/*

 * Copyright (c) 1997, 2015, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package java.security;

import java.util.ArrayList;

import java.util.List;

import sun.security.util.Debug;

import sun.security.util.FilePermCompat;

import sun.security.util.SecurityConstants;

/**

 * An AccessControlContext is used to make system resource access decisions

 * based on the context it encapsulates.

 *

 * <p>More specifically, it encapsulates a context and

 * has a single method, {@code checkPermission},

 * that is equivalent to the {@code checkPermission} method

 * in the AccessController class, with one difference: The AccessControlContext

 * {@code checkPermission} method makes access decisions based on the

 * context it encapsulates,

 * rather than that of the current execution thread.

 *

 * <p>Thus, the purpose of AccessControlContext is for those situations where

 * a security check that should be made within a given context

 * actually needs to be done from within a

 * <i>different</i> context (for example, from within a worker thread).

 *

 * <p> An AccessControlContext is created by calling the

 * {@code AccessController.getContext} method.

 * The {@code getContext} method takes a "snapshot"

 * of the current calling context, and places

 * it in an AccessControlContext object, which it returns. A sample call is

 * the following:

 *

 * <pre>

 *   AccessControlContext acc = AccessController.getContext()

 * </pre>

 *

 * <p>

 * Code within a different context can subsequently call the

 * {@code checkPermission} method on the

 * previously-saved AccessControlContext object. A sample call is the

 * following:

 *

 * <pre>

 *   acc.checkPermission(permission)

 * </pre>

 *

 * @see AccessController

 *

 * @author Roland Schemers

 * @since 1.2

 */

public final class AccessControlContext {

    private ProtectionDomain[] context;

    // isPrivileged and isAuthorized are referenced by the VM - do not remove

    // or change their names

    private boolean isPrivileged;

    private boolean isAuthorized = false;

    // Note: This field is directly used by the virtual machine

    // native codes. Don't touch it.

    private AccessControlContext privilegedContext;

    private DomainCombiner combiner = null;

    // limited privilege scope

    private Permission[] permissions;

    private AccessControlContext parent;

    private boolean isWrapped;

    // is constrained by limited privilege scope?

    private boolean isLimited;

    private ProtectionDomain[] limitedContext;

    private static boolean debugInit = false;

    private static Debug debug = null;

    static Debug getDebug()

    {

        if (debugInit)

            return debug;

        else {

            if (Policy.isSet()) {

                debug = Debug.getInstance("access");

                debugInit = true;

            }

            return debug;

        }

    }

    /**

     * Create an AccessControlContext with the given array of ProtectionDomains.

     * Context must not be null. Duplicate domains will be removed from the

     * context.

     *

     * @param context the ProtectionDomains associated with this context.

     * The non-duplicate domains are copied from the array. Subsequent

     * changes to the array will not affect this AccessControlContext.

     * @throws NullPointerException if {@code context} is {@code null}

     */

    public AccessControlContext(ProtectionDomain[] context)

    {

        if (context.length == 0) {

            this.context = null;

        } else if (context.length == 1) {

            if (context[0] != null) {

                this.context = context.clone();

            } else {

                this.context = null;

            }

        } else {

            List<ProtectionDomain> v = new ArrayList<>(context.length);

            for (int i =0; i< context.length; i++) {

                if ((context[i] != null) &&  (!v.contains(context[i])))

                    v.add(context[i]);

            }

            if (!v.isEmpty()) {

                this.context = new ProtectionDomain[v.size()];

                this.context = v.toArray(this.context);

            }

        }

    }

    /**

     * Create a new {@code AccessControlContext} with the given

     * {@code AccessControlContext} and {@code DomainCombiner}.

     * This constructor associates the provided

     * {@code DomainCombiner} with the provided

     * {@code AccessControlContext}.

     *

     * @param acc the {@code AccessControlContext} associated

     *          with the provided {@code DomainCombiner}.

     *

     * @param combiner the {@code DomainCombiner} to be associated

     *          with the provided {@code AccessControlContext}.

     *

     * @exception NullPointerException if the provided

     *          {@code context} is {@code null}.

     *

     * @exception SecurityException if a security manager is installed and the

     *          caller does not have the "createAccessControlContext"

     *          {@link SecurityPermission}

     * @since 1.3

     */

    public AccessControlContext(AccessControlContext acc,

                                DomainCombiner combiner) {

        this(acc, combiner, false);

    }

    /**

     * package private to allow calls from ProtectionDomain without performing

     * the security check for {@linkplain SecurityConstants#CREATE_ACC_PERMISSION}

     * permission

     */

    AccessControlContext(AccessControlContext acc,

                        DomainCombiner combiner,

                        boolean preauthorized) {

        if (!preauthorized) {

            SecurityManager sm = System.getSecurityManager();

            if (sm != null) {

                sm.checkPermission(SecurityConstants.CREATE_ACC_PERMISSION);

                this.isAuthorized = true;

            }

        } else {

            this.isAuthorized = true;

        }

        this.context = acc.context;

        // we do not need to run the combine method on the

        // provided ACC.  it was already "combined" when the

        // context was originally retrieved.

        //

        // at this point in time, we simply throw away the old

        // combiner and use the newly provided one.

        this.combiner = combiner;

    }

    /**

     * package private for AccessController

     *

     * This "argument wrapper" context will be passed as the actual context

     * parameter on an internal doPrivileged() call used in the implementation.

     */

    AccessControlContext(ProtectionDomain caller, DomainCombiner combiner,

        AccessControlContext parent, AccessControlContext context,

        Permission[] perms)

    {

        /*

         * Combine the domains from the doPrivileged() context into our

         * wrapper context, if necessary.

         */

        ProtectionDomain[] callerPDs = null;

        if (caller != null) {

             callerPDs = new ProtectionDomain[] { caller };

        }

        if (context != null) {

            if (combiner != null) {

                this.context = combiner.combine(callerPDs, context.context);

            } else {

                this.context = combine(callerPDs, context.context);

            }

        } else {

            /*

             * Call combiner even if there is seemingly nothing to combine.

             */

            if (combiner != null) {

                this.context = combiner.combine(callerPDs, null);

            } else {

                this.context = combine(callerPDs, null);

            }

        }

        this.combiner = combiner;

        Permission[] tmp = null;

        if (perms != null) {

            tmp = new Permission[perms.length];

            for (int i=0; i < perms.length; i++) {

                if (perms[i] == null) {

                    throw new NullPointerException("permission can't be null");

                }

                /*

                 * An AllPermission argument is equivalent to calling

                 * doPrivileged() without any limit permissions.

                 */

                if (perms[i].getClass() == AllPermission.class) {

                    parent = null;

                }

                // Add altPath into permission for compatibility.

                tmp[i] = FilePermCompat.newPermPlusAltPath(perms[i]);

            }

        }

        /*

         * For a doPrivileged() with limited privilege scope, initialize

         * the relevant fields.

         *

         * The limitedContext field contains the union of all domains which

         * are enclosed by this limited privilege scope. In other words,

         * it contains all of the domains which could potentially be checked

         * if none of the limiting permissions implied a requested permission.

         */

        if (parent != null) {

            this.limitedContext = combine(parent.context, parent.limitedContext);

            this.isLimited = true;

            this.isWrapped = true;

            this.permissions = tmp;

            this.parent = parent;

            this.privilegedContext = context; // used in checkPermission2()

        }

        this.isAuthorized = true;

    }

    /**

     * package private constructor for AccessController.getContext()

     */

    AccessControlContext(ProtectionDomain[] context,

                         boolean isPrivileged)

    {

        this.context = context;

        this.isPrivileged = isPrivileged;

        this.isAuthorized = true;

    }

    /**

     * Constructor for JavaSecurityAccess.doIntersectionPrivilege()

     */

    AccessControlContext(ProtectionDomain[] context,

                         AccessControlContext privilegedContext)

    {

        this.context = context;

        this.privilegedContext = privilegedContext;

        this.isPrivileged = true;

    }

    /**

     * Returns this context's context.

     */

    ProtectionDomain[] getContext() {

        return context;

    }

    /**

     * Returns true if this context is privileged.

     */

    boolean isPrivileged()

    {

        return isPrivileged;

    }

    /**

     * get the assigned combiner from the privileged or inherited context

     */

    DomainCombiner getAssignedCombiner() {

        AccessControlContext acc;

        if (isPrivileged) {

            acc = privilegedContext;

        } else {

            acc = AccessController.getInheritedAccessControlContext();

        }

        if (acc != null) {

            return acc.combiner;

        }

        return null;

    }

    /**

     * Get the {@code DomainCombiner} associated with this

     * {@code AccessControlContext}.

     *

     * @return the {@code DomainCombiner} associated with this

     *          {@code AccessControlContext}, or {@code null}

     *          if there is none.

     *

     * @exception SecurityException if a security manager is installed and

     *          the caller does not have the "getDomainCombiner"

     *          {@link SecurityPermission}

     * @since 1.3

     */

    public DomainCombiner getDomainCombiner() {

        SecurityManager sm = System.getSecurityManager();

        if (sm != null) {

            sm.checkPermission(SecurityConstants.GET_COMBINER_PERMISSION);

        }

        return getCombiner();

    }

    /**

     * package private for AccessController

     */

    DomainCombiner getCombiner() {

        return combiner;

    }

    boolean isAuthorized() {

        return isAuthorized;

    }

    /**

     * Determines whether the access request indicated by the

     * specified permission should be allowed or denied, based on

     * the security policy currently in effect, and the context in

     * this object. The request is allowed only if every ProtectionDomain

     * in the context implies the permission. Otherwise the request is

     * denied.

     *

     * <p>

     * This method quietly returns if the access request

     * is permitted, or throws a suitable AccessControlException otherwise.

     *

     * @param perm the requested permission.

     *

     * @exception AccessControlException if the specified permission

     * is not permitted, based on the current security policy and the

     * context encapsulated by this object.

     * @exception NullPointerException if the permission to check for is null.

     */

    public void checkPermission(Permission perm)

        throws AccessControlException

    {

        boolean dumpDebug = false;

        if (perm == null) {

            throw new NullPointerException("permission can't be null");

        }

        if (getDebug() != null) {

            // If "codebase" is not specified, we dump the info by default.

            dumpDebug = !Debug.isOn("codebase=");

            if (!dumpDebug) {

                // If "codebase" is specified, only dump if the specified code

                // value is in the stack.

                for (int i = 0; context != null && i < context.length; i++) {

                    if (context[i].getCodeSource() != null &&

                        context[i].getCodeSource().getLocation() != null &&

                        Debug.isOn("codebase=" + context[i].getCodeSource().getLocation().toString())) {

                        dumpDebug = true;

                        break;

                    }

                }

            }

            dumpDebug &= !Debug.isOn("permission=") ||

                Debug.isOn("permission=" + perm.getClass().getCanonicalName());

            if (dumpDebug && Debug.isOn("stack")) {

                Thread.dumpStack();

            }

            if (dumpDebug && Debug.isOn("domain")) {

                if (context == null) {

                    debug.println("domain (context is null)");

                } else {

                    for (int i=0; i< context.length; i++) {

                        debug.println("domain "+i+" "+context[i]);

                    }

                }

            }

        }

        /*

         * iterate through the ProtectionDomains in the context.

         * Stop at the first one that doesn't allow the

         * requested permission (throwing an exception).

         *

         */

        /* if ctxt is null, all we had on the stack were system domains,

           or the first domain was a Privileged system domain. This

           is to make the common case for system code very fast */

        if (context == null) {

            checkPermission2(perm);

            return;

        }

        for (int i=0; i< context.length; i++) {

            if (context[i] != null && !context[i].impliesWithAltFilePerm(perm)) {

                if (dumpDebug) {

                    debug.println("access denied " + perm);

                }

                if (Debug.isOn("failure") && debug != null) {

                    // Want to make sure this is always displayed for failure,

                    // but do not want to display again if already displayed

                    // above.

                    if (!dumpDebug) {

                        debug.println("access denied " + perm);

                    }

                    Thread.dumpStack();

                    final ProtectionDomain pd = context[i];

                    final Debug db = debug;

                    AccessController.doPrivileged (new PrivilegedAction<>() {

                        public Void run() {

                            db.println("domain that failed "+pd);

                            return null;

                        }

                    });

                }

                throw new AccessControlException("access denied "+perm, perm);

            }

        }

        // allow if all of them allowed access

        if (dumpDebug) {

            debug.println("access allowed "+perm);

        }

        checkPermission2(perm);

    }

    /*

     * Check the domains associated with the limited privilege scope.

     */

    private void checkPermission2(Permission perm) {

        if (!isLimited) {

            return;

        }

        /*

         * Check the doPrivileged() context parameter, if present.

         */

        if (privilegedContext != null) {

            privilegedContext.checkPermission2(perm);

        }

        /*

         * Ignore the limited permissions and parent fields of a wrapper

         * context since they were already carried down into the unwrapped

         * context.

         */

        if (isWrapped) {

            return;

        }

        /*