src/share/classes/sun/security/pkcs11/Token.java - toolchain/jdk/jdk9_jdk - Git at Google

 /*
  * Copyright (c) 2003, 2006, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this
  * particular file as subject to the "Classpath" exception as provided
  * by Oracle in the LICENSE file that accompanied this code.
  *
  * This code is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * version 2 for more details (a copy is included in the LICENSE file that
  * accompanied this code).
  *
  * You should have received a copy of the GNU General Public License version
  * 2 along with this work; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  *
  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  * or visit www.oracle.com if you need additional information or have any
  * questions.
  */

 package sun.security.pkcs11;

 import java.util.*;
 import java.io.*;
 import java.lang.ref.*;

 import java.security.*;
 import javax.security.auth.login.LoginException;

 import sun.security.jca.JCAUtil;

 import sun.security.pkcs11.wrapper.*;
 import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

 /**
  * PKCS#11 token.
  *
  * @author  Andreas Sterbenz
  * @since   1.5
  */
 class Token implements Serializable {

     // need to be serializable to allow SecureRandom to be serialized
     private static final long serialVersionUID = 2541527649100571747L;

     // how often to check if the token is still present (in ms)
     // this is different from checking if a token has been inserted,
     // that is done in SunPKCS11. Currently 50 ms.
     private final static long CHECK_INTERVAL = 50;

     final SunPKCS11 provider;

     final PKCS11 p11;

     final Config config;

     final CK_TOKEN_INFO tokenInfo;

     // session manager to pool sessions
     final SessionManager sessionManager;

     // template manager to customize the attributes used when creating objects
     private final TemplateManager templateManager;

     // flag indicating whether we need to explicitly cancel operations
     // we started on the token. If false, we assume operations are
     // automatically cancelled once we start another one
     final boolean explicitCancel;

     // translation cache for secret keys
     final KeyCache secretCache;

     // translation cache for asymmetric keys (public and private)
     final KeyCache privateCache;

     // cached instances of the various key factories, initialized on demand
     private volatile P11KeyFactory rsaFactory, dsaFactory, dhFactory, ecFactory;

     // table which maps mechanisms to the corresponding cached
     // MechanismInfo objects
     private final Map<Long, CK_MECHANISM_INFO> mechInfoMap;

     // single SecureRandomSpi instance we use per token
     // initialized on demand (if supported)
     private volatile P11SecureRandom secureRandom;

     // single KeyStoreSpi instance we use per provider
     // initialized on demand
     private volatile P11KeyStore keyStore;

     // whether this token is a removable token
     private final boolean removable;

     // for removable tokens: whether this token is valid or has been removed
     private volatile boolean valid;

     // for removable tokens: time last checked for token presence
     private long lastPresentCheck;

     // unique token id, used for serialization only
     private byte[] tokenId;

     // flag indicating whether the token is write protected
     private boolean writeProtected;

     // flag indicating whether we are logged in
     private volatile boolean loggedIn;

     // time we last checked login status
     private long lastLoginCheck;

     // mutex for token-present-check
     private final static Object CHECK_LOCK = new Object();

     // object for indicating unsupported mechanism in 'mechInfoMap'
     private final static CK_MECHANISM_INFO INVALID_MECH =
         new CK_MECHANISM_INFO(0, 0, 0);

     Token(SunPKCS11 provider) throws PKCS11Exception {
         this.provider = provider;
         this.removable = provider.removable;
         this.valid = true;
         p11 = provider.p11;
         config = provider.config;
         tokenInfo = p11.C_GetTokenInfo(provider.slotID);
         writeProtected = (tokenInfo.flags & CKF_WRITE_PROTECTED) != 0;
         // create session manager and open a test session
         SessionManager sessionManager;
         try {
             sessionManager = new SessionManager(this);
             Session s = sessionManager.getOpSession();
             sessionManager.releaseSession(s);
         } catch (PKCS11Exception e) {
             if (writeProtected) {
                 throw e;
             }
             // token might not permit RW sessions even though
             // CKF_WRITE_PROTECTED is not set
             writeProtected = true;
             sessionManager = new SessionManager(this);
             Session s = sessionManager.getOpSession();
             sessionManager.releaseSession(s);
         }
         this.sessionManager = sessionManager;
         secretCache = new KeyCache();
         privateCache = new KeyCache();
         templateManager = config.getTemplateManager();
         explicitCancel = config.getExplicitCancel();
         mechInfoMap = Collections.synchronizedMap
             (new HashMap<Long, CK_MECHANISM_INFO>(10));
     }

     boolean isWriteProtected() {
         return writeProtected;
     }

     // return whether we are logged in
     // uses cached result if current. session is optional and may be null
     boolean isLoggedIn(Session session) throws PKCS11Exception {
         // volatile load first
         boolean loggedIn = this.loggedIn;
         long time = System.currentTimeMillis();
         if (time - lastLoginCheck > CHECK_INTERVAL) {
             loggedIn = isLoggedInNow(session);
             lastLoginCheck = time;
         }
         return loggedIn;
     }

     // return whether we are logged in now
     // does not use cache
     boolean isLoggedInNow(Session session) throws PKCS11Exception {
         boolean allocSession = (session == null);
         try {
             if (allocSession) {
                 session = getOpSession();
             }
             CK_SESSION_INFO info = p11.C_GetSessionInfo(session.id());
             boolean loggedIn = (info.state == CKS_RO_USER_FUNCTIONS) ||
                                 (info.state == CKS_RW_USER_FUNCTIONS);
             this.loggedIn = loggedIn;
             return loggedIn;
         } finally {
             if (allocSession) {
                 releaseSession(session);
             }
         }
     }

     // ensure that we are logged in
     // call provider.login() if not
     void ensureLoggedIn(Session session) throws PKCS11Exception, LoginException {
         if (isLoggedIn(session) == false) {
             provider.login(null, null);
         }
     }

     // return whether this token object is valid (i.e. token not removed)
     // returns value from last check, does not perform new check
     boolean isValid() {
         if (removable == false) {
             return true;
         }
         return valid;
     }

     void ensureValid() {
         if (isValid() == false) {
             throw new ProviderException("Token has been removed");
         }
     }

     // return whether a token is present (i.e. token not removed)
     // returns cached value if current, otherwise performs new check
     boolean isPresent(Session session) {
         if (removable == false) {
             return true;
         }
         if (valid == false) {
             return false;
         }
         long time = System.currentTimeMillis();
         if ((time - lastPresentCheck) >= CHECK_INTERVAL) {
             synchronized (CHECK_LOCK) {
                 if ((time - lastPresentCheck) >= CHECK_INTERVAL) {
                     boolean ok = false;
                     try {
                         // check if token still present
                         CK_SLOT_INFO slotInfo =
                                 provider.p11.C_GetSlotInfo(provider.slotID);
                         if ((slotInfo.flags & CKF_TOKEN_PRESENT) != 0) {
                             // if the token has been removed and re-inserted,
                             // the token should return an error
                             CK_SESSION_INFO sessInfo =
                                     provider.p11.C_GetSessionInfo
                                     (session.idInternal());
                             ok = true;
                         }
                     } catch (PKCS11Exception e) {
                         // empty
                     }
                     valid = ok;
                     lastPresentCheck = System.currentTimeMillis();
                     if (ok == false) {
                         destroy();
                     }
                 }
             }
         }
         return valid;
     }

     void destroy() {
         valid = false;
         provider.uninitToken(this);
     }

     Session getObjSession() throws PKCS11Exception {
         return sessionManager.getObjSession();
     }

     Session getOpSession() throws PKCS11Exception {
         return sessionManager.getOpSession();
     }

     Session releaseSession(Session session) {
         return sessionManager.releaseSession(session);
     }

     Session killSession(Session session) {
         return sessionManager.killSession(session);
     }

     CK_ATTRIBUTE[] getAttributes(String op, long type, long alg,
             CK_ATTRIBUTE[] attrs) throws PKCS11Exception {
         CK_ATTRIBUTE[] newAttrs =
                     templateManager.getAttributes(op, type, alg, attrs);
         for (CK_ATTRIBUTE attr : newAttrs) {
             if (attr.type == CKA_TOKEN) {
                 if (attr.getBoolean()) {
                     try {
                         ensureLoggedIn(null);
                     } catch (LoginException e) {
                         throw new ProviderException("Login failed", e);
                     }
                 }
                 // break once we have found a CKA_TOKEN attribute
                 break;
             }
         }
         return newAttrs;
     }

     P11KeyFactory getKeyFactory(String algorithm) {
         P11KeyFactory f;
         if (algorithm.equals("RSA")) {
             f = rsaFactory;
             if (f == null) {
                 f = new P11RSAKeyFactory(this, algorithm);
                 rsaFactory = f;
             }
         } else if (algorithm.equals("DSA")) {
             f = dsaFactory;
             if (f == null) {
                 f = new P11DSAKeyFactory(this, algorithm);
                 dsaFactory = f;
             }
         } else if (algorithm.equals("DH")) {
             f = dhFactory;
             if (f == null) {
                 f = new P11DHKeyFactory(this, algorithm);
                 dhFactory = f;
             }
         } else if (algorithm.equals("EC")) {
             f = ecFactory;
             if (f == null) {
                 f = new P11ECKeyFactory(this, algorithm);
                 ecFactory = f;
             }
         } else {
             throw new ProviderException("Unknown algorithm " + algorithm);
         }
         return f;
     }

     P11SecureRandom getRandom() {
         if (secureRandom == null) {
             secureRandom = new P11SecureRandom(this);
         }
         return secureRandom;
     }

     P11KeyStore getKeyStore() {
         if (keyStore == null) {
             keyStore = new P11KeyStore(this);
         }
         return keyStore;
     }

     CK_MECHANISM_INFO getMechanismInfo(long mechanism) throws PKCS11Exception {
         CK_MECHANISM_INFO result = mechInfoMap.get(mechanism);
         if (result == null) {
             try {
                 result = p11.C_GetMechanismInfo(provider.slotID,
                                                 mechanism);
                 mechInfoMap.put(mechanism, result);
             } catch (PKCS11Exception e) {
                 if (e.getErrorCode() != PKCS11Constants.CKR_MECHANISM_INVALID) {
                     throw e;
                 } else {
                     mechInfoMap.put(mechanism, INVALID_MECH);
                 }
             }
         } else if (result == INVALID_MECH) {
             result = null;
         }
         return result;
     }

     private synchronized byte[] getTokenId() {
         if (tokenId == null) {
             SecureRandom random = JCAUtil.getSecureRandom();
             tokenId = new byte[20];
             random.nextBytes(tokenId);
             serializedTokens.add(new WeakReference<Token>(this));
         }
         return tokenId;
     }

     // list of all tokens that have been serialized within this VM
     // NOTE that elements are never removed from this list
     // the assumption is that the number of tokens that are serialized
     // is relatively small
     private static final List<Reference<Token>> serializedTokens =
         new ArrayList<Reference<Token>>();

     private Object writeReplace() throws ObjectStreamException {
         if (isValid() == false) {
             throw new NotSerializableException("Token has been removed");
         }
         return new TokenRep(this);
     }

     // serialized representation of a token
     // tokens can only be de-serialized within the same VM invocation
     // and if the token has not been removed in the meantime
     private static class TokenRep implements Serializable {

         private static final long serialVersionUID = 3503721168218219807L;

         private final byte[] tokenId;

         TokenRep(Token token) {
             tokenId = token.getTokenId();
         }

         private Object readResolve() throws ObjectStreamException {
             for (Reference<Token> tokenRef : serializedTokens) {
                 Token token = tokenRef.get();
                 if ((token != null) && token.isValid()) {
                     if (Arrays.equals(token.getTokenId(), tokenId)) {
                         return token;
                     }
                 }
             }
             throw new NotSerializableException("Could not find token");
         }
     }

 }
	/*
	* Copyright (c) 2003, 2006, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	package sun.security.pkcs11;

	import java.util.*;
	import java.io.*;
	import java.lang.ref.*;

	import java.security.*;
	import javax.security.auth.login.LoginException;

	import sun.security.jca.JCAUtil;

	import sun.security.pkcs11.wrapper.*;
	import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

	/**
	* PKCS#11 token.
	*
	* @author Andreas Sterbenz
	* @since 1.5
	*/
	class Token implements Serializable {

	// need to be serializable to allow SecureRandom to be serialized
	private static final long serialVersionUID = 2541527649100571747L;

	// how often to check if the token is still present (in ms)
	// this is different from checking if a token has been inserted,
	// that is done in SunPKCS11. Currently 50 ms.
	private final static long CHECK_INTERVAL = 50;

	final SunPKCS11 provider;

	final PKCS11 p11;

	final Config config;

	final CK_TOKEN_INFO tokenInfo;

	// session manager to pool sessions
	final SessionManager sessionManager;

	// template manager to customize the attributes used when creating objects
	private final TemplateManager templateManager;

	// flag indicating whether we need to explicitly cancel operations
	// we started on the token. If false, we assume operations are
	// automatically cancelled once we start another one
	final boolean explicitCancel;

	// translation cache for secret keys
	final KeyCache secretCache;

	// translation cache for asymmetric keys (public and private)
	final KeyCache privateCache;

	// cached instances of the various key factories, initialized on demand
	private volatile P11KeyFactory rsaFactory, dsaFactory, dhFactory, ecFactory;

	// table which maps mechanisms to the corresponding cached
	// MechanismInfo objects
	private final Map<Long, CK_MECHANISM_INFO> mechInfoMap;

	// single SecureRandomSpi instance we use per token
	// initialized on demand (if supported)
	private volatile P11SecureRandom secureRandom;

	// single KeyStoreSpi instance we use per provider
	// initialized on demand
	private volatile P11KeyStore keyStore;

	// whether this token is a removable token
	private final boolean removable;

	// for removable tokens: whether this token is valid or has been removed
	private volatile boolean valid;

	// for removable tokens: time last checked for token presence
	private long lastPresentCheck;

	// unique token id, used for serialization only
	private byte[] tokenId;

	// flag indicating whether the token is write protected
	private boolean writeProtected;

	// flag indicating whether we are logged in
	private volatile boolean loggedIn;

	// time we last checked login status
	private long lastLoginCheck;

	// mutex for token-present-check
	private final static Object CHECK_LOCK = new Object();

	// object for indicating unsupported mechanism in 'mechInfoMap'
	private final static CK_MECHANISM_INFO INVALID_MECH =
	new CK_MECHANISM_INFO(0, 0, 0);

	Token(SunPKCS11 provider) throws PKCS11Exception {
	this.provider = provider;
	this.removable = provider.removable;
	this.valid = true;
	p11 = provider.p11;
	config = provider.config;
	tokenInfo = p11.C_GetTokenInfo(provider.slotID);
	writeProtected = (tokenInfo.flags & CKF_WRITE_PROTECTED) != 0;
	// create session manager and open a test session
	SessionManager sessionManager;
	try {
	sessionManager = new SessionManager(this);
	Session s = sessionManager.getOpSession();
	sessionManager.releaseSession(s);
	} catch (PKCS11Exception e) {
	if (writeProtected) {
	throw e;
	}
	// token might not permit RW sessions even though
	// CKF_WRITE_PROTECTED is not set
	writeProtected = true;
	sessionManager = new SessionManager(this);
	Session s = sessionManager.getOpSession();
	sessionManager.releaseSession(s);
	}
	this.sessionManager = sessionManager;
	secretCache = new KeyCache();
	privateCache = new KeyCache();
	templateManager = config.getTemplateManager();
	explicitCancel = config.getExplicitCancel();
	mechInfoMap = Collections.synchronizedMap
	(new HashMap<Long, CK_MECHANISM_INFO>(10));
	}

	boolean isWriteProtected() {
	return writeProtected;
	}

	// return whether we are logged in
	// uses cached result if current. session is optional and may be null
	boolean isLoggedIn(Session session) throws PKCS11Exception {
	// volatile load first
	boolean loggedIn = this.loggedIn;
	long time = System.currentTimeMillis();
	if (time - lastLoginCheck > CHECK_INTERVAL) {
	loggedIn = isLoggedInNow(session);
	lastLoginCheck = time;
	}
	return loggedIn;
	}

	// return whether we are logged in now
	// does not use cache
	boolean isLoggedInNow(Session session) throws PKCS11Exception {
	boolean allocSession = (session == null);
	try {
	if (allocSession) {
	session = getOpSession();
	}
	CK_SESSION_INFO info = p11.C_GetSessionInfo(session.id());
	boolean loggedIn = (info.state == CKS_RO_USER_FUNCTIONS) \|\|
	(info.state == CKS_RW_USER_FUNCTIONS);
	this.loggedIn = loggedIn;
	return loggedIn;
	} finally {
	if (allocSession) {
	releaseSession(session);
	}
	}
	}

	// ensure that we are logged in
	// call provider.login() if not
	void ensureLoggedIn(Session session) throws PKCS11Exception, LoginException {
	if (isLoggedIn(session) == false) {
	provider.login(null, null);
	}
	}

	// return whether this token object is valid (i.e. token not removed)
	// returns value from last check, does not perform new check
	boolean isValid() {
	if (removable == false) {
	return true;
	}
	return valid;
	}

	void ensureValid() {
	if (isValid() == false) {
	throw new ProviderException("Token has been removed");
	}
	}

	// return whether a token is present (i.e. token not removed)
	// returns cached value if current, otherwise performs new check
	boolean isPresent(Session session) {
	if (removable == false) {
	return true;
	}
	if (valid == false) {
	return false;
	}
	long time = System.currentTimeMillis();
	if ((time - lastPresentCheck) >= CHECK_INTERVAL) {
	synchronized (CHECK_LOCK) {
	if ((time - lastPresentCheck) >= CHECK_INTERVAL) {
	boolean ok = false;
	try {
	// check if token still present
	CK_SLOT_INFO slotInfo =
	provider.p11.C_GetSlotInfo(provider.slotID);
	if ((slotInfo.flags & CKF_TOKEN_PRESENT) != 0) {
	// if the token has been removed and re-inserted,
	// the token should return an error
	CK_SESSION_INFO sessInfo =
	provider.p11.C_GetSessionInfo
	(session.idInternal());
	ok = true;
	}
	} catch (PKCS11Exception e) {
	// empty
	}
	valid = ok;
	lastPresentCheck = System.currentTimeMillis();
	if (ok == false) {
	destroy();
	}
	}
	}
	}
	return valid;
	}

	void destroy() {
	valid = false;
	provider.uninitToken(this);
	}

	Session getObjSession() throws PKCS11Exception {
	return sessionManager.getObjSession();
	}

	Session getOpSession() throws PKCS11Exception {
	return sessionManager.getOpSession();
	}

	Session releaseSession(Session session) {
	return sessionManager.releaseSession(session);
	}

	Session killSession(Session session) {
	return sessionManager.killSession(session);
	}

	CK_ATTRIBUTE[] getAttributes(String op, long type, long alg,
	CK_ATTRIBUTE[] attrs) throws PKCS11Exception {
	CK_ATTRIBUTE[] newAttrs =
	templateManager.getAttributes(op, type, alg, attrs);
	for (CK_ATTRIBUTE attr : newAttrs) {
	if (attr.type == CKA_TOKEN) {
	if (attr.getBoolean()) {
	try {
	ensureLoggedIn(null);
	} catch (LoginException e) {
	throw new ProviderException("Login failed", e);
	}
	}
	// break once we have found a CKA_TOKEN attribute
	break;
	}
	}
	return newAttrs;
	}

	P11KeyFactory getKeyFactory(String algorithm) {
	P11KeyFactory f;
	if (algorithm.equals("RSA")) {
	f = rsaFactory;
	if (f == null) {
	f = new P11RSAKeyFactory(this, algorithm);
	rsaFactory = f;
	}
	} else if (algorithm.equals("DSA")) {
	f = dsaFactory;
	if (f == null) {
	f = new P11DSAKeyFactory(this, algorithm);
	dsaFactory = f;
	}
	} else if (algorithm.equals("DH")) {
	f = dhFactory;
	if (f == null) {
	f = new P11DHKeyFactory(this, algorithm);
	dhFactory = f;
	}
	} else if (algorithm.equals("EC")) {
	f = ecFactory;
	if (f == null) {
	f = new P11ECKeyFactory(this, algorithm);
	ecFactory = f;
	}
	} else {
	throw new ProviderException("Unknown algorithm " + algorithm);
	}
	return f;
	}

	P11SecureRandom getRandom() {
	if (secureRandom == null) {
	secureRandom = new P11SecureRandom(this);
	}
	return secureRandom;
	}

	P11KeyStore getKeyStore() {
	if (keyStore == null) {
	keyStore = new P11KeyStore(this);
	}
	return keyStore;
	}

	CK_MECHANISM_INFO getMechanismInfo(long mechanism) throws PKCS11Exception {
	CK_MECHANISM_INFO result = mechInfoMap.get(mechanism);
	if (result == null) {
	try {
	result = p11.C_GetMechanismInfo(provider.slotID,
	mechanism);
	mechInfoMap.put(mechanism, result);
	} catch (PKCS11Exception e) {
	if (e.getErrorCode() != PKCS11Constants.CKR_MECHANISM_INVALID) {
	throw e;
	} else {
	mechInfoMap.put(mechanism, INVALID_MECH);
	}
	}
	} else if (result == INVALID_MECH) {
	result = null;
	}
	return result;
	}

	private synchronized byte[] getTokenId() {
	if (tokenId == null) {
	SecureRandom random = JCAUtil.getSecureRandom();
	tokenId = new byte[20];
	random.nextBytes(tokenId);
	serializedTokens.add(new WeakReference<Token>(this));
	}
	return tokenId;
	}

	// list of all tokens that have been serialized within this VM
	// NOTE that elements are never removed from this list
	// the assumption is that the number of tokens that are serialized
	// is relatively small
	private static final List<Reference<Token>> serializedTokens =
	new ArrayList<Reference<Token>>();

	private Object writeReplace() throws ObjectStreamException {
	if (isValid() == false) {
	throw new NotSerializableException("Token has been removed");
	}
	return new TokenRep(this);
	}

	// serialized representation of a token
	// tokens can only be de-serialized within the same VM invocation
	// and if the token has not been removed in the meantime
	private static class TokenRep implements Serializable {

	private static final long serialVersionUID = 3503721168218219807L;

	private final byte[] tokenId;

	TokenRep(Token token) {
	tokenId = token.getTokenId();
	}

	private Object readResolve() throws ObjectStreamException {
	for (Reference<Token> tokenRef : serializedTokens) {
	Token token = tokenRef.get();
	if ((token != null) && token.isValid()) {
	if (Arrays.equals(token.getTokenId(), tokenId)) {
	return token;
	}
	}
	}
	throw new NotSerializableException("Could not find token");
	}
	}

	}