1/*
2 * Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.  Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26package sun.security.provider;
27
28import java.io.*;
29import java.net.MalformedURLException;
30import java.net.URI;
31import java.net.URL;
32import java.security.AccessController;
33import java.security.PrivilegedAction;
34import java.security.PrivilegedActionException;
35import java.security.PrivilegedExceptionAction;
36import java.security.Security;
37import java.security.URIParameter;
38import java.text.MessageFormat;
39import java.util.*;
40import javax.security.auth.AuthPermission;
41import javax.security.auth.login.AppConfigurationEntry;
42import javax.security.auth.login.AppConfigurationEntry.LoginModuleControlFlag;
43import javax.security.auth.login.Configuration;
44import javax.security.auth.login.ConfigurationSpi;
45import sun.security.util.Debug;
46import sun.security.util.PropertyExpander;
47import sun.security.util.ResourcesMgr;
48
49/**
50 * This class represents a default implementation for
51 * {@code javax.security.auth.login.Configuration}.
52 *
53 * <p> This object stores the runtime login configuration representation,
54 * and is the amalgamation of multiple static login configurations that
55 * resides in files. The algorithm for locating the login configuration
56 * file(s) and reading their information into this {@code Configuration}
57 * object is:
58 *
59 * <ol>
60 * <li>
61 *   Loop through the security properties,
62 *   <i>login.config.url.1</i>, <i>login.config.url.2</i>, ...,
63 *   <i>login.config.url.X</i>.
64 *   Each property value specifies a {@code URL} pointing to a
65 *   login configuration file to be loaded.  Read in and load
66 *   each configuration.
67 *
68 * <li>
69 *   The {@code java.lang.System} property
70 *   <i>java.security.auth.login.config</i>
71 *   may also be set to a {@code URL} pointing to another
72 *   login configuration file
73 *   (which is the case when a user uses the -D switch at runtime).
74 *   If this property is defined, and its use is allowed by the
75 *   security property file (the Security property,
76 *   <i>policy.allowSystemProperty</i> is set to <i>true</i>),
77 *   also load that login configuration.
78 *
79 * <li>
80 *   If the <i>java.security.auth.login.config</i> property is defined using
81 *   "==" (rather than "="), then ignore all other specified
82 *   login configurations and only load this configuration.
83 *
84 * <li>
85 *   If no system or security properties were set, try to read from the file,
86 *   ${user.home}/.java.login.config, where ${user.home} is the value
87 *   represented by the "user.home" System property.
88 * </ol>
89 *
90 * <p> The configuration syntax supported by this implementation
91 * is exactly that syntax specified in the
92 * {@code javax.security.auth.login.Configuration} class.
93 *
94 * @see javax.security.auth.login.LoginContext
95 * @see java.security.Security security properties
96 */
97public final class ConfigFile extends Configuration {
98
99    private final Spi spi;
100
101    public ConfigFile() {
102        spi = new Spi();
103    }
104
105    @Override
106    public AppConfigurationEntry[] getAppConfigurationEntry(String appName) {
107        return spi.engineGetAppConfigurationEntry(appName);
108    }
109
110    @Override
111    public synchronized void refresh() {
112        spi.engineRefresh();
113    }
114
115    public static final class Spi extends ConfigurationSpi {
116
117        private URL url;
118        private boolean expandProp = true;
119        private Map<String, List<AppConfigurationEntry>> configuration;
120        private int linenum;
121        private StreamTokenizer st;
122        private int lookahead;
123
124        private static Debug debugConfig = Debug.getInstance("configfile");
125        private static Debug debugParser = Debug.getInstance("configparser");
126
127        /**
128         * Creates a new {@code ConfigurationSpi} object.
129         *
130         * @throws SecurityException if the {@code ConfigurationSpi} can not be
131         *                           initialized
132         */
133        public Spi() {
134            try {
135                init();
136            } catch (IOException ioe) {
137                throw new SecurityException(ioe);
138            }
139        }
140
141        /**
142         * Creates a new {@code ConfigurationSpi} object from the specified
143         * {@code URI}.
144         *
145         * @param uri the {@code URI}
146         * @throws SecurityException if the {@code ConfigurationSpi} can not be
147         *                           initialized
148         * @throws NullPointerException if {@code uri} is null
149         */
150        public Spi(URI uri) {
151            // only load config from the specified URI
152            try {
153                url = uri.toURL();
154                init();
155            } catch (IOException ioe) {
156                throw new SecurityException(ioe);
157            }
158        }
159
160        public Spi(final Configuration.Parameters params) throws IOException {
161
162            // call in a doPrivileged
163            //
164            // we have already passed the Configuration.getInstance
165            // security check.  also this class is not freely accessible
166            // (it is in the "sun" package).
167
168            try {
169                AccessController.doPrivileged(new PrivilegedExceptionAction<Void>() {
170                    public Void run() throws IOException {
171                        if (params == null) {
172                            init();
173                        } else {
174                            if (!(params instanceof URIParameter)) {
175                                throw new IllegalArgumentException
176                                        ("Unrecognized parameter: " + params);
177                            }
178                            URIParameter uriParam = (URIParameter)params;
179                            url = uriParam.getURI().toURL();
180                            init();
181                        }
182                        return null;
183                    }
184                });
185            } catch (PrivilegedActionException pae) {
186                throw (IOException)pae.getException();
187            }
188
189            // if init() throws some other RuntimeException,
190            // let it percolate up naturally.
191        }
192
193        /**
194         * Read and initialize the entire login Configuration from the
195         * configured URL.
196         *
197         * @throws IOException if the Configuration can not be initialized
198         * @throws SecurityException if the caller does not have permission
199         *                           to initialize the Configuration
200         */
201        private void init() throws IOException {
202
203            boolean initialized = false;
204
205            // For policy.expandProperties, check if either a security or system
206            // property is set to false (old code erroneously checked the system
207            // prop so we must check both to preserve compatibility).
208            String expand = Security.getProperty("policy.expandProperties");
209            if (expand == null) {
210                expand = System.getProperty("policy.expandProperties");
211            }
212            if ("false".equals(expand)) {
213                expandProp = false;
214            }
215
216            // new configuration
217            Map<String, List<AppConfigurationEntry>> newConfig = new HashMap<>();
218
219            if (url != null) {
220                /**
221                 * If the caller specified a URI via Configuration.getInstance,
222                 * we only read from that URI
223                 */
224                if (debugConfig != null) {
225                    debugConfig.println("reading " + url);
226                }
227                init(url, newConfig);
228                configuration = newConfig;
229                return;
230            }
231
232            /**
233             * Caller did not specify URI via Configuration.getInstance.
234             * Read from URLs listed in the java.security properties file.
235             */
236            String allowSys = Security.getProperty("policy.allowSystemProperty");
237
238            if ("true".equalsIgnoreCase(allowSys)) {
239                String extra_config = System.getProperty
240                                      ("java.security.auth.login.config");
241                if (extra_config != null) {
242                    boolean overrideAll = false;
243                    if (extra_config.startsWith("=")) {
244                        overrideAll = true;
245                        extra_config = extra_config.substring(1);
246                    }
247                    try {
248                        extra_config = PropertyExpander.expand(extra_config);
249                    } catch (PropertyExpander.ExpandException peee) {
250                        throw ioException("Unable.to.properly.expand.config",
251                                          extra_config);
252                    }
253
254                    URL configURL = null;
255                    try {
256                        configURL = new URL(extra_config);
257                    } catch (MalformedURLException mue) {
258                        File configFile = new File(extra_config);
259                        if (configFile.exists()) {
260                            configURL = configFile.toURI().toURL();
261                        } else {
262                            throw ioException(
263                                "extra.config.No.such.file.or.directory.",
264                                extra_config);
265                        }
266                    }
267
268                    if (debugConfig != null) {
269                        debugConfig.println("reading "+configURL);
270                    }
271                    init(configURL, newConfig);
272                    initialized = true;
273                    if (overrideAll) {
274                        if (debugConfig != null) {
275                            debugConfig.println("overriding other policies!");
276                        }
277                        configuration = newConfig;
278                        return;
279                    }
280                }
281            }
282
283            int n = 1;
284            String config_url;
285            while ((config_url = Security.getProperty
286                                     ("login.config.url."+n)) != null) {
287                try {
288                    config_url = PropertyExpander.expand
289                        (config_url).replace(File.separatorChar, '/');
290                    if (debugConfig != null) {
291                        debugConfig.println("\tReading config: " + config_url);
292                    }
293                    init(new URL(config_url), newConfig);
294                    initialized = true;
295                } catch (PropertyExpander.ExpandException peee) {
296                    throw ioException("Unable.to.properly.expand.config",
297                                      config_url);
298                }
299                n++;
300            }
301
302            if (initialized == false && n == 1 && config_url == null) {
303
304                // get the config from the user's home directory
305                if (debugConfig != null) {
306                    debugConfig.println("\tReading Policy " +
307                                "from ~/.java.login.config");
308                }
309                config_url = System.getProperty("user.home");
310                String userConfigFile = config_url + File.separatorChar +
311                                        ".java.login.config";
312
313                // No longer throws an exception when there's no config file
314                // at all. Returns an empty Configuration instead.
315                if (new File(userConfigFile).exists()) {
316                    init(new File(userConfigFile).toURI().toURL(), newConfig);
317                }
318            }
319
320            configuration = newConfig;
321        }
322
323        private void init(URL config,
324                          Map<String, List<AppConfigurationEntry>> newConfig)
325                          throws IOException {
326
327            try (InputStreamReader isr
328                    = new InputStreamReader(getInputStream(config), "UTF-8")) {
329                readConfig(isr, newConfig);
330            } catch (FileNotFoundException fnfe) {
331                if (debugConfig != null) {
332                    debugConfig.println(fnfe.toString());
333                }
334                throw new IOException(ResourcesMgr.getAuthResourceString
335                    ("Configuration.Error.No.such.file.or.directory"));
336            }
337        }
338
339        /**
340         * Retrieve an entry from the Configuration using an application name
341         * as an index.
342         *
343         * @param applicationName the name used to index the Configuration.
344         * @return an array of AppConfigurationEntries which correspond to
345         *         the stacked configuration of LoginModules for this
346         *         application, or null if this application has no configured
347         *         LoginModules.
348         */
349        @Override
350        public AppConfigurationEntry[] engineGetAppConfigurationEntry
351            (String applicationName) {
352
353            List<AppConfigurationEntry> list = null;
354            synchronized (configuration) {
355                list = configuration.get(applicationName);
356            }
357
358            if (list == null || list.size() == 0) {
359                return null;
360            }
361
362            AppConfigurationEntry[] entries =
363                                    new AppConfigurationEntry[list.size()];
364            Iterator<AppConfigurationEntry> iterator = list.iterator();
365            for (int i = 0; iterator.hasNext(); i++) {
366                AppConfigurationEntry e = iterator.next();
367                entries[i] = new AppConfigurationEntry(e.getLoginModuleName(),
368                                                       e.getControlFlag(),
369                                                       e.getOptions());
370            }
371            return entries;
372        }
373
374        /**
375         * Refresh and reload the Configuration by re-reading all of the
376         * login configurations.
377         *
378         * @throws SecurityException if the caller does not have permission
379         *                           to refresh the Configuration.
380         */
381        @Override
382        public synchronized void engineRefresh() {
383
384            SecurityManager sm = System.getSecurityManager();
385            if (sm != null) {
386                sm.checkPermission(
387                    new AuthPermission("refreshLoginConfiguration"));
388            }
389
390            AccessController.doPrivileged(new PrivilegedAction<Void>() {
391                public Void run() {
392                    try {
393                        init();
394                    } catch (IOException ioe) {
395                        throw new SecurityException(ioe.getLocalizedMessage(),
396                                                    ioe);
397                    }
398                    return null;
399                }
400            });
401        }
402
403        private void readConfig(Reader reader,
404            Map<String, List<AppConfigurationEntry>> newConfig)
405            throws IOException {
406
407            linenum = 1;
408
409            if (!(reader instanceof BufferedReader)) {
410                reader = new BufferedReader(reader);
411            }
412
413            st = new StreamTokenizer(reader);
414            st.quoteChar('"');
415            st.wordChars('$', '$');
416            st.wordChars('_', '_');
417            st.wordChars('-', '-');
418            st.wordChars('*', '*');
419            st.lowerCaseMode(false);
420            st.slashSlashComments(true);
421            st.slashStarComments(true);
422            st.eolIsSignificant(true);
423
424            lookahead = nextToken();
425            while (lookahead != StreamTokenizer.TT_EOF) {
426                parseLoginEntry(newConfig);
427            }
428        }
429
430        private void parseLoginEntry(
431            Map<String, List<AppConfigurationEntry>> newConfig)
432            throws IOException {
433
434            List<AppConfigurationEntry> configEntries = new LinkedList<>();
435
436            // application name
437            String appName = st.sval;
438            lookahead = nextToken();
439
440            if (debugParser != null) {
441                debugParser.println("\tReading next config entry: " + appName);
442            }
443
444            match("{");
445
446            // get the modules
447            while (peek("}") == false) {
448                // get the module class name
449                String moduleClass = match("module class name");
450
451                // controlFlag (required, optional, etc)
452                LoginModuleControlFlag controlFlag;
453                String sflag = match("controlFlag").toUpperCase(Locale.ENGLISH);
454                switch (sflag) {
455                    case "REQUIRED":
456                        controlFlag = LoginModuleControlFlag.REQUIRED;
457                        break;
458                    case "REQUISITE":
459                        controlFlag = LoginModuleControlFlag.REQUISITE;
460                        break;
461                    case "SUFFICIENT":
462                        controlFlag = LoginModuleControlFlag.SUFFICIENT;
463                        break;
464                    case "OPTIONAL":
465                        controlFlag = LoginModuleControlFlag.OPTIONAL;
466                        break;
467                    default:
468                        throw ioException(
469                            "Configuration.Error.Invalid.control.flag.flag",
470                            sflag);
471                }
472
473                // get the args
474                Map<String, String> options = new HashMap<>();
475                while (peek(";") == false) {
476                    String key = match("option key");
477                    match("=");
478                    try {
479                        options.put(key, expand(match("option value")));
480                    } catch (PropertyExpander.ExpandException peee) {
481                        throw new IOException(peee.getLocalizedMessage());
482                    }
483                }
484
485                lookahead = nextToken();
486
487                // create the new element
488                if (debugParser != null) {
489                    debugParser.println("\t\t" + moduleClass + ", " + sflag);
490                    for (String key : options.keySet()) {
491                        debugParser.println("\t\t\t" + key +
492                                            "=" + options.get(key));
493                    }
494                }
495                configEntries.add(new AppConfigurationEntry(moduleClass,
496                                                            controlFlag,
497                                                            options));
498            }
499
500            match("}");
501            match(";");
502
503            // add this configuration entry
504            if (newConfig.containsKey(appName)) {
505                throw ioException(
506                    "Configuration.Error.Can.not.specify.multiple.entries.for.appName",
507                    appName);
508            }
509            newConfig.put(appName, configEntries);
510        }
511
512        private String match(String expect) throws IOException {
513
514            String value = null;
515
516            switch(lookahead) {
517            case StreamTokenizer.TT_EOF:
518                throw ioException(
519                    "Configuration.Error.expected.expect.read.end.of.file.",
520                    expect);
521
522            case '"':
523            case StreamTokenizer.TT_WORD:
524                if (expect.equalsIgnoreCase("module class name") ||
525                    expect.equalsIgnoreCase("controlFlag") ||
526                    expect.equalsIgnoreCase("option key") ||
527                    expect.equalsIgnoreCase("option value")) {
528                    value = st.sval;
529                    lookahead = nextToken();
530                } else {
531                    throw ioException(
532                        "Configuration.Error.Line.line.expected.expect.found.value.",
533                        linenum, expect, st.sval);
534                }
535                break;
536
537            case '{':
538                if (expect.equalsIgnoreCase("{")) {
539                    lookahead = nextToken();
540                } else {
541                    throw ioException(
542                        "Configuration.Error.Line.line.expected.expect.",
543                        linenum, expect, st.sval);
544                }
545                break;
546
547            case ';':
548                if (expect.equalsIgnoreCase(";")) {
549                    lookahead = nextToken();
550                } else {
551                    throw ioException(
552                        "Configuration.Error.Line.line.expected.expect.",
553                        linenum, expect, st.sval);
554                }
555                break;
556
557            case '}':
558                if (expect.equalsIgnoreCase("}")) {
559                    lookahead = nextToken();
560                } else {
561                    throw ioException(
562                        "Configuration.Error.Line.line.expected.expect.",
563                        linenum, expect, st.sval);
564                }
565                break;
566
567            case '=':
568                if (expect.equalsIgnoreCase("=")) {
569                    lookahead = nextToken();
570                } else {
571                    throw ioException(
572                        "Configuration.Error.Line.line.expected.expect.",
573                        linenum, expect, st.sval);
574                }
575                break;
576
577            default:
578                throw ioException(
579                    "Configuration.Error.Line.line.expected.expect.found.value.",
580                    linenum, expect, st.sval);
581            }
582            return value;
583        }
584
585        private boolean peek(String expect) {
586            switch (lookahead) {
587                case ',':
588                    return expect.equalsIgnoreCase(",");
589                case ';':
590                    return expect.equalsIgnoreCase(";");
591                case '{':
592                    return expect.equalsIgnoreCase("{");
593                case '}':
594                    return expect.equalsIgnoreCase("}");
595                default:
596                    return false;
597            }
598        }
599
600        private int nextToken() throws IOException {
601            int tok;
602            while ((tok = st.nextToken()) == StreamTokenizer.TT_EOL) {
603                linenum++;
604            }
605            return tok;
606        }
607
608        private InputStream getInputStream(URL url) throws IOException {
609            if ("file".equalsIgnoreCase(url.getProtocol())) {
610                // Compatibility notes:
611                //
612                // Code changed from
613                //   String path = url.getFile().replace('/', File.separatorChar);
614                //   return new FileInputStream(path);
615                //
616                // The original implementation would search for "/tmp/a%20b"
617                // when url is "file:///tmp/a%20b". This is incorrect. The
618                // current codes fix this bug and searches for "/tmp/a b".
619                // For compatibility reasons, when the file "/tmp/a b" does
620                // not exist, the file named "/tmp/a%20b" will be tried.
621                //
622                // This also means that if both file exists, the behavior of
623                // this method is changed, and the current codes choose the
624                // correct one.
625                try {
626                    return url.openStream();
627                } catch (Exception e) {
628                    String file = url.getPath();
629                    if (url.getHost().length() > 0) {  // For Windows UNC
630                        file = "//" + url.getHost() + file;
631                    }
632                    if (debugConfig != null) {
633                        debugConfig.println("cannot read " + url +
634                                            ", try " + file);
635                    }
636                    return new FileInputStream(file);
637                }
638            } else {
639                return url.openStream();
640            }
641        }
642
643        private String expand(String value)
644            throws PropertyExpander.ExpandException, IOException {
645
646            if (value.isEmpty()) {
647                return value;
648            }
649
650            if (!expandProp) {
651                return value;
652            }
653            String s = PropertyExpander.expand(value);
654            if (s == null || s.length() == 0) {
655                throw ioException(
656                    "Configuration.Error.Line.line.system.property.value.expanded.to.empty.value",
657                    linenum, value);
658            }
659            return s;
660        }
661
662        private IOException ioException(String resourceKey, Object... args) {
663            MessageFormat form = new MessageFormat(
664                ResourcesMgr.getAuthResourceString(resourceKey));
665            return new IOException(form.format(args));
666        }
667    }
668}
669