зеркало из https://github.com/mozilla/gecko-dev.git
Initial checkin of the keystore code. It's not complete yet, but
I want others to be able to see it and comment on it.
This commit is contained in:
nicolson%netscape.com
Родитель
b8b9b96753
Коммит
72347524cb
|
|
@ -0,0 +1,799 @@
|
||||||
|
/* ***** BEGIN LICENSE BLOCK *****
|
||||||
|
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
|
||||||
|
*
|
||||||
|
* The contents of this file are subject to the Mozilla Public License Version
|
||||||
|
* 1.1 (the "License"); you may not use this file except in compliance with
|
||||||
|
* the License. You may obtain a copy of the License at
|
||||||
|
* http://www.mozilla.org/MPL/
|
||||||
|
*
|
||||||
|
* Software distributed under the License is distributed on an "AS IS" basis,
|
||||||
|
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
||||||
|
* for the specific language governing rights and limitations under the
|
||||||
|
* License.
|
||||||
|
*
|
||||||
|
* The Original Code is Network Security Services for Java.
|
||||||
|
*
|
||||||
|
* The Initial Developer of the Original Code is
|
||||||
|
* Netscape Communications Corporation.
|
||||||
|
* Portions created by the Initial Developer are Copyright (C) 2002
|
||||||
|
* the Initial Developer. All Rights Reserved.
|
||||||
|
*
|
||||||
|
* Contributor(s):
|
||||||
|
*
|
||||||
|
* Alternatively, the contents of this file may be used under the terms of
|
||||||
|
* either the GNU General Public License Version 2 or later (the "GPL"), or
|
||||||
|
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
|
||||||
|
* in which case the provisions of the GPL or the LGPL are applicable instead
|
||||||
|
* of those above. If you wish to allow use of your version of this file only
|
||||||
|
* under the terms of either the GPL or the LGPL, and not to allow others to
|
||||||
|
* use your version of this file under the terms of the MPL, indicate your
|
||||||
|
* decision by deleting the provisions above and replace them with the notice
|
||||||
|
* and other provisions required by the GPL or the LGPL. If you do not delete
|
||||||
|
* the provisions above, a recipient may use your version of this file under
|
||||||
|
* the terms of any one of the MPL, the GPL or the LGPL.
|
||||||
|
*
|
||||||
|
* ***** END LICENSE BLOCK ***** */
|
||||||
|
|
||||||
|
#include "_jni/org_mozilla_jss_provider_java_security_JSSKeyStoreSpi.h"
|
||||||
|
|
||||||
|
#include <nspr.h>
|
||||||
|
#include <pk11func.h>
|
||||||
|
#include <jssutil.h>
|
||||||
|
#include <jss_exceptions.h>
|
||||||
|
#include <keyhi.h>
|
||||||
|
#include <cert.h>
|
||||||
|
#include <certdb.h>
|
||||||
|
#include <pk11util.h>
|
||||||
|
|
||||||
|
static PRStatus
|
||||||
|
getTokenSlotPtr(JNIEnv *env, jobject keyStoreObj, PK11SlotInfo **ptr)
|
||||||
|
{
|
||||||
|
return JSS_getPtrFromProxyOwner(env, keyStoreObj,
|
||||||
|
"proxy", "Lorg/mozilla/jss/pkcs11/TokenProxy;", (void**)ptr);
|
||||||
|
}
|
||||||
|
|
||||||
|
typedef enum {
|
||||||
|
PRIVKEY=0x01,
|
||||||
|
PUBKEY=0x02,
|
||||||
|
SYMKEY=0x04,
|
||||||
|
CERT=0x08
|
||||||
|
} TokenObjectType;
|
||||||
|
#define ALL_OBJECT_TYPES (PRIVKEY | PUBKEY | SYMKEY | CERT )
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
PRStatus status;
|
||||||
|
PRBool deleteIt;
|
||||||
|
PRBool stopIterating;
|
||||||
|
} JSSTraversalStatus;
|
||||||
|
#define INIT_TRAVSTAT {PR_FAILURE, PR_FALSE, PR_FALSE}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* contract: you must throw an exception if you return PRFailure.
|
||||||
|
*/
|
||||||
|
typedef JSSTraversalStatus
|
||||||
|
(*TokenObjectTraversalCallback)
|
||||||
|
(JNIEnv* env, PK11SlotInfo *slot, TokenObjectType type, void *obj, void *data);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* objectType is bitwise-OR of all the object types you want to traverse.
|
||||||
|
*/
|
||||||
|
static PRStatus
|
||||||
|
traverseTokenObjects
|
||||||
|
(JNIEnv *env, PK11SlotInfo *slot, TokenObjectTraversalCallback cb,
|
||||||
|
int objectTypes, void *data)
|
||||||
|
{
|
||||||
|
PRStatus status = PR_FAILURE;
|
||||||
|
JSSTraversalStatus travstat = INIT_TRAVSTAT;
|
||||||
|
SECKEYPrivateKeyList* privkList = NULL;
|
||||||
|
SECKEYPublicKeyList* pubkList = NULL;
|
||||||
|
PK11SymKey *symKey = NULL;
|
||||||
|
CERTCertList *certList = NULL;
|
||||||
|
SECStatus secstat;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Get all private keys
|
||||||
|
*/
|
||||||
|
if( objectTypes & PRIVKEY ) {
|
||||||
|
SECKEYPrivateKeyListNode *node = NULL;
|
||||||
|
|
||||||
|
privkList = PK11_ListPrivKeysInSlot(slot, NULL /*nickname*/,
|
||||||
|
NULL /*wincx*/);
|
||||||
|
if( privkList != NULL ) {
|
||||||
|
|
||||||
|
for( node = PRIVKEY_LIST_HEAD(privkList);
|
||||||
|
! PRIVKEY_LIST_END(node, privkList);
|
||||||
|
node = PRIVKEY_LIST_NEXT(node) )
|
||||||
|
{
|
||||||
|
travstat = cb(env, slot, PRIVKEY, (void*) node->key, data);
|
||||||
|
if( travstat.status == PR_FAILURE ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
if( travstat.deleteIt ) {
|
||||||
|
/* Setting "force" to PR_FALSE means that if there is a
|
||||||
|
* matching cert, the key won't be deleted.
|
||||||
|
* If the KeyStore API is being followed, the cert
|
||||||
|
* should have the same nickname as the key. So
|
||||||
|
* both will get deleted when we scan for matching
|
||||||
|
* certs later.
|
||||||
|
*/
|
||||||
|
PK11_DeleteTokenPrivateKey(node->key, PR_FALSE /*force*/);
|
||||||
|
node->key = NULL;
|
||||||
|
PR_REMOVE_LINK(&node->links);
|
||||||
|
/* we don't free node because it is allocated from
|
||||||
|
* the list's arena and will get freed when the list
|
||||||
|
* is freed. */
|
||||||
|
}
|
||||||
|
if( travstat.stopIterating ) {
|
||||||
|
goto stop_early;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Get all symmetric keys
|
||||||
|
*/
|
||||||
|
if(objectTypes & SYMKEY) {
|
||||||
|
/* this function returns a chained list of symmetric keys */
|
||||||
|
symKey = PK11_ListFixedKeysInSlot(slot, NULL /*nickname*/,
|
||||||
|
NULL/*wincx*/);
|
||||||
|
|
||||||
|
while( symKey != NULL ) {
|
||||||
|
PK11SymKey *deadKey;
|
||||||
|
travstat = cb(env, slot, SYMKEY, (void*) symKey, data);
|
||||||
|
if( travstat.status != PR_SUCCESS ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
if( travstat.deleteIt ) {
|
||||||
|
/* this just deletes the PKCS #11 object. The data structure
|
||||||
|
* is NOT deleted. */
|
||||||
|
PK11_DeleteTokenSymKey(symKey);
|
||||||
|
}
|
||||||
|
if( travstat.stopIterating ) {
|
||||||
|
goto stop_early;
|
||||||
|
}
|
||||||
|
|
||||||
|
deadKey = symKey;
|
||||||
|
symKey = PK11_GetNextSymKey(symKey);
|
||||||
|
PK11_FreeSymKey(deadKey);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* get all public keys
|
||||||
|
*/
|
||||||
|
if( objectTypes & PUBKEY ) {
|
||||||
|
SECKEYPublicKeyListNode *node = NULL;
|
||||||
|
|
||||||
|
pubkList = PK11_ListPublicKeysInSlot(slot, NULL /*nickname*/);
|
||||||
|
if( pubkList != NULL ) {
|
||||||
|
|
||||||
|
for( node = PUBKEY_LIST_HEAD(pubkList);
|
||||||
|
! PUBKEY_LIST_END(node, pubkList);
|
||||||
|
node = PUBKEY_LIST_NEXT(node) )
|
||||||
|
{
|
||||||
|
travstat = cb(env, slot, PUBKEY, (void*) node->key, data);
|
||||||
|
if( travstat.status != PR_SUCCESS ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
if( travstat.deleteIt ) {
|
||||||
|
/* XXX!!!
|
||||||
|
* Workaround for 125408: PK11_DeleteTokenPublic key asserts
|
||||||
|
* Don't delete the public key.
|
||||||
|
|
||||||
|
* PK11_DeleteTokenPublicKey(node->key);
|
||||||
|
* node->key = NULL;
|
||||||
|
* PR_REMOVE_LINK(&node->links);
|
||||||
|
*/
|
||||||
|
/* node is allocated from the list's arena, it will get
|
||||||
|
* freed with the list */
|
||||||
|
}
|
||||||
|
if( travstat.stopIterating ) {
|
||||||
|
goto stop_early;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* XXX!!!
|
||||||
|
* Destroy the list before we move on. Why bother, since we'll
|
||||||
|
* do it anyway in the finish block? Because of bug 125408.
|
||||||
|
* If we delete the cert and private key while traversing certs,
|
||||||
|
* we'll delete the public key too, and then we'll crash when
|
||||||
|
* we free the same public key while destroying the list.
|
||||||
|
*/
|
||||||
|
SECKEY_DestroyPublicKeyList(pubkList);
|
||||||
|
pubkList = NULL;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Get all certs
|
||||||
|
*/
|
||||||
|
if( objectTypes & CERT ) {
|
||||||
|
CERTCertListNode *node = NULL;
|
||||||
|
|
||||||
|
certList = PK11_ListCertsInSlot(slot);
|
||||||
|
if( certList == NULL ) {
|
||||||
|
JSS_throwMsg(env, TOKEN_EXCEPTION,
|
||||||
|
"Failed to list certificates on token");
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
for( node = CERT_LIST_HEAD(certList);
|
||||||
|
! CERT_LIST_END(node, certList);
|
||||||
|
node = CERT_LIST_NEXT(node) )
|
||||||
|
{
|
||||||
|
travstat = cb(env, slot, CERT, (void*) node->cert, data);
|
||||||
|
if( travstat.status != PR_SUCCESS ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
if( travstat.deleteIt ) {
|
||||||
|
/*
|
||||||
|
* Since, in a KeyStore, certs and private keys go together,
|
||||||
|
* remove the private key too, if there is one.
|
||||||
|
*
|
||||||
|
* The hack here is that PK11_DeleteTokenCertAndKey will
|
||||||
|
* not delete the cert if there is no matching private key.
|
||||||
|
* We want to the cert to be deleted even if the key isn't
|
||||||
|
* there. So we only call that function if we're sure the
|
||||||
|
* key is there. Otherwise we delete the cert directly.
|
||||||
|
*/
|
||||||
|
SECKEYPrivateKey *privKey = PK11_FindKeyByAnyCert(node->cert,
|
||||||
|
NULL /*wincx*/);
|
||||||
|
PRBool keyPresent = (privKey != NULL);
|
||||||
|
SECKEY_DestroyPrivateKey(privKey);
|
||||||
|
if( keyPresent ) {
|
||||||
|
PK11_DeleteTokenCertAndKey(node->cert, NULL /*wincx*/);
|
||||||
|
} else {
|
||||||
|
SEC_DeletePermCertificate(node->cert);
|
||||||
|
}
|
||||||
|
PR_REMOVE_LINK(&node->links);
|
||||||
|
/* node is allocated from the list's arena, it will get freed
|
||||||
|
* with the list */
|
||||||
|
}
|
||||||
|
if( travstat.stopIterating ) {
|
||||||
|
goto stop_early;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
stop_early:
|
||||||
|
status = PR_SUCCESS;
|
||||||
|
finish:
|
||||||
|
if( privkList != NULL ) {
|
||||||
|
SECKEY_DestroyPrivateKeyList(privkList);
|
||||||
|
}
|
||||||
|
if( pubkList != NULL ) {
|
||||||
|
SECKEY_DestroyPublicKeyList(pubkList);
|
||||||
|
}
|
||||||
|
while( symKey != NULL ) {
|
||||||
|
PK11SymKey *deadKey;
|
||||||
|
deadKey = symKey;
|
||||||
|
symKey = PK11_GetNextSymKey(symKey);
|
||||||
|
PK11_FreeSymKey(deadKey);
|
||||||
|
}
|
||||||
|
if( certList != NULL ) {
|
||||||
|
CERT_DestroyCertList(certList);
|
||||||
|
}
|
||||||
|
return status;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* allocates memory if type != CERT */
|
||||||
|
static char*
|
||||||
|
getObjectNick(void *obj, TokenObjectType type)
|
||||||
|
{
|
||||||
|
switch(type) {
|
||||||
|
case PRIVKEY:
|
||||||
|
/* NOTE: this function allocates memory for the nickname */
|
||||||
|
return PK11_GetPrivateKeyNickname((SECKEYPrivateKey*)obj);
|
||||||
|
case SYMKEY:
|
||||||
|
/* NOTE: this function allocates memory for the nickname */
|
||||||
|
return PK11_GetSymKeyNickname((PK11SymKey*)obj);
|
||||||
|
case PUBKEY:
|
||||||
|
/* NOTE: this function allocates memory for the nickname */
|
||||||
|
return PK11_GetPublicKeyNickname((SECKEYPublicKey*)obj);
|
||||||
|
case CERT:
|
||||||
|
return ((CERTCertificate*)obj)->nickname;
|
||||||
|
default:
|
||||||
|
PR_ASSERT(PR_FALSE);
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static void
|
||||||
|
freeObjectNick(char *nick, TokenObjectType type)
|
||||||
|
{
|
||||||
|
if( type != CERT && nick != NULL) {
|
||||||
|
PR_Free(nick);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
jobject setObj;
|
||||||
|
jmethodID setAdd;
|
||||||
|
} EngineAliasesCBInfo;
|
||||||
|
|
||||||
|
static JSSTraversalStatus
|
||||||
|
engineAliasesTraversalCallback
|
||||||
|
(JNIEnv *env, PK11SlotInfo *slot, TokenObjectType type, void *obj, void *data)
|
||||||
|
{
|
||||||
|
JSSTraversalStatus travStat = INIT_TRAVSTAT;
|
||||||
|
EngineAliasesCBInfo *cbinfo = (EngineAliasesCBInfo*)data;
|
||||||
|
char *nickname=NULL;
|
||||||
|
|
||||||
|
nickname = getObjectNick(obj, type);
|
||||||
|
|
||||||
|
if( nickname != NULL ) {
|
||||||
|
jstring nickString;
|
||||||
|
|
||||||
|
/* convert it to a string */
|
||||||
|
nickString = (*env)->NewStringUTF(env, nickname);
|
||||||
|
freeObjectNick(nickname, type);
|
||||||
|
if( nickString == NULL ) {
|
||||||
|
/* exception was thrown */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* store the string in the vector */
|
||||||
|
(*env)->CallBooleanMethod(env, cbinfo->setObj,
|
||||||
|
cbinfo->setAdd, nickString);
|
||||||
|
if( (*env)->ExceptionOccurred(env) ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
travStat.status = PR_SUCCESS;
|
||||||
|
finish:
|
||||||
|
return travStat;
|
||||||
|
}
|
||||||
|
|
||||||
|
JNIEXPORT jobject JNICALL
|
||||||
|
Java_org_mozilla_jss_provider_java_security_JSSKeyStoreSpi_getRawAliases
|
||||||
|
(JNIEnv *env, jobject this)
|
||||||
|
{
|
||||||
|
PK11SlotInfo *slot = NULL;
|
||||||
|
jobject setObj=NULL;
|
||||||
|
jmethodID setAdd=NULL;
|
||||||
|
EngineAliasesCBInfo cbinfo;
|
||||||
|
|
||||||
|
if( getTokenSlotPtr(env, this, &slot) != PR_SUCCESS ) {
|
||||||
|
/* exception was thrown */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Create the vector object and get its method IDs
|
||||||
|
*/
|
||||||
|
{
|
||||||
|
jclass setClass;
|
||||||
|
jmethodID setCons;
|
||||||
|
|
||||||
|
setClass = (*env)->FindClass(env, "java/util/HashSet");
|
||||||
|
if( setClass == NULL ) {
|
||||||
|
/* should have thrown an exception */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
setCons = (*env)->GetMethodID(env, setClass, "<init>", "()V");
|
||||||
|
if( setCons == NULL ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
setObj = (*env)->NewObject(env, setClass, setCons);
|
||||||
|
if( setObj == NULL ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
setAdd = (*env)->GetMethodID(env, setClass, "add",
|
||||||
|
"(Ljava/lang/Object;)Z");
|
||||||
|
if( setAdd == NULL ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
cbinfo.setObj = setObj;
|
||||||
|
cbinfo.setAdd = setAdd;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* traverse all slot objects
|
||||||
|
*/
|
||||||
|
if( traverseTokenObjects( env,
|
||||||
|
slot,
|
||||||
|
engineAliasesTraversalCallback,
|
||||||
|
ALL_OBJECT_TYPES,
|
||||||
|
&cbinfo)
|
||||||
|
!= PR_SUCCESS )
|
||||||
|
{
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
finish:
|
||||||
|
return setObj;
|
||||||
|
}
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
const char *targetNickname;
|
||||||
|
} EngineDeleteEntryCBInfo;
|
||||||
|
|
||||||
|
static JSSTraversalStatus
|
||||||
|
engineDeleteEntryTraversalCallback
|
||||||
|
(JNIEnv *env, PK11SlotInfo *slot, TokenObjectType type,
|
||||||
|
void *obj, void *data)
|
||||||
|
{
|
||||||
|
EngineDeleteEntryCBInfo *cbinfo = (EngineDeleteEntryCBInfo*)data;
|
||||||
|
JSSTraversalStatus status = INIT_TRAVSTAT;
|
||||||
|
char *nickname = getObjectNick(obj, type);
|
||||||
|
|
||||||
|
if( nickname != NULL &&
|
||||||
|
(PL_strcmp(nickname, cbinfo->targetNickname) == 0) ) {
|
||||||
|
status.deleteIt = PR_TRUE;
|
||||||
|
}
|
||||||
|
freeObjectNick(nickname, type);
|
||||||
|
status.status = PR_SUCCESS;
|
||||||
|
return status;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
JNIEXPORT void JNICALL
|
||||||
|
Java_org_mozilla_jss_provider_java_security_JSSKeyStoreSpi_engineDeleteEntry
|
||||||
|
(JNIEnv *env, jobject this, jobject aliasString)
|
||||||
|
{
|
||||||
|
EngineDeleteEntryCBInfo cbinfo;
|
||||||
|
PK11SlotInfo *slot = NULL;
|
||||||
|
|
||||||
|
cbinfo.targetNickname = NULL;
|
||||||
|
|
||||||
|
if( getTokenSlotPtr(env, this, &slot) != PR_SUCCESS ) {
|
||||||
|
/* exception was thrown */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* get the nickname */
|
||||||
|
cbinfo.targetNickname = (*env)->GetStringUTFChars(env, aliasString, NULL);
|
||||||
|
if( cbinfo.targetNickname == NULL ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* traverse */
|
||||||
|
/*
|
||||||
|
* traverse all slot objects
|
||||||
|
*/
|
||||||
|
traverseTokenObjects( env,
|
||||||
|
slot,
|
||||||
|
engineDeleteEntryTraversalCallback,
|
||||||
|
ALL_OBJECT_TYPES,
|
||||||
|
(void*) &cbinfo);
|
||||||
|
|
||||||
|
finish:
|
||||||
|
if( cbinfo.targetNickname != NULL ) {
|
||||||
|
(*env)->ReleaseStringUTFChars(env, aliasString, cbinfo.targetNickname);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
const char *targetNickname;
|
||||||
|
CERTCertificate *cert;
|
||||||
|
} EngineGetCertificateCBInfo;
|
||||||
|
|
||||||
|
static JSSTraversalStatus
|
||||||
|
engineGetCertificateTraversalCallback
|
||||||
|
(JNIEnv *env, PK11SlotInfo *slot, TokenObjectType type,
|
||||||
|
void *obj, void *data)
|
||||||
|
{
|
||||||
|
JSSTraversalStatus travStat = INIT_TRAVSTAT;
|
||||||
|
CERTCertificate *cert = (CERTCertificate*) obj;
|
||||||
|
EngineGetCertificateCBInfo *cbinfo = (EngineGetCertificateCBInfo*)data;
|
||||||
|
|
||||||
|
PR_ASSERT(type == CERT); /* shouldn't get called otherwise */
|
||||||
|
PR_ASSERT(cbinfo->cert == NULL);
|
||||||
|
|
||||||
|
if( cert->nickname != NULL &&
|
||||||
|
PL_strcmp(cert->nickname, cbinfo->targetNickname) == 0 )
|
||||||
|
{
|
||||||
|
cbinfo->cert = CERT_DupCertificate(cert);
|
||||||
|
travStat.stopIterating = PR_TRUE;
|
||||||
|
}
|
||||||
|
travStat.status = PR_SUCCESS;
|
||||||
|
|
||||||
|
return travStat;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
JNIEXPORT jbyteArray JNICALL
|
||||||
|
Java_org_mozilla_jss_provider_java_security_JSSKeyStoreSpi_getDERCert
|
||||||
|
(JNIEnv *env, jobject this, jstring alias)
|
||||||
|
{
|
||||||
|
PK11SlotInfo *slot;
|
||||||
|
EngineGetCertificateCBInfo cbinfo = {NULL,NULL};
|
||||||
|
jbyteArray derCertBA = NULL;
|
||||||
|
|
||||||
|
if( alias == NULL ) goto finish;
|
||||||
|
|
||||||
|
if( getTokenSlotPtr(env, this, &slot) != PR_SUCCESS ) {
|
||||||
|
/* exception was thrown */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
cbinfo.targetNickname = (*env)->GetStringUTFChars(env, alias, NULL);
|
||||||
|
if(cbinfo.targetNickname == NULL ) goto finish;
|
||||||
|
|
||||||
|
if( traverseTokenObjects( env,
|
||||||
|
slot,
|
||||||
|
engineGetCertificateTraversalCallback,
|
||||||
|
CERT,
|
||||||
|
(void*) &cbinfo)
|
||||||
|
!= PR_SUCCESS )
|
||||||
|
{
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
if( cbinfo.cert != NULL ) {
|
||||||
|
derCertBA = JSS_SECItemToByteArray(env, &cbinfo.cert->derCert);
|
||||||
|
}
|
||||||
|
|
||||||
|
finish:
|
||||||
|
if( cbinfo.targetNickname != NULL ) {
|
||||||
|
(*env)->ReleaseStringUTFChars(env, alias, cbinfo.targetNickname);
|
||||||
|
}
|
||||||
|
if( cbinfo.cert != NULL) {
|
||||||
|
CERT_DestroyCertificate(cbinfo.cert);
|
||||||
|
}
|
||||||
|
return derCertBA;
|
||||||
|
}
|
||||||
|
|
||||||
|
JNIEXPORT jstring JNICALL
|
||||||
|
Java_org_mozilla_jss_provider_java_security_JSSKeyStoreSpi_getCertNickname
|
||||||
|
(JNIEnv *env, jobject this, jbyteArray derCertBA)
|
||||||
|
{
|
||||||
|
PK11SlotInfo *slot=NULL;
|
||||||
|
SECItem *derCert=NULL;
|
||||||
|
CERTCertificate * cert=NULL;
|
||||||
|
CERTCertificate searchCert;
|
||||||
|
jstring nickString = NULL;
|
||||||
|
|
||||||
|
if( getTokenSlotPtr(env, this, &slot) != PR_SUCCESS ) {
|
||||||
|
/* exception was thrown */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* convert derCert to SECItem */
|
||||||
|
derCert = JSS_ByteArrayToSECItem(env, derCertBA);
|
||||||
|
if( derCert == NULL ) {
|
||||||
|
/* exception was thrown */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* lookup cert by derCert */
|
||||||
|
searchCert.derCert = *derCert;
|
||||||
|
cert = PK11_FindCertFromDERCert(slot, &searchCert, NULL /*wincx*/);
|
||||||
|
if( cert == NULL ) {
|
||||||
|
/* not found. return NULL */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* convert cert nickname to Java string */
|
||||||
|
nickString = (*env)->NewStringUTF(env, cert->nickname);
|
||||||
|
|
||||||
|
finish:
|
||||||
|
if( derCert != NULL ) {
|
||||||
|
SECITEM_FreeItem(derCert, PR_TRUE /*freeit*/);
|
||||||
|
}
|
||||||
|
if( cert != NULL ) {
|
||||||
|
CERT_DestroyCertificate(cert);
|
||||||
|
}
|
||||||
|
return nickString;
|
||||||
|
}
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
const char *label;
|
||||||
|
SECKEYPrivateKey *privk;
|
||||||
|
PK11SymKey *symk;
|
||||||
|
} FindKeyCBInfo;
|
||||||
|
|
||||||
|
static JSSTraversalStatus
|
||||||
|
findKeyCallback
|
||||||
|
(JNIEnv *env, PK11SlotInfo *slot, TokenObjectType type, void *obj, void *data)
|
||||||
|
{
|
||||||
|
JSSTraversalStatus status = INIT_TRAVSTAT;
|
||||||
|
FindKeyCBInfo *cbinfo = (FindKeyCBInfo*)data;
|
||||||
|
const char *objNick = getObjectNick(obj, type);
|
||||||
|
|
||||||
|
status.status = PR_SUCCESS;
|
||||||
|
|
||||||
|
PR_ASSERT(cbinfo->privk==NULL && cbinfo->symk==NULL);
|
||||||
|
|
||||||
|
if( PL_strcmp(objNick, cbinfo->label) == 0 ) {
|
||||||
|
/* found it */
|
||||||
|
status.stopIterating = PR_TRUE;
|
||||||
|
switch( type ) {
|
||||||
|
case PRIVKEY:
|
||||||
|
cbinfo->privk = (SECKEYPrivateKey*)obj;
|
||||||
|
printf("Found private key with label '%s'\n", objNick);
|
||||||
|
break;
|
||||||
|
case SYMKEY:
|
||||||
|
cbinfo->symk = (PK11SymKey*)obj;
|
||||||
|
printf("Found summetric key with label '%s'\n", objNick);
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
PR_ASSERT(PR_FALSE);
|
||||||
|
status.status = PR_FAILURE;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
freeObjectNick(obj, type);
|
||||||
|
return status;
|
||||||
|
}
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
const char *targetNickname;
|
||||||
|
SECKEYPrivateKey *privk;
|
||||||
|
} GetKeyByCertNickCBInfo;
|
||||||
|
|
||||||
|
static JSSTraversalStatus
|
||||||
|
getKeyByCertNickCallback
|
||||||
|
(JNIEnv *env, PK11SlotInfo *slot, TokenObjectType type,
|
||||||
|
void *obj, void *data)
|
||||||
|
{
|
||||||
|
JSSTraversalStatus travStat = INIT_TRAVSTAT;
|
||||||
|
CERTCertificate *cert = (CERTCertificate*) obj;
|
||||||
|
GetKeyByCertNickCBInfo *cbinfo = (GetKeyByCertNickCBInfo*) data;
|
||||||
|
|
||||||
|
PR_ASSERT(type == CERT); /* shouldn't get called otherwise */
|
||||||
|
PR_ASSERT(cbinfo->privk == NULL);
|
||||||
|
|
||||||
|
if( cert->nickname != NULL &&
|
||||||
|
PL_strcmp(cert->nickname, cbinfo->targetNickname) == 0 )
|
||||||
|
{
|
||||||
|
travStat.stopIterating = PR_TRUE;
|
||||||
|
|
||||||
|
cbinfo->privk = PK11_FindPrivateKeyFromCert(slot, cert, NULL /*wincx*/);
|
||||||
|
if( cbinfo->privk ) {
|
||||||
|
printf("Found private key from cert with label '%s'\n",
|
||||||
|
cert->nickname);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
travStat.status = PR_SUCCESS;
|
||||||
|
|
||||||
|
return travStat;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
JNIEXPORT jobject JNICALL
|
||||||
|
Java_org_mozilla_jss_provider_java_security_JSSKeyStoreSpi_engineGetKey
|
||||||
|
(JNIEnv *env, jobject this, jstring alias, jcharArray password)
|
||||||
|
{
|
||||||
|
PK11SlotInfo *slot=NULL;
|
||||||
|
FindKeyCBInfo keyCbinfo = {NULL, NULL, NULL};
|
||||||
|
GetKeyByCertNickCBInfo certCbinfo = {NULL, NULL};
|
||||||
|
jobject keyObj = NULL;
|
||||||
|
|
||||||
|
if( getTokenSlotPtr(env, this, &slot) != PR_SUCCESS ) {
|
||||||
|
/* exception was thrown */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
if( alias == NULL ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* first look for a matching key
|
||||||
|
*/
|
||||||
|
|
||||||
|
keyCbinfo.label = (*env)->GetStringUTFChars(env, alias, NULL);
|
||||||
|
if( keyCbinfo.label == NULL ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
if( traverseTokenObjects( env,
|
||||||
|
slot,
|
||||||
|
findKeyCallback,
|
||||||
|
PRIVKEY | SYMKEY,
|
||||||
|
&keyCbinfo)
|
||||||
|
!= PR_SUCCESS )
|
||||||
|
{
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
if(keyCbinfo.privk != NULL ) {
|
||||||
|
/* found a matching private key */
|
||||||
|
keyObj = JSS_PK11_wrapPrivKey(env, &keyCbinfo.privk);
|
||||||
|
} else if( keyCbinfo.symk != NULL ) {
|
||||||
|
/* found a matching symmetric key */
|
||||||
|
keyObj = JSS_PK11_wrapSymKey(env, &keyCbinfo.symk);
|
||||||
|
}
|
||||||
|
|
||||||
|
if( keyObj == NULL ) {
|
||||||
|
/*
|
||||||
|
* If we didn't find a matching key, look for a matching cert
|
||||||
|
*/
|
||||||
|
|
||||||
|
certCbinfo.targetNickname = (*env)->GetStringUTFChars(env, alias, NULL);
|
||||||
|
if(certCbinfo.targetNickname == NULL ) goto finish;
|
||||||
|
|
||||||
|
if( traverseTokenObjects( env,
|
||||||
|
slot,
|
||||||
|
getKeyByCertNickCallback,
|
||||||
|
CERT,
|
||||||
|
(void*) &certCbinfo)
|
||||||
|
!= PR_SUCCESS )
|
||||||
|
{
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
if( certCbinfo.privk != NULL ) {
|
||||||
|
keyObj = JSS_PK11_wrapPrivKey(env, &certCbinfo.privk);
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
finish:
|
||||||
|
if( keyCbinfo.label != NULL ) {
|
||||||
|
(*env)->ReleaseStringUTFChars(env, alias, keyCbinfo.label);
|
||||||
|
}
|
||||||
|
if( certCbinfo.targetNickname != NULL ) {
|
||||||
|
(*env)->ReleaseStringUTFChars(env, alias, certCbinfo.targetNickname);
|
||||||
|
}
|
||||||
|
PR_ASSERT( keyCbinfo.privk==NULL && keyCbinfo.symk==NULL);
|
||||||
|
PR_ASSERT( certCbinfo.privk==NULL );
|
||||||
|
|
||||||
|
return keyObj;
|
||||||
|
}
|
||||||
|
|
||||||
|
JNIEXPORT jboolean JNICALL
|
||||||
|
Java_org_mozilla_jss_provider_java_security_JSSKeyStoreSpi_engineIsCertificateEntry
|
||||||
|
(JNIEnv *env, jobject this, jstring alias)
|
||||||
|
{
|
||||||
|
PK11SlotInfo *slot;
|
||||||
|
EngineGetCertificateCBInfo cbinfo = {NULL,NULL};
|
||||||
|
jboolean retVal = JNI_FALSE;
|
||||||
|
SECKEYPrivateKey *privk = NULL;
|
||||||
|
|
||||||
|
if( alias == NULL ) goto finish;
|
||||||
|
|
||||||
|
if( getTokenSlotPtr(env, this, &slot) != PR_SUCCESS ) {
|
||||||
|
/* exception was thrown */
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
cbinfo.targetNickname = (*env)->GetStringUTFChars(env, alias, NULL);
|
||||||
|
if(cbinfo.targetNickname == NULL ) goto finish;
|
||||||
|
|
||||||
|
if( traverseTokenObjects( env,
|
||||||
|
slot,
|
||||||
|
engineGetCertificateTraversalCallback,
|
||||||
|
CERT,
|
||||||
|
(void*) &cbinfo)
|
||||||
|
!= PR_SUCCESS )
|
||||||
|
{
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
if( cbinfo.cert != NULL ) {
|
||||||
|
unsigned int allTrust;
|
||||||
|
CERTCertTrust trust;
|
||||||
|
SECStatus status;
|
||||||
|
|
||||||
|
status = CERT_GetCertTrust(cbinfo.cert, &trust);
|
||||||
|
if( status != SECSuccess ) {
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
allTrust = trust.sslFlags | trust.emailFlags | trust.objectSigningFlags;
|
||||||
|
|
||||||
|
if( (allTrust & (CERTDB_TRUSTED | CERTDB_TRUSTED_CA |
|
||||||
|
CERTDB_NS_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA))
|
||||||
|
&& !(allTrust & CERTDB_USER) )
|
||||||
|
{
|
||||||
|
/* It's a trusted cert and not a user cert. */
|
||||||
|
retVal = JNI_TRUE;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
finish:
|
||||||
|
if( cbinfo.targetNickname != NULL ) {
|
||||||
|
(*env)->ReleaseStringUTFChars(env, alias, cbinfo.targetNickname);
|
||||||
|
}
|
||||||
|
if( cbinfo.cert != NULL) {
|
||||||
|
CERT_DestroyCertificate(cbinfo.cert);
|
||||||
|
}
|
||||||
|
return retVal;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,263 @@
|
||||||
|
/* ***** BEGIN LICENSE BLOCK *****
|
||||||
|
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
|
||||||
|
*
|
||||||
|
* The contents of this file are subject to the Mozilla Public License Version
|
||||||
|
* 1.1 (the "License"); you may not use this file except in compliance with
|
||||||
|
* the License. You may obtain a copy of the License at
|
||||||
|
* http://www.mozilla.org/MPL/
|
||||||
|
*
|
||||||
|
* Software distributed under the License is distributed on an "AS IS" basis,
|
||||||
|
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
||||||
|
* for the specific language governing rights and limitations under the
|
||||||
|
* License.
|
||||||
|
*
|
||||||
|
* The Original Code is Network Security Services for Java.
|
||||||
|
*
|
||||||
|
* The Initial Developer of the Original Code is
|
||||||
|
* Netscape Communications Corporation.
|
||||||
|
* Portions created by the Initial Developer are Copyright (C) 2002
|
||||||
|
* the Initial Developer. All Rights Reserved.
|
||||||
|
*
|
||||||
|
* Contributor(s):
|
||||||
|
*
|
||||||
|
* Alternatively, the contents of this file may be used under the terms of
|
||||||
|
* either the GNU General Public License Version 2 or later (the "GPL"), or
|
||||||
|
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
|
||||||
|
* in which case the provisions of the GPL or the LGPL are applicable instead
|
||||||
|
* of those above. If you wish to allow use of your version of this file only
|
||||||
|
* under the terms of either the GPL or the LGPL, and not to allow others to
|
||||||
|
* use your version of this file under the terms of the MPL, indicate your
|
||||||
|
* decision by deleting the provisions above and replace them with the notice
|
||||||
|
* and other provisions required by the GPL or the LGPL. If you do not delete
|
||||||
|
* the provisions above, a recipient may use your version of this file under
|
||||||
|
* the terms of any one of the MPL, the GPL or the LGPL.
|
||||||
|
*
|
||||||
|
* ***** END LICENSE BLOCK ***** */
|
||||||
|
|
||||||
|
package org.mozilla.jss.provider.java.security;
|
||||||
|
|
||||||
|
import java.io.ByteArrayInputStream;
|
||||||
|
import java.io.InputStream;
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.io.OutputStream;
|
||||||
|
import java.security.Key;
|
||||||
|
import java.security.KeyStoreException;
|
||||||
|
import java.security.cert.Certificate;
|
||||||
|
import java.security.cert.CertificateFactory;
|
||||||
|
import java.security.cert.CertificateException;
|
||||||
|
import java.security.cert.CertificateEncodingException;
|
||||||
|
import java.util.Enumeration;
|
||||||
|
import java.util.HashSet;
|
||||||
|
import java.util.Iterator;
|
||||||
|
import org.mozilla.jss.pkcs11.PK11Token;
|
||||||
|
import org.mozilla.jss.pkcs11.TokenProxy;
|
||||||
|
import org.mozilla.jss.crypto.CryptoToken;
|
||||||
|
import org.mozilla.jss.crypto.TokenSupplierManager;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* The JSS implementation of the JCA KeyStore SPI.
|
||||||
|
*
|
||||||
|
* <p>Implementation notes
|
||||||
|
* <ol>
|
||||||
|
* <li>deleteEntry will delete all entries with that label. If the entry is a
|
||||||
|
* cert with a matching private key, it will also delete the private key.
|
||||||
|
*
|
||||||
|
* <li>getCertificate returns first cert with matching nickname. Converts it
|
||||||
|
* into a java.security.cert.X509Certificate (not a JSS cert).
|
||||||
|
*
|
||||||
|
* <li>getCertificateChain only returns a single certificate. That's because
|
||||||
|
* we don't have a way to build a chain from a specific slot--only from
|
||||||
|
* the set of all slots. Kannan Bhoopathy has already indicated that he
|
||||||
|
* wants to get back whole chains from the KeyStore API, so this implementation
|
||||||
|
* is incorrect. Question: is it better to do an NSS-wide cert chain lookup
|
||||||
|
* and risk returning some certs from different tokens, or to only return
|
||||||
|
* the one cert that is guaranteed to be on the token? Probably the former,
|
||||||
|
* but I need confirmation.
|
||||||
|
*
|
||||||
|
* <li>getCreationDate is unsupported because NSS doesn't store that
|
||||||
|
* information. Hopefully nobody cares about this.
|
||||||
|
*
|
||||||
|
* <li>getKey first looks for a private/symmetric key with the given label.
|
||||||
|
* It returns the first one it finds. If it doesn't find one, it looks for a
|
||||||
|
* cert with the given nickname. If it finds one, it returns the private key
|
||||||
|
* for that cert.
|
||||||
|
*
|
||||||
|
* <li>isCertificateEntry returns true if there is a cert with this nickname,
|
||||||
|
* but it doesn't have a private key. isKeyEntry returns true if there is a key
|
||||||
|
* with this nickname, or if there is a cert with this nickname and the cert
|
||||||
|
* has an associated private key.
|
||||||
|
*
|
||||||
|
* <li>load and store are no-ops.
|
||||||
|
*
|
||||||
|
* <li>setCertificateEntry doesn't work.NSS doesn't have a way of storing a
|
||||||
|
* certificate on a specific token unless it has an associated private key.
|
||||||
|
* That rules out trusted certificate entries.
|
||||||
|
*
|
||||||
|
* <li>setKeyEntry not supported yet. Need to convert a temporary key
|
||||||
|
* into a permanent key.
|
||||||
|
* </ol>
|
||||||
|
*/
|
||||||
|
public class JSSKeyStoreSpi extends java.security.KeyStoreSpi {
|
||||||
|
|
||||||
|
protected TokenProxy proxy;
|
||||||
|
|
||||||
|
public JSSKeyStoreSpi() {
|
||||||
|
CryptoToken token =
|
||||||
|
TokenSupplierManager.getTokenSupplier().getThreadToken();
|
||||||
|
PK11Token pk11tok = (PK11Token)token;
|
||||||
|
proxy = pk11tok.getProxy();
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Converts an Iterator into an Enumeration.
|
||||||
|
*/
|
||||||
|
private static class IteratorEnumeration implements Enumeration {
|
||||||
|
private Iterator iter;
|
||||||
|
|
||||||
|
public IteratorEnumeration(Iterator iter) {
|
||||||
|
this.iter = iter;
|
||||||
|
}
|
||||||
|
|
||||||
|
public boolean hasMoreElements() {
|
||||||
|
return iter.hasNext();
|
||||||
|
}
|
||||||
|
|
||||||
|
public Object nextElement() {
|
||||||
|
return iter.next();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private native HashSet getRawAliases();
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns a list of unique aliases.
|
||||||
|
*/
|
||||||
|
public Enumeration engineAliases() {
|
||||||
|
return new IteratorEnumeration( getRawAliases().iterator() );
|
||||||
|
}
|
||||||
|
|
||||||
|
public boolean engineContainsAlias(String alias) {
|
||||||
|
return getRawAliases().contains(alias);
|
||||||
|
}
|
||||||
|
|
||||||
|
public native void engineDeleteEntry(String alias);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* XXX-!!! Is shared cert factory thread safe?
|
||||||
|
*/
|
||||||
|
private CertificateFactory certFactory=null;
|
||||||
|
{
|
||||||
|
try {
|
||||||
|
certFactory = CertificateFactory.getInstance("X.509");
|
||||||
|
} catch(CertificateException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
throw new RuntimeException(e.getMessage());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
public Certificate engineGetCertificate(String alias) {
|
||||||
|
byte[] derCert = getDERCert(alias);
|
||||||
|
if( derCert == null ) {
|
||||||
|
return null;
|
||||||
|
} else {
|
||||||
|
try {
|
||||||
|
return
|
||||||
|
certFactory.generateCertificate(
|
||||||
|
new ByteArrayInputStream(derCert)
|
||||||
|
);
|
||||||
|
} catch( CertificateException e ) {
|
||||||
|
e.printStackTrace();
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private native byte[] getDERCert(String alias);
|
||||||
|
|
||||||
|
public String engineGetCertificateAlias(Certificate cert) {
|
||||||
|
try {
|
||||||
|
return getCertNickname( cert.getEncoded() );
|
||||||
|
} catch(CertificateEncodingException e) {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private native String getCertNickname(byte[] derCert);
|
||||||
|
|
||||||
|
public Certificate[] engineGetCertificateChain(String alias) {
|
||||||
|
Certificate cert = engineGetCertificate(alias);
|
||||||
|
if( cert == null ) {
|
||||||
|
return null;
|
||||||
|
} else {
|
||||||
|
Certificate[] certs = new Certificate[1];
|
||||||
|
certs[0] = cert;
|
||||||
|
return certs;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Not supported.
|
||||||
|
*/
|
||||||
|
public java.util.Date engineGetCreationDate(String alias) {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
public native Key engineGetKey(String alias, char[] password);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns true if there is a cert with this nickname but there is no
|
||||||
|
* key associated with the cert.
|
||||||
|
*/
|
||||||
|
public native boolean engineIsCertificateEntry(String alias);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns true if there is a key with this alias, or if
|
||||||
|
* there is a cert with this alias that has an associated key.
|
||||||
|
*/
|
||||||
|
public boolean engineIsKeyEntry(String alias) {
|
||||||
|
/* this is somewhat wasteful but we can speed it up later */
|
||||||
|
return ( engineGetKey(alias, null) != null );
|
||||||
|
}
|
||||||
|
|
||||||
|
public void engineLoad(InputStream stream, char[] password)
|
||||||
|
throws IOException
|
||||||
|
{
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* NSS doesn't have a way of storing a certificate on a specific token
|
||||||
|
* unless it has an associated private key. That rules out
|
||||||
|
* trusted certificate entries, so we can't supply this method currently.
|
||||||
|
*/
|
||||||
|
public void engineSetCertificateEntry(String alias, Certificate cert)
|
||||||
|
throws KeyStoreException
|
||||||
|
{
|
||||||
|
throw new KeyStoreException(
|
||||||
|
"Storing trusted certificate entries to a JSS KeyStore is not" +
|
||||||
|
" supported.");
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
public void engineSetKeyEntry(String alias, byte[] key, Certificate[] chain)
|
||||||
|
throws KeyStoreException
|
||||||
|
{
|
||||||
|
throw new KeyStoreException("Storing plaintext keys is not supported."+
|
||||||
|
"Store the key as a handle instead.");
|
||||||
|
}
|
||||||
|
|
||||||
|
public void engineSetKeyEntry(String alias, Key key, char[] password,
|
||||||
|
Certificate[] chain) throws KeyStoreException
|
||||||
|
{
|
||||||
|
throw new KeyStoreException("Storing plaintext keys is not supported."+
|
||||||
|
"Store the key as a handle instead.");
|
||||||
|
}
|
||||||
|
|
||||||
|
public int engineSize() {
|
||||||
|
return getRawAliases().size();
|
||||||
|
}
|
||||||
|
|
||||||
|
public void engineStore(OutputStream stream, char[] password)
|
||||||
|
throws IOException
|
||||||
|
{
|
||||||
|
}
|
||||||
|
}
|
||||||
Загрузка…
Ссылка в новой задаче