the following grants the <code>Subject</code> "Duke"

 * access to its own a.b.Credential.

 *

 * <pre>

 *   grant principal foo.com.Principal "Duke" {

 *      permission javax.security.auth.PrivateCredentialPermission

 *              "a.b.Credential self",

 *              "read";

 *    };

 * </pre>

 *

 * The following grants the <code>Subject</code> "Duke"

 * access to all of its own private Credentials:

 *

 * <pre>

 *   grant principal foo.com.Principal "Duke" {

 *      permission javax.security.auth.PrivateCredentialPermission

 *              "* self",

 *              "read";

 *    };

 * </pre>

 *

 * The following grants all Subjects authenticated as a

 * <code>SolarisPrincipal</code> (regardless of their respective names)

 * permission to access their own private Credentials:

 *

 * <pre>

 *   grant principal com.sun.security.auth.SolarisPrincipal * {

 *      permission javax.security.auth.PrivateCredentialPermission

 *              "* self",

 *              "read";

 *    };

 * </pre>

 *

 * The following grants all Subjects permission to access their own

 * private Credentials:

 *

 * <pre>

 *   grant principal * * {

 *      permission javax.security.auth.PrivateCredentialPermission

 *              "* self",

 *              "read";

 *    };

 * </pre>

 * @deprecated As of JDK 1.4, replaced by

 *             <code>sun.security.provider.PolicyFile</code>.

 *             This class is entirely deprecated.

 *

 * @see java.security.CodeSource

 * @see java.security.Permissions

 * @see java.security.ProtectionDomain

 */

@Deprecated

public class PolicyFile extends javax.security.auth.Policy {

    static final java.util.ResourceBundle rb =

        java.security.AccessController.doPrivileged

        (new java.security.PrivilegedAction<java.util.ResourceBundle>() {

            public java.util.ResourceBundle run() {

                return (java.util.ResourceBundle.getBundle

                        ("sun.security.util.AuthResources"));

            }

        });

    // needs to be package private

    private static final sun.security.util.Debug debug =

        sun.security.util.Debug.getInstance("policy", "\t[Auth Policy]");

    private static final String AUTH_POLICY = "java.security.auth.policy";

    private static final String SECURITY_MANAGER = "java.security.manager";

    private static final String AUTH_POLICY_URL = "auth.policy.url.";

    private Vector<PolicyEntry> policyEntries;

    private Hashtable aliasMapping;

    private boolean initialized = false;

    private boolean expandProperties = true;

    private boolean ignoreIdentityScope = false;

    // for use with the reflection API

    private static final Class[] PARAMS = { String.class, String.class};

    /**

     * Initializes the Policy object and reads the default policy

     * configuration file(s) into the Policy object.

     */

    public PolicyFile() {

        // initialize Policy if either the AUTH_POLICY or

        // SECURITY_MANAGER properties are set

        String prop = System.getProperty(AUTH_POLICY);

        if (prop == null) {

            prop = System.getProperty(SECURITY_MANAGER);

        }

        if (prop != null)

            init();

    }

    private synchronized void init() {

        if (initialized)

            return;

        policyEntries = new Vector<PolicyEntry>();

        aliasMapping = new Hashtable(11);

        initPolicyFile();

        initialized = true;

    }

    /**

     * Refreshes the policy object by re-reading all the policy files.

     *

     * <p>

     *

     * @exception SecurityException if the caller doesn't have permission

     *          to refresh the <code>Policy</code>.

     */

    public synchronized void refresh()

    {

        java.lang.SecurityManager sm = System.getSecurityManager();

        if (sm != null) {

            sm.checkPermission(new javax.security.auth.AuthPermission

                                ("refreshPolicy"));

        }

        // XXX

        //

        // 1)   if code instantiates PolicyFile directly, then it will need

        //      all the permissions required for the PolicyFile initialization

        // 2)   if code calls Policy.getPolicy, then it simply needs

        //      AuthPermission(getPolicy), and the javax.security.auth.Policy

        //      implementation instantiates PolicyFile in a doPrivileged block

        // 3)   if after instantiating a Policy (either via #1 or #2),

        //      code calls refresh, it simply needs

        //      AuthPermission(refreshPolicy).  then PolicyFile wraps

        //      the refresh in a doPrivileged block.

        initialized = false;

        java.security.AccessController.doPrivileged

            (new java.security.PrivilegedAction<Void>() {

            public Void run() {

                init();

                return null;

            }

        });

    }

    private KeyStore initKeyStore(URL policyUrl, String keyStoreName,

                                  String keyStoreType) {

        if (keyStoreName != null) {

            try {

                /*

                 * location of keystore is specified as absolute URL in policy

                 * file, or is relative to URL of policy file

                 */

                URL keyStoreUrl = null;

                try {

                    keyStoreUrl = new URL(keyStoreName);

                    // absolute URL

                } catch (java.net.MalformedURLException e) {

                    // relative URL

                    keyStoreUrl = new URL(policyUrl, keyStoreName);

                }

                if (debug != null) {

                    debug.println("reading keystore"+keyStoreUrl);

                }

                InputStream inStream =

                    new BufferedInputStream(getInputStream(keyStoreUrl));

                KeyStore ks;

                if (keyStoreType != null)

                    ks = KeyStore.getInstance(keyStoreType);

                else

                    ks = KeyStore.getInstance(KeyStore.getDefaultType());

                ks.load(inStream, null);

                inStream.close();

                return ks;

            } catch (Exception e) {

                // ignore, treat it like we have no keystore

                if (debug != null) {

                    e.printStackTrace();

                }

                return null;

            }

        }

        return null;

    }

    private void initPolicyFile() {

        String prop = Security.getProperty("policy.expandProperties");

        if (prop != null) expandProperties = prop.equalsIgnoreCase("true");

        String iscp = Security.getProperty("policy.ignoreIdentityScope");

        if (iscp != null) ignoreIdentityScope = iscp.equalsIgnoreCase("true");

        String allowSys  = Security.getProperty("policy.allowSystemProperty");

        if ((allowSys!=null) && allowSys.equalsIgnoreCase("true")) {

            String extra_policy = System.getProperty(AUTH_POLICY);

            if (extra_policy != null) {

                boolean overrideAll = false;

                if (extra_policy.startsWith("=")) {

                    overrideAll = true;

                    extra_policy = extra_policy.substring(1);

                }

                try {

                    extra_policy = PropertyExpander.expand(extra_policy);

                    URL policyURL;;

                    File policyFile = new File(extra_policy);

                    if (policyFile.exists()) {

                        policyURL =

                            new URL("file:" + policyFile.getCanonicalPath());

                    } else {

                        policyURL = new URL(extra_policy);

                    }

                    if (debug != null)

                        debug.println("reading "+policyURL);

                    init(policyURL);

                } catch (Exception e) {

                    // ignore.

                    if (debug != null) {

                        debug.println("caught exception: "+e);

                    }

                }

                if (overrideAll) {

                    if (debug != null) {

                        debug.println("overriding other policies!");

                    }

                    return;

                }

            }

        }

        int n = 1;

        boolean loaded_one = false;

        String policy_url;

        while ((policy_url = Security.getProperty(AUTH_POLICY_URL+n)) != null) {

            try {

                policy_url = PropertyExpander.expand(policy_url).replace

                                                (File.separatorChar, '/');

                if (debug != null)

                    debug.println("reading "+policy_url);

                init(new URL(policy_url));

                loaded_one = true;

            } catch (Exception e) {

                if (debug != null) {

                    debug.println("error reading policy "+e);

                    e.printStackTrace();

                }

                // ignore that policy

            }

            n++;

        }

        if (loaded_one == false) {

            // do not load a static policy

        }

    }

    /** the scope to check */

    private static IdentityScope scope = null;

    /**

     * Checks public key. If it is marked as trusted in

     * the identity database, add it to the policy

     * with the AllPermission.

     */

    private boolean checkForTrustedIdentity(final Certificate cert) {

        // XXX  JAAS has no way to access the SUN package.

        //      we'll add this back in when JAAS goes into core.

        return false;

    }

    /**

     * Reads a policy configuration into the Policy object using a

     * Reader object.

     *

     * @param policyFile the policy Reader object.

     */

    private void init(URL policy) {

        PolicyParser pp = new PolicyParser(expandProperties);

        try {

            InputStreamReader isr

                = new InputStreamReader(getInputStream(policy));

            pp.read(isr);

            isr.close();

            KeyStore keyStore = initKeyStore(policy, pp.getKeyStoreUrl(),

                                             pp.getKeyStoreType());

            Enumeration<PolicyParser.GrantEntry> enum_ = pp.grantElements();

            while (enum_.hasMoreElements()) {

                PolicyParser.GrantEntry ge = enum_.nextElement();

                addGrantEntry(ge, keyStore);

            }

        } catch (PolicyParser.ParsingException pe) {

            System.err.println(AUTH_POLICY +

                                rb.getString(": error parsing ") + policy);

            System.err.println(AUTH_POLICY +

                                rb.getString(": ") +

                                pe.getMessage());

            if (debug != null)

                pe.printStackTrace();

        } catch (Exception e) {

            if (debug != null) {

                debug.println("error parsing "+policy);

                debug.println(e.toString());

                e.printStackTrace();

            }

        }

    }

    /*

     * Fast path reading from file urls in order to avoid calling

     * FileURLConnection.connect() which can be quite slow the first time

     * it is called. We really should clean up FileURLConnection so that

     * this is not a problem but in the meantime this fix helps reduce

     * start up time noticeably for the new launcher. -- DAC

     */

    private InputStream getInputStream(URL url) throws IOException {

        if ("file".equals(url.getProtocol())) {

            String path = url.getFile().replace('/', File.separatorChar);

            return new FileInputStream(path);

        } else {

            return url.openStream();

        }

    }