267 lines
17 KiB
Java
267 lines
17 KiB
Java
package org.bouncycastle.jce.provider;
|
|
|
|
import java.security.InvalidAlgorithmParameterException;
|
|
import java.security.PublicKey;
|
|
import java.security.cert.CertPath;
|
|
import java.security.cert.CertPathParameters;
|
|
import java.security.cert.CertPathValidatorException;
|
|
import java.security.cert.CertPathValidatorResult;
|
|
import java.security.cert.CertPathValidatorSpi;
|
|
import java.security.cert.Certificate;
|
|
import java.security.cert.PKIXCertPathChecker;
|
|
import java.security.cert.PKIXCertPathValidatorResult;
|
|
import java.security.cert.PKIXParameters;
|
|
import java.security.cert.TrustAnchor;
|
|
import java.security.cert.X509Certificate;
|
|
import java.util.ArrayList;
|
|
import java.util.HashSet;
|
|
import java.util.Iterator;
|
|
import java.util.List;
|
|
import java.util.Set;
|
|
import org.bouncycastle.asn1.x500.X500Name;
|
|
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
|
|
import org.bouncycastle.asn1.x509.Extension;
|
|
import org.bouncycastle.jcajce.PKIXExtendedBuilderParameters;
|
|
import org.bouncycastle.jcajce.PKIXExtendedParameters;
|
|
import org.bouncycastle.jcajce.util.BCJcaJceHelper;
|
|
import org.bouncycastle.jcajce.util.JcaJceHelper;
|
|
import org.bouncycastle.jce.exception.ExtCertPathValidatorException;
|
|
import org.bouncycastle.x509.ExtendedPKIXParameters;
|
|
|
|
/* loaded from: classes6.dex */
|
|
public class PKIXCertPathValidatorSpi extends CertPathValidatorSpi {
|
|
private final JcaJceHelper helper = new BCJcaJceHelper();
|
|
|
|
/* JADX WARN: Multi-variable type inference failed */
|
|
/* JADX WARN: Type inference failed for: r14v1 */
|
|
/* JADX WARN: Type inference failed for: r14v2, types: [int, java.util.Set] */
|
|
/* JADX WARN: Type inference failed for: r14v3 */
|
|
/* JADX WARN: Type inference failed for: r14v4, types: [int] */
|
|
/* JADX WARN: Type inference failed for: r14v5 */
|
|
/* JADX WARN: Type inference failed for: r5v4 */
|
|
@Override // java.security.cert.CertPathValidatorSpi
|
|
public CertPathValidatorResult engineValidate(CertPath certPath, CertPathParameters certPathParameters) throws CertPathValidatorException, InvalidAlgorithmParameterException {
|
|
PKIXExtendedParameters pKIXExtendedParameters;
|
|
X500Name ca;
|
|
PublicKey cAPublicKey;
|
|
HashSet hashSet;
|
|
int i;
|
|
ArrayList[] arrayListArr;
|
|
HashSet hashSet2;
|
|
PKIXCertPathValidatorSpi pKIXCertPathValidatorSpi = this;
|
|
if (certPathParameters instanceof PKIXParameters) {
|
|
PKIXExtendedParameters.Builder builder = new PKIXExtendedParameters.Builder((PKIXParameters) certPathParameters);
|
|
if (certPathParameters instanceof ExtendedPKIXParameters) {
|
|
ExtendedPKIXParameters extendedPKIXParameters = (ExtendedPKIXParameters) certPathParameters;
|
|
builder.setUseDeltasEnabled(extendedPKIXParameters.isUseDeltasEnabled());
|
|
builder.setValidityModel(extendedPKIXParameters.getValidityModel());
|
|
}
|
|
pKIXExtendedParameters = builder.build();
|
|
} else if (certPathParameters instanceof PKIXExtendedBuilderParameters) {
|
|
pKIXExtendedParameters = ((PKIXExtendedBuilderParameters) certPathParameters).getBaseParameters();
|
|
} else {
|
|
if (!(certPathParameters instanceof PKIXExtendedParameters)) {
|
|
StringBuilder sb = new StringBuilder("Parameters must be a ");
|
|
sb.append(PKIXParameters.class.getName());
|
|
sb.append(" instance.");
|
|
throw new InvalidAlgorithmParameterException(sb.toString());
|
|
}
|
|
pKIXExtendedParameters = (PKIXExtendedParameters) certPathParameters;
|
|
}
|
|
if (pKIXExtendedParameters.getTrustAnchors() == null) {
|
|
throw new InvalidAlgorithmParameterException("trustAnchors is null, this is not allowed for certification path validation.");
|
|
}
|
|
List<? extends Certificate> certificates = certPath.getCertificates();
|
|
int size = certificates.size();
|
|
if (certificates.isEmpty()) {
|
|
throw new CertPathValidatorException("Certification path is empty.", null, certPath, -1);
|
|
}
|
|
pKIXExtendedParameters.getInitialPolicies();
|
|
try {
|
|
TrustAnchor findTrustAnchor = CertPathValidatorUtilities.findTrustAnchor((X509Certificate) certificates.get(certificates.size() - 1), pKIXExtendedParameters.getTrustAnchors(), pKIXExtendedParameters.getSigProvider());
|
|
if (findTrustAnchor == null) {
|
|
throw new CertPathValidatorException("Trust anchor for certification path not found.", null, certPath, -1);
|
|
}
|
|
PKIXExtendedParameters build = new PKIXExtendedParameters.Builder(pKIXExtendedParameters).setTrustAnchor(findTrustAnchor).build();
|
|
int i2 = size + 1;
|
|
ArrayList[] arrayListArr2 = new ArrayList[i2];
|
|
boolean z = false;
|
|
for (int i3 = 0; i3 < i2; i3++) {
|
|
arrayListArr2[i3] = new ArrayList();
|
|
}
|
|
HashSet hashSet3 = new HashSet();
|
|
hashSet3.add(RFC3280CertPathUtilities.ANY_POLICY);
|
|
arrayListArr2[0].add(new PKIXPolicyNode(new ArrayList(), 0, hashSet3, null, new HashSet(), RFC3280CertPathUtilities.ANY_POLICY, false));
|
|
PKIXNameConstraintValidator pKIXNameConstraintValidator = new PKIXNameConstraintValidator();
|
|
HashSet hashSet4 = new HashSet();
|
|
int i4 = build.isExplicitPolicyRequired() ? 0 : i2;
|
|
int i5 = build.isAnyPolicyInhibited() ? 0 : i2;
|
|
if (build.isPolicyMappingInhibited()) {
|
|
i2 = 0;
|
|
}
|
|
X509Certificate trustedCert = findTrustAnchor.getTrustedCert();
|
|
try {
|
|
if (trustedCert != null) {
|
|
ca = PrincipalUtils.getSubjectPrincipal(trustedCert);
|
|
cAPublicKey = trustedCert.getPublicKey();
|
|
} else {
|
|
ca = PrincipalUtils.getCA(findTrustAnchor);
|
|
cAPublicKey = findTrustAnchor.getCAPublicKey();
|
|
}
|
|
try {
|
|
AlgorithmIdentifier algorithmIdentifier = CertPathValidatorUtilities.getAlgorithmIdentifier(cAPublicKey);
|
|
algorithmIdentifier.getAlgorithm();
|
|
algorithmIdentifier.getParameters();
|
|
if (build.getTargetConstraints() != null && !build.getTargetConstraints().match((Certificate) certificates.get(0))) {
|
|
throw new ExtCertPathValidatorException("Target certificate in certification path does not match targetConstraints.", null, certPath, 0);
|
|
}
|
|
List certPathCheckers = build.getCertPathCheckers();
|
|
Iterator it = certPathCheckers.iterator();
|
|
while (it.hasNext()) {
|
|
((PKIXCertPathChecker) it.next()).init(false);
|
|
}
|
|
int i6 = i2;
|
|
X509Certificate x509Certificate = null;
|
|
?? r14 = size;
|
|
?? size2 = certificates.size() - 1;
|
|
int i7 = i5;
|
|
PKIXPolicyNode pKIXPolicyNode = size2;
|
|
int i8 = size2;
|
|
while (i8 >= 0) {
|
|
X509Certificate x509Certificate2 = (X509Certificate) certificates.get(i8);
|
|
boolean z2 = i8 == certificates.size() + (-1) ? true : z;
|
|
JcaJceHelper jcaJceHelper = pKIXCertPathValidatorSpi.helper;
|
|
int i9 = i7;
|
|
List<? extends Certificate> list = certificates;
|
|
int i10 = i4;
|
|
int i11 = i8;
|
|
PKIXExtendedParameters pKIXExtendedParameters2 = build;
|
|
PKIXNameConstraintValidator pKIXNameConstraintValidator2 = pKIXNameConstraintValidator;
|
|
boolean z3 = z2;
|
|
boolean z4 = z;
|
|
ArrayList[] arrayListArr3 = arrayListArr2;
|
|
TrustAnchor trustAnchor = findTrustAnchor;
|
|
RFC3280CertPathUtilities.processCertA(certPath, build, i8, cAPublicKey, z3, ca, trustedCert, jcaJceHelper);
|
|
RFC3280CertPathUtilities.processCertBC(certPath, i11, pKIXNameConstraintValidator2);
|
|
PKIXPolicyNode processCertE = RFC3280CertPathUtilities.processCertE(certPath, i11, RFC3280CertPathUtilities.processCertD(certPath, i11, hashSet4, pKIXPolicyNode, arrayListArr3, i9));
|
|
RFC3280CertPathUtilities.processCertF(certPath, i11, processCertE, i10);
|
|
if (size - i11 == size) {
|
|
i = i11;
|
|
arrayListArr = arrayListArr3;
|
|
pKIXCertPathValidatorSpi = this;
|
|
pKIXPolicyNode = processCertE;
|
|
i7 = i9;
|
|
i4 = i10;
|
|
} else {
|
|
if (x509Certificate2 != null && x509Certificate2.getVersion() == 1) {
|
|
throw new CertPathValidatorException("Version 1 certificates can't be used as CA ones.", null, certPath, i11);
|
|
}
|
|
RFC3280CertPathUtilities.prepareNextCertA(certPath, i11);
|
|
arrayListArr = arrayListArr3;
|
|
PKIXPolicyNode prepareCertB = RFC3280CertPathUtilities.prepareCertB(certPath, i11, arrayListArr, processCertE, i6);
|
|
RFC3280CertPathUtilities.prepareNextCertG(certPath, i11, pKIXNameConstraintValidator2);
|
|
int prepareNextCertH1 = RFC3280CertPathUtilities.prepareNextCertH1(certPath, i11, i10);
|
|
int prepareNextCertH2 = RFC3280CertPathUtilities.prepareNextCertH2(certPath, i11, i6);
|
|
int prepareNextCertH3 = RFC3280CertPathUtilities.prepareNextCertH3(certPath, i11, i9);
|
|
int prepareNextCertI1 = RFC3280CertPathUtilities.prepareNextCertI1(certPath, i11, prepareNextCertH1);
|
|
int prepareNextCertI2 = RFC3280CertPathUtilities.prepareNextCertI2(certPath, i11, prepareNextCertH2);
|
|
int prepareNextCertJ = RFC3280CertPathUtilities.prepareNextCertJ(certPath, i11, prepareNextCertH3);
|
|
RFC3280CertPathUtilities.prepareNextCertK(certPath, i11);
|
|
r14 = RFC3280CertPathUtilities.prepareNextCertM(certPath, i11, RFC3280CertPathUtilities.prepareNextCertL(certPath, i11, r14));
|
|
RFC3280CertPathUtilities.prepareNextCertN(certPath, i11);
|
|
Set<String> criticalExtensionOIDs = x509Certificate2.getCriticalExtensionOIDs();
|
|
if (criticalExtensionOIDs != null) {
|
|
hashSet2 = new HashSet(criticalExtensionOIDs);
|
|
hashSet2.remove(RFC3280CertPathUtilities.KEY_USAGE);
|
|
hashSet2.remove(RFC3280CertPathUtilities.CERTIFICATE_POLICIES);
|
|
hashSet2.remove(RFC3280CertPathUtilities.POLICY_MAPPINGS);
|
|
hashSet2.remove(RFC3280CertPathUtilities.INHIBIT_ANY_POLICY);
|
|
hashSet2.remove(RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT);
|
|
hashSet2.remove(RFC3280CertPathUtilities.DELTA_CRL_INDICATOR);
|
|
hashSet2.remove(RFC3280CertPathUtilities.POLICY_CONSTRAINTS);
|
|
hashSet2.remove(RFC3280CertPathUtilities.BASIC_CONSTRAINTS);
|
|
hashSet2.remove(RFC3280CertPathUtilities.SUBJECT_ALTERNATIVE_NAME);
|
|
hashSet2.remove(RFC3280CertPathUtilities.NAME_CONSTRAINTS);
|
|
} else {
|
|
hashSet2 = new HashSet();
|
|
}
|
|
RFC3280CertPathUtilities.prepareNextCertO(certPath, i11, hashSet2, certPathCheckers);
|
|
X500Name subjectPrincipal = PrincipalUtils.getSubjectPrincipal(x509Certificate2);
|
|
try {
|
|
i = i11;
|
|
pKIXCertPathValidatorSpi = this;
|
|
try {
|
|
PublicKey nextWorkingKey = CertPathValidatorUtilities.getNextWorkingKey(certPath.getCertificates(), i, pKIXCertPathValidatorSpi.helper);
|
|
AlgorithmIdentifier algorithmIdentifier2 = CertPathValidatorUtilities.getAlgorithmIdentifier(nextWorkingKey);
|
|
algorithmIdentifier2.getAlgorithm();
|
|
algorithmIdentifier2.getParameters();
|
|
pKIXPolicyNode = prepareCertB;
|
|
i6 = prepareNextCertI2;
|
|
ca = subjectPrincipal;
|
|
cAPublicKey = nextWorkingKey;
|
|
trustedCert = x509Certificate2;
|
|
i4 = prepareNextCertI1;
|
|
i7 = prepareNextCertJ;
|
|
} catch (CertPathValidatorException e) {
|
|
e = e;
|
|
throw new CertPathValidatorException("Next working key could not be retrieved.", e, certPath, i);
|
|
}
|
|
} catch (CertPathValidatorException e2) {
|
|
e = e2;
|
|
i = i11;
|
|
}
|
|
}
|
|
int i12 = i - 1;
|
|
arrayListArr2 = arrayListArr;
|
|
x509Certificate = x509Certificate2;
|
|
z = z4;
|
|
certificates = list;
|
|
findTrustAnchor = trustAnchor;
|
|
pKIXNameConstraintValidator = pKIXNameConstraintValidator2;
|
|
build = pKIXExtendedParameters2;
|
|
i8 = i12;
|
|
r14 = r14;
|
|
}
|
|
PKIXExtendedParameters pKIXExtendedParameters3 = build;
|
|
ArrayList[] arrayListArr4 = arrayListArr2;
|
|
TrustAnchor trustAnchor2 = findTrustAnchor;
|
|
int i13 = i8;
|
|
int i14 = i13 + 1;
|
|
int wrapupCertB = RFC3280CertPathUtilities.wrapupCertB(certPath, i14, RFC3280CertPathUtilities.wrapupCertA(i4, x509Certificate));
|
|
Set<String> criticalExtensionOIDs2 = x509Certificate.getCriticalExtensionOIDs();
|
|
if (criticalExtensionOIDs2 != null) {
|
|
hashSet = new HashSet(criticalExtensionOIDs2);
|
|
hashSet.remove(RFC3280CertPathUtilities.KEY_USAGE);
|
|
hashSet.remove(RFC3280CertPathUtilities.CERTIFICATE_POLICIES);
|
|
hashSet.remove(RFC3280CertPathUtilities.POLICY_MAPPINGS);
|
|
hashSet.remove(RFC3280CertPathUtilities.INHIBIT_ANY_POLICY);
|
|
hashSet.remove(RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT);
|
|
hashSet.remove(RFC3280CertPathUtilities.DELTA_CRL_INDICATOR);
|
|
hashSet.remove(RFC3280CertPathUtilities.POLICY_CONSTRAINTS);
|
|
hashSet.remove(RFC3280CertPathUtilities.BASIC_CONSTRAINTS);
|
|
hashSet.remove(RFC3280CertPathUtilities.SUBJECT_ALTERNATIVE_NAME);
|
|
hashSet.remove(RFC3280CertPathUtilities.NAME_CONSTRAINTS);
|
|
hashSet.remove(RFC3280CertPathUtilities.CRL_DISTRIBUTION_POINTS);
|
|
hashSet.remove(Extension.extendedKeyUsage.getId());
|
|
} else {
|
|
hashSet = new HashSet();
|
|
}
|
|
RFC3280CertPathUtilities.wrapupCertF(certPath, i14, certPathCheckers, hashSet);
|
|
X509Certificate x509Certificate3 = x509Certificate;
|
|
PKIXPolicyNode wrapupCertG = RFC3280CertPathUtilities.wrapupCertG(certPath, pKIXExtendedParameters3, r14, i14, arrayListArr4, pKIXPolicyNode, hashSet4);
|
|
if (wrapupCertB > 0 || wrapupCertG != null) {
|
|
return new PKIXCertPathValidatorResult(trustAnchor2, wrapupCertG, x509Certificate3.getPublicKey());
|
|
}
|
|
throw new CertPathValidatorException("Path processing failed on policy.", null, certPath, i13);
|
|
} catch (CertPathValidatorException e3) {
|
|
throw new ExtCertPathValidatorException("Algorithm identifier of public key of trust anchor could not be read.", e3, certPath, -1);
|
|
}
|
|
} catch (IllegalArgumentException e4) {
|
|
throw new ExtCertPathValidatorException("Subject of trust anchor could not be (re)encoded.", e4, certPath, -1);
|
|
}
|
|
} catch (AnnotatedException e5) {
|
|
throw new CertPathValidatorException(e5.getMessage(), e5, certPath, certificates.size() - 1);
|
|
}
|
|
}
|
|
}
|