101 lines
3.9 KiB
Java
101 lines
3.9 KiB
Java
|
package okhttp3.internal.tls;
|
||
|
|
|
||
|
|
import java.security.GeneralSecurityException;
|
||
|
|
import java.security.cert.Certificate;
|
||
|
|
import java.security.cert.X509Certificate;
|
||
|
|
import java.util.ArrayDeque;
|
||
|
|
import java.util.ArrayList;
|
||
|
|
import java.util.Iterator;
|
||
|
|
import java.util.List;
|
||
|
|
import javax.net.ssl.SSLPeerUnverifiedException;
|
||
|
|
import o.C14953gcr;
|
||
|
|
import o.C14957gcv;
|
||
|
|
|
||
|
|
/* loaded from: classes.dex */
|
||
|
|
public final class BasicCertificateChainCleaner extends CertificateChainCleaner {
|
||
|
|
public static final Companion Companion = new Companion(null);
|
||
|
|
private static final int MAX_SIGNERS = 9;
|
||
|
|
private final TrustRootIndex trustRootIndex;
|
||
|
|
|
||
|
|
public BasicCertificateChainCleaner(TrustRootIndex trustRootIndex) {
|
||
|
|
C14957gcv.e(trustRootIndex, "");
|
||
|
|
this.trustRootIndex = trustRootIndex;
|
||
|
|
}
|
||
|
|
|
||
|
|
@Override // okhttp3.internal.tls.CertificateChainCleaner
|
||
|
|
public final List<Certificate> clean(List<? extends Certificate> list, String str) throws SSLPeerUnverifiedException {
|
||
|
|
C14957gcv.e(list, "");
|
||
|
|
C14957gcv.e(str, "");
|
||
|
|
ArrayDeque arrayDeque = new ArrayDeque(list);
|
||
|
|
ArrayList arrayList = new ArrayList();
|
||
|
|
Object removeFirst = arrayDeque.removeFirst();
|
||
|
|
C14957gcv.c(removeFirst, "");
|
||
|
|
arrayList.add(removeFirst);
|
||
|
|
int i = 0;
|
||
|
|
boolean z = false;
|
||
|
|
while (i < 9) {
|
||
|
|
i++;
|
||
|
|
X509Certificate x509Certificate = (X509Certificate) arrayList.get(arrayList.size() - 1);
|
||
|
|
X509Certificate findByIssuerAndSignature = this.trustRootIndex.findByIssuerAndSignature(x509Certificate);
|
||
|
|
if (findByIssuerAndSignature != null) {
|
||
|
|
if (arrayList.size() > 1 || !C14957gcv.b(x509Certificate, findByIssuerAndSignature)) {
|
||
|
|
arrayList.add(findByIssuerAndSignature);
|
||
|
|
}
|
||
|
|
if (verifySignature(findByIssuerAndSignature, findByIssuerAndSignature)) {
|
||
|
|
return arrayList;
|
||
|
|
}
|
||
|
|
z = true;
|
||
|
|
} else {
|
||
|
|
Iterator it = arrayDeque.iterator();
|
||
|
|
C14957gcv.c(it, "");
|
||
|
|
while (it.hasNext()) {
|
||
|
|
Object next = it.next();
|
||
|
|
if (next == null) {
|
||
|
|
throw new NullPointerException("null cannot be cast to non-null type java.security.cert.X509Certificate");
|
||
|
|
}
|
||
|
|
X509Certificate x509Certificate2 = (X509Certificate) next;
|
||
|
|
if (verifySignature(x509Certificate, x509Certificate2)) {
|
||
|
|
it.remove();
|
||
|
|
arrayList.add(x509Certificate2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (z) {
|
||
|
|
return arrayList;
|
||
|
|
}
|
||
|
|
throw new SSLPeerUnverifiedException(C14957gcv.c("Failed to find a trusted cert that signed ", x509Certificate));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
throw new SSLPeerUnverifiedException(C14957gcv.c("Certificate chain too long: ", arrayList));
|
||
|
|
}
|
||
|
|
|
||
|
|
private final boolean verifySignature(X509Certificate x509Certificate, X509Certificate x509Certificate2) {
|
||
|
|
if (!C14957gcv.b(x509Certificate.getIssuerDN(), x509Certificate2.getSubjectDN())) {
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
try {
|
||
|
|
x509Certificate.verify(x509Certificate2.getPublicKey());
|
||
|
|
return true;
|
||
|
|
} catch (GeneralSecurityException unused) {
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
public final int hashCode() {
|
||
|
|
return this.trustRootIndex.hashCode();
|
||
|
|
}
|
||
|
|
|
||
|
|
public final boolean equals(Object obj) {
|
||
|
|
return obj == this || ((obj instanceof BasicCertificateChainCleaner) && C14957gcv.b(((BasicCertificateChainCleaner) obj).trustRootIndex, this.trustRootIndex));
|
||
|
|
}
|
||
|
|
|
||
|
|
/* loaded from: classes.dex */
|
||
|
|
public static final class Companion {
|
||
|
|
private Companion() {
|
||
|
|
}
|
||
|
|
|
||
|
|
public /* synthetic */ Companion(C14953gcr c14953gcr) {
|
||
|
|
this();
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|