Examples with QaPolicyMappingsOption org.xipki.ca.qa.internal.QaPolicyMappingsOption used on opensource projects

Example 1 with QaPolicyMappingsOption

use of org.xipki.ca.qa.internal.QaPolicyMappingsOption in project xipki by xipki.

the class ExtensionsChecker method checkExtensionPolicyMappings.

// method checkExtensionCertificatePolicies
private void checkExtensionPolicyMappings(StringBuilder failureMsg, byte[] extensionValue, Extensions requestedExtensions, ExtensionControl extControl) {
    QaPolicyMappingsOption conf = policyMappings;
    if (conf == null) {
        byte[] expected = getExpectedExtValue(Extension.policyMappings, requestedExtensions, extControl);
        if (!Arrays.equals(expected, extensionValue)) {
            addViolation(failureMsg, "extension values", hex(extensionValue), (expected == null) ? "not present" : hex(expected));
        }
        return;
    }
    ASN1Sequence isPolicyMappings = DERSequence.getInstance(extensionValue);
    Map<String, String> isMap = new HashMap<>();
    int size = isPolicyMappings.size();
    for (int i = 0; i < size; i++) {
        ASN1Sequence seq = ASN1Sequence.getInstance(isPolicyMappings.getObjectAt(i));
        CertPolicyId issuerDomainPolicy = CertPolicyId.getInstance(seq.getObjectAt(0));
        CertPolicyId subjectDomainPolicy = CertPolicyId.getInstance(seq.getObjectAt(1));
        isMap.put(issuerDomainPolicy.getId(), subjectDomainPolicy.getId());
    }
    Set<String> expIssuerDomainPolicies = conf.getIssuerDomainPolicies();
    for (String expIssuerDomainPolicy : expIssuerDomainPolicies) {
        String expSubjectDomainPolicy = conf.addSubjectDomainPolicy(expIssuerDomainPolicy);
        String isSubjectDomainPolicy = isMap.remove(expIssuerDomainPolicy);
        if (isSubjectDomainPolicy == null) {
            failureMsg.append("issuerDomainPolicy '").append(expIssuerDomainPolicy).append("' is absent but is required; ");
        } else if (!isSubjectDomainPolicy.equals(expSubjectDomainPolicy)) {
            addViolation(failureMsg, "subjectDomainPolicy for issuerDomainPolicy", isSubjectDomainPolicy, expSubjectDomainPolicy);
        }
    }
    if (CollectionUtil.isNonEmpty(isMap)) {
        failureMsg.append("issuerDomainPolicies '").append(isMap.keySet()).append("' are present but not expected; ");
    }
}