Example code: *
* Secmod secmod = Secmod.getInstance();
* if (secmod.isInitialized() == false) {
* secmod.initialize("/home/myself/.mozilla", "/usr/sfw/lib/mozilla");
* }
*
* Provider p = secmod.getModule(ModuleType.KEYSTORE).getProvider();
* KeyStore ks = KeyStore.getInstance("PKCS11", p);
* ks.load(null, password);
*
*
* @since 1.6
* @author Andreas Sterbenz
*/
public final class Secmod {
private final static boolean DEBUG = false;
private final static Secmod INSTANCE;
static {
sun.security.pkcs11.wrapper.PKCS11.loadNative();
INSTANCE = new Secmod();
}
private final static String NSS_LIB_NAME = "nss3";
private final static String SOFTTOKEN_LIB_NAME = "softokn3";
private final static String TRUST_LIB_NAME = "nssckbi";
// handle to be passed to the native code, 0 means not initialized
private long nssHandle;
// whether this is a supported version of NSS
private boolean supported;
// list of the modules
private List
* It allows the set of trusted certificates that are returned by
* the KeyStore to be specified.
*/
public static final class KeyStoreLoadParameter implements LoadStoreParameter {
final TrustType trustType;
final ProtectionParameter protection;
public KeyStoreLoadParameter(TrustType trustType, char[] password) {
this(trustType, new PasswordProtection(password));
}
public KeyStoreLoadParameter(TrustType trustType, ProtectionParameter prot) {
if (trustType == null) {
throw new NullPointerException("trustType must not be null");
}
this.trustType = trustType;
this.protection = prot;
}
public ProtectionParameter getProtectionParameter() {
return protection;
}
public TrustType getTrustType() {
return trustType;
}
}
static class TrustAttributes {
final long handle;
final long clientAuth, serverAuth, codeSigning, emailProtection;
final byte[] shaHash;
TrustAttributes(Token token, X509Certificate cert, Bytes bytes, long trustValue) {
Session session = null;
try {
session = token.getOpSession();
// XXX use KeyStore TrustType settings to determine which
// attributes to set
CK_ATTRIBUTE[] attrs = new CK_ATTRIBUTE[] {
new CK_ATTRIBUTE(CKA_TOKEN, true),
new CK_ATTRIBUTE(CKA_CLASS, CKO_NETSCAPE_TRUST),
new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_SERVER_AUTH, trustValue),
new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_CODE_SIGNING, trustValue),
new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_EMAIL_PROTECTION, trustValue),
new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_CLIENT_AUTH, trustValue),
new CK_ATTRIBUTE(CKA_NETSCAPE_CERT_SHA1_HASH, bytes.b),
new CK_ATTRIBUTE(CKA_NETSCAPE_CERT_MD5_HASH, getDigest(cert, "MD5")),
new CK_ATTRIBUTE(CKA_ISSUER, cert.getIssuerX500Principal().getEncoded()),
new CK_ATTRIBUTE(CKA_SERIAL_NUMBER, cert.getSerialNumber().toByteArray()),
// XXX per PKCS#11 spec, the serial number should be in ASN.1
};
handle = token.p11.C_CreateObject(session.id(), attrs);
shaHash = bytes.b;
clientAuth = trustValue;
serverAuth = trustValue;
codeSigning = trustValue;
emailProtection = trustValue;
} catch (PKCS11Exception e) {
throw new ProviderException("Could not create trust object", e);
} finally {
token.releaseSession(session);
}
}
TrustAttributes(Token token, Session session, long handle)
throws PKCS11Exception {
this.handle = handle;
CK_ATTRIBUTE[] attrs = new CK_ATTRIBUTE[] {
new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_SERVER_AUTH),
new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_CODE_SIGNING),
new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_EMAIL_PROTECTION),
new CK_ATTRIBUTE(CKA_NETSCAPE_CERT_SHA1_HASH),
};
token.p11.C_GetAttributeValue(session.id(), handle, attrs);
serverAuth = attrs[0].getLong();
codeSigning = attrs[1].getLong();
emailProtection = attrs[2].getLong();
shaHash = attrs[3].getByteArray();
attrs = new CK_ATTRIBUTE[] {
new CK_ATTRIBUTE(CKA_NETSCAPE_TRUST_CLIENT_AUTH),
};
long c;
try {
token.p11.C_GetAttributeValue(session.id(), handle, attrs);
c = attrs[0].getLong();
} catch (PKCS11Exception e) {
// trust anchor module does not support this attribute
c = serverAuth;
}
clientAuth = c;
}
Bytes getHash() {
return new Bytes(shaHash);
}
boolean isTrusted(TrustType type) {
switch (type) {
case CLIENT_AUTH:
return isTrusted(clientAuth);
case SERVER_AUTH:
return isTrusted(serverAuth);
case CODE_SIGNING:
return isTrusted(codeSigning);
case EMAIL_PROTECTION:
return isTrusted(emailProtection);
case ALL:
return isTrusted(TrustType.CLIENT_AUTH)
&& isTrusted(TrustType.SERVER_AUTH)
&& isTrusted(TrustType.CODE_SIGNING)
&& isTrusted(TrustType.EMAIL_PROTECTION);
default:
return false;
}
}
private boolean isTrusted(long l) {
// XXX CKT_TRUSTED?
return (l == CKT_NETSCAPE_TRUSTED_DELEGATOR);
}
}
private static class Bytes {
final byte[] b;
Bytes(byte[] b) {
this.b = b;
}
public int hashCode() {
return Arrays.hashCode(b);
}
public boolean equals(Object o) {
if (this == o) {
return true;
}
if (o instanceof Bytes == false) {
return false;
}
Bytes other = (Bytes)o;
return Arrays.equals(this.b, other.b);
}
}
private static Map