package org.bouncycastle.jce.provider; import java.io.IOException; import java.security.InvalidAlgorithmParameterException; import java.security.NoSuchAlgorithmException; import java.security.NoSuchProviderException; import java.security.Principal; import java.security.cert.CertPath; import java.security.cert.CertPathBuilder; import java.security.cert.CertPathBuilderException; import java.security.cert.CertPathBuilderResult; import java.security.cert.CertPathValidator; import java.security.cert.CertPathValidatorException; import java.security.cert.CertPathValidatorResult; import java.security.cert.CertificateExpiredException; import java.security.cert.CertificateNotYetValidException; import java.security.cert.TrustAnchor; import java.security.cert.X509CertSelector; import java.security.cert.X509Certificate; import java.util.HashSet; import java.util.Iterator; import java.util.Set; import javax.security.auth.x500.X500Principal; import org.bouncycastle.asn1.x509.TargetInformation; import org.bouncycastle.asn1.x509.X509Extensions; import org.bouncycastle.jcajce.PKIXCertStoreSelector; import org.bouncycastle.jcajce.PKIXExtendedBuilderParameters; import org.bouncycastle.jcajce.PKIXExtendedParameters; import org.bouncycastle.jce.exception.ExtCertPathValidatorException; import org.bouncycastle.x509.PKIXAttrCertChecker; import org.bouncycastle.x509.X509AttributeCertificate; import org.bouncycastle.x509.X509CertStoreSelector; /* loaded from: classes6.dex */ class RFC3281CertPathUtilities { private static final String TARGET_INFORMATION = X509Extensions.TargetInformation.getId(); private static final String NO_REV_AVAIL = X509Extensions.NoRevAvail.getId(); private static final String CRL_DISTRIBUTION_POINTS = X509Extensions.CRLDistributionPoints.getId(); private static final String AUTHORITY_INFO_ACCESS = X509Extensions.AuthorityInfoAccess.getId(); protected static void processAttrCert7(X509AttributeCertificate x509AttributeCertificate, CertPath certPath, CertPath certPath2, PKIXExtendedParameters pKIXExtendedParameters, Set set) throws CertPathValidatorException { Set criticalExtensionOIDs = x509AttributeCertificate.getCriticalExtensionOIDs(); String str = TARGET_INFORMATION; if (criticalExtensionOIDs.contains(str)) { try { TargetInformation.getInstance(CertPathValidatorUtilities.getExtensionValue(x509AttributeCertificate, str)); } catch (IllegalArgumentException e) { throw new ExtCertPathValidatorException("Target information extension could not be read.", e); } catch (AnnotatedException e2) { throw new ExtCertPathValidatorException("Target information extension could not be read.", e2); } } criticalExtensionOIDs.remove(str); Iterator it = set.iterator(); while (it.hasNext()) { ((PKIXAttrCertChecker) it.next()).check(x509AttributeCertificate, certPath, certPath2, criticalExtensionOIDs); } if (!criticalExtensionOIDs.isEmpty()) { throw new CertPathValidatorException("Attribute certificate contains unsupported critical extensions: ".concat(String.valueOf(criticalExtensionOIDs))); } } protected static void processAttrCert5(X509AttributeCertificate x509AttributeCertificate, PKIXExtendedParameters pKIXExtendedParameters) throws CertPathValidatorException { try { x509AttributeCertificate.checkValidity(CertPathValidatorUtilities.getValidDate(pKIXExtendedParameters)); } catch (CertificateExpiredException e) { throw new ExtCertPathValidatorException("Attribute certificate is not valid.", e); } catch (CertificateNotYetValidException e2) { throw new ExtCertPathValidatorException("Attribute certificate is not valid.", e2); } } protected static void processAttrCert4(X509Certificate x509Certificate, Set set) throws CertPathValidatorException { Iterator it = set.iterator(); boolean z = false; while (it.hasNext()) { TrustAnchor trustAnchor = (TrustAnchor) it.next(); if (x509Certificate.getSubjectX500Principal().getName("RFC2253").equals(trustAnchor.getCAName()) || x509Certificate.equals(trustAnchor.getTrustedCert())) { z = true; } } if (!z) { throw new CertPathValidatorException("Attribute certificate issuer is not directly trusted."); } } protected static void processAttrCert3(X509Certificate x509Certificate, PKIXExtendedParameters pKIXExtendedParameters) throws CertPathValidatorException { if (x509Certificate.getKeyUsage() != null && !x509Certificate.getKeyUsage()[0] && !x509Certificate.getKeyUsage()[1]) { throw new CertPathValidatorException("Attribute certificate issuer public key cannot be used to validate digital signatures."); } if (x509Certificate.getBasicConstraints() != -1) { throw new CertPathValidatorException("Attribute certificate issuer is also a public key certificate issuer."); } } protected static CertPathValidatorResult processAttrCert2(CertPath certPath, PKIXExtendedParameters pKIXExtendedParameters) throws CertPathValidatorException { try { try { return CertPathValidator.getInstance("PKIX", BouncyCastleProvider.PROVIDER_NAME).validate(certPath, pKIXExtendedParameters); } catch (InvalidAlgorithmParameterException e) { throw new RuntimeException(e.getMessage()); } catch (CertPathValidatorException e2) { throw new ExtCertPathValidatorException("Certification path for issuer certificate of attribute certificate could not be validated.", e2); } } catch (NoSuchAlgorithmException e3) { throw new ExtCertPathValidatorException("Support class could not be created.", e3); } catch (NoSuchProviderException e4) { throw new ExtCertPathValidatorException("Support class could not be created.", e4); } } protected static CertPath processAttrCert1(X509AttributeCertificate x509AttributeCertificate, PKIXExtendedParameters pKIXExtendedParameters) throws CertPathValidatorException { HashSet hashSet = new HashSet(); if (x509AttributeCertificate.getHolder().getIssuer() != null) { X509CertSelector x509CertSelector = new X509CertSelector(); x509CertSelector.setSerialNumber(x509AttributeCertificate.getHolder().getSerialNumber()); for (Principal principal : x509AttributeCertificate.getHolder().getIssuer()) { try { if (principal instanceof X500Principal) { x509CertSelector.setIssuer(((X500Principal) principal).getEncoded()); } hashSet.addAll(CertPathValidatorUtilities.findCertificates(new PKIXCertStoreSelector.Builder(x509CertSelector).build(), pKIXExtendedParameters.getCertStores())); } catch (IOException e) { throw new ExtCertPathValidatorException("Unable to encode X500 principal.", e); } catch (AnnotatedException e2) { throw new ExtCertPathValidatorException("Public key certificate for attribute certificate cannot be searched.", e2); } } if (hashSet.isEmpty()) { throw new CertPathValidatorException("Public key certificate specified in base certificate ID for attribute certificate cannot be found."); } } if (x509AttributeCertificate.getHolder().getEntityNames() != null) { X509CertStoreSelector x509CertStoreSelector = new X509CertStoreSelector(); for (Principal principal2 : x509AttributeCertificate.getHolder().getEntityNames()) { try { if (principal2 instanceof X500Principal) { x509CertStoreSelector.setIssuer(((X500Principal) principal2).getEncoded()); } hashSet.addAll(CertPathValidatorUtilities.findCertificates(new PKIXCertStoreSelector.Builder(x509CertStoreSelector).build(), pKIXExtendedParameters.getCertStores())); } catch (IOException e3) { throw new ExtCertPathValidatorException("Unable to encode X500 principal.", e3); } catch (AnnotatedException e4) { throw new ExtCertPathValidatorException("Public key certificate for attribute certificate cannot be searched.", e4); } } if (hashSet.isEmpty()) { throw new CertPathValidatorException("Public key certificate specified in entity name for attribute certificate cannot be found."); } } PKIXExtendedParameters.Builder builder = new PKIXExtendedParameters.Builder(pKIXExtendedParameters); Iterator it = hashSet.iterator(); ExtCertPathValidatorException extCertPathValidatorException = null; CertPathBuilderResult certPathBuilderResult = null; while (it.hasNext()) { X509CertStoreSelector x509CertStoreSelector2 = new X509CertStoreSelector(); x509CertStoreSelector2.setCertificate((X509Certificate) it.next()); builder.setTargetConstraints(new PKIXCertStoreSelector.Builder(x509CertStoreSelector2).build()); try { try { certPathBuilderResult = CertPathBuilder.getInstance("PKIX", BouncyCastleProvider.PROVIDER_NAME).build(new PKIXExtendedBuilderParameters.Builder(builder.build()).build()); } catch (InvalidAlgorithmParameterException e5) { throw new RuntimeException(e5.getMessage()); } catch (CertPathBuilderException e6) { extCertPathValidatorException = new ExtCertPathValidatorException("Certification path for public key certificate of attribute certificate could not be build.", e6); } } catch (NoSuchAlgorithmException e7) { throw new ExtCertPathValidatorException("Support class could not be created.", e7); } catch (NoSuchProviderException e8) { throw new ExtCertPathValidatorException("Support class could not be created.", e8); } } if (extCertPathValidatorException == null) { return certPathBuilderResult.getCertPath(); } throw extCertPathValidatorException; } /* JADX WARN: Removed duplicated region for block: B:41:0x0118 */ /* JADX WARN: Removed duplicated region for block: B:55:0x0172 */ /* Code decompiled incorrectly, please refer to instructions dump. To view partially-correct add '--show-bad-code' argument */ protected static void checkCRLs(org.bouncycastle.x509.X509AttributeCertificate r18, org.bouncycastle.jcajce.PKIXExtendedParameters r19, java.security.cert.X509Certificate r20, java.util.Date r21, java.util.List r22, org.bouncycastle.jcajce.util.JcaJceHelper r23) throws java.security.cert.CertPathValidatorException { /* Method dump skipped, instructions count: 422 To view this dump add '--comments-level debug' option */ throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3281CertPathUtilities.checkCRLs(org.bouncycastle.x509.X509AttributeCertificate, org.bouncycastle.jcajce.PKIXExtendedParameters, java.security.cert.X509Certificate, java.util.Date, java.util.List, org.bouncycastle.jcajce.util.JcaJceHelper):void"); } /* JADX WARN: Code restructure failed: missing block: B:52:0x00eb, code lost: return; */ /* Code decompiled incorrectly, please refer to instructions dump. To view partially-correct add '--show-bad-code' argument */ private static void checkCRL(org.bouncycastle.asn1.x509.DistributionPoint r21, org.bouncycastle.x509.X509AttributeCertificate r22, org.bouncycastle.jcajce.PKIXExtendedParameters r23, java.util.Date r24, java.security.cert.X509Certificate r25, org.bouncycastle.jce.provider.CertStatus r26, org.bouncycastle.jce.provider.ReasonsMask r27, java.util.List r28, org.bouncycastle.jcajce.util.JcaJceHelper r29) throws org.bouncycastle.jce.provider.AnnotatedException { /* r1 = r21 r9 = r22 r10 = r23 r11 = r24 r12 = r26 r13 = r27 org.bouncycastle.asn1.ASN1ObjectIdentifier r0 = org.bouncycastle.asn1.x509.X509Extensions.NoRevAvail java.lang.String r0 = r0.getId() byte[] r0 = r9.getExtensionValue(r0) if (r0 == 0) goto L19 return L19: java.util.Date r14 = new java.util.Date long r2 = java.lang.System.currentTimeMillis() r14.(r2) long r2 = r24.getTime() long r4 = r14.getTime() int r0 = (r2 > r4 ? 1 : (r2 == r4 ? 0 : -1)) if (r0 > 0) goto Led java.util.Set r0 = org.bouncycastle.jce.provider.CertPathValidatorUtilities.getCompleteCRLs(r1, r9, r14, r10) java.util.Iterator r15 = r0.iterator() r16 = 0 r0 = 0 r17 = r0 r0 = r16 L3d: boolean r2 = r15.hasNext() if (r2 == 0) goto Le9 int r2 = r26.getCertStatus() r8 = 11 if (r2 != r8) goto Le9 boolean r2 = r27.isAllReasons() if (r2 != 0) goto Le9 java.lang.Object r2 = r15.next() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le2 r7 = r2 java.security.cert.X509CRL r7 = (java.security.cert.X509CRL) r7 // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le2 org.bouncycastle.jce.provider.ReasonsMask r6 = org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLD(r7, r1) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le2 boolean r2 = r6.hasNewReasons(r13) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le2 if (r2 == 0) goto L3d r4 = 0 r5 = 0 r2 = r7 r3 = r22 r18 = r6 r6 = r23 r19 = r7 r7 = r28 r25 = r15 r15 = r8 r8 = r29 java.util.Set r2 = org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLF(r2, r3, r4, r5, r6, r7, r8) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 r3 = r19 java.security.PublicKey r2 = org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLG(r3, r2) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 boolean r4 = r23.isUseDeltasEnabled() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 if (r4 == 0) goto L95 java.util.List r4 = r23.getCertStores() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 java.util.List r5 = r23.getCRLStores() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 java.util.Set r4 = org.bouncycastle.jce.provider.CertPathValidatorUtilities.getDeltaCRLs(r14, r3, r4, r5) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 java.security.cert.X509CRL r2 = org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLH(r4, r2) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 goto L97 L95: r2 = r16 L97: int r4 = r23.getValidityModel() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 r5 = 1 if (r4 == r5) goto Lbb java.util.Date r4 = r22.getNotAfter() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 long r6 = r4.getTime() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 java.util.Date r4 = r3.getThisUpdate() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 long r19 = r4.getTime() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 int r4 = (r6 > r19 ? 1 : (r6 == r19 ? 0 : -1)) if (r4 < 0) goto Lb3 goto Lbb Lb3: org.bouncycastle.jce.provider.AnnotatedException r0 = new org.bouncycastle.jce.provider.AnnotatedException // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 java.lang.String r2 = "No valid CRL for current time found." r0.(r2) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 throw r0 // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 Lbb: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLB1(r1, r9, r3) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLB2(r1, r9, r3) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLC(r2, r3, r10) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLI(r11, r2, r9, r12, r10) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCRLJ(r11, r3, r9, r12) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 int r2 = r26.getCertStatus() // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 r3 = 8 if (r2 != r3) goto Ld5 r12.setCertStatus(r15) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 Ld5: r2 = r18 r13.addReasons(r2) // Catch: org.bouncycastle.jce.provider.AnnotatedException -> Le0 r15 = r25 r17 = r5 goto L3d Le0: r0 = move-exception goto Le5 Le2: r0 = move-exception r25 = r15 Le5: r15 = r25 goto L3d Le9: if (r17 == 0) goto Lec return Lec: throw r0 Led: org.bouncycastle.jce.provider.AnnotatedException r0 = new org.bouncycastle.jce.provider.AnnotatedException java.lang.String r1 = "Validation time is in future." r0.(r1) throw r0 */ throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3281CertPathUtilities.checkCRL(org.bouncycastle.asn1.x509.DistributionPoint, org.bouncycastle.x509.X509AttributeCertificate, org.bouncycastle.jcajce.PKIXExtendedParameters, java.util.Date, java.security.cert.X509Certificate, org.bouncycastle.jce.provider.CertStatus, org.bouncycastle.jce.provider.ReasonsMask, java.util.List, org.bouncycastle.jcajce.util.JcaJceHelper):void"); } protected static void additionalChecks(X509AttributeCertificate x509AttributeCertificate, Set set, Set set2) throws CertPathValidatorException { Iterator it = set.iterator(); while (it.hasNext()) { String str = (String) it.next(); if (x509AttributeCertificate.getAttributes(str) != null) { StringBuilder sb = new StringBuilder("Attribute certificate contains prohibited attribute: "); sb.append(str); sb.append("."); throw new CertPathValidatorException(sb.toString()); } } Iterator it2 = set2.iterator(); while (it2.hasNext()) { String str2 = (String) it2.next(); if (x509AttributeCertificate.getAttributes(str2) == null) { StringBuilder sb2 = new StringBuilder("Attribute certificate does not contain necessary attribute: "); sb2.append(str2); sb2.append("."); throw new CertPathValidatorException(sb2.toString()); } } } RFC3281CertPathUtilities() { } }