1 /*

     2  * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.pkcs11;

    27 

    28 import java.util.*;

    29 import java.util.concurrent.ConcurrentHashMap;

    30 import java.io.*;

    31 import java.lang.ref.*;

    32 

    33 import java.security.*;

    34 import javax.security.auth.login.LoginException;

    35 

    36 import sun.security.jca.JCAUtil;

    37 

    38 import sun.security.pkcs11.wrapper.*;

    39 import static sun.security.pkcs11.TemplateManager.*;

    40 import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

    41 

    42 /**

    43  * PKCS#11 token.

    44  *

    45  * @author  Andreas Sterbenz

    46  * @since   1.5

    47  */

    48 class Token implements Serializable {

    49 

    50     // need to be serializable to allow SecureRandom to be serialized

    51     private static final long serialVersionUID = 2541527649100571747L;

    52 

    53     // how often to check if the token is still present (in ms)

    54     // this is different from checking if a token has been inserted,

    55     // that is done in SunPKCS11. Currently 50 ms.

    56     private final static long CHECK_INTERVAL = 50;

    57 

    58     final SunPKCS11 provider;

    59 

    60     final PKCS11 p11;

    61 

    62     final Config config;

    63 

    64     final CK_TOKEN_INFO tokenInfo;

    65 

    66     // session manager to pool sessions

    67     final SessionManager sessionManager;

    68 

    69     // template manager to customize the attributes used when creating objects

    70     private final TemplateManager templateManager;

    71 

    72     // flag indicating whether we need to explicitly cancel operations

    73     // we started on the token. If false, we assume operations are

    74     // automatically cancelled once we start another one

    75     final boolean explicitCancel;

    76 

    77     // translation cache for secret keys

    78     final KeyCache secretCache;

    79 

    80     // translation cache for asymmetric keys (public and private)

    81     final KeyCache privateCache;

    82 

    83     // cached instances of the various key factories, initialized on demand

    84     private volatile P11KeyFactory rsaFactory, dsaFactory, dhFactory, ecFactory;

    85 

    86     // table which maps mechanisms to the corresponding cached

    87     // MechanismInfo objects

    88     private final Map<Long, CK_MECHANISM_INFO> mechInfoMap;

    89 

    90     // single SecureRandomSpi instance we use per token

    91     // initialized on demand (if supported)

    92     private volatile P11SecureRandom secureRandom;

    93 

    94     // single KeyStoreSpi instance we use per provider

    95     // initialized on demand

    96     private volatile P11KeyStore keyStore;

    97 

    98     // whether this token is a removable token

    99     private final boolean removable;

   100 

   101     // for removable tokens: whether this token is valid or has been removed

   102     private volatile boolean valid;

   103 

   104     // for removable tokens: time last checked for token presence

   105     private long lastPresentCheck;

   106 

   107     // unique token id, used for serialization only

   108     private byte[] tokenId;

   109 

   110     // flag indicating whether the token is write protected

   111     private boolean writeProtected;

   112 

   113     // flag indicating whether we are logged in

   114     private volatile boolean loggedIn;

   115 

   116     // time we last checked login status

   117     private long lastLoginCheck;

   118 

   119     // mutex for token-present-check

   120     private final static Object CHECK_LOCK = new Object();

   121 

   122     // object for indicating unsupported mechanism in 'mechInfoMap'

   123     private final static CK_MECHANISM_INFO INVALID_MECH =

   124         new CK_MECHANISM_INFO(0, 0, 0);

   125 

   126     // flag indicating whether the token supports raw secret key material import

   127     private Boolean supportsRawSecretKeyImport;

   128 

   129     Token(SunPKCS11 provider) throws PKCS11Exception {

   130         this.provider = provider;

   131         this.removable = provider.removable;

   132         this.valid = true;

   133         p11 = provider.p11;

   134         config = provider.config;

   135         tokenInfo = p11.C_GetTokenInfo(provider.slotID);

   136         writeProtected = (tokenInfo.flags & CKF_WRITE_PROTECTED) != 0;

   137         // create session manager and open a test session

   138         SessionManager sessionManager;

   139         try {

   140             sessionManager = new SessionManager(this);

   141             Session s = sessionManager.getOpSession();

   142             sessionManager.releaseSession(s);

   143         } catch (PKCS11Exception e) {

   144             if (writeProtected) {

   145                 throw e;

   146             }

   147             // token might not permit RW sessions even though

   148             // CKF_WRITE_PROTECTED is not set

   149             writeProtected = true;

   150             sessionManager = new SessionManager(this);

   151             Session s = sessionManager.getOpSession();

   152             sessionManager.releaseSession(s);

   153         }

   154         this.sessionManager = sessionManager;

   155         secretCache = new KeyCache();

   156         privateCache = new KeyCache();

   157         templateManager = config.getTemplateManager();

   158         explicitCancel = config.getExplicitCancel();

   159         mechInfoMap =

   160             new ConcurrentHashMap<Long, CK_MECHANISM_INFO>(10);

   161     }

   162 

   163     boolean isWriteProtected() {

   164         return writeProtected;

   165     }

   166 

   167     // return whether the token supports raw secret key material import

   168     boolean supportsRawSecretKeyImport() {

   169         if (supportsRawSecretKeyImport == null) {

   170             SecureRandom random = JCAUtil.getSecureRandom();

   171             byte[] encoded = new byte[48];

   172             random.nextBytes(encoded);

   173 

   174             CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[3];

   175             attributes[0] = new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY);

   176             attributes[1] = new CK_ATTRIBUTE(CKA_KEY_TYPE, CKK_GENERIC_SECRET);

   177             attributes[2] = new CK_ATTRIBUTE(CKA_VALUE, encoded);

   178 

   179             Session session = null;

   180             try {

   181                 attributes = getAttributes(O_IMPORT,

   182                         CKO_SECRET_KEY, CKK_GENERIC_SECRET, attributes);

   183                 session = getObjSession();

   184                 long keyID = p11.C_CreateObject(session.id(), attributes);

   185 

   186                 supportsRawSecretKeyImport = Boolean.TRUE;

   187             } catch (PKCS11Exception e) {

   188                 supportsRawSecretKeyImport = Boolean.FALSE;

   189             } finally {

   190                 releaseSession(session);

   191             }

   192         }

   193 

   194         return supportsRawSecretKeyImport;

   195     }

   196 

   197     // return whether we are logged in

   198     // uses cached result if current. session is optional and may be null

   199     boolean isLoggedIn(Session session) throws PKCS11Exception {

   200         // volatile load first

   201         boolean loggedIn = this.loggedIn;

   202         long time = System.currentTimeMillis();

   203         if (time - lastLoginCheck > CHECK_INTERVAL) {

   204             loggedIn = isLoggedInNow(session);

   205             lastLoginCheck = time;

   206         }

   207         return loggedIn;

   208     }

   209 

   210     // return whether we are logged in now

   211     // does not use cache

   212     boolean isLoggedInNow(Session session) throws PKCS11Exception {

   213         boolean allocSession = (session == null);

   214         try {

   215             if (allocSession) {

   216                 session = getOpSession();

   217             }

   218             CK_SESSION_INFO info = p11.C_GetSessionInfo(session.id());

   219             boolean loggedIn = (info.state == CKS_RO_USER_FUNCTIONS) ||

   220                                 (info.state == CKS_RW_USER_FUNCTIONS);

   221             this.loggedIn = loggedIn;

   222             return loggedIn;

   223         } finally {

   224             if (allocSession) {

   225                 releaseSession(session);

   226             }

   227         }

   228     }

   229 

   230     // ensure that we are logged in

   231     // call provider.login() if not

   232     void ensureLoggedIn(Session session) throws PKCS11Exception, LoginException {

   233         if (isLoggedIn(session) == false) {

   234             provider.login(null, null);

   235         }

   236     }

   237 

   238     // return whether this token object is valid (i.e. token not removed)

   239     // returns value from last check, does not perform new check

   240     boolean isValid() {

   241         if (removable == false) {

   242             return true;

   243         }

   244         return valid;

   245     }

   246 

   247     void ensureValid() {

   248         if (isValid() == false) {

   249             throw new ProviderException("Token has been removed");

   250         }

   251     }

   252 

   253     // return whether a token is present (i.e. token not removed)

   254     // returns cached value if current, otherwise performs new check

   255     boolean isPresent(long sessionID) {

   256         if (removable == false) {

   257             return true;

   258         }

   259         if (valid == false) {

   260             return false;

   261         }

   262         long time = System.currentTimeMillis();

   263         if ((time - lastPresentCheck) >= CHECK_INTERVAL) {

   264             synchronized (CHECK_LOCK) {

   265                 if ((time - lastPresentCheck) >= CHECK_INTERVAL) {

   266                     boolean ok = false;

   267                     try {

   268                         // check if token still present

   269                         CK_SLOT_INFO slotInfo =

   270                                 provider.p11.C_GetSlotInfo(provider.slotID);

   271                         if ((slotInfo.flags & CKF_TOKEN_PRESENT) != 0) {

   272                             // if the token has been removed and re-inserted,

   273                             // the token should return an error

   274                             CK_SESSION_INFO sessInfo =

   275                                     provider.p11.C_GetSessionInfo

   276                                     (sessionID);

   277                             ok = true;

   278                         }

   279                     } catch (PKCS11Exception e) {

   280                         // empty

   281                     }

   282                     valid = ok;

   283                     lastPresentCheck = System.currentTimeMillis();

   284                     if (ok == false) {

   285                         destroy();

   286                     }

   287                 }

   288             }

   289         }

   290         return valid;

   291     }

   292 

   293     void destroy() {

   294         valid = false;

   295         provider.uninitToken(this);

   296     }

   297 

   298     Session getObjSession() throws PKCS11Exception {

   299         return sessionManager.getObjSession();

   300     }

   301 

   302     Session getOpSession() throws PKCS11Exception {

   303         return sessionManager.getOpSession();

   304     }

   305 

   306     Session releaseSession(Session session) {

   307         return sessionManager.releaseSession(session);

   308     }

   309 

   310     Session killSession(Session session) {

   311         return sessionManager.killSession(session);

   312     }

   313 

   314     CK_ATTRIBUTE[] getAttributes(String op, long type, long alg,

   315             CK_ATTRIBUTE[] attrs) throws PKCS11Exception {

   316         CK_ATTRIBUTE[] newAttrs =

   317                     templateManager.getAttributes(op, type, alg, attrs);

   318         for (CK_ATTRIBUTE attr : newAttrs) {

   319             if (attr.type == CKA_TOKEN) {

   320                 if (attr.getBoolean()) {

   321                     try {

   322                         ensureLoggedIn(null);

   323                     } catch (LoginException e) {

   324                         throw new ProviderException("Login failed", e);

   325                     }

   326                 }

   327                 // break once we have found a CKA_TOKEN attribute

   328                 break;

   329             }

   330         }

   331         return newAttrs;

   332     }

   333 

   334     P11KeyFactory getKeyFactory(String algorithm) {

   335         P11KeyFactory f;

   336         if (algorithm.equals("RSA")) {

   337             f = rsaFactory;

   338             if (f == null) {

   339                 f = new P11RSAKeyFactory(this, algorithm);

   340                 rsaFactory = f;

   341             }

   342         } else if (algorithm.equals("DSA")) {

   343             f = dsaFactory;

   344             if (f == null) {

   345                 f = new P11DSAKeyFactory(this, algorithm);

   346                 dsaFactory = f;

   347             }

   348         } else if (algorithm.equals("DH")) {

   349             f = dhFactory;

   350             if (f == null) {

   351                 f = new P11DHKeyFactory(this, algorithm);

   352                 dhFactory = f;

   353             }

   354         } else if (algorithm.equals("EC")) {

   355             f = ecFactory;

   356             if (f == null) {

   357                 f = new P11ECKeyFactory(this, algorithm);

   358                 ecFactory = f;

   359             }

   360         } else {

   361             throw new ProviderException("Unknown algorithm " + algorithm);

   362         }

   363         return f;

   364     }

   365 

   366     P11SecureRandom getRandom() {

   367         if (secureRandom == null) {

   368             secureRandom = new P11SecureRandom(this);

   369         }

   370         return secureRandom;

   371     }

   372 

   373     P11KeyStore getKeyStore() {

   374         if (keyStore == null) {

   375             keyStore = new P11KeyStore(this);

   376         }

   377         return keyStore;

   378     }

   379 

   380     CK_MECHANISM_INFO getMechanismInfo(long mechanism) throws PKCS11Exception {

   381         CK_MECHANISM_INFO result = mechInfoMap.get(mechanism);

   382         if (result == null) {

   383             try {

   384                 result = p11.C_GetMechanismInfo(provider.slotID,

   385                                                 mechanism);

   386                 mechInfoMap.put(mechanism, result);

   387             } catch (PKCS11Exception e) {

   388                 if (e.getErrorCode() != PKCS11Constants.CKR_MECHANISM_INVALID) {

   389                     throw e;

   390                 } else {

   391                     mechInfoMap.put(mechanism, INVALID_MECH);

   392                 }

   393             }

   394         } else if (result == INVALID_MECH) {

   395             result = null;

   396         }

   397         return result;

   398     }

   399 

   400     private synchronized byte[] getTokenId() {

   401         if (tokenId == null) {

   402             SecureRandom random = JCAUtil.getSecureRandom();

   403             tokenId = new byte[20];

   404             random.nextBytes(tokenId);

   405             serializedTokens.add(new WeakReference<Token>(this));

   406         }

   407         return tokenId;

   408     }

   409 

   410     // list of all tokens that have been serialized within this VM

   411     // NOTE that elements are never removed from this list

   412     // the assumption is that the number of tokens that are serialized

   413     // is relatively small

   414     private static final List<Reference<Token>> serializedTokens =

   415         new ArrayList<Reference<Token>>();

   416 

   417     private Object writeReplace() throws ObjectStreamException {

   418         if (isValid() == false) {

   419             throw new NotSerializableException("Token has been removed");

   420         }

   421         return new TokenRep(this);

   422     }

   423 

   424     // serialized representation of a token

   425     // tokens can only be de-serialized within the same VM invocation

   426     // and if the token has not been removed in the meantime

   427     private static class TokenRep implements Serializable {

   428 

   429         private static final long serialVersionUID = 3503721168218219807L;

   430 

   431         private final byte[] tokenId;

   432 

   433         TokenRep(Token token) {

   434             tokenId = token.getTokenId();

   435         }

   436 

   437         private Object readResolve() throws ObjectStreamException {

   438             for (Reference<Token> tokenRef : serializedTokens) {

   439                 Token token = tokenRef.get();

   440                 if ((token != null) && token.isValid()) {

   441                     if (Arrays.equals(token.getTokenId(), tokenId)) {

   442                         return token;

   443                     }

   444                 }

   445             }

   446             throw new NotSerializableException("Could not find token");

   447         }

   448     }

   449 

   450 }