1250 lines
72 KiB
Java
1250 lines
72 KiB
Java
|
package org.bouncycastle.jce.provider;
|
||
|
|
|
||
|
|
import com.huawei.hms.android.SystemUtils;
|
||
|
|
import java.io.IOException;
|
||
|
|
import java.math.BigInteger;
|
||
|
|
import java.security.GeneralSecurityException;
|
||
|
|
import java.security.PublicKey;
|
||
|
|
import java.security.cert.CRL;
|
||
|
|
import java.security.cert.CertPath;
|
||
|
|
import java.security.cert.CertPathBuilderException;
|
||
|
|
import java.security.cert.CertPathValidatorException;
|
||
|
|
import java.security.cert.Certificate;
|
||
|
|
import java.security.cert.CertificateExpiredException;
|
||
|
|
import java.security.cert.CertificateNotYetValidException;
|
||
|
|
import java.security.cert.PKIXCertPathChecker;
|
||
|
|
import java.security.cert.X509CRL;
|
||
|
|
import java.security.cert.X509CRLSelector;
|
||
|
|
import java.security.cert.X509CertSelector;
|
||
|
|
import java.security.cert.X509Certificate;
|
||
|
|
import java.security.cert.X509Extension;
|
||
|
|
import java.util.ArrayList;
|
||
|
|
import java.util.Collection;
|
||
|
|
import java.util.Date;
|
||
|
|
import java.util.Enumeration;
|
||
|
|
import java.util.HashSet;
|
||
|
|
import java.util.Iterator;
|
||
|
|
import java.util.List;
|
||
|
|
import java.util.Set;
|
||
|
|
import org.bouncycastle.asn1.ASN1Encodable;
|
||
|
|
import org.bouncycastle.asn1.ASN1EncodableVector;
|
||
|
|
import org.bouncycastle.asn1.ASN1Integer;
|
||
|
|
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
|
||
|
|
import org.bouncycastle.asn1.ASN1Primitive;
|
||
|
|
import org.bouncycastle.asn1.ASN1Sequence;
|
||
|
|
import org.bouncycastle.asn1.ASN1String;
|
||
|
|
import org.bouncycastle.asn1.ASN1TaggedObject;
|
||
|
|
import org.bouncycastle.asn1.DERSequence;
|
||
|
|
import org.bouncycastle.asn1.x500.RDN;
|
||
|
|
import org.bouncycastle.asn1.x500.X500Name;
|
||
|
|
import org.bouncycastle.asn1.x500.style.BCStyle;
|
||
|
|
import org.bouncycastle.asn1.x509.BasicConstraints;
|
||
|
|
import org.bouncycastle.asn1.x509.CRLDistPoint;
|
||
|
|
import org.bouncycastle.asn1.x509.DistributionPoint;
|
||
|
|
import org.bouncycastle.asn1.x509.DistributionPointName;
|
||
|
|
import org.bouncycastle.asn1.x509.Extension;
|
||
|
|
import org.bouncycastle.asn1.x509.GeneralName;
|
||
|
|
import org.bouncycastle.asn1.x509.GeneralNames;
|
||
|
|
import org.bouncycastle.asn1.x509.GeneralSubtree;
|
||
|
|
import org.bouncycastle.asn1.x509.IssuingDistributionPoint;
|
||
|
|
import org.bouncycastle.asn1.x509.NameConstraints;
|
||
|
|
import org.bouncycastle.asn1.x509.PolicyInformation;
|
||
|
|
import org.bouncycastle.jcajce.PKIXCRLStoreSelector;
|
||
|
|
import org.bouncycastle.jcajce.PKIXCertStoreSelector;
|
||
|
|
import org.bouncycastle.jcajce.PKIXExtendedBuilderParameters;
|
||
|
|
import org.bouncycastle.jcajce.PKIXExtendedParameters;
|
||
|
|
import org.bouncycastle.jcajce.util.JcaJceHelper;
|
||
|
|
import org.bouncycastle.jce.exception.ExtCertPathValidatorException;
|
||
|
|
import org.bouncycastle.util.Arrays;
|
||
|
|
|
||
|
|
/* loaded from: classes6.dex */
|
||
|
|
class RFC3280CertPathUtilities {
|
||
|
|
public static final String ANY_POLICY = "2.5.29.32.0";
|
||
|
|
protected static final int CRL_SIGN = 6;
|
||
|
|
protected static final int KEY_CERT_SIGN = 5;
|
||
|
|
private static final PKIXCRLUtil CRL_UTIL = new PKIXCRLUtil();
|
||
|
|
public static final String CERTIFICATE_POLICIES = Extension.certificatePolicies.getId();
|
||
|
|
public static final String POLICY_MAPPINGS = Extension.policyMappings.getId();
|
||
|
|
public static final String INHIBIT_ANY_POLICY = Extension.inhibitAnyPolicy.getId();
|
||
|
|
public static final String ISSUING_DISTRIBUTION_POINT = Extension.issuingDistributionPoint.getId();
|
||
|
|
public static final String FRESHEST_CRL = Extension.freshestCRL.getId();
|
||
|
|
public static final String DELTA_CRL_INDICATOR = Extension.deltaCRLIndicator.getId();
|
||
|
|
public static final String POLICY_CONSTRAINTS = Extension.policyConstraints.getId();
|
||
|
|
public static final String BASIC_CONSTRAINTS = Extension.basicConstraints.getId();
|
||
|
|
public static final String CRL_DISTRIBUTION_POINTS = Extension.cRLDistributionPoints.getId();
|
||
|
|
public static final String SUBJECT_ALTERNATIVE_NAME = Extension.subjectAlternativeName.getId();
|
||
|
|
public static final String NAME_CONSTRAINTS = Extension.nameConstraints.getId();
|
||
|
|
public static final String AUTHORITY_KEY_IDENTIFIER = Extension.authorityKeyIdentifier.getId();
|
||
|
|
public static final String KEY_USAGE = Extension.keyUsage.getId();
|
||
|
|
public static final String CRL_NUMBER = Extension.cRLNumber.getId();
|
||
|
|
protected static final String[] crlReasons = {"unspecified", "keyCompromise", "cACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", SystemUtils.UNKNOWN, "removeFromCRL", "privilegeWithdrawn", "aACompromise"};
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static PKIXPolicyNode wrapupCertG(CertPath certPath, PKIXExtendedParameters pKIXExtendedParameters, Set set, int i, List[] listArr, PKIXPolicyNode pKIXPolicyNode, Set set2) throws CertPathValidatorException {
|
||
|
|
int size = certPath.getCertificates().size();
|
||
|
|
if (pKIXPolicyNode == null) {
|
||
|
|
if (pKIXExtendedParameters.isExplicitPolicyRequired()) {
|
||
|
|
throw new ExtCertPathValidatorException("Explicit policy requested but none available.", null, certPath, i);
|
||
|
|
}
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
if (!CertPathValidatorUtilities.isAnyPolicy(set)) {
|
||
|
|
HashSet<PKIXPolicyNode> hashSet = new HashSet();
|
||
|
|
for (List list : listArr) {
|
||
|
|
for (int i2 = 0; i2 < list.size(); i2++) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode2 = (PKIXPolicyNode) list.get(i2);
|
||
|
|
if (ANY_POLICY.equals(pKIXPolicyNode2.getValidPolicy())) {
|
||
|
|
Iterator children = pKIXPolicyNode2.getChildren();
|
||
|
|
while (children.hasNext()) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) children.next();
|
||
|
|
if (!ANY_POLICY.equals(pKIXPolicyNode3.getValidPolicy())) {
|
||
|
|
hashSet.add(pKIXPolicyNode3);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
for (PKIXPolicyNode pKIXPolicyNode4 : hashSet) {
|
||
|
|
if (!set.contains(pKIXPolicyNode4.getValidPolicy())) {
|
||
|
|
pKIXPolicyNode = CertPathValidatorUtilities.removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode4);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (pKIXPolicyNode != null) {
|
||
|
|
for (int i3 = size - 1; i3 >= 0; i3--) {
|
||
|
|
List list2 = listArr[i3];
|
||
|
|
for (int i4 = 0; i4 < list2.size(); i4++) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode5 = (PKIXPolicyNode) list2.get(i4);
|
||
|
|
if (!pKIXPolicyNode5.hasChildren()) {
|
||
|
|
pKIXPolicyNode = CertPathValidatorUtilities.removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode5);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} else if (pKIXExtendedParameters.isExplicitPolicyRequired()) {
|
||
|
|
if (set2.isEmpty()) {
|
||
|
|
throw new ExtCertPathValidatorException("Explicit policy requested but none available.", null, certPath, i);
|
||
|
|
}
|
||
|
|
HashSet hashSet2 = new HashSet();
|
||
|
|
for (List list3 : listArr) {
|
||
|
|
for (int i5 = 0; i5 < list3.size(); i5++) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode6 = (PKIXPolicyNode) list3.get(i5);
|
||
|
|
if (ANY_POLICY.equals(pKIXPolicyNode6.getValidPolicy())) {
|
||
|
|
Iterator children2 = pKIXPolicyNode6.getChildren();
|
||
|
|
while (children2.hasNext()) {
|
||
|
|
hashSet2.add(children2.next());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
Iterator it = hashSet2.iterator();
|
||
|
|
while (it.hasNext()) {
|
||
|
|
set2.contains(((PKIXPolicyNode) it.next()).getValidPolicy());
|
||
|
|
}
|
||
|
|
if (pKIXPolicyNode != null) {
|
||
|
|
for (int i6 = size - 1; i6 >= 0; i6--) {
|
||
|
|
List list4 = listArr[i6];
|
||
|
|
for (int i7 = 0; i7 < list4.size(); i7++) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode7 = (PKIXPolicyNode) list4.get(i7);
|
||
|
|
if (!pKIXPolicyNode7.hasChildren()) {
|
||
|
|
pKIXPolicyNode = CertPathValidatorUtilities.removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode7);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return pKIXPolicyNode;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void wrapupCertF(CertPath certPath, int i, List list, Set set) throws CertPathValidatorException {
|
||
|
|
X509Certificate x509Certificate = (X509Certificate) certPath.getCertificates().get(i);
|
||
|
|
Iterator it = list.iterator();
|
||
|
|
while (it.hasNext()) {
|
||
|
|
try {
|
||
|
|
((PKIXCertPathChecker) it.next()).check(x509Certificate, set);
|
||
|
|
} catch (CertPathValidatorException e) {
|
||
|
|
throw new ExtCertPathValidatorException("Additional certificate path checker failed.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (!set.isEmpty()) {
|
||
|
|
throw new ExtCertPathValidatorException("Certificate has unsupported critical extension: ".concat(String.valueOf(set)), null, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static int wrapupCertB(CertPath certPath, int i, int i2) throws CertPathValidatorException {
|
||
|
|
try {
|
||
|
|
ASN1Sequence dERSequence = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), POLICY_CONSTRAINTS));
|
||
|
|
if (dERSequence != null) {
|
||
|
|
Enumeration objects = dERSequence.getObjects();
|
||
|
|
while (objects.hasMoreElements()) {
|
||
|
|
ASN1TaggedObject aSN1TaggedObject = (ASN1TaggedObject) objects.nextElement();
|
||
|
|
if (aSN1TaggedObject.getTagNo() == 0) {
|
||
|
|
try {
|
||
|
|
if (ASN1Integer.getInstance(aSN1TaggedObject, false).getValue().intValue() == 0) {
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new ExtCertPathValidatorException("Policy constraints requireExplicitPolicy field could not be decoded.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return i2;
|
||
|
|
} catch (AnnotatedException e2) {
|
||
|
|
throw new ExtCertPathValidatorException("Policy constraints could not be decoded.", e2, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static int wrapupCertA(int i, X509Certificate x509Certificate) {
|
||
|
|
return (CertPathValidatorUtilities.isSelfIssued(x509Certificate) || i == 0) ? i : i - 1;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCertF(CertPath certPath, int i, PKIXPolicyNode pKIXPolicyNode, int i2) throws CertPathValidatorException {
|
||
|
|
if (i2 <= 0 && pKIXPolicyNode == null) {
|
||
|
|
throw new ExtCertPathValidatorException("No valid policy tree found when one expected.", null, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static PKIXPolicyNode processCertE(CertPath certPath, int i, PKIXPolicyNode pKIXPolicyNode) throws CertPathValidatorException {
|
||
|
|
try {
|
||
|
|
if (DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), CERTIFICATE_POLICIES)) == null) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
return pKIXPolicyNode;
|
||
|
|
} catch (AnnotatedException e) {
|
||
|
|
throw new ExtCertPathValidatorException("Could not read certificate policies extension from certificate.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static PKIXPolicyNode processCertD(CertPath certPath, int i, Set set, PKIXPolicyNode pKIXPolicyNode, List[] listArr, int i2) throws CertPathValidatorException {
|
||
|
|
String str;
|
||
|
|
int i3;
|
||
|
|
List<? extends Certificate> certificates = certPath.getCertificates();
|
||
|
|
X509Certificate x509Certificate = (X509Certificate) certificates.get(i);
|
||
|
|
int size = certificates.size();
|
||
|
|
int i4 = size - i;
|
||
|
|
try {
|
||
|
|
ASN1Sequence dERSequence = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(x509Certificate, CERTIFICATE_POLICIES));
|
||
|
|
if (dERSequence == null || pKIXPolicyNode == null) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
Enumeration objects = dERSequence.getObjects();
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
while (objects.hasMoreElements()) {
|
||
|
|
PolicyInformation policyInformation = PolicyInformation.getInstance(objects.nextElement());
|
||
|
|
ASN1ObjectIdentifier policyIdentifier = policyInformation.getPolicyIdentifier();
|
||
|
|
hashSet.add(policyIdentifier.getId());
|
||
|
|
if (!ANY_POLICY.equals(policyIdentifier.getId())) {
|
||
|
|
try {
|
||
|
|
Set qualifierSet = CertPathValidatorUtilities.getQualifierSet(policyInformation.getPolicyQualifiers());
|
||
|
|
if (!CertPathValidatorUtilities.processCertD1i(i4, listArr, policyIdentifier, qualifierSet)) {
|
||
|
|
CertPathValidatorUtilities.processCertD1ii(i4, listArr, policyIdentifier, qualifierSet);
|
||
|
|
}
|
||
|
|
} catch (CertPathValidatorException e) {
|
||
|
|
throw new ExtCertPathValidatorException("Policy qualifier info set could not be build.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (set.isEmpty() || set.contains(ANY_POLICY)) {
|
||
|
|
set.clear();
|
||
|
|
set.addAll(hashSet);
|
||
|
|
} else {
|
||
|
|
HashSet hashSet2 = new HashSet();
|
||
|
|
for (Object obj : set) {
|
||
|
|
if (hashSet.contains(obj)) {
|
||
|
|
hashSet2.add(obj);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
set.clear();
|
||
|
|
set.addAll(hashSet2);
|
||
|
|
}
|
||
|
|
if (i2 > 0 || (i4 < size && CertPathValidatorUtilities.isSelfIssued(x509Certificate))) {
|
||
|
|
Enumeration objects2 = dERSequence.getObjects();
|
||
|
|
while (true) {
|
||
|
|
if (!objects2.hasMoreElements()) {
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
PolicyInformation policyInformation2 = PolicyInformation.getInstance(objects2.nextElement());
|
||
|
|
if (ANY_POLICY.equals(policyInformation2.getPolicyIdentifier().getId())) {
|
||
|
|
Set qualifierSet2 = CertPathValidatorUtilities.getQualifierSet(policyInformation2.getPolicyQualifiers());
|
||
|
|
List list = listArr[i4 - 1];
|
||
|
|
for (int i5 = 0; i5 < list.size(); i5++) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode2 = (PKIXPolicyNode) list.get(i5);
|
||
|
|
for (Object obj2 : pKIXPolicyNode2.getExpectedPolicies()) {
|
||
|
|
if (obj2 instanceof String) {
|
||
|
|
str = (String) obj2;
|
||
|
|
} else if (obj2 instanceof ASN1ObjectIdentifier) {
|
||
|
|
str = ((ASN1ObjectIdentifier) obj2).getId();
|
||
|
|
}
|
||
|
|
String str2 = str;
|
||
|
|
Iterator children = pKIXPolicyNode2.getChildren();
|
||
|
|
boolean z = false;
|
||
|
|
while (children.hasNext()) {
|
||
|
|
if (str2.equals(((PKIXPolicyNode) children.next()).getValidPolicy())) {
|
||
|
|
z = true;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (!z) {
|
||
|
|
HashSet hashSet3 = new HashSet();
|
||
|
|
hashSet3.add(str2);
|
||
|
|
PKIXPolicyNode pKIXPolicyNode3 = new PKIXPolicyNode(new ArrayList(), i4, hashSet3, pKIXPolicyNode2, qualifierSet2, str2, false);
|
||
|
|
pKIXPolicyNode2.addChild(pKIXPolicyNode3);
|
||
|
|
listArr[i4].add(pKIXPolicyNode3);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
PKIXPolicyNode pKIXPolicyNode4 = pKIXPolicyNode;
|
||
|
|
for (int i6 = i4 - 1; i6 >= 0; i6--) {
|
||
|
|
List list2 = listArr[i6];
|
||
|
|
while (i3 < list2.size()) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode5 = (PKIXPolicyNode) list2.get(i3);
|
||
|
|
i3 = (pKIXPolicyNode5.hasChildren() || (pKIXPolicyNode4 = CertPathValidatorUtilities.removePolicyNode(pKIXPolicyNode4, listArr, pKIXPolicyNode5)) != null) ? i3 + 1 : 0;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
Set<String> criticalExtensionOIDs = x509Certificate.getCriticalExtensionOIDs();
|
||
|
|
if (criticalExtensionOIDs != null) {
|
||
|
|
boolean contains = criticalExtensionOIDs.contains(CERTIFICATE_POLICIES);
|
||
|
|
List list3 = listArr[i4];
|
||
|
|
for (int i7 = 0; i7 < list3.size(); i7++) {
|
||
|
|
((PKIXPolicyNode) list3.get(i7)).setCritical(contains);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return pKIXPolicyNode4;
|
||
|
|
} catch (AnnotatedException e2) {
|
||
|
|
throw new ExtCertPathValidatorException("Could not read certificate policies extension from certificate.", e2, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCertBC(CertPath certPath, int i, PKIXNameConstraintValidator pKIXNameConstraintValidator) throws CertPathValidatorException {
|
||
|
|
List<? extends Certificate> certificates = certPath.getCertificates();
|
||
|
|
X509Certificate x509Certificate = (X509Certificate) certificates.get(i);
|
||
|
|
int size = certificates.size();
|
||
|
|
if (!CertPathValidatorUtilities.isSelfIssued(x509Certificate) || size - i >= size) {
|
||
|
|
try {
|
||
|
|
ASN1Sequence dERSequence = DERSequence.getInstance(PrincipalUtils.getSubjectPrincipal(x509Certificate).getEncoded());
|
||
|
|
try {
|
||
|
|
pKIXNameConstraintValidator.checkPermittedDN(dERSequence);
|
||
|
|
pKIXNameConstraintValidator.checkExcludedDN(dERSequence);
|
||
|
|
try {
|
||
|
|
GeneralNames generalNames = GeneralNames.getInstance(CertPathValidatorUtilities.getExtensionValue(x509Certificate, SUBJECT_ALTERNATIVE_NAME));
|
||
|
|
RDN[] rDNs = X500Name.getInstance(dERSequence).getRDNs(BCStyle.EmailAddress);
|
||
|
|
for (int i2 = 0; i2 != rDNs.length; i2++) {
|
||
|
|
GeneralName generalName = new GeneralName(1, ((ASN1String) rDNs[i2].getFirst().getValue()).getString());
|
||
|
|
try {
|
||
|
|
pKIXNameConstraintValidator.checkPermitted(generalName);
|
||
|
|
pKIXNameConstraintValidator.checkExcluded(generalName);
|
||
|
|
} catch (PKIXNameConstraintValidatorException e) {
|
||
|
|
throw new CertPathValidatorException("Subtree check for certificate subject alternative email failed.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (generalNames != null) {
|
||
|
|
try {
|
||
|
|
GeneralName[] names = generalNames.getNames();
|
||
|
|
for (int i3 = 0; i3 < names.length; i3++) {
|
||
|
|
try {
|
||
|
|
pKIXNameConstraintValidator.checkPermitted(names[i3]);
|
||
|
|
pKIXNameConstraintValidator.checkExcluded(names[i3]);
|
||
|
|
} catch (PKIXNameConstraintValidatorException e2) {
|
||
|
|
throw new CertPathValidatorException("Subtree check for certificate subject alternative name failed.", e2, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (Exception e3) {
|
||
|
|
throw new CertPathValidatorException("Subject alternative name contents could not be decoded.", e3, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (Exception e4) {
|
||
|
|
throw new CertPathValidatorException("Subject alternative name extension could not be decoded.", e4, certPath, i);
|
||
|
|
}
|
||
|
|
} catch (PKIXNameConstraintValidatorException e5) {
|
||
|
|
throw new CertPathValidatorException("Subtree check for certificate subject failed.", e5, certPath, i);
|
||
|
|
}
|
||
|
|
} catch (Exception e6) {
|
||
|
|
throw new CertPathValidatorException("Exception extracting subject name when checking subtrees.", e6, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCertA(CertPath certPath, PKIXExtendedParameters pKIXExtendedParameters, int i, PublicKey publicKey, boolean z, X500Name x500Name, X509Certificate x509Certificate, JcaJceHelper jcaJceHelper) throws ExtCertPathValidatorException {
|
||
|
|
List<? extends Certificate> certificates = certPath.getCertificates();
|
||
|
|
X509Certificate x509Certificate2 = (X509Certificate) certificates.get(i);
|
||
|
|
if (!z) {
|
||
|
|
try {
|
||
|
|
CertPathValidatorUtilities.verifyX509Certificate(x509Certificate2, publicKey, pKIXExtendedParameters.getSigProvider());
|
||
|
|
} catch (GeneralSecurityException e) {
|
||
|
|
throw new ExtCertPathValidatorException("Could not validate certificate signature.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
try {
|
||
|
|
x509Certificate2.checkValidity(CertPathValidatorUtilities.getValidCertDateFromValidityModel(pKIXExtendedParameters, certPath, i));
|
||
|
|
if (pKIXExtendedParameters.isRevocationEnabled()) {
|
||
|
|
try {
|
||
|
|
checkCRLs(pKIXExtendedParameters, x509Certificate2, CertPathValidatorUtilities.getValidCertDateFromValidityModel(pKIXExtendedParameters, certPath, i), x509Certificate, publicKey, certificates, jcaJceHelper);
|
||
|
|
} catch (AnnotatedException e2) {
|
||
|
|
throw new ExtCertPathValidatorException(e2.getMessage(), e2.getCause() != null ? e2.getCause() : e2, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (PrincipalUtils.getEncodedIssuerPrincipal(x509Certificate2).equals(x500Name)) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
StringBuilder sb = new StringBuilder("IssuerName(");
|
||
|
|
sb.append(PrincipalUtils.getEncodedIssuerPrincipal(x509Certificate2));
|
||
|
|
sb.append(") does not match SubjectName(");
|
||
|
|
sb.append(x500Name);
|
||
|
|
sb.append(") of signing certificate.");
|
||
|
|
throw new ExtCertPathValidatorException(sb.toString(), null, certPath, i);
|
||
|
|
} catch (CertificateExpiredException e3) {
|
||
|
|
StringBuilder sb2 = new StringBuilder("Could not validate certificate: ");
|
||
|
|
sb2.append(e3.getMessage());
|
||
|
|
throw new ExtCertPathValidatorException(sb2.toString(), e3, certPath, i);
|
||
|
|
} catch (CertificateNotYetValidException e4) {
|
||
|
|
StringBuilder sb3 = new StringBuilder("Could not validate certificate: ");
|
||
|
|
sb3.append(e4.getMessage());
|
||
|
|
throw new ExtCertPathValidatorException(sb3.toString(), e4, certPath, i);
|
||
|
|
} catch (AnnotatedException e5) {
|
||
|
|
throw new ExtCertPathValidatorException("Could not validate time of certificate.", e5, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCRLJ(Date date, X509CRL x509crl, Object obj, CertStatus certStatus) throws AnnotatedException {
|
||
|
|
if (certStatus.getCertStatus() == 11) {
|
||
|
|
CertPathValidatorUtilities.getCertStatus(date, x509crl, obj, certStatus);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCRLI(Date date, X509CRL x509crl, Object obj, CertStatus certStatus, PKIXExtendedParameters pKIXExtendedParameters) throws AnnotatedException {
|
||
|
|
if (!pKIXExtendedParameters.isUseDeltasEnabled() || x509crl == null) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
CertPathValidatorUtilities.getCertStatus(date, x509crl, obj, certStatus);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static X509CRL processCRLH(Set set, PublicKey publicKey) throws AnnotatedException {
|
||
|
|
Iterator it = set.iterator();
|
||
|
|
Exception e = null;
|
||
|
|
while (it.hasNext()) {
|
||
|
|
X509CRL x509crl = (X509CRL) it.next();
|
||
|
|
try {
|
||
|
|
x509crl.verify(publicKey);
|
||
|
|
return x509crl;
|
||
|
|
} catch (Exception e2) {
|
||
|
|
e = e2;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (e == null) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
throw new AnnotatedException("Cannot verify delta CRL.", e);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static PublicKey processCRLG(X509CRL x509crl, Set set) throws AnnotatedException {
|
||
|
|
Iterator it = set.iterator();
|
||
|
|
Exception e = null;
|
||
|
|
while (it.hasNext()) {
|
||
|
|
PublicKey publicKey = (PublicKey) it.next();
|
||
|
|
try {
|
||
|
|
x509crl.verify(publicKey);
|
||
|
|
return publicKey;
|
||
|
|
} catch (Exception e2) {
|
||
|
|
e = e2;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
throw new AnnotatedException("Cannot verify CRL.", e);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static Set processCRLF(X509CRL x509crl, Object obj, X509Certificate x509Certificate, PublicKey publicKey, PKIXExtendedParameters pKIXExtendedParameters, List list, JcaJceHelper jcaJceHelper) throws AnnotatedException {
|
||
|
|
int i;
|
||
|
|
X509CertSelector x509CertSelector = new X509CertSelector();
|
||
|
|
try {
|
||
|
|
x509CertSelector.setSubject(PrincipalUtils.getIssuerPrincipal(x509crl).getEncoded());
|
||
|
|
PKIXCertStoreSelector<? extends Certificate> build = new PKIXCertStoreSelector.Builder(x509CertSelector).build();
|
||
|
|
try {
|
||
|
|
Collection findCertificates = CertPathValidatorUtilities.findCertificates(build, pKIXExtendedParameters.getCertificateStores());
|
||
|
|
findCertificates.addAll(CertPathValidatorUtilities.findCertificates(build, pKIXExtendedParameters.getCertStores()));
|
||
|
|
findCertificates.add(x509Certificate);
|
||
|
|
Iterator it = findCertificates.iterator();
|
||
|
|
ArrayList arrayList = new ArrayList();
|
||
|
|
ArrayList arrayList2 = new ArrayList();
|
||
|
|
while (true) {
|
||
|
|
if (!it.hasNext()) {
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
X509Certificate x509Certificate2 = (X509Certificate) it.next();
|
||
|
|
if (x509Certificate2.equals(x509Certificate)) {
|
||
|
|
arrayList.add(x509Certificate2);
|
||
|
|
arrayList2.add(publicKey);
|
||
|
|
} else {
|
||
|
|
try {
|
||
|
|
PKIXCertPathBuilderSpi pKIXCertPathBuilderSpi = new PKIXCertPathBuilderSpi();
|
||
|
|
X509CertSelector x509CertSelector2 = new X509CertSelector();
|
||
|
|
x509CertSelector2.setCertificate(x509Certificate2);
|
||
|
|
PKIXExtendedParameters.Builder targetConstraints = new PKIXExtendedParameters.Builder(pKIXExtendedParameters).setTargetConstraints(new PKIXCertStoreSelector.Builder(x509CertSelector2).build());
|
||
|
|
if (list.contains(x509Certificate2)) {
|
||
|
|
targetConstraints.setRevocationEnabled(false);
|
||
|
|
} else {
|
||
|
|
targetConstraints.setRevocationEnabled(true);
|
||
|
|
}
|
||
|
|
List<? extends Certificate> certificates = pKIXCertPathBuilderSpi.engineBuild(new PKIXExtendedBuilderParameters.Builder(targetConstraints.build()).build()).getCertPath().getCertificates();
|
||
|
|
arrayList.add(x509Certificate2);
|
||
|
|
arrayList2.add(CertPathValidatorUtilities.getNextWorkingKey(certificates, 0, jcaJceHelper));
|
||
|
|
} catch (CertPathBuilderException e) {
|
||
|
|
throw new AnnotatedException("CertPath for CRL signer failed to validate.", e);
|
||
|
|
} catch (CertPathValidatorException e2) {
|
||
|
|
throw new AnnotatedException("Public key of issuer certificate of CRL could not be retrieved.", e2);
|
||
|
|
} catch (Exception e3) {
|
||
|
|
throw new AnnotatedException(e3.getMessage());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
AnnotatedException annotatedException = null;
|
||
|
|
for (i = 0; i < arrayList.size(); i++) {
|
||
|
|
boolean[] keyUsage = ((X509Certificate) arrayList.get(i)).getKeyUsage();
|
||
|
|
if (keyUsage == null || (keyUsage.length >= 7 && keyUsage[6])) {
|
||
|
|
hashSet.add(arrayList2.get(i));
|
||
|
|
} else {
|
||
|
|
annotatedException = new AnnotatedException("Issuer certificate key usage extension does not permit CRL signing.");
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (hashSet.isEmpty() && annotatedException == null) {
|
||
|
|
throw new AnnotatedException("Cannot find a valid issuer certificate.");
|
||
|
|
}
|
||
|
|
if (!hashSet.isEmpty() || annotatedException == null) {
|
||
|
|
return hashSet;
|
||
|
|
}
|
||
|
|
throw annotatedException;
|
||
|
|
} catch (AnnotatedException e4) {
|
||
|
|
throw new AnnotatedException("Issuer certificate for CRL cannot be searched.", e4);
|
||
|
|
}
|
||
|
|
} catch (IOException e5) {
|
||
|
|
throw new AnnotatedException("Subject criteria for certificate selector to find issuer certificate for CRL could not be set.", e5);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static ReasonsMask processCRLD(X509CRL x509crl, DistributionPoint distributionPoint) throws AnnotatedException {
|
||
|
|
try {
|
||
|
|
IssuingDistributionPoint issuingDistributionPoint = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl, ISSUING_DISTRIBUTION_POINT));
|
||
|
|
if (issuingDistributionPoint != null && issuingDistributionPoint.getOnlySomeReasons() != null && distributionPoint.getReasons() != null) {
|
||
|
|
return new ReasonsMask(distributionPoint.getReasons()).intersect(new ReasonsMask(issuingDistributionPoint.getOnlySomeReasons()));
|
||
|
|
}
|
||
|
|
if ((issuingDistributionPoint == null || issuingDistributionPoint.getOnlySomeReasons() == null) && distributionPoint.getReasons() == null) {
|
||
|
|
return ReasonsMask.allReasons;
|
||
|
|
}
|
||
|
|
return (distributionPoint.getReasons() == null ? ReasonsMask.allReasons : new ReasonsMask(distributionPoint.getReasons())).intersect(issuingDistributionPoint == null ? ReasonsMask.allReasons : new ReasonsMask(issuingDistributionPoint.getOnlySomeReasons()));
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCRLC(X509CRL x509crl, X509CRL x509crl2, PKIXExtendedParameters pKIXExtendedParameters) throws AnnotatedException {
|
||
|
|
if (x509crl == null) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
try {
|
||
|
|
String str = ISSUING_DISTRIBUTION_POINT;
|
||
|
|
IssuingDistributionPoint issuingDistributionPoint = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl2, str));
|
||
|
|
if (pKIXExtendedParameters.isUseDeltasEnabled()) {
|
||
|
|
if (!PrincipalUtils.getIssuerPrincipal(x509crl).equals(PrincipalUtils.getIssuerPrincipal(x509crl2))) {
|
||
|
|
throw new AnnotatedException("Complete CRL issuer does not match delta CRL issuer.");
|
||
|
|
}
|
||
|
|
try {
|
||
|
|
IssuingDistributionPoint issuingDistributionPoint2 = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl, str));
|
||
|
|
if (issuingDistributionPoint != null ? !issuingDistributionPoint.equals(issuingDistributionPoint2) : issuingDistributionPoint2 != null) {
|
||
|
|
throw new AnnotatedException("Issuing distribution point extension from delta CRL and complete CRL does not match.");
|
||
|
|
}
|
||
|
|
try {
|
||
|
|
String str2 = AUTHORITY_KEY_IDENTIFIER;
|
||
|
|
ASN1Primitive extensionValue = CertPathValidatorUtilities.getExtensionValue(x509crl2, str2);
|
||
|
|
try {
|
||
|
|
ASN1Primitive extensionValue2 = CertPathValidatorUtilities.getExtensionValue(x509crl, str2);
|
||
|
|
if (extensionValue == null) {
|
||
|
|
throw new AnnotatedException("CRL authority key identifier is null.");
|
||
|
|
}
|
||
|
|
if (extensionValue2 == null) {
|
||
|
|
throw new AnnotatedException("Delta CRL authority key identifier is null.");
|
||
|
|
}
|
||
|
|
if (!extensionValue.equals(extensionValue2)) {
|
||
|
|
throw new AnnotatedException("Delta CRL authority key identifier does not match complete CRL authority key identifier.");
|
||
|
|
}
|
||
|
|
} catch (AnnotatedException e) {
|
||
|
|
throw new AnnotatedException("Authority key identifier extension could not be extracted from delta CRL.", e);
|
||
|
|
}
|
||
|
|
} catch (AnnotatedException e2) {
|
||
|
|
throw new AnnotatedException("Authority key identifier extension could not be extracted from complete CRL.", e2);
|
||
|
|
}
|
||
|
|
} catch (Exception e3) {
|
||
|
|
throw new AnnotatedException("Issuing distribution point extension from delta CRL could not be decoded.", e3);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (Exception e4) {
|
||
|
|
throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e4);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCRLB2(DistributionPoint distributionPoint, Object obj, X509CRL x509crl) throws AnnotatedException {
|
||
|
|
int i;
|
||
|
|
GeneralName[] generalNameArr;
|
||
|
|
try {
|
||
|
|
IssuingDistributionPoint issuingDistributionPoint = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl, ISSUING_DISTRIBUTION_POINT));
|
||
|
|
if (issuingDistributionPoint != null) {
|
||
|
|
if (issuingDistributionPoint.getDistributionPoint() != null) {
|
||
|
|
DistributionPointName distributionPoint2 = IssuingDistributionPoint.getInstance(issuingDistributionPoint).getDistributionPoint();
|
||
|
|
ArrayList arrayList = new ArrayList();
|
||
|
|
if (distributionPoint2.getType() == 0) {
|
||
|
|
for (GeneralName generalName : GeneralNames.getInstance(distributionPoint2.getName()).getNames()) {
|
||
|
|
arrayList.add(generalName);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (distributionPoint2.getType() == 1) {
|
||
|
|
ASN1EncodableVector aSN1EncodableVector = new ASN1EncodableVector();
|
||
|
|
try {
|
||
|
|
Enumeration objects = ASN1Sequence.getInstance(PrincipalUtils.getIssuerPrincipal(x509crl)).getObjects();
|
||
|
|
while (objects.hasMoreElements()) {
|
||
|
|
aSN1EncodableVector.add((ASN1Encodable) objects.nextElement());
|
||
|
|
}
|
||
|
|
aSN1EncodableVector.add(distributionPoint2.getName());
|
||
|
|
arrayList.add(new GeneralName(X500Name.getInstance(new DERSequence(aSN1EncodableVector))));
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new AnnotatedException("Could not read CRL issuer.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (distributionPoint.getDistributionPoint() == null) {
|
||
|
|
if (distributionPoint.getCRLIssuer() == null) {
|
||
|
|
throw new AnnotatedException("Either the cRLIssuer or the distributionPoint field must be contained in DistributionPoint.");
|
||
|
|
}
|
||
|
|
GeneralName[] names = distributionPoint.getCRLIssuer().getNames();
|
||
|
|
while (i < names.length) {
|
||
|
|
i = arrayList.contains(names[i]) ? 0 : i + 1;
|
||
|
|
}
|
||
|
|
throw new AnnotatedException("No match for certificate CRL issuing distribution point name to cRLIssuer CRL distribution point.");
|
||
|
|
}
|
||
|
|
DistributionPointName distributionPoint3 = distributionPoint.getDistributionPoint();
|
||
|
|
GeneralName[] names2 = distributionPoint3.getType() == 0 ? GeneralNames.getInstance(distributionPoint3.getName()).getNames() : null;
|
||
|
|
if (distributionPoint3.getType() == 1) {
|
||
|
|
if (distributionPoint.getCRLIssuer() != null) {
|
||
|
|
generalNameArr = distributionPoint.getCRLIssuer().getNames();
|
||
|
|
} else {
|
||
|
|
generalNameArr = new GeneralName[1];
|
||
|
|
try {
|
||
|
|
generalNameArr[0] = new GeneralName(X500Name.getInstance(PrincipalUtils.getEncodedIssuerPrincipal(obj).getEncoded()));
|
||
|
|
} catch (Exception e2) {
|
||
|
|
throw new AnnotatedException("Could not read certificate issuer.", e2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
names2 = generalNameArr;
|
||
|
|
for (int i2 = 0; i2 < names2.length; i2++) {
|
||
|
|
Enumeration objects2 = ASN1Sequence.getInstance(names2[i2].getName().toASN1Primitive()).getObjects();
|
||
|
|
ASN1EncodableVector aSN1EncodableVector2 = new ASN1EncodableVector();
|
||
|
|
while (objects2.hasMoreElements()) {
|
||
|
|
aSN1EncodableVector2.add((ASN1Encodable) objects2.nextElement());
|
||
|
|
}
|
||
|
|
aSN1EncodableVector2.add(distributionPoint3.getName());
|
||
|
|
names2[i2] = new GeneralName(X500Name.getInstance(new DERSequence(aSN1EncodableVector2)));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (names2 != null) {
|
||
|
|
while (i < names2.length) {
|
||
|
|
i = arrayList.contains(names2[i]) ? 0 : i + 1;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
throw new AnnotatedException("No match for certificate CRL issuing distribution point name to cRLIssuer CRL distribution point.");
|
||
|
|
}
|
||
|
|
try {
|
||
|
|
BasicConstraints basicConstraints = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Extension) obj, BASIC_CONSTRAINTS));
|
||
|
|
if (obj instanceof X509Certificate) {
|
||
|
|
if (issuingDistributionPoint.onlyContainsUserCerts() && basicConstraints != null && basicConstraints.isCA()) {
|
||
|
|
throw new AnnotatedException("CA Cert CRL only contains user certificates.");
|
||
|
|
}
|
||
|
|
if (issuingDistributionPoint.onlyContainsCACerts() && (basicConstraints == null || !basicConstraints.isCA())) {
|
||
|
|
throw new AnnotatedException("End CRL only contains CA certificates.");
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (issuingDistributionPoint.onlyContainsAttributeCerts()) {
|
||
|
|
throw new AnnotatedException("onlyContainsAttributeCerts boolean is asserted.");
|
||
|
|
}
|
||
|
|
} catch (Exception e3) {
|
||
|
|
throw new AnnotatedException("Basic constraints extension could not be decoded.", e3);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (Exception e4) {
|
||
|
|
throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e4);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCRLB1(DistributionPoint distributionPoint, Object obj, X509CRL x509crl) throws AnnotatedException {
|
||
|
|
ASN1Primitive extensionValue = CertPathValidatorUtilities.getExtensionValue(x509crl, ISSUING_DISTRIBUTION_POINT);
|
||
|
|
boolean z = extensionValue != null && IssuingDistributionPoint.getInstance(extensionValue).isIndirectCRL();
|
||
|
|
try {
|
||
|
|
byte[] encoded = PrincipalUtils.getIssuerPrincipal(x509crl).getEncoded();
|
||
|
|
if (distributionPoint.getCRLIssuer() != null) {
|
||
|
|
GeneralName[] names = distributionPoint.getCRLIssuer().getNames();
|
||
|
|
boolean z2 = false;
|
||
|
|
for (int i = 0; i < names.length; i++) {
|
||
|
|
if (names[i].getTagNo() == 4) {
|
||
|
|
try {
|
||
|
|
if (Arrays.areEqual(names[i].getName().toASN1Primitive().getEncoded(), encoded)) {
|
||
|
|
z2 = true;
|
||
|
|
}
|
||
|
|
} catch (IOException e) {
|
||
|
|
throw new AnnotatedException("CRL issuer information from distribution point cannot be decoded.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (z2 && !z) {
|
||
|
|
throw new AnnotatedException("Distribution point contains cRLIssuer field but CRL is not indirect.");
|
||
|
|
}
|
||
|
|
if (!z2) {
|
||
|
|
throw new AnnotatedException("CRL issuer of CRL does not match CRL issuer of distribution point.");
|
||
|
|
}
|
||
|
|
if (z2) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
} else if (PrincipalUtils.getIssuerPrincipal(x509crl).equals(PrincipalUtils.getEncodedIssuerPrincipal(obj))) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
throw new AnnotatedException("Cannot find matching CRL issuer for certificate.");
|
||
|
|
} catch (IOException e2) {
|
||
|
|
StringBuilder sb = new StringBuilder("Exception encoding CRL issuer: ");
|
||
|
|
sb.append(e2.getMessage());
|
||
|
|
throw new AnnotatedException(sb.toString(), e2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
protected static Set[] processCRLA1ii(Date date, PKIXExtendedParameters pKIXExtendedParameters, X509Certificate x509Certificate, X509CRL x509crl) throws AnnotatedException {
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
X509CRLSelector x509CRLSelector = new X509CRLSelector();
|
||
|
|
x509CRLSelector.setCertificateChecking(x509Certificate);
|
||
|
|
try {
|
||
|
|
x509CRLSelector.addIssuerName(PrincipalUtils.getIssuerPrincipal(x509crl).getEncoded());
|
||
|
|
PKIXCRLStoreSelector<? extends CRL> build = new PKIXCRLStoreSelector.Builder(x509CRLSelector).setCompleteCRLEnabled(true).build();
|
||
|
|
if (pKIXExtendedParameters.getDate() != null) {
|
||
|
|
date = pKIXExtendedParameters.getDate();
|
||
|
|
}
|
||
|
|
Set findCRLs = CRL_UTIL.findCRLs(build, date, pKIXExtendedParameters.getCertStores(), pKIXExtendedParameters.getCRLStores());
|
||
|
|
if (pKIXExtendedParameters.isUseDeltasEnabled()) {
|
||
|
|
try {
|
||
|
|
hashSet.addAll(CertPathValidatorUtilities.getDeltaCRLs(date, x509crl, pKIXExtendedParameters.getCertStores(), pKIXExtendedParameters.getCRLStores()));
|
||
|
|
} catch (AnnotatedException e) {
|
||
|
|
throw new AnnotatedException("Exception obtaining delta CRLs.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return new Set[]{findCRLs, hashSet};
|
||
|
|
} catch (IOException e2) {
|
||
|
|
throw new AnnotatedException("Cannot extract issuer from CRL.".concat(String.valueOf(e2)), e2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
protected static Set processCRLA1i(Date date, PKIXExtendedParameters pKIXExtendedParameters, X509Certificate x509Certificate, X509CRL x509crl) throws AnnotatedException {
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
if (pKIXExtendedParameters.isUseDeltasEnabled()) {
|
||
|
|
try {
|
||
|
|
String str = FRESHEST_CRL;
|
||
|
|
CRLDistPoint cRLDistPoint = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509Certificate, str));
|
||
|
|
if (cRLDistPoint == null) {
|
||
|
|
try {
|
||
|
|
cRLDistPoint = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl, str));
|
||
|
|
} catch (AnnotatedException e) {
|
||
|
|
throw new AnnotatedException("Freshest CRL extension could not be decoded from CRL.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (cRLDistPoint != null) {
|
||
|
|
ArrayList arrayList = new ArrayList();
|
||
|
|
arrayList.addAll(pKIXExtendedParameters.getCRLStores());
|
||
|
|
try {
|
||
|
|
arrayList.addAll(CertPathValidatorUtilities.getAdditionalStoresFromCRLDistributionPoint(cRLDistPoint, pKIXExtendedParameters.getNamedCRLStoreMap()));
|
||
|
|
try {
|
||
|
|
hashSet.addAll(CertPathValidatorUtilities.getDeltaCRLs(date, x509crl, pKIXExtendedParameters.getCertStores(), arrayList));
|
||
|
|
} catch (AnnotatedException e2) {
|
||
|
|
throw new AnnotatedException("Exception obtaining delta CRLs.", e2);
|
||
|
|
}
|
||
|
|
} catch (AnnotatedException e3) {
|
||
|
|
throw new AnnotatedException("No new delta CRL locations could be added from Freshest CRL extension.", e3);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (AnnotatedException e4) {
|
||
|
|
throw new AnnotatedException("Freshest CRL extension could not be decoded from certificate.", e4);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return hashSet;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void prepareNextCertO(CertPath certPath, int i, Set set, List list) throws CertPathValidatorException {
|
||
|
|
X509Certificate x509Certificate = (X509Certificate) certPath.getCertificates().get(i);
|
||
|
|
Iterator it = list.iterator();
|
||
|
|
while (it.hasNext()) {
|
||
|
|
try {
|
||
|
|
((PKIXCertPathChecker) it.next()).check(x509Certificate, set);
|
||
|
|
} catch (CertPathValidatorException e) {
|
||
|
|
throw new CertPathValidatorException(e.getMessage(), e.getCause(), certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (!set.isEmpty()) {
|
||
|
|
throw new ExtCertPathValidatorException("Certificate has unsupported critical extension: ".concat(String.valueOf(set)), null, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void prepareNextCertN(CertPath certPath, int i) throws CertPathValidatorException {
|
||
|
|
boolean[] keyUsage = ((X509Certificate) certPath.getCertificates().get(i)).getKeyUsage();
|
||
|
|
if (keyUsage != null && !keyUsage[5]) {
|
||
|
|
throw new ExtCertPathValidatorException("Issuer certificate keyusage extension is critical and does not permit key signing.", null, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static int prepareNextCertM(CertPath certPath, int i, int i2) throws CertPathValidatorException {
|
||
|
|
BigInteger pathLenConstraint;
|
||
|
|
int intValue;
|
||
|
|
try {
|
||
|
|
BasicConstraints basicConstraints = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), BASIC_CONSTRAINTS));
|
||
|
|
return (basicConstraints == null || (pathLenConstraint = basicConstraints.getPathLenConstraint()) == null || (intValue = pathLenConstraint.intValue()) >= i2) ? i2 : intValue;
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new ExtCertPathValidatorException("Basic constraints extension cannot be decoded.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static int prepareNextCertL(CertPath certPath, int i, int i2) throws CertPathValidatorException {
|
||
|
|
if (CertPathValidatorUtilities.isSelfIssued((X509Certificate) certPath.getCertificates().get(i))) {
|
||
|
|
return i2;
|
||
|
|
}
|
||
|
|
if (i2 > 0) {
|
||
|
|
return i2 - 1;
|
||
|
|
}
|
||
|
|
throw new ExtCertPathValidatorException("Max path length not greater than zero", null, certPath, i);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void prepareNextCertK(CertPath certPath, int i) throws CertPathValidatorException {
|
||
|
|
try {
|
||
|
|
BasicConstraints basicConstraints = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), BASIC_CONSTRAINTS));
|
||
|
|
if (basicConstraints == null) {
|
||
|
|
throw new CertPathValidatorException("Intermediate certificate lacks BasicConstraints");
|
||
|
|
}
|
||
|
|
if (!basicConstraints.isCA()) {
|
||
|
|
throw new CertPathValidatorException("Not a CA certificate");
|
||
|
|
}
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new ExtCertPathValidatorException("Basic constraints extension cannot be decoded.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static int prepareNextCertJ(CertPath certPath, int i, int i2) throws CertPathValidatorException {
|
||
|
|
int intValue;
|
||
|
|
try {
|
||
|
|
ASN1Integer aSN1Integer = ASN1Integer.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), INHIBIT_ANY_POLICY));
|
||
|
|
return (aSN1Integer == null || (intValue = aSN1Integer.getValue().intValue()) >= i2) ? i2 : intValue;
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new ExtCertPathValidatorException("Inhibit any-policy extension cannot be decoded.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:12:0x002f, code lost:
|
||
|
|
|
||
|
|
r4 = org.bouncycastle.asn1.ASN1Integer.getInstance(r1, false).getValue().intValue();
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:13:0x003c, code lost:
|
||
|
|
|
||
|
|
if (r4 >= r6) goto L16;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:14:0x003e, code lost:
|
||
|
|
|
||
|
|
return r4;
|
||
|
|
*/
|
||
|
|
/*
|
||
|
|
Code decompiled incorrectly, please refer to instructions dump.
|
||
|
|
To view partially-correct add '--show-bad-code' argument
|
||
|
|
*/
|
||
|
|
public static int prepareNextCertI2(java.security.cert.CertPath r4, int r5, int r6) throws java.security.cert.CertPathValidatorException {
|
||
|
|
/*
|
||
|
|
java.util.List r0 = r4.getCertificates()
|
||
|
|
java.lang.Object r0 = r0.get(r5)
|
||
|
|
java.security.cert.X509Certificate r0 = (java.security.cert.X509Certificate) r0
|
||
|
|
java.lang.String r1 = org.bouncycastle.jce.provider.RFC3280CertPathUtilities.POLICY_CONSTRAINTS // Catch: java.lang.Exception -> L49
|
||
|
|
org.bouncycastle.asn1.ASN1Primitive r0 = org.bouncycastle.jce.provider.CertPathValidatorUtilities.getExtensionValue(r0, r1) // Catch: java.lang.Exception -> L49
|
||
|
|
org.bouncycastle.asn1.ASN1Sequence r0 = org.bouncycastle.asn1.DERSequence.getInstance(r0) // Catch: java.lang.Exception -> L49
|
||
|
|
if (r0 == 0) goto L48
|
||
|
|
java.util.Enumeration r0 = r0.getObjects()
|
||
|
|
L1a:
|
||
|
|
boolean r1 = r0.hasMoreElements()
|
||
|
|
if (r1 == 0) goto L48
|
||
|
|
java.lang.Object r1 = r0.nextElement() // Catch: java.lang.IllegalArgumentException -> L3f
|
||
|
|
org.bouncycastle.asn1.ASN1TaggedObject r1 = org.bouncycastle.asn1.ASN1TaggedObject.getInstance(r1) // Catch: java.lang.IllegalArgumentException -> L3f
|
||
|
|
int r2 = r1.getTagNo() // Catch: java.lang.IllegalArgumentException -> L3f
|
||
|
|
r3 = 1
|
||
|
|
if (r2 != r3) goto L1a
|
||
|
|
r0 = 0
|
||
|
|
org.bouncycastle.asn1.ASN1Integer r0 = org.bouncycastle.asn1.ASN1Integer.getInstance(r1, r0) // Catch: java.lang.IllegalArgumentException -> L3f
|
||
|
|
java.math.BigInteger r0 = r0.getValue() // Catch: java.lang.IllegalArgumentException -> L3f
|
||
|
|
int r4 = r0.intValue() // Catch: java.lang.IllegalArgumentException -> L3f
|
||
|
|
if (r4 >= r6) goto L48
|
||
|
|
return r4
|
||
|
|
L3f:
|
||
|
|
r6 = move-exception
|
||
|
|
org.bouncycastle.jce.exception.ExtCertPathValidatorException r0 = new org.bouncycastle.jce.exception.ExtCertPathValidatorException
|
||
|
|
java.lang.String r1 = "Policy constraints extension contents cannot be decoded."
|
||
|
|
r0.<init>(r1, r6, r4, r5)
|
||
|
|
throw r0
|
||
|
|
L48:
|
||
|
|
return r6
|
||
|
|
L49:
|
||
|
|
r6 = move-exception
|
||
|
|
org.bouncycastle.jce.exception.ExtCertPathValidatorException r0 = new org.bouncycastle.jce.exception.ExtCertPathValidatorException
|
||
|
|
java.lang.String r1 = "Policy constraints extension cannot be decoded."
|
||
|
|
r0.<init>(r1, r6, r4, r5)
|
||
|
|
throw r0
|
||
|
|
*/
|
||
|
|
throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.prepareNextCertI2(java.security.cert.CertPath, int, int):int");
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:12:0x002e, code lost:
|
||
|
|
|
||
|
|
r3 = org.bouncycastle.asn1.ASN1Integer.getInstance(r1, false).getValue().intValue();
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:13:0x003b, code lost:
|
||
|
|
|
||
|
|
if (r3 >= r5) goto L16;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:14:0x003d, code lost:
|
||
|
|
|
||
|
|
return r3;
|
||
|
|
*/
|
||
|
|
/*
|
||
|
|
Code decompiled incorrectly, please refer to instructions dump.
|
||
|
|
To view partially-correct add '--show-bad-code' argument
|
||
|
|
*/
|
||
|
|
public static int prepareNextCertI1(java.security.cert.CertPath r3, int r4, int r5) throws java.security.cert.CertPathValidatorException {
|
||
|
|
/*
|
||
|
|
java.util.List r0 = r3.getCertificates()
|
||
|
|
java.lang.Object r0 = r0.get(r4)
|
||
|
|
java.security.cert.X509Certificate r0 = (java.security.cert.X509Certificate) r0
|
||
|
|
java.lang.String r1 = org.bouncycastle.jce.provider.RFC3280CertPathUtilities.POLICY_CONSTRAINTS // Catch: java.lang.Exception -> L48
|
||
|
|
org.bouncycastle.asn1.ASN1Primitive r0 = org.bouncycastle.jce.provider.CertPathValidatorUtilities.getExtensionValue(r0, r1) // Catch: java.lang.Exception -> L48
|
||
|
|
org.bouncycastle.asn1.ASN1Sequence r0 = org.bouncycastle.asn1.DERSequence.getInstance(r0) // Catch: java.lang.Exception -> L48
|
||
|
|
if (r0 == 0) goto L47
|
||
|
|
java.util.Enumeration r0 = r0.getObjects()
|
||
|
|
L1a:
|
||
|
|
boolean r1 = r0.hasMoreElements()
|
||
|
|
if (r1 == 0) goto L47
|
||
|
|
java.lang.Object r1 = r0.nextElement() // Catch: java.lang.IllegalArgumentException -> L3e
|
||
|
|
org.bouncycastle.asn1.ASN1TaggedObject r1 = org.bouncycastle.asn1.ASN1TaggedObject.getInstance(r1) // Catch: java.lang.IllegalArgumentException -> L3e
|
||
|
|
int r2 = r1.getTagNo() // Catch: java.lang.IllegalArgumentException -> L3e
|
||
|
|
if (r2 != 0) goto L1a
|
||
|
|
r0 = 0
|
||
|
|
org.bouncycastle.asn1.ASN1Integer r0 = org.bouncycastle.asn1.ASN1Integer.getInstance(r1, r0) // Catch: java.lang.IllegalArgumentException -> L3e
|
||
|
|
java.math.BigInteger r0 = r0.getValue() // Catch: java.lang.IllegalArgumentException -> L3e
|
||
|
|
int r3 = r0.intValue() // Catch: java.lang.IllegalArgumentException -> L3e
|
||
|
|
if (r3 >= r5) goto L47
|
||
|
|
return r3
|
||
|
|
L3e:
|
||
|
|
r5 = move-exception
|
||
|
|
org.bouncycastle.jce.exception.ExtCertPathValidatorException r0 = new org.bouncycastle.jce.exception.ExtCertPathValidatorException
|
||
|
|
java.lang.String r1 = "Policy constraints extension contents cannot be decoded."
|
||
|
|
r0.<init>(r1, r5, r3, r4)
|
||
|
|
throw r0
|
||
|
|
L47:
|
||
|
|
return r5
|
||
|
|
L48:
|
||
|
|
r5 = move-exception
|
||
|
|
org.bouncycastle.jce.exception.ExtCertPathValidatorException r0 = new org.bouncycastle.jce.exception.ExtCertPathValidatorException
|
||
|
|
java.lang.String r1 = "Policy constraints extension cannot be decoded."
|
||
|
|
r0.<init>(r1, r5, r3, r4)
|
||
|
|
throw r0
|
||
|
|
*/
|
||
|
|
throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.prepareNextCertI1(java.security.cert.CertPath, int, int):int");
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static int prepareNextCertH3(CertPath certPath, int i, int i2) {
|
||
|
|
return (CertPathValidatorUtilities.isSelfIssued((X509Certificate) certPath.getCertificates().get(i)) || i2 == 0) ? i2 : i2 - 1;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static int prepareNextCertH2(CertPath certPath, int i, int i2) {
|
||
|
|
return (CertPathValidatorUtilities.isSelfIssued((X509Certificate) certPath.getCertificates().get(i)) || i2 == 0) ? i2 : i2 - 1;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static int prepareNextCertH1(CertPath certPath, int i, int i2) {
|
||
|
|
return (CertPathValidatorUtilities.isSelfIssued((X509Certificate) certPath.getCertificates().get(i)) || i2 == 0) ? i2 : i2 - 1;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void prepareNextCertG(CertPath certPath, int i, PKIXNameConstraintValidator pKIXNameConstraintValidator) throws CertPathValidatorException {
|
||
|
|
try {
|
||
|
|
ASN1Sequence dERSequence = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), NAME_CONSTRAINTS));
|
||
|
|
NameConstraints nameConstraints = dERSequence != null ? NameConstraints.getInstance(dERSequence) : null;
|
||
|
|
if (nameConstraints != null) {
|
||
|
|
GeneralSubtree[] permittedSubtrees = nameConstraints.getPermittedSubtrees();
|
||
|
|
if (permittedSubtrees != null) {
|
||
|
|
try {
|
||
|
|
pKIXNameConstraintValidator.intersectPermittedSubtree(permittedSubtrees);
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new ExtCertPathValidatorException("Permitted subtrees cannot be build from name constraints extension.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
GeneralSubtree[] excludedSubtrees = nameConstraints.getExcludedSubtrees();
|
||
|
|
if (excludedSubtrees != null) {
|
||
|
|
for (int i2 = 0; i2 != excludedSubtrees.length; i2++) {
|
||
|
|
try {
|
||
|
|
pKIXNameConstraintValidator.addExcludedSubtree(excludedSubtrees[i2]);
|
||
|
|
} catch (Exception e2) {
|
||
|
|
throw new ExtCertPathValidatorException("Excluded subtrees cannot be build from name constraints extension.", e2, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (Exception e3) {
|
||
|
|
throw new ExtCertPathValidatorException("Name constraints extension could not be decoded.", e3, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void prepareNextCertA(CertPath certPath, int i) throws CertPathValidatorException {
|
||
|
|
try {
|
||
|
|
ASN1Sequence dERSequence = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), POLICY_MAPPINGS));
|
||
|
|
if (dERSequence != null) {
|
||
|
|
for (int i2 = 0; i2 < dERSequence.size(); i2++) {
|
||
|
|
try {
|
||
|
|
ASN1Sequence dERSequence2 = DERSequence.getInstance(dERSequence.getObjectAt(i2));
|
||
|
|
ASN1ObjectIdentifier aSN1ObjectIdentifier = ASN1ObjectIdentifier.getInstance(dERSequence2.getObjectAt(0));
|
||
|
|
ASN1ObjectIdentifier aSN1ObjectIdentifier2 = ASN1ObjectIdentifier.getInstance(dERSequence2.getObjectAt(1));
|
||
|
|
if (ANY_POLICY.equals(aSN1ObjectIdentifier.getId())) {
|
||
|
|
throw new CertPathValidatorException("IssuerDomainPolicy is anyPolicy", null, certPath, i);
|
||
|
|
}
|
||
|
|
if (ANY_POLICY.equals(aSN1ObjectIdentifier2.getId())) {
|
||
|
|
throw new CertPathValidatorException("SubjectDomainPolicy is anyPolicy,", null, certPath, i);
|
||
|
|
}
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new ExtCertPathValidatorException("Policy mappings extension contents could not be decoded.", e, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (AnnotatedException e2) {
|
||
|
|
throw new ExtCertPathValidatorException("Policy mappings extension could not be decoded.", e2, certPath, i);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:32:0x00aa, code lost:
|
||
|
|
|
||
|
|
r5 = r20[r3].iterator();
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:34:0x00b4, code lost:
|
||
|
|
|
||
|
|
if (r5.hasNext() == false) goto L92;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:35:0x00b6, code lost:
|
||
|
|
|
||
|
|
r6 = (org.bouncycastle.jce.provider.PKIXPolicyNode) r5.next();
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:36:0x00c6, code lost:
|
||
|
|
|
||
|
|
if (org.bouncycastle.jce.provider.RFC3280CertPathUtilities.ANY_POLICY.equals(r6.getValidPolicy()) == false) goto L100;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:39:0x00d0, code lost:
|
||
|
|
|
||
|
|
r5 = ((org.bouncycastle.asn1.ASN1Sequence) org.bouncycastle.jce.provider.CertPathValidatorUtilities.getExtensionValue(r4, org.bouncycastle.jce.provider.RFC3280CertPathUtilities.CERTIFICATE_POLICIES)).getObjects();
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:41:0x00d8, code lost:
|
||
|
|
|
||
|
|
if (r5.hasMoreElements() == false) goto L101;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:43:0x00da, code lost:
|
||
|
|
|
||
|
|
r7 = org.bouncycastle.asn1.x509.PolicyInformation.getInstance(r5.nextElement());
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:45:0x00ee, code lost:
|
||
|
|
|
||
|
|
if (org.bouncycastle.jce.provider.RFC3280CertPathUtilities.ANY_POLICY.equals(r7.getPolicyIdentifier().getId()) == false) goto L102;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:47:0x00f0, code lost:
|
||
|
|
|
||
|
|
r5 = org.bouncycastle.jce.provider.CertPathValidatorUtilities.getQualifierSet(r7.getPolicyQualifiers());
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:48:0x010c, code lost:
|
||
|
|
|
||
|
|
r10 = r5;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:49:0x0111, code lost:
|
||
|
|
|
||
|
|
if (r4.getCriticalExtensionOIDs() == null) goto L48;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:50:0x0113, code lost:
|
||
|
|
|
||
|
|
r12 = r4.getCriticalExtensionOIDs().contains(org.bouncycastle.jce.provider.RFC3280CertPathUtilities.CERTIFICATE_POLICIES);
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:51:0x0120, code lost:
|
||
|
|
|
||
|
|
r9 = (org.bouncycastle.jce.provider.PKIXPolicyNode) r6.getParent();
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:52:0x012f, code lost:
|
||
|
|
|
||
|
|
if (org.bouncycastle.jce.provider.RFC3280CertPathUtilities.ANY_POLICY.equals(r9.getValidPolicy()) == false) goto L93;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:53:0x0131, code lost:
|
||
|
|
|
||
|
|
r8 = new org.bouncycastle.jce.provider.PKIXPolicyNode(new java.util.ArrayList(), r3, (java.util.Set) r13.get(r11), r9, r10, r11, r12);
|
||
|
|
r9.addChild(r8);
|
||
|
|
r20[r3].add(r8);
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:56:0x011f, code lost:
|
||
|
|
|
||
|
|
r12 = r14;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:58:0x00f9, code lost:
|
||
|
|
|
||
|
|
r0 = move-exception;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:60:0x0101, code lost:
|
||
|
|
|
||
|
|
throw new org.bouncycastle.jce.exception.ExtCertPathValidatorException("Policy qualifier info set could not be decoded.", r0, r18, r19);
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:64:0x0102, code lost:
|
||
|
|
|
||
|
|
r0 = move-exception;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:66:0x010a, code lost:
|
||
|
|
|
||
|
|
throw new java.security.cert.CertPathValidatorException("Policy information could not be decoded.", r0, r18, r19);
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:68:0x010b, code lost:
|
||
|
|
|
||
|
|
r5 = null;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:70:0x0155, code lost:
|
||
|
|
|
||
|
|
r0 = move-exception;
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:72:0x015d, code lost:
|
||
|
|
|
||
|
|
throw new org.bouncycastle.jce.exception.ExtCertPathValidatorException("Certificate policies extension could not be decoded.", r0, r18, r19);
|
||
|
|
*/
|
||
|
|
/* JADX WARN: Code restructure failed: missing block: B:74:0x01b2, code lost:
|
||
|
|
|
||
|
|
continue;
|
||
|
|
*/
|
||
|
|
/*
|
||
|
|
Code decompiled incorrectly, please refer to instructions dump.
|
||
|
|
To view partially-correct add '--show-bad-code' argument
|
||
|
|
*/
|
||
|
|
public static org.bouncycastle.jce.provider.PKIXPolicyNode prepareCertB(java.security.cert.CertPath r18, int r19, java.util.List[] r20, org.bouncycastle.jce.provider.PKIXPolicyNode r21, int r22) throws java.security.cert.CertPathValidatorException {
|
||
|
|
/*
|
||
|
|
Method dump skipped, instructions count: 449
|
||
|
|
To view this dump add '--comments-level debug' option
|
||
|
|
*/
|
||
|
|
throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.prepareCertB(java.security.cert.CertPath, int, java.util.List[], org.bouncycastle.jce.provider.PKIXPolicyNode, int):org.bouncycastle.jce.provider.PKIXPolicyNode");
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX WARN: Removed duplicated region for block: B:21:0x00fc */
|
||
|
|
/* JADX WARN: Removed duplicated region for block: B:27:0x0109 */
|
||
|
|
/*
|
||
|
|
Code decompiled incorrectly, please refer to instructions dump.
|
||
|
|
To view partially-correct add '--show-bad-code' argument
|
||
|
|
*/
|
||
|
|
protected static void checkCRLs(org.bouncycastle.jcajce.PKIXExtendedParameters r20, java.security.cert.X509Certificate r21, java.util.Date r22, java.security.cert.X509Certificate r23, java.security.PublicKey r24, java.util.List r25, org.bouncycastle.jcajce.util.JcaJceHelper r26) throws org.bouncycastle.jce.provider.AnnotatedException {
|
||
|
|
/*
|
||
|
|
Method dump skipped, instructions count: 393
|
||
|
|
To view this dump add '--comments-level debug' option
|
||
|
|
*/
|
||
|
|
throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.checkCRLs(org.bouncycastle.jcajce.PKIXExtendedParameters, java.security.cert.X509Certificate, java.util.Date, java.security.cert.X509Certificate, java.security.PublicKey, java.util.List, org.bouncycastle.jcajce.util.JcaJceHelper):void");
|
||
|
|
}
|
||
|
|
|
||
|
|
private static void checkCRL(DistributionPoint distributionPoint, PKIXExtendedParameters pKIXExtendedParameters, X509Certificate x509Certificate, Date date, X509Certificate x509Certificate2, PublicKey publicKey, CertStatus certStatus, ReasonsMask reasonsMask, List list, JcaJceHelper jcaJceHelper) throws AnnotatedException {
|
||
|
|
Date date2;
|
||
|
|
Iterator it;
|
||
|
|
Set<String> criticalExtensionOIDs;
|
||
|
|
Date date3 = new Date(System.currentTimeMillis());
|
||
|
|
if (date.getTime() > date3.getTime()) {
|
||
|
|
throw new AnnotatedException("Validation time is in future.");
|
||
|
|
}
|
||
|
|
Iterator it2 = CertPathValidatorUtilities.getCompleteCRLs(distributionPoint, x509Certificate, date3, pKIXExtendedParameters).iterator();
|
||
|
|
boolean z = false;
|
||
|
|
AnnotatedException e = null;
|
||
|
|
while (it2.hasNext() && certStatus.getCertStatus() == 11 && !reasonsMask.isAllReasons()) {
|
||
|
|
try {
|
||
|
|
X509CRL x509crl = (X509CRL) it2.next();
|
||
|
|
ReasonsMask processCRLD = processCRLD(x509crl, distributionPoint);
|
||
|
|
if (processCRLD.hasNewReasons(reasonsMask)) {
|
||
|
|
date2 = date3;
|
||
|
|
it = it2;
|
||
|
|
AnnotatedException annotatedException = e;
|
||
|
|
try {
|
||
|
|
X509CRL processCRLH = pKIXExtendedParameters.isUseDeltasEnabled() ? processCRLH(CertPathValidatorUtilities.getDeltaCRLs(pKIXExtendedParameters.getDate() != null ? pKIXExtendedParameters.getDate() : date2, x509crl, pKIXExtendedParameters.getCertStores(), pKIXExtendedParameters.getCRLStores()), processCRLG(x509crl, processCRLF(x509crl, x509Certificate, x509Certificate2, publicKey, pKIXExtendedParameters, list, jcaJceHelper))) : null;
|
||
|
|
if (pKIXExtendedParameters.getValidityModel() != 1 && x509Certificate.getNotAfter().getTime() < x509crl.getThisUpdate().getTime()) {
|
||
|
|
throw new AnnotatedException("No valid CRL for current time found.");
|
||
|
|
}
|
||
|
|
processCRLB1(distributionPoint, x509Certificate, x509crl);
|
||
|
|
processCRLB2(distributionPoint, x509Certificate, x509crl);
|
||
|
|
processCRLC(processCRLH, x509crl, pKIXExtendedParameters);
|
||
|
|
processCRLI(date, processCRLH, x509Certificate, certStatus, pKIXExtendedParameters);
|
||
|
|
processCRLJ(date, x509crl, x509Certificate, certStatus);
|
||
|
|
if (certStatus.getCertStatus() == 8) {
|
||
|
|
certStatus.setCertStatus(11);
|
||
|
|
}
|
||
|
|
reasonsMask.addReasons(processCRLD);
|
||
|
|
Set<String> criticalExtensionOIDs2 = x509crl.getCriticalExtensionOIDs();
|
||
|
|
if (criticalExtensionOIDs2 != null) {
|
||
|
|
HashSet hashSet = new HashSet(criticalExtensionOIDs2);
|
||
|
|
hashSet.remove(Extension.issuingDistributionPoint.getId());
|
||
|
|
hashSet.remove(Extension.deltaCRLIndicator.getId());
|
||
|
|
if (!hashSet.isEmpty()) {
|
||
|
|
throw new AnnotatedException("CRL contains unsupported critical extensions.");
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (processCRLH != null && (criticalExtensionOIDs = processCRLH.getCriticalExtensionOIDs()) != null) {
|
||
|
|
HashSet hashSet2 = new HashSet(criticalExtensionOIDs);
|
||
|
|
hashSet2.remove(Extension.issuingDistributionPoint.getId());
|
||
|
|
hashSet2.remove(Extension.deltaCRLIndicator.getId());
|
||
|
|
if (!hashSet2.isEmpty()) {
|
||
|
|
throw new AnnotatedException("Delta CRL contains unsupported critical extension.");
|
||
|
|
}
|
||
|
|
}
|
||
|
|
z = true;
|
||
|
|
date3 = date2;
|
||
|
|
it2 = it;
|
||
|
|
e = annotatedException;
|
||
|
|
} catch (AnnotatedException e2) {
|
||
|
|
e = e2;
|
||
|
|
date3 = date2;
|
||
|
|
it2 = it;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (AnnotatedException e3) {
|
||
|
|
e = e3;
|
||
|
|
date2 = date3;
|
||
|
|
it = it2;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
AnnotatedException annotatedException2 = e;
|
||
|
|
if (!z) {
|
||
|
|
throw annotatedException2;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
RFC3280CertPathUtilities() {
|
||
|
|
}
|
||
|
|
}
|