package org.bouncycastle.jce.provider; import com.huawei.hms.android.SystemUtils; import java.io.IOException; import java.math.BigInteger; import java.security.GeneralSecurityException; import java.security.PublicKey; import java.security.cert.CRL; import java.security.cert.CertPath; import java.security.cert.CertPathBuilderException; import java.security.cert.CertPathValidatorException; import java.security.cert.Certificate; import java.security.cert.CertificateExpiredException; import java.security.cert.CertificateNotYetValidException; import java.security.cert.PKIXCertPathChecker; import java.security.cert.X509CRL; import java.security.cert.X509CRLSelector; import java.security.cert.X509CertSelector; import java.security.cert.X509Certificate; import java.security.cert.X509Extension; import java.util.ArrayList; import java.util.Collection; import java.util.Date; import java.util.Enumeration; import java.util.HashSet; import java.util.Iterator; import java.util.List; import java.util.Set; import org.bouncycastle.asn1.ASN1Encodable; import org.bouncycastle.asn1.ASN1EncodableVector; import org.bouncycastle.asn1.ASN1Integer; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.ASN1Primitive; import org.bouncycastle.asn1.ASN1Sequence; import org.bouncycastle.asn1.ASN1String; import org.bouncycastle.asn1.ASN1TaggedObject; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.x500.RDN; import org.bouncycastle.asn1.x500.X500Name; import org.bouncycastle.asn1.x500.style.BCStyle; import org.bouncycastle.asn1.x509.BasicConstraints; import org.bouncycastle.asn1.x509.CRLDistPoint; import org.bouncycastle.asn1.x509.DistributionPoint; import org.bouncycastle.asn1.x509.DistributionPointName; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.asn1.x509.GeneralSubtree; import org.bouncycastle.asn1.x509.IssuingDistributionPoint; import org.bouncycastle.asn1.x509.NameConstraints; import org.bouncycastle.asn1.x509.PolicyInformation; import org.bouncycastle.jcajce.PKIXCRLStoreSelector; import org.bouncycastle.jcajce.PKIXCertStoreSelector; import org.bouncycastle.jcajce.PKIXExtendedBuilderParameters; import org.bouncycastle.jcajce.PKIXExtendedParameters; import org.bouncycastle.jcajce.util.JcaJceHelper; import org.bouncycastle.jce.exception.ExtCertPathValidatorException; import org.bouncycastle.util.Arrays; /* loaded from: classes6.dex */ class RFC3280CertPathUtilities { public static final String ANY_POLICY = "2.5.29.32.0"; protected static final int CRL_SIGN = 6; protected static final int KEY_CERT_SIGN = 5; private static final PKIXCRLUtil CRL_UTIL = new PKIXCRLUtil(); public static final String CERTIFICATE_POLICIES = Extension.certificatePolicies.getId(); public static final String POLICY_MAPPINGS = Extension.policyMappings.getId(); public static final String INHIBIT_ANY_POLICY = Extension.inhibitAnyPolicy.getId(); public static final String ISSUING_DISTRIBUTION_POINT = Extension.issuingDistributionPoint.getId(); public static final String FRESHEST_CRL = Extension.freshestCRL.getId(); public static final String DELTA_CRL_INDICATOR = Extension.deltaCRLIndicator.getId(); public static final String POLICY_CONSTRAINTS = Extension.policyConstraints.getId(); public static final String BASIC_CONSTRAINTS = Extension.basicConstraints.getId(); public static final String CRL_DISTRIBUTION_POINTS = Extension.cRLDistributionPoints.getId(); public static final String SUBJECT_ALTERNATIVE_NAME = Extension.subjectAlternativeName.getId(); public static final String NAME_CONSTRAINTS = Extension.nameConstraints.getId(); public static final String AUTHORITY_KEY_IDENTIFIER = Extension.authorityKeyIdentifier.getId(); public static final String KEY_USAGE = Extension.keyUsage.getId(); public static final String CRL_NUMBER = Extension.cRLNumber.getId(); protected static final String[] crlReasons = {"unspecified", "keyCompromise", "cACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", SystemUtils.UNKNOWN, "removeFromCRL", "privilegeWithdrawn", "aACompromise"}; /* JADX INFO: Access modifiers changed from: protected */ public static PKIXPolicyNode wrapupCertG(CertPath certPath, PKIXExtendedParameters pKIXExtendedParameters, Set set, int i, List[] listArr, PKIXPolicyNode pKIXPolicyNode, Set set2) throws CertPathValidatorException { int size = certPath.getCertificates().size(); if (pKIXPolicyNode == null) { if (pKIXExtendedParameters.isExplicitPolicyRequired()) { throw new ExtCertPathValidatorException("Explicit policy requested but none available.", null, certPath, i); } return null; } if (!CertPathValidatorUtilities.isAnyPolicy(set)) { HashSet hashSet = new HashSet(); for (List list : listArr) { for (int i2 = 0; i2 < list.size(); i2++) { PKIXPolicyNode pKIXPolicyNode2 = (PKIXPolicyNode) list.get(i2); if (ANY_POLICY.equals(pKIXPolicyNode2.getValidPolicy())) { Iterator children = pKIXPolicyNode2.getChildren(); while (children.hasNext()) { PKIXPolicyNode pKIXPolicyNode3 = (PKIXPolicyNode) children.next(); if (!ANY_POLICY.equals(pKIXPolicyNode3.getValidPolicy())) { hashSet.add(pKIXPolicyNode3); } } } } } for (PKIXPolicyNode pKIXPolicyNode4 : hashSet) { if (!set.contains(pKIXPolicyNode4.getValidPolicy())) { pKIXPolicyNode = CertPathValidatorUtilities.removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode4); } } if (pKIXPolicyNode != null) { for (int i3 = size - 1; i3 >= 0; i3--) { List list2 = listArr[i3]; for (int i4 = 0; i4 < list2.size(); i4++) { PKIXPolicyNode pKIXPolicyNode5 = (PKIXPolicyNode) list2.get(i4); if (!pKIXPolicyNode5.hasChildren()) { pKIXPolicyNode = CertPathValidatorUtilities.removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode5); } } } } } else if (pKIXExtendedParameters.isExplicitPolicyRequired()) { if (set2.isEmpty()) { throw new ExtCertPathValidatorException("Explicit policy requested but none available.", null, certPath, i); } HashSet hashSet2 = new HashSet(); for (List list3 : listArr) { for (int i5 = 0; i5 < list3.size(); i5++) { PKIXPolicyNode pKIXPolicyNode6 = (PKIXPolicyNode) list3.get(i5); if (ANY_POLICY.equals(pKIXPolicyNode6.getValidPolicy())) { Iterator children2 = pKIXPolicyNode6.getChildren(); while (children2.hasNext()) { hashSet2.add(children2.next()); } } } } Iterator it = hashSet2.iterator(); while (it.hasNext()) { set2.contains(((PKIXPolicyNode) it.next()).getValidPolicy()); } if (pKIXPolicyNode != null) { for (int i6 = size - 1; i6 >= 0; i6--) { List list4 = listArr[i6]; for (int i7 = 0; i7 < list4.size(); i7++) { PKIXPolicyNode pKIXPolicyNode7 = (PKIXPolicyNode) list4.get(i7); if (!pKIXPolicyNode7.hasChildren()) { pKIXPolicyNode = CertPathValidatorUtilities.removePolicyNode(pKIXPolicyNode, listArr, pKIXPolicyNode7); } } } } } return pKIXPolicyNode; } /* JADX INFO: Access modifiers changed from: protected */ public static void wrapupCertF(CertPath certPath, int i, List list, Set set) throws CertPathValidatorException { X509Certificate x509Certificate = (X509Certificate) certPath.getCertificates().get(i); Iterator it = list.iterator(); while (it.hasNext()) { try { ((PKIXCertPathChecker) it.next()).check(x509Certificate, set); } catch (CertPathValidatorException e) { throw new ExtCertPathValidatorException("Additional certificate path checker failed.", e, certPath, i); } } if (!set.isEmpty()) { throw new ExtCertPathValidatorException("Certificate has unsupported critical extension: ".concat(String.valueOf(set)), null, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static int wrapupCertB(CertPath certPath, int i, int i2) throws CertPathValidatorException { try { ASN1Sequence dERSequence = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), POLICY_CONSTRAINTS)); if (dERSequence != null) { Enumeration objects = dERSequence.getObjects(); while (objects.hasMoreElements()) { ASN1TaggedObject aSN1TaggedObject = (ASN1TaggedObject) objects.nextElement(); if (aSN1TaggedObject.getTagNo() == 0) { try { if (ASN1Integer.getInstance(aSN1TaggedObject, false).getValue().intValue() == 0) { return 0; } } catch (Exception e) { throw new ExtCertPathValidatorException("Policy constraints requireExplicitPolicy field could not be decoded.", e, certPath, i); } } } } return i2; } catch (AnnotatedException e2) { throw new ExtCertPathValidatorException("Policy constraints could not be decoded.", e2, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static int wrapupCertA(int i, X509Certificate x509Certificate) { return (CertPathValidatorUtilities.isSelfIssued(x509Certificate) || i == 0) ? i : i - 1; } /* JADX INFO: Access modifiers changed from: protected */ public static void processCertF(CertPath certPath, int i, PKIXPolicyNode pKIXPolicyNode, int i2) throws CertPathValidatorException { if (i2 <= 0 && pKIXPolicyNode == null) { throw new ExtCertPathValidatorException("No valid policy tree found when one expected.", null, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static PKIXPolicyNode processCertE(CertPath certPath, int i, PKIXPolicyNode pKIXPolicyNode) throws CertPathValidatorException { try { if (DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), CERTIFICATE_POLICIES)) == null) { return null; } return pKIXPolicyNode; } catch (AnnotatedException e) { throw new ExtCertPathValidatorException("Could not read certificate policies extension from certificate.", e, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static PKIXPolicyNode processCertD(CertPath certPath, int i, Set set, PKIXPolicyNode pKIXPolicyNode, List[] listArr, int i2) throws CertPathValidatorException { String str; int i3; List certificates = certPath.getCertificates(); X509Certificate x509Certificate = (X509Certificate) certificates.get(i); int size = certificates.size(); int i4 = size - i; try { ASN1Sequence dERSequence = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(x509Certificate, CERTIFICATE_POLICIES)); if (dERSequence == null || pKIXPolicyNode == null) { return null; } Enumeration objects = dERSequence.getObjects(); HashSet hashSet = new HashSet(); while (objects.hasMoreElements()) { PolicyInformation policyInformation = PolicyInformation.getInstance(objects.nextElement()); ASN1ObjectIdentifier policyIdentifier = policyInformation.getPolicyIdentifier(); hashSet.add(policyIdentifier.getId()); if (!ANY_POLICY.equals(policyIdentifier.getId())) { try { Set qualifierSet = CertPathValidatorUtilities.getQualifierSet(policyInformation.getPolicyQualifiers()); if (!CertPathValidatorUtilities.processCertD1i(i4, listArr, policyIdentifier, qualifierSet)) { CertPathValidatorUtilities.processCertD1ii(i4, listArr, policyIdentifier, qualifierSet); } } catch (CertPathValidatorException e) { throw new ExtCertPathValidatorException("Policy qualifier info set could not be build.", e, certPath, i); } } } if (set.isEmpty() || set.contains(ANY_POLICY)) { set.clear(); set.addAll(hashSet); } else { HashSet hashSet2 = new HashSet(); for (Object obj : set) { if (hashSet.contains(obj)) { hashSet2.add(obj); } } set.clear(); set.addAll(hashSet2); } if (i2 > 0 || (i4 < size && CertPathValidatorUtilities.isSelfIssued(x509Certificate))) { Enumeration objects2 = dERSequence.getObjects(); while (true) { if (!objects2.hasMoreElements()) { break; } PolicyInformation policyInformation2 = PolicyInformation.getInstance(objects2.nextElement()); if (ANY_POLICY.equals(policyInformation2.getPolicyIdentifier().getId())) { Set qualifierSet2 = CertPathValidatorUtilities.getQualifierSet(policyInformation2.getPolicyQualifiers()); List list = listArr[i4 - 1]; for (int i5 = 0; i5 < list.size(); i5++) { PKIXPolicyNode pKIXPolicyNode2 = (PKIXPolicyNode) list.get(i5); for (Object obj2 : pKIXPolicyNode2.getExpectedPolicies()) { if (obj2 instanceof String) { str = (String) obj2; } else if (obj2 instanceof ASN1ObjectIdentifier) { str = ((ASN1ObjectIdentifier) obj2).getId(); } String str2 = str; Iterator children = pKIXPolicyNode2.getChildren(); boolean z = false; while (children.hasNext()) { if (str2.equals(((PKIXPolicyNode) children.next()).getValidPolicy())) { z = true; } } if (!z) { HashSet hashSet3 = new HashSet(); hashSet3.add(str2); PKIXPolicyNode pKIXPolicyNode3 = new PKIXPolicyNode(new ArrayList(), i4, hashSet3, pKIXPolicyNode2, qualifierSet2, str2, false); pKIXPolicyNode2.addChild(pKIXPolicyNode3); listArr[i4].add(pKIXPolicyNode3); } } } } } } PKIXPolicyNode pKIXPolicyNode4 = pKIXPolicyNode; for (int i6 = i4 - 1; i6 >= 0; i6--) { List list2 = listArr[i6]; while (i3 < list2.size()) { PKIXPolicyNode pKIXPolicyNode5 = (PKIXPolicyNode) list2.get(i3); i3 = (pKIXPolicyNode5.hasChildren() || (pKIXPolicyNode4 = CertPathValidatorUtilities.removePolicyNode(pKIXPolicyNode4, listArr, pKIXPolicyNode5)) != null) ? i3 + 1 : 0; } } Set criticalExtensionOIDs = x509Certificate.getCriticalExtensionOIDs(); if (criticalExtensionOIDs != null) { boolean contains = criticalExtensionOIDs.contains(CERTIFICATE_POLICIES); List list3 = listArr[i4]; for (int i7 = 0; i7 < list3.size(); i7++) { ((PKIXPolicyNode) list3.get(i7)).setCritical(contains); } } return pKIXPolicyNode4; } catch (AnnotatedException e2) { throw new ExtCertPathValidatorException("Could not read certificate policies extension from certificate.", e2, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static void processCertBC(CertPath certPath, int i, PKIXNameConstraintValidator pKIXNameConstraintValidator) throws CertPathValidatorException { List certificates = certPath.getCertificates(); X509Certificate x509Certificate = (X509Certificate) certificates.get(i); int size = certificates.size(); if (!CertPathValidatorUtilities.isSelfIssued(x509Certificate) || size - i >= size) { try { ASN1Sequence dERSequence = DERSequence.getInstance(PrincipalUtils.getSubjectPrincipal(x509Certificate).getEncoded()); try { pKIXNameConstraintValidator.checkPermittedDN(dERSequence); pKIXNameConstraintValidator.checkExcludedDN(dERSequence); try { GeneralNames generalNames = GeneralNames.getInstance(CertPathValidatorUtilities.getExtensionValue(x509Certificate, SUBJECT_ALTERNATIVE_NAME)); RDN[] rDNs = X500Name.getInstance(dERSequence).getRDNs(BCStyle.EmailAddress); for (int i2 = 0; i2 != rDNs.length; i2++) { GeneralName generalName = new GeneralName(1, ((ASN1String) rDNs[i2].getFirst().getValue()).getString()); try { pKIXNameConstraintValidator.checkPermitted(generalName); pKIXNameConstraintValidator.checkExcluded(generalName); } catch (PKIXNameConstraintValidatorException e) { throw new CertPathValidatorException("Subtree check for certificate subject alternative email failed.", e, certPath, i); } } if (generalNames != null) { try { GeneralName[] names = generalNames.getNames(); for (int i3 = 0; i3 < names.length; i3++) { try { pKIXNameConstraintValidator.checkPermitted(names[i3]); pKIXNameConstraintValidator.checkExcluded(names[i3]); } catch (PKIXNameConstraintValidatorException e2) { throw new CertPathValidatorException("Subtree check for certificate subject alternative name failed.", e2, certPath, i); } } } catch (Exception e3) { throw new CertPathValidatorException("Subject alternative name contents could not be decoded.", e3, certPath, i); } } } catch (Exception e4) { throw new CertPathValidatorException("Subject alternative name extension could not be decoded.", e4, certPath, i); } } catch (PKIXNameConstraintValidatorException e5) { throw new CertPathValidatorException("Subtree check for certificate subject failed.", e5, certPath, i); } } catch (Exception e6) { throw new CertPathValidatorException("Exception extracting subject name when checking subtrees.", e6, certPath, i); } } } /* JADX INFO: Access modifiers changed from: protected */ public static void processCertA(CertPath certPath, PKIXExtendedParameters pKIXExtendedParameters, int i, PublicKey publicKey, boolean z, X500Name x500Name, X509Certificate x509Certificate, JcaJceHelper jcaJceHelper) throws ExtCertPathValidatorException { List certificates = certPath.getCertificates(); X509Certificate x509Certificate2 = (X509Certificate) certificates.get(i); if (!z) { try { CertPathValidatorUtilities.verifyX509Certificate(x509Certificate2, publicKey, pKIXExtendedParameters.getSigProvider()); } catch (GeneralSecurityException e) { throw new ExtCertPathValidatorException("Could not validate certificate signature.", e, certPath, i); } } try { x509Certificate2.checkValidity(CertPathValidatorUtilities.getValidCertDateFromValidityModel(pKIXExtendedParameters, certPath, i)); if (pKIXExtendedParameters.isRevocationEnabled()) { try { checkCRLs(pKIXExtendedParameters, x509Certificate2, CertPathValidatorUtilities.getValidCertDateFromValidityModel(pKIXExtendedParameters, certPath, i), x509Certificate, publicKey, certificates, jcaJceHelper); } catch (AnnotatedException e2) { throw new ExtCertPathValidatorException(e2.getMessage(), e2.getCause() != null ? e2.getCause() : e2, certPath, i); } } if (PrincipalUtils.getEncodedIssuerPrincipal(x509Certificate2).equals(x500Name)) { return; } StringBuilder sb = new StringBuilder("IssuerName("); sb.append(PrincipalUtils.getEncodedIssuerPrincipal(x509Certificate2)); sb.append(") does not match SubjectName("); sb.append(x500Name); sb.append(") of signing certificate."); throw new ExtCertPathValidatorException(sb.toString(), null, certPath, i); } catch (CertificateExpiredException e3) { StringBuilder sb2 = new StringBuilder("Could not validate certificate: "); sb2.append(e3.getMessage()); throw new ExtCertPathValidatorException(sb2.toString(), e3, certPath, i); } catch (CertificateNotYetValidException e4) { StringBuilder sb3 = new StringBuilder("Could not validate certificate: "); sb3.append(e4.getMessage()); throw new ExtCertPathValidatorException(sb3.toString(), e4, certPath, i); } catch (AnnotatedException e5) { throw new ExtCertPathValidatorException("Could not validate time of certificate.", e5, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static void processCRLJ(Date date, X509CRL x509crl, Object obj, CertStatus certStatus) throws AnnotatedException { if (certStatus.getCertStatus() == 11) { CertPathValidatorUtilities.getCertStatus(date, x509crl, obj, certStatus); } } /* JADX INFO: Access modifiers changed from: protected */ public static void processCRLI(Date date, X509CRL x509crl, Object obj, CertStatus certStatus, PKIXExtendedParameters pKIXExtendedParameters) throws AnnotatedException { if (!pKIXExtendedParameters.isUseDeltasEnabled() || x509crl == null) { return; } CertPathValidatorUtilities.getCertStatus(date, x509crl, obj, certStatus); } /* JADX INFO: Access modifiers changed from: protected */ public static X509CRL processCRLH(Set set, PublicKey publicKey) throws AnnotatedException { Iterator it = set.iterator(); Exception e = null; while (it.hasNext()) { X509CRL x509crl = (X509CRL) it.next(); try { x509crl.verify(publicKey); return x509crl; } catch (Exception e2) { e = e2; } } if (e == null) { return null; } throw new AnnotatedException("Cannot verify delta CRL.", e); } /* JADX INFO: Access modifiers changed from: protected */ public static PublicKey processCRLG(X509CRL x509crl, Set set) throws AnnotatedException { Iterator it = set.iterator(); Exception e = null; while (it.hasNext()) { PublicKey publicKey = (PublicKey) it.next(); try { x509crl.verify(publicKey); return publicKey; } catch (Exception e2) { e = e2; } } throw new AnnotatedException("Cannot verify CRL.", e); } /* JADX INFO: Access modifiers changed from: protected */ public static Set processCRLF(X509CRL x509crl, Object obj, X509Certificate x509Certificate, PublicKey publicKey, PKIXExtendedParameters pKIXExtendedParameters, List list, JcaJceHelper jcaJceHelper) throws AnnotatedException { int i; X509CertSelector x509CertSelector = new X509CertSelector(); try { x509CertSelector.setSubject(PrincipalUtils.getIssuerPrincipal(x509crl).getEncoded()); PKIXCertStoreSelector build = new PKIXCertStoreSelector.Builder(x509CertSelector).build(); try { Collection findCertificates = CertPathValidatorUtilities.findCertificates(build, pKIXExtendedParameters.getCertificateStores()); findCertificates.addAll(CertPathValidatorUtilities.findCertificates(build, pKIXExtendedParameters.getCertStores())); findCertificates.add(x509Certificate); Iterator it = findCertificates.iterator(); ArrayList arrayList = new ArrayList(); ArrayList arrayList2 = new ArrayList(); while (true) { if (!it.hasNext()) { break; } X509Certificate x509Certificate2 = (X509Certificate) it.next(); if (x509Certificate2.equals(x509Certificate)) { arrayList.add(x509Certificate2); arrayList2.add(publicKey); } else { try { PKIXCertPathBuilderSpi pKIXCertPathBuilderSpi = new PKIXCertPathBuilderSpi(); X509CertSelector x509CertSelector2 = new X509CertSelector(); x509CertSelector2.setCertificate(x509Certificate2); PKIXExtendedParameters.Builder targetConstraints = new PKIXExtendedParameters.Builder(pKIXExtendedParameters).setTargetConstraints(new PKIXCertStoreSelector.Builder(x509CertSelector2).build()); if (list.contains(x509Certificate2)) { targetConstraints.setRevocationEnabled(false); } else { targetConstraints.setRevocationEnabled(true); } List certificates = pKIXCertPathBuilderSpi.engineBuild(new PKIXExtendedBuilderParameters.Builder(targetConstraints.build()).build()).getCertPath().getCertificates(); arrayList.add(x509Certificate2); arrayList2.add(CertPathValidatorUtilities.getNextWorkingKey(certificates, 0, jcaJceHelper)); } catch (CertPathBuilderException e) { throw new AnnotatedException("CertPath for CRL signer failed to validate.", e); } catch (CertPathValidatorException e2) { throw new AnnotatedException("Public key of issuer certificate of CRL could not be retrieved.", e2); } catch (Exception e3) { throw new AnnotatedException(e3.getMessage()); } } } HashSet hashSet = new HashSet(); AnnotatedException annotatedException = null; for (i = 0; i < arrayList.size(); i++) { boolean[] keyUsage = ((X509Certificate) arrayList.get(i)).getKeyUsage(); if (keyUsage == null || (keyUsage.length >= 7 && keyUsage[6])) { hashSet.add(arrayList2.get(i)); } else { annotatedException = new AnnotatedException("Issuer certificate key usage extension does not permit CRL signing."); } } if (hashSet.isEmpty() && annotatedException == null) { throw new AnnotatedException("Cannot find a valid issuer certificate."); } if (!hashSet.isEmpty() || annotatedException == null) { return hashSet; } throw annotatedException; } catch (AnnotatedException e4) { throw new AnnotatedException("Issuer certificate for CRL cannot be searched.", e4); } } catch (IOException e5) { throw new AnnotatedException("Subject criteria for certificate selector to find issuer certificate for CRL could not be set.", e5); } } /* JADX INFO: Access modifiers changed from: protected */ public static ReasonsMask processCRLD(X509CRL x509crl, DistributionPoint distributionPoint) throws AnnotatedException { try { IssuingDistributionPoint issuingDistributionPoint = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl, ISSUING_DISTRIBUTION_POINT)); if (issuingDistributionPoint != null && issuingDistributionPoint.getOnlySomeReasons() != null && distributionPoint.getReasons() != null) { return new ReasonsMask(distributionPoint.getReasons()).intersect(new ReasonsMask(issuingDistributionPoint.getOnlySomeReasons())); } if ((issuingDistributionPoint == null || issuingDistributionPoint.getOnlySomeReasons() == null) && distributionPoint.getReasons() == null) { return ReasonsMask.allReasons; } return (distributionPoint.getReasons() == null ? ReasonsMask.allReasons : new ReasonsMask(distributionPoint.getReasons())).intersect(issuingDistributionPoint == null ? ReasonsMask.allReasons : new ReasonsMask(issuingDistributionPoint.getOnlySomeReasons())); } catch (Exception e) { throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e); } } /* JADX INFO: Access modifiers changed from: protected */ public static void processCRLC(X509CRL x509crl, X509CRL x509crl2, PKIXExtendedParameters pKIXExtendedParameters) throws AnnotatedException { if (x509crl == null) { return; } try { String str = ISSUING_DISTRIBUTION_POINT; IssuingDistributionPoint issuingDistributionPoint = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl2, str)); if (pKIXExtendedParameters.isUseDeltasEnabled()) { if (!PrincipalUtils.getIssuerPrincipal(x509crl).equals(PrincipalUtils.getIssuerPrincipal(x509crl2))) { throw new AnnotatedException("Complete CRL issuer does not match delta CRL issuer."); } try { IssuingDistributionPoint issuingDistributionPoint2 = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl, str)); if (issuingDistributionPoint != null ? !issuingDistributionPoint.equals(issuingDistributionPoint2) : issuingDistributionPoint2 != null) { throw new AnnotatedException("Issuing distribution point extension from delta CRL and complete CRL does not match."); } try { String str2 = AUTHORITY_KEY_IDENTIFIER; ASN1Primitive extensionValue = CertPathValidatorUtilities.getExtensionValue(x509crl2, str2); try { ASN1Primitive extensionValue2 = CertPathValidatorUtilities.getExtensionValue(x509crl, str2); if (extensionValue == null) { throw new AnnotatedException("CRL authority key identifier is null."); } if (extensionValue2 == null) { throw new AnnotatedException("Delta CRL authority key identifier is null."); } if (!extensionValue.equals(extensionValue2)) { throw new AnnotatedException("Delta CRL authority key identifier does not match complete CRL authority key identifier."); } } catch (AnnotatedException e) { throw new AnnotatedException("Authority key identifier extension could not be extracted from delta CRL.", e); } } catch (AnnotatedException e2) { throw new AnnotatedException("Authority key identifier extension could not be extracted from complete CRL.", e2); } } catch (Exception e3) { throw new AnnotatedException("Issuing distribution point extension from delta CRL could not be decoded.", e3); } } } catch (Exception e4) { throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e4); } } /* JADX INFO: Access modifiers changed from: protected */ public static void processCRLB2(DistributionPoint distributionPoint, Object obj, X509CRL x509crl) throws AnnotatedException { int i; GeneralName[] generalNameArr; try { IssuingDistributionPoint issuingDistributionPoint = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl, ISSUING_DISTRIBUTION_POINT)); if (issuingDistributionPoint != null) { if (issuingDistributionPoint.getDistributionPoint() != null) { DistributionPointName distributionPoint2 = IssuingDistributionPoint.getInstance(issuingDistributionPoint).getDistributionPoint(); ArrayList arrayList = new ArrayList(); if (distributionPoint2.getType() == 0) { for (GeneralName generalName : GeneralNames.getInstance(distributionPoint2.getName()).getNames()) { arrayList.add(generalName); } } if (distributionPoint2.getType() == 1) { ASN1EncodableVector aSN1EncodableVector = new ASN1EncodableVector(); try { Enumeration objects = ASN1Sequence.getInstance(PrincipalUtils.getIssuerPrincipal(x509crl)).getObjects(); while (objects.hasMoreElements()) { aSN1EncodableVector.add((ASN1Encodable) objects.nextElement()); } aSN1EncodableVector.add(distributionPoint2.getName()); arrayList.add(new GeneralName(X500Name.getInstance(new DERSequence(aSN1EncodableVector)))); } catch (Exception e) { throw new AnnotatedException("Could not read CRL issuer.", e); } } if (distributionPoint.getDistributionPoint() == null) { if (distributionPoint.getCRLIssuer() == null) { throw new AnnotatedException("Either the cRLIssuer or the distributionPoint field must be contained in DistributionPoint."); } GeneralName[] names = distributionPoint.getCRLIssuer().getNames(); while (i < names.length) { i = arrayList.contains(names[i]) ? 0 : i + 1; } throw new AnnotatedException("No match for certificate CRL issuing distribution point name to cRLIssuer CRL distribution point."); } DistributionPointName distributionPoint3 = distributionPoint.getDistributionPoint(); GeneralName[] names2 = distributionPoint3.getType() == 0 ? GeneralNames.getInstance(distributionPoint3.getName()).getNames() : null; if (distributionPoint3.getType() == 1) { if (distributionPoint.getCRLIssuer() != null) { generalNameArr = distributionPoint.getCRLIssuer().getNames(); } else { generalNameArr = new GeneralName[1]; try { generalNameArr[0] = new GeneralName(X500Name.getInstance(PrincipalUtils.getEncodedIssuerPrincipal(obj).getEncoded())); } catch (Exception e2) { throw new AnnotatedException("Could not read certificate issuer.", e2); } } names2 = generalNameArr; for (int i2 = 0; i2 < names2.length; i2++) { Enumeration objects2 = ASN1Sequence.getInstance(names2[i2].getName().toASN1Primitive()).getObjects(); ASN1EncodableVector aSN1EncodableVector2 = new ASN1EncodableVector(); while (objects2.hasMoreElements()) { aSN1EncodableVector2.add((ASN1Encodable) objects2.nextElement()); } aSN1EncodableVector2.add(distributionPoint3.getName()); names2[i2] = new GeneralName(X500Name.getInstance(new DERSequence(aSN1EncodableVector2))); } } if (names2 != null) { while (i < names2.length) { i = arrayList.contains(names2[i]) ? 0 : i + 1; } } throw new AnnotatedException("No match for certificate CRL issuing distribution point name to cRLIssuer CRL distribution point."); } try { BasicConstraints basicConstraints = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Extension) obj, BASIC_CONSTRAINTS)); if (obj instanceof X509Certificate) { if (issuingDistributionPoint.onlyContainsUserCerts() && basicConstraints != null && basicConstraints.isCA()) { throw new AnnotatedException("CA Cert CRL only contains user certificates."); } if (issuingDistributionPoint.onlyContainsCACerts() && (basicConstraints == null || !basicConstraints.isCA())) { throw new AnnotatedException("End CRL only contains CA certificates."); } } if (issuingDistributionPoint.onlyContainsAttributeCerts()) { throw new AnnotatedException("onlyContainsAttributeCerts boolean is asserted."); } } catch (Exception e3) { throw new AnnotatedException("Basic constraints extension could not be decoded.", e3); } } } catch (Exception e4) { throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e4); } } /* JADX INFO: Access modifiers changed from: protected */ public static void processCRLB1(DistributionPoint distributionPoint, Object obj, X509CRL x509crl) throws AnnotatedException { ASN1Primitive extensionValue = CertPathValidatorUtilities.getExtensionValue(x509crl, ISSUING_DISTRIBUTION_POINT); boolean z = extensionValue != null && IssuingDistributionPoint.getInstance(extensionValue).isIndirectCRL(); try { byte[] encoded = PrincipalUtils.getIssuerPrincipal(x509crl).getEncoded(); if (distributionPoint.getCRLIssuer() != null) { GeneralName[] names = distributionPoint.getCRLIssuer().getNames(); boolean z2 = false; for (int i = 0; i < names.length; i++) { if (names[i].getTagNo() == 4) { try { if (Arrays.areEqual(names[i].getName().toASN1Primitive().getEncoded(), encoded)) { z2 = true; } } catch (IOException e) { throw new AnnotatedException("CRL issuer information from distribution point cannot be decoded.", e); } } } if (z2 && !z) { throw new AnnotatedException("Distribution point contains cRLIssuer field but CRL is not indirect."); } if (!z2) { throw new AnnotatedException("CRL issuer of CRL does not match CRL issuer of distribution point."); } if (z2) { return; } } else if (PrincipalUtils.getIssuerPrincipal(x509crl).equals(PrincipalUtils.getEncodedIssuerPrincipal(obj))) { return; } throw new AnnotatedException("Cannot find matching CRL issuer for certificate."); } catch (IOException e2) { StringBuilder sb = new StringBuilder("Exception encoding CRL issuer: "); sb.append(e2.getMessage()); throw new AnnotatedException(sb.toString(), e2); } } protected static Set[] processCRLA1ii(Date date, PKIXExtendedParameters pKIXExtendedParameters, X509Certificate x509Certificate, X509CRL x509crl) throws AnnotatedException { HashSet hashSet = new HashSet(); X509CRLSelector x509CRLSelector = new X509CRLSelector(); x509CRLSelector.setCertificateChecking(x509Certificate); try { x509CRLSelector.addIssuerName(PrincipalUtils.getIssuerPrincipal(x509crl).getEncoded()); PKIXCRLStoreSelector build = new PKIXCRLStoreSelector.Builder(x509CRLSelector).setCompleteCRLEnabled(true).build(); if (pKIXExtendedParameters.getDate() != null) { date = pKIXExtendedParameters.getDate(); } Set findCRLs = CRL_UTIL.findCRLs(build, date, pKIXExtendedParameters.getCertStores(), pKIXExtendedParameters.getCRLStores()); if (pKIXExtendedParameters.isUseDeltasEnabled()) { try { hashSet.addAll(CertPathValidatorUtilities.getDeltaCRLs(date, x509crl, pKIXExtendedParameters.getCertStores(), pKIXExtendedParameters.getCRLStores())); } catch (AnnotatedException e) { throw new AnnotatedException("Exception obtaining delta CRLs.", e); } } return new Set[]{findCRLs, hashSet}; } catch (IOException e2) { throw new AnnotatedException("Cannot extract issuer from CRL.".concat(String.valueOf(e2)), e2); } } protected static Set processCRLA1i(Date date, PKIXExtendedParameters pKIXExtendedParameters, X509Certificate x509Certificate, X509CRL x509crl) throws AnnotatedException { HashSet hashSet = new HashSet(); if (pKIXExtendedParameters.isUseDeltasEnabled()) { try { String str = FRESHEST_CRL; CRLDistPoint cRLDistPoint = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509Certificate, str)); if (cRLDistPoint == null) { try { cRLDistPoint = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(x509crl, str)); } catch (AnnotatedException e) { throw new AnnotatedException("Freshest CRL extension could not be decoded from CRL.", e); } } if (cRLDistPoint != null) { ArrayList arrayList = new ArrayList(); arrayList.addAll(pKIXExtendedParameters.getCRLStores()); try { arrayList.addAll(CertPathValidatorUtilities.getAdditionalStoresFromCRLDistributionPoint(cRLDistPoint, pKIXExtendedParameters.getNamedCRLStoreMap())); try { hashSet.addAll(CertPathValidatorUtilities.getDeltaCRLs(date, x509crl, pKIXExtendedParameters.getCertStores(), arrayList)); } catch (AnnotatedException e2) { throw new AnnotatedException("Exception obtaining delta CRLs.", e2); } } catch (AnnotatedException e3) { throw new AnnotatedException("No new delta CRL locations could be added from Freshest CRL extension.", e3); } } } catch (AnnotatedException e4) { throw new AnnotatedException("Freshest CRL extension could not be decoded from certificate.", e4); } } return hashSet; } /* JADX INFO: Access modifiers changed from: protected */ public static void prepareNextCertO(CertPath certPath, int i, Set set, List list) throws CertPathValidatorException { X509Certificate x509Certificate = (X509Certificate) certPath.getCertificates().get(i); Iterator it = list.iterator(); while (it.hasNext()) { try { ((PKIXCertPathChecker) it.next()).check(x509Certificate, set); } catch (CertPathValidatorException e) { throw new CertPathValidatorException(e.getMessage(), e.getCause(), certPath, i); } } if (!set.isEmpty()) { throw new ExtCertPathValidatorException("Certificate has unsupported critical extension: ".concat(String.valueOf(set)), null, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static void prepareNextCertN(CertPath certPath, int i) throws CertPathValidatorException { boolean[] keyUsage = ((X509Certificate) certPath.getCertificates().get(i)).getKeyUsage(); if (keyUsage != null && !keyUsage[5]) { throw new ExtCertPathValidatorException("Issuer certificate keyusage extension is critical and does not permit key signing.", null, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static int prepareNextCertM(CertPath certPath, int i, int i2) throws CertPathValidatorException { BigInteger pathLenConstraint; int intValue; try { BasicConstraints basicConstraints = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), BASIC_CONSTRAINTS)); return (basicConstraints == null || (pathLenConstraint = basicConstraints.getPathLenConstraint()) == null || (intValue = pathLenConstraint.intValue()) >= i2) ? i2 : intValue; } catch (Exception e) { throw new ExtCertPathValidatorException("Basic constraints extension cannot be decoded.", e, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static int prepareNextCertL(CertPath certPath, int i, int i2) throws CertPathValidatorException { if (CertPathValidatorUtilities.isSelfIssued((X509Certificate) certPath.getCertificates().get(i))) { return i2; } if (i2 > 0) { return i2 - 1; } throw new ExtCertPathValidatorException("Max path length not greater than zero", null, certPath, i); } /* JADX INFO: Access modifiers changed from: protected */ public static void prepareNextCertK(CertPath certPath, int i) throws CertPathValidatorException { try { BasicConstraints basicConstraints = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), BASIC_CONSTRAINTS)); if (basicConstraints == null) { throw new CertPathValidatorException("Intermediate certificate lacks BasicConstraints"); } if (!basicConstraints.isCA()) { throw new CertPathValidatorException("Not a CA certificate"); } } catch (Exception e) { throw new ExtCertPathValidatorException("Basic constraints extension cannot be decoded.", e, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static int prepareNextCertJ(CertPath certPath, int i, int i2) throws CertPathValidatorException { int intValue; try { ASN1Integer aSN1Integer = ASN1Integer.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), INHIBIT_ANY_POLICY)); return (aSN1Integer == null || (intValue = aSN1Integer.getValue().intValue()) >= i2) ? i2 : intValue; } catch (Exception e) { throw new ExtCertPathValidatorException("Inhibit any-policy extension cannot be decoded.", e, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ /* JADX WARN: Code restructure failed: missing block: B:12:0x002f, code lost: r4 = org.bouncycastle.asn1.ASN1Integer.getInstance(r1, false).getValue().intValue(); */ /* JADX WARN: Code restructure failed: missing block: B:13:0x003c, code lost: if (r4 >= r6) goto L16; */ /* JADX WARN: Code restructure failed: missing block: B:14:0x003e, code lost: return r4; */ /* Code decompiled incorrectly, please refer to instructions dump. To view partially-correct add '--show-bad-code' argument */ public static int prepareNextCertI2(java.security.cert.CertPath r4, int r5, int r6) throws java.security.cert.CertPathValidatorException { /* java.util.List r0 = r4.getCertificates() java.lang.Object r0 = r0.get(r5) java.security.cert.X509Certificate r0 = (java.security.cert.X509Certificate) r0 java.lang.String r1 = org.bouncycastle.jce.provider.RFC3280CertPathUtilities.POLICY_CONSTRAINTS // Catch: java.lang.Exception -> L49 org.bouncycastle.asn1.ASN1Primitive r0 = org.bouncycastle.jce.provider.CertPathValidatorUtilities.getExtensionValue(r0, r1) // Catch: java.lang.Exception -> L49 org.bouncycastle.asn1.ASN1Sequence r0 = org.bouncycastle.asn1.DERSequence.getInstance(r0) // Catch: java.lang.Exception -> L49 if (r0 == 0) goto L48 java.util.Enumeration r0 = r0.getObjects() L1a: boolean r1 = r0.hasMoreElements() if (r1 == 0) goto L48 java.lang.Object r1 = r0.nextElement() // Catch: java.lang.IllegalArgumentException -> L3f org.bouncycastle.asn1.ASN1TaggedObject r1 = org.bouncycastle.asn1.ASN1TaggedObject.getInstance(r1) // Catch: java.lang.IllegalArgumentException -> L3f int r2 = r1.getTagNo() // Catch: java.lang.IllegalArgumentException -> L3f r3 = 1 if (r2 != r3) goto L1a r0 = 0 org.bouncycastle.asn1.ASN1Integer r0 = org.bouncycastle.asn1.ASN1Integer.getInstance(r1, r0) // Catch: java.lang.IllegalArgumentException -> L3f java.math.BigInteger r0 = r0.getValue() // Catch: java.lang.IllegalArgumentException -> L3f int r4 = r0.intValue() // Catch: java.lang.IllegalArgumentException -> L3f if (r4 >= r6) goto L48 return r4 L3f: r6 = move-exception org.bouncycastle.jce.exception.ExtCertPathValidatorException r0 = new org.bouncycastle.jce.exception.ExtCertPathValidatorException java.lang.String r1 = "Policy constraints extension contents cannot be decoded." r0.(r1, r6, r4, r5) throw r0 L48: return r6 L49: r6 = move-exception org.bouncycastle.jce.exception.ExtCertPathValidatorException r0 = new org.bouncycastle.jce.exception.ExtCertPathValidatorException java.lang.String r1 = "Policy constraints extension cannot be decoded." r0.(r1, r6, r4, r5) throw r0 */ throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.prepareNextCertI2(java.security.cert.CertPath, int, int):int"); } /* JADX INFO: Access modifiers changed from: protected */ /* JADX WARN: Code restructure failed: missing block: B:12:0x002e, code lost: r3 = org.bouncycastle.asn1.ASN1Integer.getInstance(r1, false).getValue().intValue(); */ /* JADX WARN: Code restructure failed: missing block: B:13:0x003b, code lost: if (r3 >= r5) goto L16; */ /* JADX WARN: Code restructure failed: missing block: B:14:0x003d, code lost: return r3; */ /* Code decompiled incorrectly, please refer to instructions dump. To view partially-correct add '--show-bad-code' argument */ public static int prepareNextCertI1(java.security.cert.CertPath r3, int r4, int r5) throws java.security.cert.CertPathValidatorException { /* java.util.List r0 = r3.getCertificates() java.lang.Object r0 = r0.get(r4) java.security.cert.X509Certificate r0 = (java.security.cert.X509Certificate) r0 java.lang.String r1 = org.bouncycastle.jce.provider.RFC3280CertPathUtilities.POLICY_CONSTRAINTS // Catch: java.lang.Exception -> L48 org.bouncycastle.asn1.ASN1Primitive r0 = org.bouncycastle.jce.provider.CertPathValidatorUtilities.getExtensionValue(r0, r1) // Catch: java.lang.Exception -> L48 org.bouncycastle.asn1.ASN1Sequence r0 = org.bouncycastle.asn1.DERSequence.getInstance(r0) // Catch: java.lang.Exception -> L48 if (r0 == 0) goto L47 java.util.Enumeration r0 = r0.getObjects() L1a: boolean r1 = r0.hasMoreElements() if (r1 == 0) goto L47 java.lang.Object r1 = r0.nextElement() // Catch: java.lang.IllegalArgumentException -> L3e org.bouncycastle.asn1.ASN1TaggedObject r1 = org.bouncycastle.asn1.ASN1TaggedObject.getInstance(r1) // Catch: java.lang.IllegalArgumentException -> L3e int r2 = r1.getTagNo() // Catch: java.lang.IllegalArgumentException -> L3e if (r2 != 0) goto L1a r0 = 0 org.bouncycastle.asn1.ASN1Integer r0 = org.bouncycastle.asn1.ASN1Integer.getInstance(r1, r0) // Catch: java.lang.IllegalArgumentException -> L3e java.math.BigInteger r0 = r0.getValue() // Catch: java.lang.IllegalArgumentException -> L3e int r3 = r0.intValue() // Catch: java.lang.IllegalArgumentException -> L3e if (r3 >= r5) goto L47 return r3 L3e: r5 = move-exception org.bouncycastle.jce.exception.ExtCertPathValidatorException r0 = new org.bouncycastle.jce.exception.ExtCertPathValidatorException java.lang.String r1 = "Policy constraints extension contents cannot be decoded." r0.(r1, r5, r3, r4) throw r0 L47: return r5 L48: r5 = move-exception org.bouncycastle.jce.exception.ExtCertPathValidatorException r0 = new org.bouncycastle.jce.exception.ExtCertPathValidatorException java.lang.String r1 = "Policy constraints extension cannot be decoded." r0.(r1, r5, r3, r4) throw r0 */ throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.prepareNextCertI1(java.security.cert.CertPath, int, int):int"); } /* JADX INFO: Access modifiers changed from: protected */ public static int prepareNextCertH3(CertPath certPath, int i, int i2) { return (CertPathValidatorUtilities.isSelfIssued((X509Certificate) certPath.getCertificates().get(i)) || i2 == 0) ? i2 : i2 - 1; } /* JADX INFO: Access modifiers changed from: protected */ public static int prepareNextCertH2(CertPath certPath, int i, int i2) { return (CertPathValidatorUtilities.isSelfIssued((X509Certificate) certPath.getCertificates().get(i)) || i2 == 0) ? i2 : i2 - 1; } /* JADX INFO: Access modifiers changed from: protected */ public static int prepareNextCertH1(CertPath certPath, int i, int i2) { return (CertPathValidatorUtilities.isSelfIssued((X509Certificate) certPath.getCertificates().get(i)) || i2 == 0) ? i2 : i2 - 1; } /* JADX INFO: Access modifiers changed from: protected */ public static void prepareNextCertG(CertPath certPath, int i, PKIXNameConstraintValidator pKIXNameConstraintValidator) throws CertPathValidatorException { try { ASN1Sequence dERSequence = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), NAME_CONSTRAINTS)); NameConstraints nameConstraints = dERSequence != null ? NameConstraints.getInstance(dERSequence) : null; if (nameConstraints != null) { GeneralSubtree[] permittedSubtrees = nameConstraints.getPermittedSubtrees(); if (permittedSubtrees != null) { try { pKIXNameConstraintValidator.intersectPermittedSubtree(permittedSubtrees); } catch (Exception e) { throw new ExtCertPathValidatorException("Permitted subtrees cannot be build from name constraints extension.", e, certPath, i); } } GeneralSubtree[] excludedSubtrees = nameConstraints.getExcludedSubtrees(); if (excludedSubtrees != null) { for (int i2 = 0; i2 != excludedSubtrees.length; i2++) { try { pKIXNameConstraintValidator.addExcludedSubtree(excludedSubtrees[i2]); } catch (Exception e2) { throw new ExtCertPathValidatorException("Excluded subtrees cannot be build from name constraints extension.", e2, certPath, i); } } } } } catch (Exception e3) { throw new ExtCertPathValidatorException("Name constraints extension could not be decoded.", e3, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ public static void prepareNextCertA(CertPath certPath, int i) throws CertPathValidatorException { try { ASN1Sequence dERSequence = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Certificate) certPath.getCertificates().get(i), POLICY_MAPPINGS)); if (dERSequence != null) { for (int i2 = 0; i2 < dERSequence.size(); i2++) { try { ASN1Sequence dERSequence2 = DERSequence.getInstance(dERSequence.getObjectAt(i2)); ASN1ObjectIdentifier aSN1ObjectIdentifier = ASN1ObjectIdentifier.getInstance(dERSequence2.getObjectAt(0)); ASN1ObjectIdentifier aSN1ObjectIdentifier2 = ASN1ObjectIdentifier.getInstance(dERSequence2.getObjectAt(1)); if (ANY_POLICY.equals(aSN1ObjectIdentifier.getId())) { throw new CertPathValidatorException("IssuerDomainPolicy is anyPolicy", null, certPath, i); } if (ANY_POLICY.equals(aSN1ObjectIdentifier2.getId())) { throw new CertPathValidatorException("SubjectDomainPolicy is anyPolicy,", null, certPath, i); } } catch (Exception e) { throw new ExtCertPathValidatorException("Policy mappings extension contents could not be decoded.", e, certPath, i); } } } } catch (AnnotatedException e2) { throw new ExtCertPathValidatorException("Policy mappings extension could not be decoded.", e2, certPath, i); } } /* JADX INFO: Access modifiers changed from: protected */ /* JADX WARN: Code restructure failed: missing block: B:32:0x00aa, code lost: r5 = r20[r3].iterator(); */ /* JADX WARN: Code restructure failed: missing block: B:34:0x00b4, code lost: if (r5.hasNext() == false) goto L92; */ /* JADX WARN: Code restructure failed: missing block: B:35:0x00b6, code lost: r6 = (org.bouncycastle.jce.provider.PKIXPolicyNode) r5.next(); */ /* JADX WARN: Code restructure failed: missing block: B:36:0x00c6, code lost: if (org.bouncycastle.jce.provider.RFC3280CertPathUtilities.ANY_POLICY.equals(r6.getValidPolicy()) == false) goto L100; */ /* JADX WARN: Code restructure failed: missing block: B:39:0x00d0, code lost: r5 = ((org.bouncycastle.asn1.ASN1Sequence) org.bouncycastle.jce.provider.CertPathValidatorUtilities.getExtensionValue(r4, org.bouncycastle.jce.provider.RFC3280CertPathUtilities.CERTIFICATE_POLICIES)).getObjects(); */ /* JADX WARN: Code restructure failed: missing block: B:41:0x00d8, code lost: if (r5.hasMoreElements() == false) goto L101; */ /* JADX WARN: Code restructure failed: missing block: B:43:0x00da, code lost: r7 = org.bouncycastle.asn1.x509.PolicyInformation.getInstance(r5.nextElement()); */ /* JADX WARN: Code restructure failed: missing block: B:45:0x00ee, code lost: if (org.bouncycastle.jce.provider.RFC3280CertPathUtilities.ANY_POLICY.equals(r7.getPolicyIdentifier().getId()) == false) goto L102; */ /* JADX WARN: Code restructure failed: missing block: B:47:0x00f0, code lost: r5 = org.bouncycastle.jce.provider.CertPathValidatorUtilities.getQualifierSet(r7.getPolicyQualifiers()); */ /* JADX WARN: Code restructure failed: missing block: B:48:0x010c, code lost: r10 = r5; */ /* JADX WARN: Code restructure failed: missing block: B:49:0x0111, code lost: if (r4.getCriticalExtensionOIDs() == null) goto L48; */ /* JADX WARN: Code restructure failed: missing block: B:50:0x0113, code lost: r12 = r4.getCriticalExtensionOIDs().contains(org.bouncycastle.jce.provider.RFC3280CertPathUtilities.CERTIFICATE_POLICIES); */ /* JADX WARN: Code restructure failed: missing block: B:51:0x0120, code lost: r9 = (org.bouncycastle.jce.provider.PKIXPolicyNode) r6.getParent(); */ /* JADX WARN: Code restructure failed: missing block: B:52:0x012f, code lost: if (org.bouncycastle.jce.provider.RFC3280CertPathUtilities.ANY_POLICY.equals(r9.getValidPolicy()) == false) goto L93; */ /* JADX WARN: Code restructure failed: missing block: B:53:0x0131, code lost: r8 = new org.bouncycastle.jce.provider.PKIXPolicyNode(new java.util.ArrayList(), r3, (java.util.Set) r13.get(r11), r9, r10, r11, r12); r9.addChild(r8); r20[r3].add(r8); */ /* JADX WARN: Code restructure failed: missing block: B:56:0x011f, code lost: r12 = r14; */ /* JADX WARN: Code restructure failed: missing block: B:58:0x00f9, code lost: r0 = move-exception; */ /* JADX WARN: Code restructure failed: missing block: B:60:0x0101, code lost: throw new org.bouncycastle.jce.exception.ExtCertPathValidatorException("Policy qualifier info set could not be decoded.", r0, r18, r19); */ /* JADX WARN: Code restructure failed: missing block: B:64:0x0102, code lost: r0 = move-exception; */ /* JADX WARN: Code restructure failed: missing block: B:66:0x010a, code lost: throw new java.security.cert.CertPathValidatorException("Policy information could not be decoded.", r0, r18, r19); */ /* JADX WARN: Code restructure failed: missing block: B:68:0x010b, code lost: r5 = null; */ /* JADX WARN: Code restructure failed: missing block: B:70:0x0155, code lost: r0 = move-exception; */ /* JADX WARN: Code restructure failed: missing block: B:72:0x015d, code lost: throw new org.bouncycastle.jce.exception.ExtCertPathValidatorException("Certificate policies extension could not be decoded.", r0, r18, r19); */ /* JADX WARN: Code restructure failed: missing block: B:74:0x01b2, code lost: continue; */ /* Code decompiled incorrectly, please refer to instructions dump. To view partially-correct add '--show-bad-code' argument */ public static org.bouncycastle.jce.provider.PKIXPolicyNode prepareCertB(java.security.cert.CertPath r18, int r19, java.util.List[] r20, org.bouncycastle.jce.provider.PKIXPolicyNode r21, int r22) throws java.security.cert.CertPathValidatorException { /* Method dump skipped, instructions count: 449 To view this dump add '--comments-level debug' option */ throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.prepareCertB(java.security.cert.CertPath, int, java.util.List[], org.bouncycastle.jce.provider.PKIXPolicyNode, int):org.bouncycastle.jce.provider.PKIXPolicyNode"); } /* JADX WARN: Removed duplicated region for block: B:21:0x00fc */ /* JADX WARN: Removed duplicated region for block: B:27:0x0109 */ /* Code decompiled incorrectly, please refer to instructions dump. To view partially-correct add '--show-bad-code' argument */ protected static void checkCRLs(org.bouncycastle.jcajce.PKIXExtendedParameters r20, java.security.cert.X509Certificate r21, java.util.Date r22, java.security.cert.X509Certificate r23, java.security.PublicKey r24, java.util.List r25, org.bouncycastle.jcajce.util.JcaJceHelper r26) throws org.bouncycastle.jce.provider.AnnotatedException { /* Method dump skipped, instructions count: 393 To view this dump add '--comments-level debug' option */ throw new UnsupportedOperationException("Method not decompiled: org.bouncycastle.jce.provider.RFC3280CertPathUtilities.checkCRLs(org.bouncycastle.jcajce.PKIXExtendedParameters, java.security.cert.X509Certificate, java.util.Date, java.security.cert.X509Certificate, java.security.PublicKey, java.util.List, org.bouncycastle.jcajce.util.JcaJceHelper):void"); } private static void checkCRL(DistributionPoint distributionPoint, PKIXExtendedParameters pKIXExtendedParameters, X509Certificate x509Certificate, Date date, X509Certificate x509Certificate2, PublicKey publicKey, CertStatus certStatus, ReasonsMask reasonsMask, List list, JcaJceHelper jcaJceHelper) throws AnnotatedException { Date date2; Iterator it; Set criticalExtensionOIDs; Date date3 = new Date(System.currentTimeMillis()); if (date.getTime() > date3.getTime()) { throw new AnnotatedException("Validation time is in future."); } Iterator it2 = CertPathValidatorUtilities.getCompleteCRLs(distributionPoint, x509Certificate, date3, pKIXExtendedParameters).iterator(); boolean z = false; AnnotatedException e = null; while (it2.hasNext() && certStatus.getCertStatus() == 11 && !reasonsMask.isAllReasons()) { try { X509CRL x509crl = (X509CRL) it2.next(); ReasonsMask processCRLD = processCRLD(x509crl, distributionPoint); if (processCRLD.hasNewReasons(reasonsMask)) { date2 = date3; it = it2; AnnotatedException annotatedException = e; try { X509CRL processCRLH = pKIXExtendedParameters.isUseDeltasEnabled() ? processCRLH(CertPathValidatorUtilities.getDeltaCRLs(pKIXExtendedParameters.getDate() != null ? pKIXExtendedParameters.getDate() : date2, x509crl, pKIXExtendedParameters.getCertStores(), pKIXExtendedParameters.getCRLStores()), processCRLG(x509crl, processCRLF(x509crl, x509Certificate, x509Certificate2, publicKey, pKIXExtendedParameters, list, jcaJceHelper))) : null; if (pKIXExtendedParameters.getValidityModel() != 1 && x509Certificate.getNotAfter().getTime() < x509crl.getThisUpdate().getTime()) { throw new AnnotatedException("No valid CRL for current time found."); } processCRLB1(distributionPoint, x509Certificate, x509crl); processCRLB2(distributionPoint, x509Certificate, x509crl); processCRLC(processCRLH, x509crl, pKIXExtendedParameters); processCRLI(date, processCRLH, x509Certificate, certStatus, pKIXExtendedParameters); processCRLJ(date, x509crl, x509Certificate, certStatus); if (certStatus.getCertStatus() == 8) { certStatus.setCertStatus(11); } reasonsMask.addReasons(processCRLD); Set criticalExtensionOIDs2 = x509crl.getCriticalExtensionOIDs(); if (criticalExtensionOIDs2 != null) { HashSet hashSet = new HashSet(criticalExtensionOIDs2); hashSet.remove(Extension.issuingDistributionPoint.getId()); hashSet.remove(Extension.deltaCRLIndicator.getId()); if (!hashSet.isEmpty()) { throw new AnnotatedException("CRL contains unsupported critical extensions."); } } if (processCRLH != null && (criticalExtensionOIDs = processCRLH.getCriticalExtensionOIDs()) != null) { HashSet hashSet2 = new HashSet(criticalExtensionOIDs); hashSet2.remove(Extension.issuingDistributionPoint.getId()); hashSet2.remove(Extension.deltaCRLIndicator.getId()); if (!hashSet2.isEmpty()) { throw new AnnotatedException("Delta CRL contains unsupported critical extension."); } } z = true; date3 = date2; it2 = it; e = annotatedException; } catch (AnnotatedException e2) { e = e2; date3 = date2; it2 = it; } } } catch (AnnotatedException e3) { e = e3; date2 = date3; it = it2; } } AnnotatedException annotatedException2 = e; if (!z) { throw annotatedException2; } } RFC3280CertPathUtilities() { } }