1 /* 2 * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Oracle designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Oracle in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 22 * or visit www.oracle.com if you need additional information or have any 23 * questions. 24 */ 25 26 package java.security.cert; 27 28 import java.io.IOException; 29 30 import sun.security.util.HexDumpEncoder; 31 import sun.security.util.DerValue; 32 33 /** 34 * An immutable policy qualifier represented by the ASN.1 PolicyQualifierInfo 35 * structure. 36 * 37 * <p>The ASN.1 definition is as follows: 38 * <pre> 39 * PolicyQualifierInfo ::= SEQUENCE { 40 * policyQualifierId PolicyQualifierId, 41 * qualifier ANY DEFINED BY policyQualifierId } 42 * </pre> 43 * <p> 44 * A certificate policies extension, if present in an X.509 version 3 45 * certificate, contains a sequence of one or more policy information terms, 46 * each of which consists of an object identifier (OID) and optional 47 * qualifiers. In an end-entity certificate, these policy information terms 48 * indicate the policy under which the certificate has been issued and the 49 * purposes for which the certificate may be used. In a CA certificate, these 50 * policy information terms limit the set of policies for certification paths 51 * which include this certificate. 52 * <p> 53 * A {@code Set} of {@code PolicyQualifierInfo} objects are returned 54 * by the {@link PolicyNode#getPolicyQualifiers PolicyNode.getPolicyQualifiers} 55 * method. This allows applications with specific policy requirements to 56 * process and validate each policy qualifier. Applications that need to 57 * process policy qualifiers should explicitly set the 58 * {@code policyQualifiersRejected} flag to false (by calling the 59 * {@link PKIXParameters#setPolicyQualifiersRejected 60 * PKIXParameters.setPolicyQualifiersRejected} method) before validating 61 * a certification path. 62 * 63 * <p>Note that the PKIX certification path validation algorithm specifies 64 * that any policy qualifier in a certificate policies extension that is 65 * marked critical must be processed and validated. Otherwise the 66 * certification path must be rejected. If the 67 * {@code policyQualifiersRejected} flag is set to false, it is up to 68 * the application to validate all policy qualifiers in this manner in order 69 * to be PKIX compliant. 70 * 71 * <p><b>Concurrent Access</b> 72 * 73 * <p>All {@code PolicyQualifierInfo} objects must be immutable and 74 * thread-safe. That is, multiple threads may concurrently invoke the 75 * methods defined in this class on a single {@code PolicyQualifierInfo} 76 * object (or more than one) with no ill effects. Requiring 77 * {@code PolicyQualifierInfo} objects to be immutable and thread-safe 78 * allows them to be passed around to various pieces of code without 79 * worrying about coordinating access. 80 * 81 * @author seth proctor 82 * @author Sean Mullan 83 * @since 1.4 84 */ 85 public class PolicyQualifierInfo { 86 87 private byte [] mEncoded; 88 private String mId; 89 private byte [] mData; 90 private String pqiString; 91 92 /** 93 * Creates an instance of {@code PolicyQualifierInfo} from the 94 * encoded bytes. The encoded byte array is copied on construction. 95 * 96 * @param encoded a byte array containing the qualifier in DER encoding 97 * @exception IOException thrown if the byte array does not represent a 98 * valid and parsable policy qualifier 99 */ PolicyQualifierInfo(byte[] encoded)100 public PolicyQualifierInfo(byte[] encoded) throws IOException { 101 mEncoded = encoded.clone(); 102 103 DerValue val = new DerValue(mEncoded); 104 if (val.tag != DerValue.tag_Sequence) 105 throw new IOException("Invalid encoding for PolicyQualifierInfo"); 106 107 mId = (val.data.getDerValue()).getOID().toString(); 108 byte [] tmp = val.data.toByteArray(); 109 if (tmp == null) { 110 mData = null; 111 } else { 112 mData = new byte[tmp.length]; 113 System.arraycopy(tmp, 0, mData, 0, tmp.length); 114 } 115 } 116 117 /** 118 * Returns the {@code policyQualifierId} field of this 119 * {@code PolicyQualifierInfo}. The {@code policyQualifierId} 120 * is an Object Identifier (OID) represented by a set of nonnegative 121 * integers separated by periods. 122 * 123 * @return the OID (never {@code null}) 124 */ getPolicyQualifierId()125 public final String getPolicyQualifierId() { 126 return mId; 127 } 128 129 /** 130 * Returns the ASN.1 DER encoded form of this 131 * {@code PolicyQualifierInfo}. 132 * 133 * @return the ASN.1 DER encoded bytes (never {@code null}). 134 * Note that a copy is returned, so the data is cloned each time 135 * this method is called. 136 */ getEncoded()137 public final byte[] getEncoded() { 138 return mEncoded.clone(); 139 } 140 141 /** 142 * Returns the ASN.1 DER encoded form of the {@code qualifier} 143 * field of this {@code PolicyQualifierInfo}. 144 * 145 * @return the ASN.1 DER encoded bytes of the {@code qualifier} 146 * field. Note that a copy is returned, so the data is cloned each 147 * time this method is called. 148 */ getPolicyQualifier()149 public final byte[] getPolicyQualifier() { 150 return (mData == null ? null : mData.clone()); 151 } 152 153 /** 154 * Return a printable representation of this 155 * {@code PolicyQualifierInfo}. 156 * 157 * @return a {@code String} describing the contents of this 158 * {@code PolicyQualifierInfo} 159 */ toString()160 public String toString() { 161 if (pqiString != null) 162 return pqiString; 163 HexDumpEncoder enc = new HexDumpEncoder(); 164 StringBuilder sb = new StringBuilder(); 165 sb.append("PolicyQualifierInfo: [\n"); 166 sb.append(" qualifierID: " + mId + "\n"); 167 sb.append(" qualifier: " + 168 (mData == null ? "null" : enc.encodeBuffer(mData)) + "\n"); 169 sb.append("]"); 170 pqiString = sb.toString(); 171 return pqiString; 172 } 173 } 174