package org.bouncycastle.jce.provider;

import java.security.InvalidAlgorithmParameterException;
import java.security.PublicKey;
import java.security.cert.CertPath;
import java.security.cert.CertPathParameters;
import java.security.cert.CertPathValidatorException;
import java.security.cert.CertPathValidatorResult;
import java.security.cert.CertPathValidatorSpi;
import java.security.cert.Certificate;
import java.security.cert.PKIXCertPathChecker;
import java.security.cert.PKIXCertPathValidatorResult;
import java.security.cert.PKIXParameters;
import java.security.cert.TrustAnchor;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Set;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.jcajce.PKIXExtendedBuilderParameters;
import org.bouncycastle.jcajce.PKIXExtendedParameters;
import org.bouncycastle.jcajce.util.BCJcaJceHelper;
import org.bouncycastle.jcajce.util.JcaJceHelper;
import org.bouncycastle.jce.exception.ExtCertPathValidatorException;
import org.bouncycastle.x509.ExtendedPKIXParameters;

/* loaded from: classes6.dex */
public class PKIXCertPathValidatorSpi extends CertPathValidatorSpi {
    private final JcaJceHelper helper = new BCJcaJceHelper();

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r14v1 */
    /* JADX WARN: Type inference failed for: r14v2, types: [int, java.util.Set] */
    /* JADX WARN: Type inference failed for: r14v3 */
    /* JADX WARN: Type inference failed for: r14v4, types: [int] */
    /* JADX WARN: Type inference failed for: r14v5 */
    /* JADX WARN: Type inference failed for: r5v4 */
    @Override // java.security.cert.CertPathValidatorSpi
    public CertPathValidatorResult engineValidate(CertPath certPath, CertPathParameters certPathParameters) throws CertPathValidatorException, InvalidAlgorithmParameterException {
        PKIXExtendedParameters pKIXExtendedParameters;
        X500Name ca;
        PublicKey cAPublicKey;
        HashSet hashSet;
        int i;
        ArrayList[] arrayListArr;
        HashSet hashSet2;
        PKIXCertPathValidatorSpi pKIXCertPathValidatorSpi = this;
        if (certPathParameters instanceof PKIXParameters) {
            PKIXExtendedParameters.Builder builder = new PKIXExtendedParameters.Builder((PKIXParameters) certPathParameters);
            if (certPathParameters instanceof ExtendedPKIXParameters) {
                ExtendedPKIXParameters extendedPKIXParameters = (ExtendedPKIXParameters) certPathParameters;
                builder.setUseDeltasEnabled(extendedPKIXParameters.isUseDeltasEnabled());
                builder.setValidityModel(extendedPKIXParameters.getValidityModel());
            }
            pKIXExtendedParameters = builder.build();
        } else if (certPathParameters instanceof PKIXExtendedBuilderParameters) {
            pKIXExtendedParameters = ((PKIXExtendedBuilderParameters) certPathParameters).getBaseParameters();
        } else {
            if (!(certPathParameters instanceof PKIXExtendedParameters)) {
                StringBuilder sb = new StringBuilder("Parameters must be a ");
                sb.append(PKIXParameters.class.getName());
                sb.append(" instance.");
                throw new InvalidAlgorithmParameterException(sb.toString());
            }
            pKIXExtendedParameters = (PKIXExtendedParameters) certPathParameters;
        }
        if (pKIXExtendedParameters.getTrustAnchors() == null) {
            throw new InvalidAlgorithmParameterException("trustAnchors is null, this is not allowed for certification path validation.");
        }
        List<? extends Certificate> certificates = certPath.getCertificates();
        int size = certificates.size();
        if (certificates.isEmpty()) {
            throw new CertPathValidatorException("Certification path is empty.", null, certPath, -1);
        }
        pKIXExtendedParameters.getInitialPolicies();
        try {
            TrustAnchor findTrustAnchor = CertPathValidatorUtilities.findTrustAnchor((X509Certificate) certificates.get(certificates.size() - 1), pKIXExtendedParameters.getTrustAnchors(), pKIXExtendedParameters.getSigProvider());
            if (findTrustAnchor == null) {
                throw new CertPathValidatorException("Trust anchor for certification path not found.", null, certPath, -1);
            }
            PKIXExtendedParameters build = new PKIXExtendedParameters.Builder(pKIXExtendedParameters).setTrustAnchor(findTrustAnchor).build();
            int i2 = size + 1;
            ArrayList[] arrayListArr2 = new ArrayList[i2];
            boolean z = false;
            for (int i3 = 0; i3 < i2; i3++) {
                arrayListArr2[i3] = new ArrayList();
            }
            HashSet hashSet3 = new HashSet();
            hashSet3.add(RFC3280CertPathUtilities.ANY_POLICY);
            arrayListArr2[0].add(new PKIXPolicyNode(new ArrayList(), 0, hashSet3, null, new HashSet(), RFC3280CertPathUtilities.ANY_POLICY, false));
            PKIXNameConstraintValidator pKIXNameConstraintValidator = new PKIXNameConstraintValidator();
            HashSet hashSet4 = new HashSet();
            int i4 = build.isExplicitPolicyRequired() ? 0 : i2;
            int i5 = build.isAnyPolicyInhibited() ? 0 : i2;
            if (build.isPolicyMappingInhibited()) {
                i2 = 0;
            }
            X509Certificate trustedCert = findTrustAnchor.getTrustedCert();
            try {
                if (trustedCert != null) {
                    ca = PrincipalUtils.getSubjectPrincipal(trustedCert);
                    cAPublicKey = trustedCert.getPublicKey();
                } else {
                    ca = PrincipalUtils.getCA(findTrustAnchor);
                    cAPublicKey = findTrustAnchor.getCAPublicKey();
                }
                try {
                    AlgorithmIdentifier algorithmIdentifier = CertPathValidatorUtilities.getAlgorithmIdentifier(cAPublicKey);
                    algorithmIdentifier.getAlgorithm();
                    algorithmIdentifier.getParameters();
                    if (build.getTargetConstraints() != null && !build.getTargetConstraints().match((Certificate) certificates.get(0))) {
                        throw new ExtCertPathValidatorException("Target certificate in certification path does not match targetConstraints.", null, certPath, 0);
                    }
                    List certPathCheckers = build.getCertPathCheckers();
                    Iterator it = certPathCheckers.iterator();
                    while (it.hasNext()) {
                        ((PKIXCertPathChecker) it.next()).init(false);
                    }
                    int i6 = i2;
                    X509Certificate x509Certificate = null;
                    ?? r14 = size;
                    ?? size2 = certificates.size() - 1;
                    int i7 = i5;
                    PKIXPolicyNode pKIXPolicyNode = size2;
                    int i8 = size2;
                    while (i8 >= 0) {
                        X509Certificate x509Certificate2 = (X509Certificate) certificates.get(i8);
                        boolean z2 = i8 == certificates.size() + (-1) ? true : z;
                        JcaJceHelper jcaJceHelper = pKIXCertPathValidatorSpi.helper;
                        int i9 = i7;
                        List<? extends Certificate> list = certificates;
                        int i10 = i4;
                        int i11 = i8;
                        PKIXExtendedParameters pKIXExtendedParameters2 = build;
                        PKIXNameConstraintValidator pKIXNameConstraintValidator2 = pKIXNameConstraintValidator;
                        boolean z3 = z2;
                        boolean z4 = z;
                        ArrayList[] arrayListArr3 = arrayListArr2;
                        TrustAnchor trustAnchor = findTrustAnchor;
                        RFC3280CertPathUtilities.processCertA(certPath, build, i8, cAPublicKey, z3, ca, trustedCert, jcaJceHelper);
                        RFC3280CertPathUtilities.processCertBC(certPath, i11, pKIXNameConstraintValidator2);
                        PKIXPolicyNode processCertE = RFC3280CertPathUtilities.processCertE(certPath, i11, RFC3280CertPathUtilities.processCertD(certPath, i11, hashSet4, pKIXPolicyNode, arrayListArr3, i9));
                        RFC3280CertPathUtilities.processCertF(certPath, i11, processCertE, i10);
                        if (size - i11 == size) {
                            i = i11;
                            arrayListArr = arrayListArr3;
                            pKIXCertPathValidatorSpi = this;
                            pKIXPolicyNode = processCertE;
                            i7 = i9;
                            i4 = i10;
                        } else {
                            if (x509Certificate2 != null && x509Certificate2.getVersion() == 1) {
                                throw new CertPathValidatorException("Version 1 certificates can't be used as CA ones.", null, certPath, i11);
                            }
                            RFC3280CertPathUtilities.prepareNextCertA(certPath, i11);
                            arrayListArr = arrayListArr3;
                            PKIXPolicyNode prepareCertB = RFC3280CertPathUtilities.prepareCertB(certPath, i11, arrayListArr, processCertE, i6);
                            RFC3280CertPathUtilities.prepareNextCertG(certPath, i11, pKIXNameConstraintValidator2);
                            int prepareNextCertH1 = RFC3280CertPathUtilities.prepareNextCertH1(certPath, i11, i10);
                            int prepareNextCertH2 = RFC3280CertPathUtilities.prepareNextCertH2(certPath, i11, i6);
                            int prepareNextCertH3 = RFC3280CertPathUtilities.prepareNextCertH3(certPath, i11, i9);
                            int prepareNextCertI1 = RFC3280CertPathUtilities.prepareNextCertI1(certPath, i11, prepareNextCertH1);
                            int prepareNextCertI2 = RFC3280CertPathUtilities.prepareNextCertI2(certPath, i11, prepareNextCertH2);
                            int prepareNextCertJ = RFC3280CertPathUtilities.prepareNextCertJ(certPath, i11, prepareNextCertH3);
                            RFC3280CertPathUtilities.prepareNextCertK(certPath, i11);
                            r14 = RFC3280CertPathUtilities.prepareNextCertM(certPath, i11, RFC3280CertPathUtilities.prepareNextCertL(certPath, i11, r14));
                            RFC3280CertPathUtilities.prepareNextCertN(certPath, i11);
                            Set<String> criticalExtensionOIDs = x509Certificate2.getCriticalExtensionOIDs();
                            if (criticalExtensionOIDs != null) {
                                hashSet2 = new HashSet(criticalExtensionOIDs);
                                hashSet2.remove(RFC3280CertPathUtilities.KEY_USAGE);
                                hashSet2.remove(RFC3280CertPathUtilities.CERTIFICATE_POLICIES);
                                hashSet2.remove(RFC3280CertPathUtilities.POLICY_MAPPINGS);
                                hashSet2.remove(RFC3280CertPathUtilities.INHIBIT_ANY_POLICY);
                                hashSet2.remove(RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT);
                                hashSet2.remove(RFC3280CertPathUtilities.DELTA_CRL_INDICATOR);
                                hashSet2.remove(RFC3280CertPathUtilities.POLICY_CONSTRAINTS);
                                hashSet2.remove(RFC3280CertPathUtilities.BASIC_CONSTRAINTS);
                                hashSet2.remove(RFC3280CertPathUtilities.SUBJECT_ALTERNATIVE_NAME);
                                hashSet2.remove(RFC3280CertPathUtilities.NAME_CONSTRAINTS);
                            } else {
                                hashSet2 = new HashSet();
                            }
                            RFC3280CertPathUtilities.prepareNextCertO(certPath, i11, hashSet2, certPathCheckers);
                            X500Name subjectPrincipal = PrincipalUtils.getSubjectPrincipal(x509Certificate2);
                            try {
                                i = i11;
                                pKIXCertPathValidatorSpi = this;
                                try {
                                    PublicKey nextWorkingKey = CertPathValidatorUtilities.getNextWorkingKey(certPath.getCertificates(), i, pKIXCertPathValidatorSpi.helper);
                                    AlgorithmIdentifier algorithmIdentifier2 = CertPathValidatorUtilities.getAlgorithmIdentifier(nextWorkingKey);
                                    algorithmIdentifier2.getAlgorithm();
                                    algorithmIdentifier2.getParameters();
                                    pKIXPolicyNode = prepareCertB;
                                    i6 = prepareNextCertI2;
                                    ca = subjectPrincipal;
                                    cAPublicKey = nextWorkingKey;
                                    trustedCert = x509Certificate2;
                                    i4 = prepareNextCertI1;
                                    i7 = prepareNextCertJ;
                                } catch (CertPathValidatorException e) {
                                    e = e;
                                    throw new CertPathValidatorException("Next working key could not be retrieved.", e, certPath, i);
                                }
                            } catch (CertPathValidatorException e2) {
                                e = e2;
                                i = i11;
                            }
                        }
                        int i12 = i - 1;
                        arrayListArr2 = arrayListArr;
                        x509Certificate = x509Certificate2;
                        z = z4;
                        certificates = list;
                        findTrustAnchor = trustAnchor;
                        pKIXNameConstraintValidator = pKIXNameConstraintValidator2;
                        build = pKIXExtendedParameters2;
                        i8 = i12;
                        r14 = r14;
                    }
                    PKIXExtendedParameters pKIXExtendedParameters3 = build;
                    ArrayList[] arrayListArr4 = arrayListArr2;
                    TrustAnchor trustAnchor2 = findTrustAnchor;
                    int i13 = i8;
                    int i14 = i13 + 1;
                    int wrapupCertB = RFC3280CertPathUtilities.wrapupCertB(certPath, i14, RFC3280CertPathUtilities.wrapupCertA(i4, x509Certificate));
                    Set<String> criticalExtensionOIDs2 = x509Certificate.getCriticalExtensionOIDs();
                    if (criticalExtensionOIDs2 != null) {
                        hashSet = new HashSet(criticalExtensionOIDs2);
                        hashSet.remove(RFC3280CertPathUtilities.KEY_USAGE);
                        hashSet.remove(RFC3280CertPathUtilities.CERTIFICATE_POLICIES);
                        hashSet.remove(RFC3280CertPathUtilities.POLICY_MAPPINGS);
                        hashSet.remove(RFC3280CertPathUtilities.INHIBIT_ANY_POLICY);
                        hashSet.remove(RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT);
                        hashSet.remove(RFC3280CertPathUtilities.DELTA_CRL_INDICATOR);
                        hashSet.remove(RFC3280CertPathUtilities.POLICY_CONSTRAINTS);
                        hashSet.remove(RFC3280CertPathUtilities.BASIC_CONSTRAINTS);
                        hashSet.remove(RFC3280CertPathUtilities.SUBJECT_ALTERNATIVE_NAME);
                        hashSet.remove(RFC3280CertPathUtilities.NAME_CONSTRAINTS);
                        hashSet.remove(RFC3280CertPathUtilities.CRL_DISTRIBUTION_POINTS);
                        hashSet.remove(Extension.extendedKeyUsage.getId());
                    } else {
                        hashSet = new HashSet();
                    }
                    RFC3280CertPathUtilities.wrapupCertF(certPath, i14, certPathCheckers, hashSet);
                    X509Certificate x509Certificate3 = x509Certificate;
                    PKIXPolicyNode wrapupCertG = RFC3280CertPathUtilities.wrapupCertG(certPath, pKIXExtendedParameters3, r14, i14, arrayListArr4, pKIXPolicyNode, hashSet4);
                    if (wrapupCertB > 0 || wrapupCertG != null) {
                        return new PKIXCertPathValidatorResult(trustAnchor2, wrapupCertG, x509Certificate3.getPublicKey());
                    }
                    throw new CertPathValidatorException("Path processing failed on policy.", null, certPath, i13);
                } catch (CertPathValidatorException e3) {
                    throw new ExtCertPathValidatorException("Algorithm identifier of public key of trust anchor could not be read.", e3, certPath, -1);
                }
            } catch (IllegalArgumentException e4) {
                throw new ExtCertPathValidatorException("Subject of trust anchor could not be (re)encoded.", e4, certPath, -1);
            }
        } catch (AnnotatedException e5) {
            throw new CertPathValidatorException(e5.getMessage(), e5, certPath, certificates.size() - 1);
        }
    }
}