1 /*

     2  * Copyright (c) 2003, 2015, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.pkcs11;

    27 

    28 import java.math.BigInteger;

    29 

    30 import java.io.InputStream;

    31 import java.io.OutputStream;

    32 import java.io.IOException;

    33 import java.io.ByteArrayInputStream;

    34 import java.io.UnsupportedEncodingException;

    35 

    36 import java.util.Arrays;

    37 import java.util.Collections;

    38 import java.util.Date;

    39 import java.util.Enumeration;

    40 import java.util.ArrayList;

    41 import java.util.HashSet;

    42 import java.util.HashMap;

    43 import java.util.Set;

    44 

    45 import java.security.*;

    46 import java.security.KeyStore.*;

    47 

    48 import java.security.cert.Certificate;

    49 import java.security.cert.X509Certificate;

    50 import java.security.cert.CertificateFactory;

    51 import java.security.cert.CertificateException;

    52 

    53 import java.security.interfaces.*;

    54 import java.security.spec.*;

    55 

    56 import javax.crypto.SecretKey;

    57 import javax.crypto.interfaces.*;

    58 

    59 import javax.security.auth.x500.X500Principal;

    60 import javax.security.auth.login.LoginException;

    61 import javax.security.auth.callback.Callback;

    62 import javax.security.auth.callback.PasswordCallback;

    63 import javax.security.auth.callback.CallbackHandler;

    64 import javax.security.auth.callback.UnsupportedCallbackException;

    65 

    66 import sun.security.util.Debug;

    67 import sun.security.util.DerValue;

    68 import sun.security.util.ECUtil;

    69 

    70 import sun.security.pkcs11.Secmod.*;

    71 import static sun.security.pkcs11.P11Util.*;

    72 

    73 import sun.security.pkcs11.wrapper.*;

    74 import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

    75 

    76 import sun.security.rsa.RSAKeyFactory;

    77 

    78 final class P11KeyStore extends KeyStoreSpi {

    79 

    80     private static final CK_ATTRIBUTE ATTR_CLASS_CERT =

    81                         new CK_ATTRIBUTE(CKA_CLASS, CKO_CERTIFICATE);

    82     private static final CK_ATTRIBUTE ATTR_CLASS_PKEY =

    83                         new CK_ATTRIBUTE(CKA_CLASS, CKO_PRIVATE_KEY);

    84     private static final CK_ATTRIBUTE ATTR_CLASS_SKEY =

    85                         new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY);

    86 

    87     private static final CK_ATTRIBUTE ATTR_X509_CERT_TYPE =

    88                         new CK_ATTRIBUTE(CKA_CERTIFICATE_TYPE, CKC_X_509);

    89 

    90     private static final CK_ATTRIBUTE ATTR_TOKEN_TRUE =

    91                         new CK_ATTRIBUTE(CKA_TOKEN, true);

    92 

    93     // XXX for testing purposes only

    94     //  - NSS doesn't support persistent secret keys

    95     //    (key type gets mangled if secret key is a token key)

    96     //  - if debug is turned on, then this is set to false

    97     private static CK_ATTRIBUTE ATTR_SKEY_TOKEN_TRUE = ATTR_TOKEN_TRUE;

    98 

    99     private static final CK_ATTRIBUTE ATTR_TRUSTED_TRUE =

   100                         new CK_ATTRIBUTE(CKA_TRUSTED, true);

   101     private static final CK_ATTRIBUTE ATTR_PRIVATE_TRUE =

   102                         new CK_ATTRIBUTE(CKA_PRIVATE, true);

   103 

   104     private static final long NO_HANDLE = -1;

   105     private static final long FINDOBJECTS_MAX = 100;

   106     private static final String ALIAS_SEP = "/";

   107 

   108     private static final boolean NSS_TEST = false;

   109     private static final Debug debug =

   110                         Debug.getInstance("pkcs11keystore");

   111     private static boolean CKA_TRUSTED_SUPPORTED = true;

   112 

   113     private final Token token;

   114 

   115     // If multiple certs are found to share the same CKA_LABEL

   116     // at load time (NSS-style keystore), then the keystore is read

   117     // and the unique keystore aliases are mapped to the entries.

   118     // However, write capabilities are disabled.

   119     private boolean writeDisabled = false;

   120 

   121     // Map of unique keystore aliases to entries in the token

   122     private HashMap<String, AliasInfo> aliasMap;

   123 

   124     // whether to use NSS Secmod info for trust attributes

   125     private final boolean useSecmodTrust;

   126 

   127     // if useSecmodTrust == true, which type of trust we are interested in

   128     private Secmod.TrustType nssTrustType;

   129 

   130     /**

   131      * The underlying token may contain multiple certs belonging to the

   132      * same "personality" (for example, a signing cert and encryption cert),

   133      * all sharing the same CKA_LABEL.  These must be resolved

   134      * into unique keystore aliases.

   135      *

   136      * In addition, private keys and certs may not have a CKA_LABEL.

   137      * It is assumed that a private key and corresponding certificate

   138      * share the same CKA_ID, and that the CKA_ID is unique across the token.

   139      * The CKA_ID may not be human-readable.

   140      * These pairs must be resolved into unique keystore aliases.

   141      *

   142      * Furthermore, secret keys are assumed to have a CKA_LABEL

   143      * unique across the entire token.

   144      *

   145      * When the KeyStore is loaded, instances of this class are

   146      * created to represent the private keys/secret keys/certs

   147      * that reside on the token.

   148      */

   149     private static class AliasInfo {

   150 

   151         // CKA_CLASS - entry type

   152         private CK_ATTRIBUTE type = null;

   153 

   154         // CKA_LABEL of cert and secret key

   155         private String label = null;

   156 

   157         // CKA_ID of the private key/cert pair

   158         private byte[] id = null;

   159 

   160         // CKA_TRUSTED - true if cert is trusted

   161         private boolean trusted = false;

   162 

   163         // either end-entity cert or trusted cert depending on 'type'

   164         private X509Certificate cert = null;

   165 

   166         // chain

   167         private X509Certificate[] chain = null;

   168 

   169         // true if CKA_ID for private key and cert match up

   170         private boolean matched = false;

   171 

   172         // SecretKeyEntry

   173         public AliasInfo(String label) {

   174             this.type = ATTR_CLASS_SKEY;

   175             this.label = label;

   176         }

   177 

   178         // PrivateKeyEntry

   179         public AliasInfo(String label,

   180                         byte[] id,

   181                         boolean trusted,

   182                         X509Certificate cert) {

   183             this.type = ATTR_CLASS_PKEY;

   184             this.label = label;

   185             this.id = id;

   186             this.trusted = trusted;

   187             this.cert = cert;

   188         }

   189 

   190         public String toString() {

   191             StringBuilder sb = new StringBuilder();

   192             if (type == ATTR_CLASS_PKEY) {

   193                 sb.append("\ttype=[private key]\n");

   194             } else if (type == ATTR_CLASS_SKEY) {

   195                 sb.append("\ttype=[secret key]\n");

   196             } else if (type == ATTR_CLASS_CERT) {

   197                 sb.append("\ttype=[trusted cert]\n");

   198             }

   199             sb.append("\tlabel=[" + label + "]\n");

   200             if (id == null) {

   201                 sb.append("\tid=[null]\n");

   202             } else {

   203                 sb.append("\tid=" + P11KeyStore.getID(id) + "\n");

   204             }

   205             sb.append("\ttrusted=[" + trusted + "]\n");

   206             sb.append("\tmatched=[" + matched + "]\n");

   207             if (cert == null) {

   208                 sb.append("\tcert=[null]\n");

   209             } else {

   210                 sb.append("\tcert=[\tsubject: " +

   211                         cert.getSubjectX500Principal() +

   212                         "\n\t\tissuer: " +

   213                         cert.getIssuerX500Principal() +

   214                         "\n\t\tserialNum: " +

   215                         cert.getSerialNumber().toString() +

   216                         "]");

   217             }

   218             return sb.toString();

   219         }

   220     }

   221 

   222     /**

   223      * callback handler for passing password to Provider.login method

   224      */

   225     private static class PasswordCallbackHandler implements CallbackHandler {

   226 

   227         private char[] password;

   228 

   229         private PasswordCallbackHandler(char[] password) {

   230             if (password != null) {

   231                 this.password = password.clone();

   232             }

   233         }

   234 

   235         public void handle(Callback[] callbacks)

   236                 throws IOException, UnsupportedCallbackException {

   237             if (!(callbacks[0] instanceof PasswordCallback)) {

   238                 throw new UnsupportedCallbackException(callbacks[0]);

   239             }

   240             PasswordCallback pc = (PasswordCallback)callbacks[0];

   241             pc.setPassword(password);  // this clones the password if not null

   242         }

   243 

   244         protected void finalize() throws Throwable {

   245             if (password != null) {

   246                 Arrays.fill(password, ' ');

   247             }

   248             super.finalize();

   249         }

   250     }

   251 

   252     /**

   253      * getTokenObject return value.

   254      *

   255      * if object is not found, type is set to null.

   256      * otherwise, type is set to the requested type.

   257      */

   258     private static class THandle {

   259         private final long handle;              // token object handle

   260         private final CK_ATTRIBUTE type;        // CKA_CLASS

   261 

   262         private THandle(long handle, CK_ATTRIBUTE type) {

   263             this.handle = handle;

   264             this.type = type;

   265         }

   266     }

   267 

   268     P11KeyStore(Token token) {

   269         this.token = token;

   270         this.useSecmodTrust = token.provider.nssUseSecmodTrust;

   271     }

   272 

   273     /**

   274      * Returns the key associated with the given alias.

   275      * The key must have been associated with

   276      * the alias by a call to <code>setKeyEntry</code>,

   277      * or by a call to <code>setEntry</code> with a

   278      * <code>PrivateKeyEntry</code> or <code>SecretKeyEntry</code>.

   279      *

   280      * @param alias the alias name

   281      * @param password the password, which must be <code>null</code>

   282      *

   283      * @return the requested key, or null if the given alias does not exist

   284      * or does not identify a key-related entry.

   285      *

   286      * @exception NoSuchAlgorithmException if the algorithm for recovering the

   287      * key cannot be found

   288      * @exception UnrecoverableKeyException if the key cannot be recovered

   289      */

   290     public synchronized Key engineGetKey(String alias, char[] password)

   291                 throws NoSuchAlgorithmException, UnrecoverableKeyException {

   292 

   293         token.ensureValid();

   294         if (password != null && !token.config.getKeyStoreCompatibilityMode()) {

   295             throw new NoSuchAlgorithmException("password must be null");

   296         }

   297 

   298         AliasInfo aliasInfo = aliasMap.get(alias);

   299         if (aliasInfo == null || aliasInfo.type == ATTR_CLASS_CERT) {

   300             return null;

   301         }

   302 

   303         Session session = null;

   304         try {

   305             session = token.getOpSession();

   306 

   307             if (aliasInfo.type == ATTR_CLASS_PKEY) {

   308                 THandle h = getTokenObject(session,

   309                                         aliasInfo.type,

   310                                         aliasInfo.id,

   311                                         null);

   312                 if (h.type == ATTR_CLASS_PKEY) {

   313                     return loadPkey(session, h.handle);

   314                 }

   315             } else {

   316                 THandle h = getTokenObject(session,

   317                                         ATTR_CLASS_SKEY,

   318                                         null,

   319                                         alias);

   320                 if (h.type == ATTR_CLASS_SKEY) {

   321                     return loadSkey(session, h.handle);

   322                 }

   323             }

   324 

   325             // did not find anything

   326             return null;

   327         } catch (PKCS11Exception | KeyStoreException e) {

   328             throw new ProviderException(e);

   329         } finally {

   330             token.releaseSession(session);

   331         }

   332     }

   333 

   334     /**

   335      * Returns the certificate chain associated with the given alias.

   336      * The certificate chain must have been associated with the alias

   337      * by a call to <code>setKeyEntry</code>,

   338      * or by a call to <code>setEntry</code> with a

   339      * <code>PrivateKeyEntry</code>.

   340      *

   341      * @param alias the alias name

   342      *

   343      * @return the certificate chain (ordered with the user's certificate first

   344      * and the root certificate authority last), or null if the given alias

   345      * does not exist or does not contain a certificate chain

   346      */

   347     public synchronized Certificate[] engineGetCertificateChain(String alias) {

   348 

   349         token.ensureValid();

   350 

   351         AliasInfo aliasInfo = aliasMap.get(alias);

   352         if (aliasInfo == null || aliasInfo.type != ATTR_CLASS_PKEY) {

   353             return null;

   354         }

   355         return aliasInfo.chain;

   356     }

   357 

   358     /**

   359      * Returns the certificate associated with the given alias.

   360      *

   361      * <p> If the given alias name identifies an entry

   362      * created by a call to <code>setCertificateEntry</code>,

   363      * or created by a call to <code>setEntry</code> with a

   364      * <code>TrustedCertificateEntry</code>,

   365      * then the trusted certificate contained in that entry is returned.

   366      *

   367      * <p> If the given alias name identifies an entry

   368      * created by a call to <code>setKeyEntry</code>,

   369      * or created by a call to <code>setEntry</code> with a

   370      * <code>PrivateKeyEntry</code>,

   371      * then the first element of the certificate chain in that entry

   372      * (if a chain exists) is returned.

   373      *

   374      * @param alias the alias name

   375      *

   376      * @return the certificate, or null if the given alias does not exist or

   377      * does not contain a certificate.

   378      */

   379     public synchronized Certificate engineGetCertificate(String alias) {

   380         token.ensureValid();

   381 

   382         AliasInfo aliasInfo = aliasMap.get(alias);

   383         if (aliasInfo == null) {

   384             return null;

   385         }

   386         return aliasInfo.cert;

   387     }

   388 

   389     /**

   390      * Returns the creation date of the entry identified by the given alias.

   391      *

   392      * @param alias the alias name

   393      *

   394      * @return the creation date of this entry, or null if the given alias does

   395      * not exist

   396      */

   397     public Date engineGetCreationDate(String alias) {

   398         token.ensureValid();

   399         throw new ProviderException(new UnsupportedOperationException());

   400     }

   401 

   402     /**

   403      * Assigns the given key to the given alias, protecting it with the given

   404      * password.

   405      *

   406      * <p>If the given key is of type <code>java.security.PrivateKey</code>,

   407      * it must be accompanied by a certificate chain certifying the

   408      * corresponding public key.

   409      *

   410      * <p>If the given alias already exists, the keystore information

   411      * associated with it is overridden by the given key (and possibly

   412      * certificate chain).

   413      *

   414      * @param alias the alias name

   415      * @param key the key to be associated with the alias

   416      * @param password the password to protect the key

   417      * @param chain the certificate chain for the corresponding public

   418      * key (only required if the given key is of type

   419      * <code>java.security.PrivateKey</code>).

   420      *

   421      * @exception KeyStoreException if the given key cannot be protected, or

   422      * this operation fails for some other reason

   423      */

   424     public synchronized void engineSetKeyEntry(String alias, Key key,

   425                                    char[] password,

   426                                    Certificate[] chain)

   427                 throws KeyStoreException {

   428 

   429         token.ensureValid();

   430         checkWrite();

   431 

   432         if (!(key instanceof PrivateKey) && !(key instanceof SecretKey)) {

   433             throw new KeyStoreException("key must be PrivateKey or SecretKey");

   434         } else if (key instanceof PrivateKey && chain == null) {

   435             throw new KeyStoreException

   436                 ("PrivateKey must be accompanied by non-null chain");

   437         } else if (key instanceof SecretKey && chain != null) {

   438             throw new KeyStoreException

   439                 ("SecretKey must be accompanied by null chain");

   440         } else if (password != null &&

   441                     !token.config.getKeyStoreCompatibilityMode()) {

   442             throw new KeyStoreException("Password must be null");

   443         }

   444 

   445         KeyStore.Entry entry = null;

   446         try {

   447             if (key instanceof PrivateKey) {

   448                 entry = new KeyStore.PrivateKeyEntry((PrivateKey)key, chain);

   449             } else if (key instanceof SecretKey) {

   450                 entry = new KeyStore.SecretKeyEntry((SecretKey)key);

   451             }

   452         } catch (NullPointerException | IllegalArgumentException e) {

   453             throw new KeyStoreException(e);

   454         }

   455         engineSetEntry(alias, entry, new KeyStore.PasswordProtection(password));

   456     }

   457 

   458     /**

   459      * Assigns the given key (that has already been protected) to the given

   460      * alias.

   461      *

   462      * <p>If the protected key is of type

   463      * <code>java.security.PrivateKey</code>,

   464      * it must be accompanied by a certificate chain certifying the

   465      * corresponding public key.

   466      *

   467      * <p>If the given alias already exists, the keystore information

   468      * associated with it is overridden by the given key (and possibly

   469      * certificate chain).

   470      *

   471      * @param alias the alias name

   472      * @param key the key (in protected format) to be associated with the alias

   473      * @param chain the certificate chain for the corresponding public

   474      * key (only useful if the protected key is of type

   475      * <code>java.security.PrivateKey</code>).

   476      *

   477      * @exception KeyStoreException if this operation fails.

   478      */

   479     public void engineSetKeyEntry(String alias, byte[] key, Certificate[] chain)

   480                 throws KeyStoreException {

   481         token.ensureValid();

   482         throw new ProviderException(new UnsupportedOperationException());

   483     }

   484 

   485     /**

   486      * Assigns the given certificate to the given alias.

   487      *

   488      * <p> If the given alias identifies an existing entry

   489      * created by a call to <code>setCertificateEntry</code>,

   490      * or created by a call to <code>setEntry</code> with a

   491      * <code>TrustedCertificateEntry</code>,

   492      * the trusted certificate in the existing entry

   493      * is overridden by the given certificate.

   494      *

   495      * @param alias the alias name

   496      * @param cert the certificate

   497      *

   498      * @exception KeyStoreException if the given alias already exists and does

   499      * not identify an entry containing a trusted certificate,

   500      * or this operation fails for some other reason.

   501      */

   502     public synchronized void engineSetCertificateEntry

   503         (String alias, Certificate cert) throws KeyStoreException {

   504 

   505         token.ensureValid();

   506         checkWrite();

   507 

   508         if (cert == null) {

   509             throw new KeyStoreException("invalid null certificate");

   510         }

   511 

   512         KeyStore.Entry entry = null;

   513         entry = new KeyStore.TrustedCertificateEntry(cert);

   514         engineSetEntry(alias, entry, null);

   515     }

   516 

   517     /**

   518      * Deletes the entry identified by the given alias from this keystore.

   519      *

   520      * @param alias the alias name

   521      *

   522      * @exception KeyStoreException if the entry cannot be removed.

   523      */

   524     public synchronized void engineDeleteEntry(String alias)

   525                 throws KeyStoreException {

   526         token.ensureValid();

   527 

   528         if (token.isWriteProtected()) {

   529             throw new KeyStoreException("token write-protected");

   530         }

   531         checkWrite();

   532         deleteEntry(alias);

   533     }

   534 

   535     /**

   536      * XXX - not sure whether to keep this

   537      */

   538     private boolean deleteEntry(String alias) throws KeyStoreException {

   539         AliasInfo aliasInfo = aliasMap.get(alias);

   540         if (aliasInfo != null) {

   541 

   542             aliasMap.remove(alias);

   543 

   544             try {

   545                 if (aliasInfo.type == ATTR_CLASS_CERT) {

   546                     // trusted certificate entry

   547                     return destroyCert(aliasInfo.id);

   548                 } else if (aliasInfo.type == ATTR_CLASS_PKEY) {

   549                     // private key entry

   550                     return destroyPkey(aliasInfo.id) &&

   551                                 destroyChain(aliasInfo.id);

   552                 } else if (aliasInfo.type == ATTR_CLASS_SKEY) {

   553                     // secret key entry

   554                     return destroySkey(alias);

   555                 } else {

   556                     throw new KeyStoreException("unexpected entry type");

   557                 }

   558             } catch (PKCS11Exception | CertificateException e) {

   559                 throw new KeyStoreException(e);

   560             }

   561         }

   562         return false;

   563     }

   564 

   565     /**

   566      * Lists all the alias names of this keystore.

   567      *

   568      * @return enumeration of the alias names

   569      */

   570     public synchronized Enumeration<String> engineAliases() {

   571         token.ensureValid();

   572 

   573         // don't want returned enumeration to iterate off actual keySet -

   574         // otherwise applications that iterate and modify the keystore

   575         // may run into concurrent modification problems

   576         return Collections.enumeration(new HashSet<String>(aliasMap.keySet()));

   577     }

   578 

   579     /**

   580      * Checks if the given alias exists in this keystore.

   581      *

   582      * @param alias the alias name

   583      *

   584      * @return true if the alias exists, false otherwise

   585      */

   586     public synchronized boolean engineContainsAlias(String alias) {

   587         token.ensureValid();

   588         return aliasMap.containsKey(alias);

   589     }

   590 

   591     /**

   592      * Retrieves the number of entries in this keystore.

   593      *

   594      * @return the number of entries in this keystore

   595      */

   596     public synchronized int engineSize() {

   597         token.ensureValid();

   598         return aliasMap.size();

   599     }

   600 

   601     /**

   602      * Returns true if the entry identified by the given alias

   603      * was created by a call to <code>setKeyEntry</code>,

   604      * or created by a call to <code>setEntry</code> with a

   605      * <code>PrivateKeyEntry</code> or a <code>SecretKeyEntry</code>.

   606      *

   607      * @param alias the alias for the keystore entry to be checked

   608      *

   609      * @return true if the entry identified by the given alias is a

   610      * key-related, false otherwise.

   611      */

   612     public synchronized boolean engineIsKeyEntry(String alias) {

   613         token.ensureValid();

   614 

   615         AliasInfo aliasInfo = aliasMap.get(alias);

   616         if (aliasInfo == null || aliasInfo.type == ATTR_CLASS_CERT) {

   617             return false;

   618         }

   619         return true;

   620     }

   621 

   622     /**

   623      * Returns true if the entry identified by the given alias

   624      * was created by a call to <code>setCertificateEntry</code>,

   625      * or created by a call to <code>setEntry</code> with a

   626      * <code>TrustedCertificateEntry</code>.

   627      *

   628      * @param alias the alias for the keystore entry to be checked

   629      *

   630      * @return true if the entry identified by the given alias contains a

   631      * trusted certificate, false otherwise.

   632      */

   633     public synchronized boolean engineIsCertificateEntry(String alias) {

   634         token.ensureValid();

   635 

   636         AliasInfo aliasInfo = aliasMap.get(alias);

   637         if (aliasInfo == null || aliasInfo.type != ATTR_CLASS_CERT) {

   638             return false;

   639         }

   640         return true;

   641     }

   642 

   643     /**

   644      * Returns the (alias) name of the first keystore entry whose certificate

   645      * matches the given certificate.

   646      *

   647      * <p>This method attempts to match the given certificate with each

   648      * keystore entry. If the entry being considered was

   649      * created by a call to <code>setCertificateEntry</code>,

   650      * or created by a call to <code>setEntry</code> with a

   651      * <code>TrustedCertificateEntry</code>,

   652      * then the given certificate is compared to that entry's certificate.

   653      *

   654      * <p> If the entry being considered was

   655      * created by a call to <code>setKeyEntry</code>,

   656      * or created by a call to <code>setEntry</code> with a

   657      * <code>PrivateKeyEntry</code>,

   658      * then the given certificate is compared to the first

   659      * element of that entry's certificate chain.

   660      *

   661      * @param cert the certificate to match with.

   662      *

   663      * @return the alias name of the first entry with matching certificate,

   664      * or null if no such entry exists in this keystore.

   665      */

   666     public synchronized String engineGetCertificateAlias(Certificate cert) {

   667         token.ensureValid();

   668         Enumeration<String> e = engineAliases();

   669         while (e.hasMoreElements()) {

   670             String alias = e.nextElement();

   671             Certificate tokenCert = engineGetCertificate(alias);

   672             if (tokenCert != null && tokenCert.equals(cert)) {

   673                 return alias;

   674             }

   675         }

   676         return null;

   677     }

   678 

   679     /**

   680      * engineStore currently is a No-op.

   681      * Entries are stored to the token during engineSetEntry

   682      *

   683      * @param stream this must be <code>null</code>

   684      * @param password this must be <code>null</code>

   685      */

   686     public synchronized void engineStore(OutputStream stream, char[] password)

   687         throws IOException, NoSuchAlgorithmException, CertificateException {

   688         token.ensureValid();

   689         if (stream != null && !token.config.getKeyStoreCompatibilityMode()) {

   690             throw new IOException("output stream must be null");

   691         }

   692 

   693         if (password != null && !token.config.getKeyStoreCompatibilityMode()) {

   694             throw new IOException("password must be null");

   695         }

   696     }

   697 

   698     /**

   699      * engineStore currently is a No-op.

   700      * Entries are stored to the token during engineSetEntry

   701      *

   702      * @param param this must be <code>null</code>

   703      *

   704      * @exception IllegalArgumentException if the given

   705      *          <code>KeyStore.LoadStoreParameter</code>

   706      *          input is not <code>null</code>

   707      */

   708     public synchronized void engineStore(KeyStore.LoadStoreParameter param)

   709         throws IOException, NoSuchAlgorithmException, CertificateException {

   710         token.ensureValid();

   711         if (param != null) {

   712             throw new IllegalArgumentException

   713                 ("LoadStoreParameter must be null");

   714         }

   715     }

   716 

   717     /**

   718      * Loads the keystore.

   719      *

   720      * @param stream the input stream, which must be <code>null</code>

   721      * @param password the password used to unlock the keystore,

   722      *          or <code>null</code> if the token supports a

   723      *          CKF_PROTECTED_AUTHENTICATION_PATH

   724      *

   725      * @exception IOException if the given <code>stream</code> is not

   726      *          <code>null</code>, if the token supports a

   727      *          CKF_PROTECTED_AUTHENTICATION_PATH and a non-null

   728      *          password is given, of if the token login operation failed

   729      */

   730     public synchronized void engineLoad(InputStream stream, char[] password)

   731         throws IOException, NoSuchAlgorithmException, CertificateException {

   732 

   733         token.ensureValid();

   734 

   735         if (NSS_TEST) {

   736             ATTR_SKEY_TOKEN_TRUE = new CK_ATTRIBUTE(CKA_TOKEN, false);

   737         }

   738 

   739         if (stream != null && !token.config.getKeyStoreCompatibilityMode()) {

   740             throw new IOException("input stream must be null");

   741         }

   742 

   743         if (useSecmodTrust) {

   744             nssTrustType = Secmod.TrustType.ALL;

   745         }

   746 

   747         try {

   748             if (password == null) {

   749                 login(null);

   750             } else {

   751                 login(new PasswordCallbackHandler(password));

   752             }

   753         } catch(LoginException e) {

   754             Throwable cause = e.getCause();

   755             if (cause instanceof PKCS11Exception) {

   756                 PKCS11Exception pe = (PKCS11Exception) cause;

   757                 if (pe.getErrorCode() == CKR_PIN_INCORRECT) {

   758                     // if password is wrong, the cause of the IOException

   759                     // should be an UnrecoverableKeyException

   760                     throw new IOException("load failed",

   761                             new UnrecoverableKeyException().initCause(e));

   762                 }

   763             }

   764             throw new IOException("load failed", e);

   765         }

   766 

   767         try {

   768             if (mapLabels() == true) {

   769                 // CKA_LABELs are shared by multiple certs

   770                 writeDisabled = true;

   771             }

   772             if (debug != null) {

   773                 dumpTokenMap();

   774             }

   775         } catch (KeyStoreException | PKCS11Exception e) {

   776             throw new IOException("load failed", e);

   777         }

   778     }

   779 

   780     /**

   781      * Loads the keystore using the given

   782      * <code>KeyStore.LoadStoreParameter</code>.

   783      *

   784      * <p> The <code>LoadStoreParameter.getProtectionParameter()</code>

   785      * method is expected to return a <code>KeyStore.PasswordProtection</code>

   786      * object.  The password is retrieved from that object and used

   787      * to unlock the PKCS#11 token.

   788      *

   789      * <p> If the token supports a CKF_PROTECTED_AUTHENTICATION_PATH

   790      * then the provided password must be <code>null</code>.

   791      *

   792      * @param param the <code>KeyStore.LoadStoreParameter</code>

   793      *

   794      * @exception IllegalArgumentException if the given

   795      *          <code>KeyStore.LoadStoreParameter</code> is <code>null</code>,

   796      *          or if that parameter returns a <code>null</code>

   797      *          <code>ProtectionParameter</code> object.

   798      *          input is not recognized

   799      * @exception IOException if the token supports a

   800      *          CKF_PROTECTED_AUTHENTICATION_PATH and the provided password

   801      *          is non-null, or if the token login operation fails

   802      */

   803     public synchronized void engineLoad(KeyStore.LoadStoreParameter param)

   804                 throws IOException, NoSuchAlgorithmException,

   805                 CertificateException {

   806 

   807         token.ensureValid();

   808 

   809         if (NSS_TEST) {

   810             ATTR_SKEY_TOKEN_TRUE = new CK_ATTRIBUTE(CKA_TOKEN, false);

   811         }

   812 

   813         // if caller wants to pass a NULL password,

   814         // force it to pass a non-NULL PasswordProtection that returns

   815         // a NULL password

   816 

   817         if (param == null) {

   818             throw new IllegalArgumentException

   819                         ("invalid null LoadStoreParameter");

   820         }

   821         if (useSecmodTrust) {

   822             if (param instanceof Secmod.KeyStoreLoadParameter) {

   823                 nssTrustType = ((Secmod.KeyStoreLoadParameter)param).getTrustType();

   824             } else {

   825                 nssTrustType = Secmod.TrustType.ALL;

   826             }

   827         }

   828 

   829         CallbackHandler handler;

   830         KeyStore.ProtectionParameter pp = param.getProtectionParameter();

   831         if (pp instanceof PasswordProtection) {

   832             char[] password = ((PasswordProtection)pp).getPassword();

   833             if (password == null) {

   834                 handler = null;

   835             } else {

   836                 handler = new PasswordCallbackHandler(password);

   837             }

   838         } else if (pp instanceof CallbackHandlerProtection) {

   839             handler = ((CallbackHandlerProtection)pp).getCallbackHandler();

   840         } else {

   841             throw new IllegalArgumentException

   842                         ("ProtectionParameter must be either " +

   843                         "PasswordProtection or CallbackHandlerProtection");

   844         }

   845 

   846         try {

   847             login(handler);

   848             if (mapLabels() == true) {

   849                 // CKA_LABELs are shared by multiple certs

   850                 writeDisabled = true;

   851             }

   852             if (debug != null) {

   853                 dumpTokenMap();

   854             }

   855         } catch (LoginException | KeyStoreException | PKCS11Exception e) {

   856             throw new IOException("load failed", e);

   857         }

   858     }

   859 

   860     private void login(CallbackHandler handler) throws LoginException {

   861         if ((token.tokenInfo.flags & CKF_PROTECTED_AUTHENTICATION_PATH) == 0) {

   862             token.provider.login(null, handler);

   863         } else {

   864             // token supports protected authentication path

   865             // (external pin-pad, for example)

   866             if (handler != null &&

   867                 !token.config.getKeyStoreCompatibilityMode()) {

   868                 throw new LoginException("can not specify password if token " +

   869                                 "supports protected authentication path");

   870             }

   871 

   872             // must rely on application-set or default handler

   873             // if one is necessary

   874             token.provider.login(null, null);

   875         }

   876     }

   877 

   878     /**

   879      * Get a <code>KeyStore.Entry</code> for the specified alias

   880      *

   881      * @param alias get the <code>KeyStore.Entry</code> for this alias

   882      * @param protParam this must be <code>null</code>

   883      *

   884      * @return the <code>KeyStore.Entry</code> for the specified alias,

   885      *          or <code>null</code> if there is no such entry

   886      *

   887      * @exception KeyStoreException if the operation failed

   888      * @exception NoSuchAlgorithmException if the algorithm for recovering the

   889      *          entry cannot be found

   890      * @exception UnrecoverableEntryException if the specified

   891      *          <code>protParam</code> were insufficient or invalid

   892      *

   893      * @since 1.5

   894      */

   895     public synchronized KeyStore.Entry engineGetEntry(String alias,

   896                         KeyStore.ProtectionParameter protParam)

   897                 throws KeyStoreException, NoSuchAlgorithmException,

   898                 UnrecoverableEntryException {

   899 

   900         token.ensureValid();

   901 

   902         if (protParam != null &&

   903             protParam instanceof KeyStore.PasswordProtection &&

   904             ((KeyStore.PasswordProtection)protParam).getPassword() != null &&

   905             !token.config.getKeyStoreCompatibilityMode()) {

   906             throw new KeyStoreException("ProtectionParameter must be null");

   907         }

   908 

   909         AliasInfo aliasInfo = aliasMap.get(alias);

   910         if (aliasInfo == null) {

   911             if (debug != null) {

   912                 debug.println("engineGetEntry did not find alias [" +

   913                         alias +

   914                         "] in map");

   915             }

   916             return null;

   917         }

   918 

   919         Session session = null;

   920         try {

   921             session = token.getOpSession();

   922 

   923             if (aliasInfo.type == ATTR_CLASS_CERT) {

   924                 // trusted certificate entry

   925                 if (debug != null) {

   926                     debug.println("engineGetEntry found trusted cert entry");

   927                 }

   928                 return new KeyStore.TrustedCertificateEntry(aliasInfo.cert);

   929             } else if (aliasInfo.type == ATTR_CLASS_SKEY) {

   930                 // secret key entry

   931                 if (debug != null) {

   932                     debug.println("engineGetEntry found secret key entry");

   933                 }

   934 

   935                 THandle h = getTokenObject

   936                         (session, ATTR_CLASS_SKEY, null, aliasInfo.label);

   937                 if (h.type != ATTR_CLASS_SKEY) {

   938                     throw new KeyStoreException

   939                         ("expected but could not find secret key");

   940                 } else {

   941                     SecretKey skey = loadSkey(session, h.handle);

   942                     return new KeyStore.SecretKeyEntry(skey);

   943                 }

   944             } else {

   945                 // private key entry

   946                 if (debug != null) {

   947                     debug.println("engineGetEntry found private key entry");

   948                 }

   949 

   950                 THandle h = getTokenObject

   951                         (session, ATTR_CLASS_PKEY, aliasInfo.id, null);

   952                 if (h.type != ATTR_CLASS_PKEY) {

   953                     throw new KeyStoreException

   954                         ("expected but could not find private key");

   955                 } else {

   956                     PrivateKey pkey = loadPkey(session, h.handle);

   957                     Certificate[] chain = aliasInfo.chain;

   958                     if ((pkey != null) && (chain != null)) {

   959                         return new KeyStore.PrivateKeyEntry(pkey, chain);

   960                     } else {

   961                         if (debug != null) {

   962                             debug.println

   963                                 ("engineGetEntry got null cert chain or private key");

   964                         }

   965                     }

   966                 }

   967             }

   968             return null;

   969         } catch (PKCS11Exception pe) {

   970             throw new KeyStoreException(pe);

   971         } finally {

   972             token.releaseSession(session);

   973         }

   974     }

   975 

   976     /**

   977      * Save a <code>KeyStore.Entry</code> under the specified alias.

   978      *

   979      * <p> If an entry already exists for the specified alias,

   980      * it is overridden.

   981      *

   982      * <p> This KeyStore implementation only supports the standard

   983      * entry types, and only supports X509Certificates in

   984      * TrustedCertificateEntries.  Also, this implementation does not support

   985      * protecting entries using a different password

   986      * from the one used for token login.

   987      *

   988      * <p> Entries are immediately stored on the token.

   989      *

   990      * @param alias save the <code>KeyStore.Entry</code> under this alias

   991      * @param entry the <code>Entry</code> to save

   992      * @param protParam this must be <code>null</code>

   993      *

   994      * @exception KeyStoreException if this operation fails

   995      *

   996      * @since 1.5

   997      */

   998     public synchronized void engineSetEntry(String alias, KeyStore.Entry entry,

   999                         KeyStore.ProtectionParameter protParam)

  1000                 throws KeyStoreException {

  1001 

  1002         token.ensureValid();

  1003         checkWrite();

  1004 

  1005         if (protParam != null &&

  1006             protParam instanceof KeyStore.PasswordProtection &&

  1007             ((KeyStore.PasswordProtection)protParam).getPassword() != null &&

  1008             !token.config.getKeyStoreCompatibilityMode()) {

  1009             throw new KeyStoreException(new UnsupportedOperationException

  1010                                 ("ProtectionParameter must be null"));

  1011         }

  1012 

  1013         if (token.isWriteProtected()) {

  1014             throw new KeyStoreException("token write-protected");

  1015         }

  1016 

  1017         if (entry instanceof KeyStore.TrustedCertificateEntry) {

  1018 

  1019             if (useSecmodTrust == false) {

  1020                 // PKCS #11 does not allow app to modify trusted certs -

  1021                 throw new KeyStoreException(new UnsupportedOperationException

  1022                                     ("trusted certificates may only be set by " +

  1023                                     "token initialization application"));

  1024             }

  1025             Module module = token.provider.nssModule;

  1026             if ((module.type != ModuleType.KEYSTORE) && (module.type != ModuleType.FIPS)) {

  1027                 // XXX allow TRUSTANCHOR module

  1028                 throw new KeyStoreException("Trusted certificates can only be "

  1029                     + "added to the NSS KeyStore module");

  1030             }

  1031             Certificate cert = ((TrustedCertificateEntry)entry).getTrustedCertificate();

  1032             if (cert instanceof X509Certificate == false) {

  1033                 throw new KeyStoreException("Certificate must be an X509Certificate");

  1034             }

  1035             X509Certificate xcert = (X509Certificate)cert;

  1036             AliasInfo info = aliasMap.get(alias);

  1037             if (info != null) {

  1038                 // XXX try to update

  1039                 deleteEntry(alias);

  1040             }

  1041             try {

  1042                 storeCert(alias, xcert);

  1043                 module.setTrust(token, xcert);

  1044                 mapLabels();

  1045             } catch (PKCS11Exception | CertificateException e) {

  1046                 throw new KeyStoreException(e);

  1047             }

  1048 

  1049         } else {

  1050 

  1051             if (entry instanceof KeyStore.PrivateKeyEntry) {

  1052 

  1053                 PrivateKey key =

  1054                         ((KeyStore.PrivateKeyEntry)entry).getPrivateKey();

  1055                 if (!(key instanceof P11Key) &&

  1056                     !(key instanceof RSAPrivateKey) &&

  1057                     !(key instanceof DSAPrivateKey) &&

  1058                     !(key instanceof DHPrivateKey) &&

  1059                     !(key instanceof ECPrivateKey)) {

  1060                     throw new KeyStoreException("unsupported key type: " +

  1061                                                 key.getClass().getName());

  1062                 }

  1063 

  1064                 // only support X509Certificate chains

  1065                 Certificate[] chain =

  1066                     ((KeyStore.PrivateKeyEntry)entry).getCertificateChain();

  1067                 if (!(chain instanceof X509Certificate[])) {

  1068                     throw new KeyStoreException

  1069                         (new UnsupportedOperationException

  1070                                 ("unsupported certificate array type: " +

  1071                                 chain.getClass().getName()));

  1072                 }

  1073 

  1074                 try {

  1075                     boolean updatedAlias = false;

  1076                     Set<String> aliases = aliasMap.keySet();

  1077                     for (String oldAlias : aliases) {

  1078 

  1079                         // see if there's an existing entry with the same info

  1080 

  1081                         AliasInfo aliasInfo = aliasMap.get(oldAlias);

  1082                         if (aliasInfo.type == ATTR_CLASS_PKEY &&

  1083                             aliasInfo.cert.getPublicKey().equals

  1084                                         (chain[0].getPublicKey())) {

  1085 

  1086                             // found existing entry -

  1087                             // caller is renaming entry or updating cert chain

  1088                             //

  1089                             // set new CKA_LABEL/CKA_ID

  1090                             // and update certs if necessary

  1091 

  1092                             updatePkey(alias,

  1093                                         aliasInfo.id,

  1094                                         (X509Certificate[])chain,

  1095                                         !aliasInfo.cert.equals(chain[0]));

  1096                             updatedAlias = true;

  1097                             break;

  1098                         }

  1099                     }

  1100 

  1101                     if (!updatedAlias) {

  1102                         // caller adding new entry

  1103                         engineDeleteEntry(alias);

  1104                         storePkey(alias, (KeyStore.PrivateKeyEntry)entry);

  1105                     }

  1106 

  1107                 } catch (PKCS11Exception | CertificateException pe) {

  1108                     throw new KeyStoreException(pe);

  1109                 }

  1110 

  1111             } else if (entry instanceof KeyStore.SecretKeyEntry) {

  1112 

  1113                 KeyStore.SecretKeyEntry ske = (KeyStore.SecretKeyEntry)entry;

  1114                 SecretKey skey = ske.getSecretKey();

  1115 

  1116                 try {

  1117                     // first check if the key already exists

  1118                     AliasInfo aliasInfo = aliasMap.get(alias);

  1119 

  1120                     if (aliasInfo != null) {

  1121                         engineDeleteEntry(alias);

  1122                     }

  1123                     storeSkey(alias, ske);

  1124 

  1125                 } catch (PKCS11Exception pe) {

  1126                     throw new KeyStoreException(pe);

  1127                 }

  1128 

  1129             } else {

  1130                 throw new KeyStoreException(new UnsupportedOperationException

  1131                     ("unsupported entry type: " + entry.getClass().getName()));

  1132             }

  1133 

  1134             try {

  1135