Providers.java revision ebe4f19cd62ed042845e23b7132859c88d91934b
1/* 2 * Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Oracle designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Oracle in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 22 * or visit www.oracle.com if you need additional information or have any 23 * questions. 24 */ 25 26package sun.security.jca; 27 28import java.util.*; 29 30import java.security.Provider; 31import java.security.Security; 32 33/** 34 * Collection of methods to get and set provider list. Also includes 35 * special code for the provider list during JAR verification. 36 * 37 * @author Andreas Sterbenz 38 * @since 1.5 39 */ 40public class Providers { 41 42 private static final ThreadLocal<ProviderList> threadLists = 43 new InheritableThreadLocal<>(); 44 45 // number of threads currently using thread-local provider lists 46 // tracked to allow an optimization if == 0 47 private static volatile int threadListsUsed; 48 49 // current system-wide provider list 50 // Note volatile immutable object, so no synchronization needed. 51 private static volatile ProviderList providerList; 52 53 static { 54 // set providerList to empty list first in case initialization somehow 55 // triggers a getInstance() call (although that should not happen) 56 providerList = ProviderList.EMPTY; 57 providerList = ProviderList.fromSecurityProperties(); 58 } 59 60 private Providers() { 61 // empty 62 } 63 64 // we need special handling to resolve circularities when loading 65 // signed JAR files during startup. The code below is part of that. 66 67 // Basically, before we load data from a signed JAR file, we parse 68 // the PKCS#7 file and verify the signature. We need a 69 // CertificateFactory, Signatures, etc. to do that. We have to make 70 // sure that we do not try to load the implementation from the JAR 71 // file we are just verifying. 72 // 73 // To avoid that, we use different provider settings during JAR 74 // verification. However, we do not want those provider settings to 75 // interfere with other parts of the system. Therefore, we make them local 76 // to the Thread executing the JAR verification code. 77 // 78 // The code here is used by sun.security.util.SignatureFileVerifier. 79 // See there for details. 80 81 private static final String BACKUP_PROVIDER_CLASSNAME = 82 "sun.security.provider.VerificationProvider"; 83 84 // Hardcoded classnames of providers to use for JAR verification. 85 // MUST NOT be on the bootclasspath and not in signed JAR files. 86 private static final String[] jarVerificationProviders = { 87 /* ----- BEGIN android ----- 88 "sun.security.provider.Sun", 89 "sun.security.rsa.SunRsaSign", 90 // Note: SunEC *is* in a signed JAR file, but it's not signed 91 // by EC itself. So it's still safe to be listed here. 92 "sun.security.ec.SunEC",*/ 93 "com.android.org.conscrypt.OpenSSLProvider", 94 "com.android.org.bouncycastle.jce.provider.BouncyCastleProvider", 95 "com.android.org.conscrypt.JSSEProvider", 96 // ----- END android ----- 97 BACKUP_PROVIDER_CLASSNAME, 98 }; 99 100 // Return to Sun provider or its backup. 101 // This method should only be called by 102 // sun.security.util.ManifestEntryVerifier and java.security.SecureRandom. 103 public static Provider getSunProvider() { 104 try { 105 Class clazz = Class.forName(jarVerificationProviders[0]); 106 return (Provider)clazz.newInstance(); 107 } catch (Exception e) { 108 try { 109 Class clazz = Class.forName(BACKUP_PROVIDER_CLASSNAME); 110 return (Provider)clazz.newInstance(); 111 } catch (Exception ee) { 112 throw new RuntimeException("Sun provider not found", e); 113 } 114 } 115 } 116 117 /** 118 * Start JAR verification. This sets a special provider list for 119 * the current thread. You MUST save the return value from this 120 * method and you MUST call stopJarVerification() with that object 121 * once you are done. 122 */ 123 public static Object startJarVerification() { 124 ProviderList currentList = getProviderList(); 125 ProviderList jarList = currentList.getJarList(jarVerificationProviders); 126 // return the old thread-local provider list, usually null 127 return beginThreadProviderList(jarList); 128 } 129 130 /** 131 * Stop JAR verification. Call once you have completed JAR verification. 132 */ 133 public static void stopJarVerification(Object obj) { 134 // restore old thread-local provider list 135 endThreadProviderList((ProviderList)obj); 136 } 137 138 /** 139 * Return the current ProviderList. If the thread-local list is set, 140 * it is returned. Otherwise, the system wide list is returned. 141 */ 142 public static ProviderList getProviderList() { 143 ProviderList list = getThreadProviderList(); 144 if (list == null) { 145 list = getSystemProviderList(); 146 } 147 return list; 148 } 149 150 /** 151 * Set the current ProviderList. Affects the thread-local list if set, 152 * otherwise the system wide list. 153 */ 154 public static void setProviderList(ProviderList newList) { 155 if (getThreadProviderList() == null) { 156 setSystemProviderList(newList); 157 } else { 158 changeThreadProviderList(newList); 159 } 160 } 161 162 /** 163 * Get the full provider list with invalid providers (those that 164 * could not be loaded) removed. This is the list we need to 165 * present to applications. 166 */ 167 public static ProviderList getFullProviderList() { 168 ProviderList list; 169 synchronized (Providers.class) { 170 list = getThreadProviderList(); 171 if (list != null) { 172 ProviderList newList = list.removeInvalid(); 173 if (newList != list) { 174 changeThreadProviderList(newList); 175 list = newList; 176 } 177 return list; 178 } 179 } 180 list = getSystemProviderList(); 181 ProviderList newList = list.removeInvalid(); 182 if (newList != list) { 183 setSystemProviderList(newList); 184 list = newList; 185 } 186 return list; 187 } 188 189 private static ProviderList getSystemProviderList() { 190 return providerList; 191 } 192 193 private static void setSystemProviderList(ProviderList list) { 194 providerList = list; 195 } 196 197 public static ProviderList getThreadProviderList() { 198 // avoid accessing the threadlocal if none are currently in use 199 // (first use of ThreadLocal.get() for a Thread allocates a Map) 200 if (threadListsUsed == 0) { 201 return null; 202 } 203 return threadLists.get(); 204 } 205 206 // Change the thread local provider list. Use only if the current thread 207 // is already using a thread local list and you want to change it in place. 208 // In other cases, use the begin/endThreadProviderList() methods. 209 private static void changeThreadProviderList(ProviderList list) { 210 threadLists.set(list); 211 } 212 213 /** 214 * Methods to manipulate the thread local provider list. It is for use by 215 * JAR verification (see above) and the SunJSSE FIPS mode only. 216 * 217 * It should be used as follows: 218 * 219 * ProviderList list = ...; 220 * ProviderList oldList = Providers.beginThreadProviderList(list); 221 * try { 222 * // code that needs thread local provider list 223 * } finally { 224 * Providers.endThreadProviderList(oldList); 225 * } 226 * 227 */ 228 229 public static synchronized ProviderList beginThreadProviderList(ProviderList list) { 230 if (ProviderList.debug != null) { 231 ProviderList.debug.println("ThreadLocal providers: " + list); 232 } 233 ProviderList oldList = threadLists.get(); 234 threadListsUsed++; 235 threadLists.set(list); 236 return oldList; 237 } 238 239 public static synchronized void endThreadProviderList(ProviderList list) { 240 if (list == null) { 241 if (ProviderList.debug != null) { 242 ProviderList.debug.println("Disabling ThreadLocal providers"); 243 } 244 threadLists.remove(); 245 } else { 246 if (ProviderList.debug != null) { 247 ProviderList.debug.println 248 ("Restoring previous ThreadLocal providers: " + list); 249 } 250 threadLists.set(list); 251 } 252 threadListsUsed--; 253 } 254 255} 256