654 lines
33 KiB
Java
654 lines
33 KiB
Java
|
package org.bouncycastle.jce.provider;
|
||
|
|
|
||
|
|
import com.huawei.hms.android.SystemUtils;
|
||
|
|
import java.io.ByteArrayOutputStream;
|
||
|
|
import java.io.IOException;
|
||
|
|
import java.math.BigInteger;
|
||
|
|
import java.security.GeneralSecurityException;
|
||
|
|
import java.security.PublicKey;
|
||
|
|
import java.security.cert.CRL;
|
||
|
|
import java.security.cert.CRLException;
|
||
|
|
import java.security.cert.CertPath;
|
||
|
|
import java.security.cert.CertPathValidatorException;
|
||
|
|
import java.security.cert.CertStore;
|
||
|
|
import java.security.cert.CertStoreException;
|
||
|
|
import java.security.cert.Certificate;
|
||
|
|
import java.security.cert.CertificateParsingException;
|
||
|
|
import java.security.cert.PolicyQualifierInfo;
|
||
|
|
import java.security.cert.TrustAnchor;
|
||
|
|
import java.security.cert.X509CRL;
|
||
|
|
import java.security.cert.X509CRLEntry;
|
||
|
|
import java.security.cert.X509CRLSelector;
|
||
|
|
import java.security.cert.X509CertSelector;
|
||
|
|
import java.security.cert.X509Certificate;
|
||
|
|
import java.security.cert.X509Extension;
|
||
|
|
import java.security.interfaces.DSAParams;
|
||
|
|
import java.security.interfaces.DSAPublicKey;
|
||
|
|
import java.security.spec.DSAPublicKeySpec;
|
||
|
|
import java.text.ParseException;
|
||
|
|
import java.util.ArrayList;
|
||
|
|
import java.util.Collection;
|
||
|
|
import java.util.Collections;
|
||
|
|
import java.util.Date;
|
||
|
|
import java.util.Enumeration;
|
||
|
|
import java.util.HashSet;
|
||
|
|
import java.util.Iterator;
|
||
|
|
import java.util.LinkedHashSet;
|
||
|
|
import java.util.List;
|
||
|
|
import java.util.Map;
|
||
|
|
import java.util.Set;
|
||
|
|
import javax.security.auth.x500.X500Principal;
|
||
|
|
import org.bouncycastle.asn1.ASN1Encodable;
|
||
|
|
import org.bouncycastle.asn1.ASN1Enumerated;
|
||
|
|
import org.bouncycastle.asn1.ASN1GeneralizedTime;
|
||
|
|
import org.bouncycastle.asn1.ASN1InputStream;
|
||
|
|
import org.bouncycastle.asn1.ASN1Integer;
|
||
|
|
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
|
||
|
|
import org.bouncycastle.asn1.ASN1OctetString;
|
||
|
|
import org.bouncycastle.asn1.ASN1OutputStream;
|
||
|
|
import org.bouncycastle.asn1.ASN1Primitive;
|
||
|
|
import org.bouncycastle.asn1.ASN1Sequence;
|
||
|
|
import org.bouncycastle.asn1.DEROctetString;
|
||
|
|
import org.bouncycastle.asn1.DERSequence;
|
||
|
|
import org.bouncycastle.asn1.isismtt.ISISMTTObjectIdentifiers;
|
||
|
|
import org.bouncycastle.asn1.x500.X500Name;
|
||
|
|
import org.bouncycastle.asn1.x500.style.RFC4519Style;
|
||
|
|
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
|
||
|
|
import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier;
|
||
|
|
import org.bouncycastle.asn1.x509.CRLDistPoint;
|
||
|
|
import org.bouncycastle.asn1.x509.DistributionPoint;
|
||
|
|
import org.bouncycastle.asn1.x509.DistributionPointName;
|
||
|
|
import org.bouncycastle.asn1.x509.Extension;
|
||
|
|
import org.bouncycastle.asn1.x509.GeneralName;
|
||
|
|
import org.bouncycastle.asn1.x509.GeneralNames;
|
||
|
|
import org.bouncycastle.asn1.x509.PolicyInformation;
|
||
|
|
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
|
||
|
|
import org.bouncycastle.jcajce.PKIXCRLStore;
|
||
|
|
import org.bouncycastle.jcajce.PKIXCRLStoreSelector;
|
||
|
|
import org.bouncycastle.jcajce.PKIXCertStore;
|
||
|
|
import org.bouncycastle.jcajce.PKIXCertStoreSelector;
|
||
|
|
import org.bouncycastle.jcajce.PKIXExtendedParameters;
|
||
|
|
import org.bouncycastle.jcajce.util.JcaJceHelper;
|
||
|
|
import org.bouncycastle.jce.exception.ExtCertPathValidatorException;
|
||
|
|
import org.bouncycastle.util.Store;
|
||
|
|
import org.bouncycastle.util.StoreException;
|
||
|
|
import org.bouncycastle.x509.X509AttributeCertificate;
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: package-private */
|
||
|
|
/* loaded from: classes6.dex */
|
||
|
|
public class CertPathValidatorUtilities {
|
||
|
|
protected static final String ANY_POLICY = "2.5.29.32.0";
|
||
|
|
protected static final int CRL_SIGN = 6;
|
||
|
|
protected static final int KEY_CERT_SIGN = 5;
|
||
|
|
protected static final PKIXCRLUtil CRL_UTIL = new PKIXCRLUtil();
|
||
|
|
protected static final String CERTIFICATE_POLICIES = Extension.certificatePolicies.getId();
|
||
|
|
protected static final String BASIC_CONSTRAINTS = Extension.basicConstraints.getId();
|
||
|
|
protected static final String POLICY_MAPPINGS = Extension.policyMappings.getId();
|
||
|
|
protected static final String SUBJECT_ALTERNATIVE_NAME = Extension.subjectAlternativeName.getId();
|
||
|
|
protected static final String NAME_CONSTRAINTS = Extension.nameConstraints.getId();
|
||
|
|
protected static final String KEY_USAGE = Extension.keyUsage.getId();
|
||
|
|
protected static final String INHIBIT_ANY_POLICY = Extension.inhibitAnyPolicy.getId();
|
||
|
|
protected static final String ISSUING_DISTRIBUTION_POINT = Extension.issuingDistributionPoint.getId();
|
||
|
|
protected static final String DELTA_CRL_INDICATOR = Extension.deltaCRLIndicator.getId();
|
||
|
|
protected static final String POLICY_CONSTRAINTS = Extension.policyConstraints.getId();
|
||
|
|
protected static final String FRESHEST_CRL = Extension.freshestCRL.getId();
|
||
|
|
protected static final String CRL_DISTRIBUTION_POINTS = Extension.cRLDistributionPoints.getId();
|
||
|
|
protected static final String AUTHORITY_KEY_IDENTIFIER = Extension.authorityKeyIdentifier.getId();
|
||
|
|
protected static final String CRL_NUMBER = Extension.cRLNumber.getId();
|
||
|
|
protected static final String[] crlReasons = {"unspecified", "keyCompromise", "cACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", SystemUtils.UNKNOWN, "removeFromCRL", "privilegeWithdrawn", "aACompromise"};
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void verifyX509Certificate(X509Certificate x509Certificate, PublicKey publicKey, String str) throws GeneralSecurityException {
|
||
|
|
if (str == null) {
|
||
|
|
x509Certificate.verify(publicKey);
|
||
|
|
} else {
|
||
|
|
x509Certificate.verify(publicKey, str);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
private static void removePolicyNodeRecurse(List[] listArr, PKIXPolicyNode pKIXPolicyNode) {
|
||
|
|
listArr[pKIXPolicyNode.getDepth()].remove(pKIXPolicyNode);
|
||
|
|
if (pKIXPolicyNode.hasChildren()) {
|
||
|
|
Iterator children = pKIXPolicyNode.getChildren();
|
||
|
|
while (children.hasNext()) {
|
||
|
|
removePolicyNodeRecurse(listArr, (PKIXPolicyNode) children.next());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static PKIXPolicyNode removePolicyNode(PKIXPolicyNode pKIXPolicyNode, List[] listArr, PKIXPolicyNode pKIXPolicyNode2) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) pKIXPolicyNode2.getParent();
|
||
|
|
if (pKIXPolicyNode == null) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
if (pKIXPolicyNode3 != null) {
|
||
|
|
pKIXPolicyNode3.removeChild(pKIXPolicyNode2);
|
||
|
|
removePolicyNodeRecurse(listArr, pKIXPolicyNode2);
|
||
|
|
return pKIXPolicyNode;
|
||
|
|
}
|
||
|
|
for (int i = 0; i < listArr.length; i++) {
|
||
|
|
listArr[i] = new ArrayList();
|
||
|
|
}
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void processCertD1ii(int i, List[] listArr, ASN1ObjectIdentifier aSN1ObjectIdentifier, Set set) {
|
||
|
|
List list = listArr[i - 1];
|
||
|
|
for (int i2 = 0; i2 < list.size(); i2++) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode = (PKIXPolicyNode) list.get(i2);
|
||
|
|
if ("2.5.29.32.0".equals(pKIXPolicyNode.getValidPolicy())) {
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
hashSet.add(aSN1ObjectIdentifier.getId());
|
||
|
|
PKIXPolicyNode pKIXPolicyNode2 = new PKIXPolicyNode(new ArrayList(), i, hashSet, pKIXPolicyNode, set, aSN1ObjectIdentifier.getId(), false);
|
||
|
|
pKIXPolicyNode.addChild(pKIXPolicyNode2);
|
||
|
|
listArr[i].add(pKIXPolicyNode2);
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static boolean processCertD1i(int i, List[] listArr, ASN1ObjectIdentifier aSN1ObjectIdentifier, Set set) {
|
||
|
|
List list = listArr[i - 1];
|
||
|
|
for (int i2 = 0; i2 < list.size(); i2++) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode = (PKIXPolicyNode) list.get(i2);
|
||
|
|
if (pKIXPolicyNode.getExpectedPolicies().contains(aSN1ObjectIdentifier.getId())) {
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
hashSet.add(aSN1ObjectIdentifier.getId());
|
||
|
|
PKIXPolicyNode pKIXPolicyNode2 = new PKIXPolicyNode(new ArrayList(), i, hashSet, pKIXPolicyNode, set, aSN1ObjectIdentifier.getId(), false);
|
||
|
|
pKIXPolicyNode.addChild(pKIXPolicyNode2);
|
||
|
|
listArr[i].add(pKIXPolicyNode2);
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
|
||
|
|
protected static PKIXPolicyNode prepareNextCertB2(int i, List[] listArr, String str, PKIXPolicyNode pKIXPolicyNode) {
|
||
|
|
int i2;
|
||
|
|
Iterator it = listArr[i].iterator();
|
||
|
|
while (it.hasNext()) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode2 = (PKIXPolicyNode) it.next();
|
||
|
|
if (pKIXPolicyNode2.getValidPolicy().equals(str)) {
|
||
|
|
((PKIXPolicyNode) pKIXPolicyNode2.getParent()).removeChild(pKIXPolicyNode2);
|
||
|
|
it.remove();
|
||
|
|
for (int i3 = i - 1; i3 >= 0; i3--) {
|
||
|
|
List list = listArr[i3];
|
||
|
|
while (i2 < list.size()) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) list.get(i2);
|
||
|
|
i2 = (pKIXPolicyNode3.hasChildren() || (pKIXPolicyNode = removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode3)) != null) ? i2 + 1 : 0;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return pKIXPolicyNode;
|
||
|
|
}
|
||
|
|
|
||
|
|
protected static void prepareNextCertB1(int i, List[] listArr, String str, Map map, X509Certificate x509Certificate) throws AnnotatedException, CertPathValidatorException {
|
||
|
|
Set set;
|
||
|
|
for (PKIXPolicyNode pKIXPolicyNode : listArr[i]) {
|
||
|
|
if (pKIXPolicyNode.getValidPolicy().equals(str)) {
|
||
|
|
pKIXPolicyNode.expectedPolicies = (Set) map.get(str);
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
for (PKIXPolicyNode pKIXPolicyNode2 : listArr[i]) {
|
||
|
|
if ("2.5.29.32.0".equals(pKIXPolicyNode2.getValidPolicy())) {
|
||
|
|
try {
|
||
|
|
Enumeration objects = DERSequence.getInstance(getExtensionValue(x509Certificate, CERTIFICATE_POLICIES)).getObjects();
|
||
|
|
while (true) {
|
||
|
|
if (!objects.hasMoreElements()) {
|
||
|
|
set = null;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
try {
|
||
|
|
PolicyInformation policyInformation = PolicyInformation.getInstance(objects.nextElement());
|
||
|
|
if ("2.5.29.32.0".equals(policyInformation.getPolicyIdentifier().getId())) {
|
||
|
|
try {
|
||
|
|
set = getQualifierSet(policyInformation.getPolicyQualifiers());
|
||
|
|
break;
|
||
|
|
} catch (CertPathValidatorException e) {
|
||
|
|
throw new ExtCertPathValidatorException("Policy qualifier info set could not be built.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (Exception e2) {
|
||
|
|
throw new AnnotatedException("Policy information cannot be decoded.", e2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
Set set2 = set;
|
||
|
|
boolean contains = x509Certificate.getCriticalExtensionOIDs() != null ? x509Certificate.getCriticalExtensionOIDs().contains(CERTIFICATE_POLICIES) : false;
|
||
|
|
PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) pKIXPolicyNode2.getParent();
|
||
|
|
if ("2.5.29.32.0".equals(pKIXPolicyNode3.getValidPolicy())) {
|
||
|
|
PKIXPolicyNode pKIXPolicyNode4 = new PKIXPolicyNode(new ArrayList(), i, (Set) map.get(str), pKIXPolicyNode3, set2, str, contains);
|
||
|
|
pKIXPolicyNode3.addChild(pKIXPolicyNode4);
|
||
|
|
listArr[i].add(pKIXPolicyNode4);
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
return;
|
||
|
|
} catch (Exception e3) {
|
||
|
|
throw new AnnotatedException("Certificate policies cannot be decoded.", e3);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static boolean isSelfIssued(X509Certificate x509Certificate) {
|
||
|
|
return x509Certificate.getSubjectDN().equals(x509Certificate.getIssuerDN());
|
||
|
|
}
|
||
|
|
|
||
|
|
private static boolean isDeltaCRL(X509CRL x509crl) {
|
||
|
|
Set<String> criticalExtensionOIDs = x509crl.getCriticalExtensionOIDs();
|
||
|
|
if (criticalExtensionOIDs == null) {
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
return criticalExtensionOIDs.contains(RFC3280CertPathUtilities.DELTA_CRL_INDICATOR);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static boolean isAnyPolicy(Set set) {
|
||
|
|
return set == null || set.contains("2.5.29.32.0") || set.isEmpty();
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static Date getValidDate(PKIXExtendedParameters pKIXExtendedParameters) {
|
||
|
|
Date date = pKIXExtendedParameters.getDate();
|
||
|
|
return date == null ? new Date() : date;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static Date getValidCertDateFromValidityModel(PKIXExtendedParameters pKIXExtendedParameters, CertPath certPath, int i) throws AnnotatedException {
|
||
|
|
if (pKIXExtendedParameters.getValidityModel() == 1 && i > 0) {
|
||
|
|
int i2 = i - 1;
|
||
|
|
if (i2 == 0) {
|
||
|
|
try {
|
||
|
|
byte[] extensionValue = ((X509Certificate) certPath.getCertificates().get(i2)).getExtensionValue(ISISMTTObjectIdentifiers.id_isismtt_at_dateOfCertGen.getId());
|
||
|
|
ASN1GeneralizedTime aSN1GeneralizedTime = extensionValue != null ? ASN1GeneralizedTime.getInstance(ASN1Primitive.fromByteArray(extensionValue)) : null;
|
||
|
|
if (aSN1GeneralizedTime != null) {
|
||
|
|
try {
|
||
|
|
return aSN1GeneralizedTime.getDate();
|
||
|
|
} catch (ParseException e) {
|
||
|
|
throw new AnnotatedException("Date from date of cert gen extension could not be parsed.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} catch (IOException unused) {
|
||
|
|
throw new AnnotatedException("Date of cert gen extension could not be read.");
|
||
|
|
} catch (IllegalArgumentException unused2) {
|
||
|
|
throw new AnnotatedException("Date of cert gen extension could not be read.");
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return ((X509Certificate) certPath.getCertificates().get(i2)).getNotBefore();
|
||
|
|
}
|
||
|
|
return getValidDate(pKIXExtendedParameters);
|
||
|
|
}
|
||
|
|
|
||
|
|
private static BigInteger getSerialNumber(Object obj) {
|
||
|
|
return ((X509Certificate) obj).getSerialNumber();
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static final Set getQualifierSet(ASN1Sequence aSN1Sequence) throws CertPathValidatorException {
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
if (aSN1Sequence == null) {
|
||
|
|
return hashSet;
|
||
|
|
}
|
||
|
|
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
|
||
|
|
ASN1OutputStream aSN1OutputStream = new ASN1OutputStream(byteArrayOutputStream);
|
||
|
|
Enumeration objects = aSN1Sequence.getObjects();
|
||
|
|
while (objects.hasMoreElements()) {
|
||
|
|
try {
|
||
|
|
aSN1OutputStream.writeObject((ASN1Encodable) objects.nextElement());
|
||
|
|
hashSet.add(new PolicyQualifierInfo(byteArrayOutputStream.toByteArray()));
|
||
|
|
byteArrayOutputStream.reset();
|
||
|
|
} catch (IOException e) {
|
||
|
|
throw new ExtCertPathValidatorException("Policy qualifier info cannot be decoded.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return hashSet;
|
||
|
|
}
|
||
|
|
|
||
|
|
private static ASN1Primitive getObject(String str, byte[] bArr) throws AnnotatedException {
|
||
|
|
try {
|
||
|
|
return new ASN1InputStream(((ASN1OctetString) new ASN1InputStream(bArr).readObject()).getOctets()).readObject();
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new AnnotatedException("exception processing extension ".concat(String.valueOf(str)), e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static PublicKey getNextWorkingKey(List list, int i, JcaJceHelper jcaJceHelper) throws CertPathValidatorException {
|
||
|
|
DSAPublicKey dSAPublicKey;
|
||
|
|
PublicKey publicKey = ((Certificate) list.get(i)).getPublicKey();
|
||
|
|
if (!(publicKey instanceof DSAPublicKey)) {
|
||
|
|
return publicKey;
|
||
|
|
}
|
||
|
|
DSAPublicKey dSAPublicKey2 = (DSAPublicKey) publicKey;
|
||
|
|
if (dSAPublicKey2.getParams() != null) {
|
||
|
|
return dSAPublicKey2;
|
||
|
|
}
|
||
|
|
do {
|
||
|
|
i++;
|
||
|
|
if (i >= list.size()) {
|
||
|
|
throw new CertPathValidatorException("DSA parameters cannot be inherited from previous certificate.");
|
||
|
|
}
|
||
|
|
PublicKey publicKey2 = ((X509Certificate) list.get(i)).getPublicKey();
|
||
|
|
if (!(publicKey2 instanceof DSAPublicKey)) {
|
||
|
|
throw new CertPathValidatorException("DSA parameters cannot be inherited from previous certificate.");
|
||
|
|
}
|
||
|
|
dSAPublicKey = (DSAPublicKey) publicKey2;
|
||
|
|
} while (dSAPublicKey.getParams() == null);
|
||
|
|
DSAParams params = dSAPublicKey.getParams();
|
||
|
|
try {
|
||
|
|
return jcaJceHelper.createKeyFactory("DSA").generatePublic(new DSAPublicKeySpec(dSAPublicKey2.getY(), params.getP(), params.getQ(), params.getG()));
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new RuntimeException(e.getMessage());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static ASN1Primitive getExtensionValue(X509Extension x509Extension, String str) throws AnnotatedException {
|
||
|
|
byte[] extensionValue = x509Extension.getExtensionValue(str);
|
||
|
|
if (extensionValue == null) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
return getObject(str, extensionValue);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static Set getDeltaCRLs(Date date, X509CRL x509crl, List<CertStore> list, List<PKIXCRLStore> list2) throws AnnotatedException {
|
||
|
|
X509CRLSelector x509CRLSelector = new X509CRLSelector();
|
||
|
|
try {
|
||
|
|
x509CRLSelector.addIssuerName(PrincipalUtils.getIssuerPrincipal(x509crl).getEncoded());
|
||
|
|
try {
|
||
|
|
ASN1Primitive extensionValue = getExtensionValue(x509crl, CRL_NUMBER);
|
||
|
|
BigInteger positiveValue = extensionValue != null ? ASN1Integer.getInstance(extensionValue).getPositiveValue() : null;
|
||
|
|
try {
|
||
|
|
byte[] extensionValue2 = x509crl.getExtensionValue(ISSUING_DISTRIBUTION_POINT);
|
||
|
|
x509CRLSelector.setMinCRLNumber(positiveValue != null ? positiveValue.add(BigInteger.valueOf(1L)) : null);
|
||
|
|
PKIXCRLStoreSelector.Builder builder = new PKIXCRLStoreSelector.Builder(x509CRLSelector);
|
||
|
|
builder.setIssuingDistributionPoint(extensionValue2);
|
||
|
|
builder.setIssuingDistributionPointEnabled(true);
|
||
|
|
builder.setMaxBaseCRLNumber(positiveValue);
|
||
|
|
Set<X509CRL> findCRLs = CRL_UTIL.findCRLs(builder.build(), date, list, list2);
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
for (X509CRL x509crl2 : findCRLs) {
|
||
|
|
if (isDeltaCRL(x509crl2)) {
|
||
|
|
hashSet.add(x509crl2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return hashSet;
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new AnnotatedException("Issuing distribution point extension value could not be read.", e);
|
||
|
|
}
|
||
|
|
} catch (Exception e2) {
|
||
|
|
throw new AnnotatedException("CRL number extension could not be extracted from CRL.", e2);
|
||
|
|
}
|
||
|
|
} catch (IOException e3) {
|
||
|
|
throw new AnnotatedException("Cannot extract issuer from CRL.", e3);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static Set getCompleteCRLs(DistributionPoint distributionPoint, Object obj, Date date, PKIXExtendedParameters pKIXExtendedParameters) throws AnnotatedException {
|
||
|
|
X509CRLSelector x509CRLSelector = new X509CRLSelector();
|
||
|
|
try {
|
||
|
|
HashSet hashSet = new HashSet();
|
||
|
|
hashSet.add(PrincipalUtils.getEncodedIssuerPrincipal(obj));
|
||
|
|
getCRLIssuersFromDistributionPoint(distributionPoint, hashSet, x509CRLSelector);
|
||
|
|
if (obj instanceof X509Certificate) {
|
||
|
|
x509CRLSelector.setCertificateChecking((X509Certificate) obj);
|
||
|
|
}
|
||
|
|
PKIXCRLStoreSelector<? extends CRL> build = new PKIXCRLStoreSelector.Builder(x509CRLSelector).setCompleteCRLEnabled(true).build();
|
||
|
|
if (pKIXExtendedParameters.getDate() != null) {
|
||
|
|
date = pKIXExtendedParameters.getDate();
|
||
|
|
}
|
||
|
|
Set findCRLs = CRL_UTIL.findCRLs(build, date, pKIXExtendedParameters.getCertStores(), pKIXExtendedParameters.getCRLStores());
|
||
|
|
checkCRLsNotEmpty(findCRLs, obj);
|
||
|
|
return findCRLs;
|
||
|
|
} catch (AnnotatedException e) {
|
||
|
|
throw new AnnotatedException("Could not get issuer information from distribution point.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static void getCertStatus(Date date, X509CRL x509crl, Object obj, CertStatus certStatus) throws AnnotatedException {
|
||
|
|
X509CRLEntry revokedCertificate;
|
||
|
|
ASN1Enumerated aSN1Enumerated;
|
||
|
|
try {
|
||
|
|
if (X509CRLObject.isIndirectCRL(x509crl)) {
|
||
|
|
revokedCertificate = x509crl.getRevokedCertificate(getSerialNumber(obj));
|
||
|
|
if (revokedCertificate == null) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
X500Principal certificateIssuer = revokedCertificate.getCertificateIssuer();
|
||
|
|
if (!PrincipalUtils.getEncodedIssuerPrincipal(obj).equals(certificateIssuer == null ? PrincipalUtils.getIssuerPrincipal(x509crl) : X500Name.getInstance(certificateIssuer.getEncoded()))) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
} else if (!PrincipalUtils.getEncodedIssuerPrincipal(obj).equals(PrincipalUtils.getIssuerPrincipal(x509crl)) || (revokedCertificate = x509crl.getRevokedCertificate(getSerialNumber(obj))) == null) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
if (revokedCertificate.hasExtensions()) {
|
||
|
|
try {
|
||
|
|
aSN1Enumerated = ASN1Enumerated.getInstance(getExtensionValue(revokedCertificate, Extension.reasonCode.getId()));
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new AnnotatedException("Reason code CRL entry extension could not be decoded.", e);
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
aSN1Enumerated = null;
|
||
|
|
}
|
||
|
|
if (date.getTime() >= revokedCertificate.getRevocationDate().getTime() || aSN1Enumerated == null || aSN1Enumerated.getValue().intValue() == 0 || aSN1Enumerated.getValue().intValue() == 1 || aSN1Enumerated.getValue().intValue() == 2 || aSN1Enumerated.getValue().intValue() == 8) {
|
||
|
|
certStatus.setCertStatus(aSN1Enumerated != null ? aSN1Enumerated.getValue().intValue() : 0);
|
||
|
|
certStatus.setRevocationDate(revokedCertificate.getRevocationDate());
|
||
|
|
}
|
||
|
|
} catch (CRLException e2) {
|
||
|
|
throw new AnnotatedException("Failed check for indirect CRL.", e2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
protected static void getCRLIssuersFromDistributionPoint(DistributionPoint distributionPoint, Collection collection, X509CRLSelector x509CRLSelector) throws AnnotatedException {
|
||
|
|
ArrayList arrayList = new ArrayList();
|
||
|
|
if (distributionPoint.getCRLIssuer() != null) {
|
||
|
|
GeneralName[] names = distributionPoint.getCRLIssuer().getNames();
|
||
|
|
for (int i = 0; i < names.length; i++) {
|
||
|
|
if (names[i].getTagNo() == 4) {
|
||
|
|
try {
|
||
|
|
arrayList.add(X500Name.getInstance(names[i].getName().toASN1Primitive().getEncoded()));
|
||
|
|
} catch (IOException e) {
|
||
|
|
throw new AnnotatedException("CRL issuer information from distribution point cannot be decoded.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
if (distributionPoint.getDistributionPoint() == null) {
|
||
|
|
throw new AnnotatedException("CRL issuer is omitted from distribution point but no distributionPoint field present.");
|
||
|
|
}
|
||
|
|
Iterator it = collection.iterator();
|
||
|
|
while (it.hasNext()) {
|
||
|
|
arrayList.add(it.next());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
Iterator it2 = arrayList.iterator();
|
||
|
|
while (it2.hasNext()) {
|
||
|
|
try {
|
||
|
|
x509CRLSelector.addIssuerName(((X500Name) it2.next()).getEncoded());
|
||
|
|
} catch (IOException e2) {
|
||
|
|
throw new AnnotatedException("Cannot decode CRL issuer information.", e2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static AlgorithmIdentifier getAlgorithmIdentifier(PublicKey publicKey) throws CertPathValidatorException {
|
||
|
|
try {
|
||
|
|
return SubjectPublicKeyInfo.getInstance(new ASN1InputStream(publicKey.getEncoded()).readObject()).getAlgorithm();
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new ExtCertPathValidatorException("Subject public key cannot be decoded.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: package-private */
|
||
|
|
public static List<PKIXCRLStore> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint cRLDistPoint, Map<GeneralName, PKIXCRLStore> map) throws AnnotatedException {
|
||
|
|
if (cRLDistPoint == null) {
|
||
|
|
return Collections.EMPTY_LIST;
|
||
|
|
}
|
||
|
|
try {
|
||
|
|
DistributionPoint[] distributionPoints = cRLDistPoint.getDistributionPoints();
|
||
|
|
ArrayList arrayList = new ArrayList();
|
||
|
|
for (DistributionPoint distributionPoint : distributionPoints) {
|
||
|
|
DistributionPointName distributionPoint2 = distributionPoint.getDistributionPoint();
|
||
|
|
if (distributionPoint2 != null && distributionPoint2.getType() == 0) {
|
||
|
|
for (GeneralName generalName : GeneralNames.getInstance(distributionPoint2.getName()).getNames()) {
|
||
|
|
PKIXCRLStore pKIXCRLStore = map.get(generalName);
|
||
|
|
if (pKIXCRLStore != null) {
|
||
|
|
arrayList.add(pKIXCRLStore);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return arrayList;
|
||
|
|
} catch (Exception e) {
|
||
|
|
throw new AnnotatedException("Distribution points could not be read.", e);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: package-private */
|
||
|
|
public static List<PKIXCertStore> getAdditionalStoresFromAltNames(byte[] bArr, Map<GeneralName, PKIXCertStore> map) throws CertificateParsingException {
|
||
|
|
if (bArr == null) {
|
||
|
|
return Collections.EMPTY_LIST;
|
||
|
|
}
|
||
|
|
GeneralName[] names = GeneralNames.getInstance(ASN1OctetString.getInstance(bArr).getOctets()).getNames();
|
||
|
|
ArrayList arrayList = new ArrayList();
|
||
|
|
for (int i = 0; i != names.length; i++) {
|
||
|
|
PKIXCertStore pKIXCertStore = map.get(names[i]);
|
||
|
|
if (pKIXCertStore != null) {
|
||
|
|
arrayList.add(pKIXCertStore);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return arrayList;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static TrustAnchor findTrustAnchor(X509Certificate x509Certificate, Set set, String str) throws AnnotatedException {
|
||
|
|
X509CertSelector x509CertSelector = new X509CertSelector();
|
||
|
|
X500Name encodedIssuerPrincipal = PrincipalUtils.getEncodedIssuerPrincipal(x509Certificate);
|
||
|
|
try {
|
||
|
|
x509CertSelector.setSubject(encodedIssuerPrincipal.getEncoded());
|
||
|
|
Iterator it = set.iterator();
|
||
|
|
TrustAnchor trustAnchor = null;
|
||
|
|
Exception e = null;
|
||
|
|
PublicKey publicKey = null;
|
||
|
|
while (it.hasNext() && trustAnchor == null) {
|
||
|
|
trustAnchor = (TrustAnchor) it.next();
|
||
|
|
if (trustAnchor.getTrustedCert() != null) {
|
||
|
|
if (x509CertSelector.match(trustAnchor.getTrustedCert())) {
|
||
|
|
publicKey = trustAnchor.getTrustedCert().getPublicKey();
|
||
|
|
}
|
||
|
|
trustAnchor = null;
|
||
|
|
} else {
|
||
|
|
if (trustAnchor.getCAName() != null && trustAnchor.getCAPublicKey() != null) {
|
||
|
|
try {
|
||
|
|
if (encodedIssuerPrincipal.equals(PrincipalUtils.getCA(trustAnchor))) {
|
||
|
|
publicKey = trustAnchor.getCAPublicKey();
|
||
|
|
}
|
||
|
|
} catch (IllegalArgumentException unused) {
|
||
|
|
}
|
||
|
|
}
|
||
|
|
trustAnchor = null;
|
||
|
|
}
|
||
|
|
if (publicKey != null) {
|
||
|
|
try {
|
||
|
|
verifyX509Certificate(x509Certificate, publicKey, str);
|
||
|
|
} catch (Exception e2) {
|
||
|
|
e = e2;
|
||
|
|
trustAnchor = null;
|
||
|
|
publicKey = null;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (trustAnchor != null || e == null) {
|
||
|
|
return trustAnchor;
|
||
|
|
}
|
||
|
|
throw new AnnotatedException("TrustAnchor found but certificate validation failed.", e);
|
||
|
|
} catch (IOException e3) {
|
||
|
|
throw new AnnotatedException("Cannot set subject search criteria for trust anchor.", e3);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
protected static TrustAnchor findTrustAnchor(X509Certificate x509Certificate, Set set) throws AnnotatedException {
|
||
|
|
return findTrustAnchor(x509Certificate, set, null);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: package-private */
|
||
|
|
public static Collection findIssuerCerts(X509Certificate x509Certificate, List<CertStore> list, List<PKIXCertStore> list2) throws AnnotatedException {
|
||
|
|
byte[] keyIdentifier;
|
||
|
|
X509CertSelector x509CertSelector = new X509CertSelector();
|
||
|
|
try {
|
||
|
|
x509CertSelector.setSubject(PrincipalUtils.getIssuerPrincipal(x509Certificate).getEncoded());
|
||
|
|
try {
|
||
|
|
byte[] extensionValue = x509Certificate.getExtensionValue(AUTHORITY_KEY_IDENTIFIER);
|
||
|
|
if (extensionValue != null && (keyIdentifier = AuthorityKeyIdentifier.getInstance(ASN1OctetString.getInstance(extensionValue).getOctets()).getKeyIdentifier()) != null) {
|
||
|
|
x509CertSelector.setSubjectKeyIdentifier(new DEROctetString(keyIdentifier).getEncoded());
|
||
|
|
}
|
||
|
|
} catch (Exception unused) {
|
||
|
|
}
|
||
|
|
PKIXCertStoreSelector<? extends Certificate> build = new PKIXCertStoreSelector.Builder(x509CertSelector).build();
|
||
|
|
LinkedHashSet linkedHashSet = new LinkedHashSet();
|
||
|
|
try {
|
||
|
|
ArrayList arrayList = new ArrayList();
|
||
|
|
arrayList.addAll(findCertificates(build, list));
|
||
|
|
arrayList.addAll(findCertificates(build, list2));
|
||
|
|
Iterator it = arrayList.iterator();
|
||
|
|
while (it.hasNext()) {
|
||
|
|
linkedHashSet.add((X509Certificate) it.next());
|
||
|
|
}
|
||
|
|
return linkedHashSet;
|
||
|
|
} catch (AnnotatedException e) {
|
||
|
|
throw new AnnotatedException("Issuer certificate cannot be searched.", e);
|
||
|
|
}
|
||
|
|
} catch (IOException e2) {
|
||
|
|
throw new AnnotatedException("Subject criteria for certificate selector to find issuer certificate could not be set.", e2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* JADX INFO: Access modifiers changed from: protected */
|
||
|
|
public static Collection findCertificates(PKIXCertStoreSelector pKIXCertStoreSelector, List list) throws AnnotatedException {
|
||
|
|
LinkedHashSet linkedHashSet = new LinkedHashSet();
|
||
|
|
for (Object obj : list) {
|
||
|
|
if (obj instanceof Store) {
|
||
|
|
try {
|
||
|
|
linkedHashSet.addAll(((Store) obj).getMatches(pKIXCertStoreSelector));
|
||
|
|
} catch (StoreException e) {
|
||
|
|
throw new AnnotatedException("Problem while picking certificates from X.509 store.", e);
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
try {
|
||
|
|
linkedHashSet.addAll(PKIXCertStoreSelector.getCertificates(pKIXCertStoreSelector, (CertStore) obj));
|
||
|
|
} catch (CertStoreException e2) {
|
||
|
|
throw new AnnotatedException("Problem while picking certificates from certificate store.", e2);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return linkedHashSet;
|
||
|
|
}
|
||
|
|
|
||
|
|
static void checkCRLsNotEmpty(Set set, Object obj) throws AnnotatedException {
|
||
|
|
if (set.isEmpty()) {
|
||
|
|
if (obj instanceof X509AttributeCertificate) {
|
||
|
|
StringBuilder sb = new StringBuilder("No CRLs found for issuer \"");
|
||
|
|
sb.append(((X509AttributeCertificate) obj).getIssuer().getPrincipals()[0]);
|
||
|
|
sb.append("\"");
|
||
|
|
throw new AnnotatedException(sb.toString());
|
||
|
|
}
|
||
|
|
StringBuilder sb2 = new StringBuilder("No CRLs found for issuer \"");
|
||
|
|
sb2.append(RFC4519Style.INSTANCE.toString(PrincipalUtils.getIssuerPrincipal((X509Certificate) obj)));
|
||
|
|
sb2.append("\"");
|
||
|
|
throw new AnnotatedException(sb2.toString());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
CertPathValidatorUtilities() {
|
||
|
|
}
|
||
|
|
}
|