Example code: - *
- * Secmod secmod = Secmod.getInstance();
- * if (secmod.isInitialized() == false) {
- * secmod.initialize("/home/myself/.mozilla");
- * }
- *
- * Provider p = secmod.getModule(ModuleType.KEYSTORE).getProvider();
- * KeyStore ks = KeyStore.getInstance("PKCS11", p);
- * ks.load(null, password);
- *
- *
- * @since 1.6
- * @author Andreas Sterbenz
- */
-public final class Secmod {
-
- private final static boolean DEBUG = false;
-
- private final static Secmod INSTANCE;
-
- static {
- sun.security.pkcs11.wrapper.PKCS11.loadNative();
- INSTANCE = new Secmod();
- }
-
- private final static String NSS_LIB_NAME = "nss3";
-
- private final static String SOFTTOKEN_LIB_NAME = "softokn3";
-
- private final static String TRUST_LIB_NAME = "nssckbi";
-
- // handle to be passed to the native code, 0 means not initialized
- private long nssHandle;
-
- // whether this is a supported version of NSS
- private boolean supported;
-
- // list of the modules
- private List
- * It allows the set of trusted certificates that are returned by
- * the KeyStore to be specified.
- */
- public static final class KeyStoreLoadParameter implements LoadStoreParameter {
- final TrustType trustType;
- final ProtectionParameter protection;
- public KeyStoreLoadParameter(TrustType trustType, char[] password) {
- this(trustType, new PasswordProtection(password));
-
- }
- public KeyStoreLoadParameter(TrustType trustType, ProtectionParameter prot) {
- if (trustType == null) {
- throw new NullPointerException("trustType must not be null");
- }
- this.trustType = trustType;
- this.protection = prot;
- }
- public ProtectionParameter getProtectionParameter() {
- return protection;
- }
- public TrustType getTrustType() {
- return trustType;
- }
- }
-
- static class TrustAttributes {
- final long handle;
- final long clientAuth, serverAuth, codeSigning, emailProtection;
- final byte[] shaHash;
- TrustAttributes(Token token, X509Certificate cert, Bytes bytes, long trustValue) {
- Session session = null;
- try {
- session = token.getOpSession();
- // XXX use KeyStore TrustType settings to determine which
- // attributes to set
- CK_ATTRIBUTE[] attrs = new CK_ATTRIBUTE[] {
- new CK_ATTRIBUTE(CKA_TOKEN, true),
- new CK_ATTRIBUTE(CKA_CLASS, CKO_NETSCAPE_TRUST),
- new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_SERVER_AUTH, trustValue),
- new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_CODE_SIGNING, trustValue),
- new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_EMAIL_PROTECTION, trustValue),
- new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_CLIENT_AUTH, trustValue),
- new CK_ATTRIBUTE(CKA_NETSCAPE_CERT_SHA1_HASH, bytes.b),
- new CK_ATTRIBUTE(CKA_NETSCAPE_CERT_MD5_HASH, getDigest(cert, "MD5")),
- new CK_ATTRIBUTE(CKA_ISSUER, cert.getIssuerX500Principal().getEncoded()),
- new CK_ATTRIBUTE(CKA_SERIAL_NUMBER, cert.getSerialNumber().toByteArray()),
- // XXX per PKCS#11 spec, the serial number should be in ASN.1
- };
- handle = token.p11.C_CreateObject(session.id(), attrs);
- shaHash = bytes.b;
- clientAuth = trustValue;
- serverAuth = trustValue;
- codeSigning = trustValue;
- emailProtection = trustValue;
- } catch (PKCS11Exception e) {
- throw new ProviderException("Could not create trust object", e);
- } finally {
- token.releaseSession(session);
- }
- }
- TrustAttributes(Token token, Session session, long handle)
- throws PKCS11Exception {
- this.handle = handle;
- CK_ATTRIBUTE[] attrs = new CK_ATTRIBUTE[] {
- new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_SERVER_AUTH),
- new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_CODE_SIGNING),
- new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_EMAIL_PROTECTION),
- new CK_ATTRIBUTE(CKA_NETSCAPE_CERT_SHA1_HASH),
- };
-
- token.p11.C_GetAttributeValue(session.id(), handle, attrs);
- serverAuth = attrs[0].getLong();
- codeSigning = attrs[1].getLong();
- emailProtection = attrs[2].getLong();
- shaHash = attrs[3].getByteArray();
-
- attrs = new CK_ATTRIBUTE[] {
- new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_CLIENT_AUTH),
- };
- long c;
- try {
- token.p11.C_GetAttributeValue(session.id(), handle, attrs);
- c = attrs[0].getLong();
- } catch (PKCS11Exception e) {
- // trust anchor module does not support this attribute
- c = serverAuth;
- }
- clientAuth = c;
- }
- Bytes getHash() {
- return new Bytes(shaHash);
- }
- boolean isTrusted(TrustType type) {
- switch (type) {
- case CLIENT_AUTH:
- return isTrusted(clientAuth);
- case SERVER_AUTH:
- return isTrusted(serverAuth);
- case CODE_SIGNING:
- return isTrusted(codeSigning);
- case EMAIL_PROTECTION:
- return isTrusted(emailProtection);
- case ALL:
- return isTrusted(TrustType.CLIENT_AUTH)
- && isTrusted(TrustType.SERVER_AUTH)
- && isTrusted(TrustType.CODE_SIGNING)
- && isTrusted(TrustType.EMAIL_PROTECTION);
- default:
- return false;
- }
- }
-
- private boolean isTrusted(long l) {
- // XXX CKT_TRUSTED?
- return (l == CKT_NETSCAPE_TRUSTED_DELEGATOR);
- }
-
- }
-
- private static class Bytes {
- final byte[] b;
- Bytes(byte[] b) {
- this.b = b;
- }
- public int hashCode() {
- return Arrays.hashCode(b);
- }
- public boolean equals(Object o) {
- if (this == o) {
- return true;
- }
- if (o instanceof Bytes == false) {
- return false;
- }
- Bytes other = (Bytes)o;
- return Arrays.equals(this.b, other.b);
- }
- }
-
- private static Map