package io.netty.handler.ssl;

import io.netty.handler.ssl.ReferenceCountedOpenSslContext;
import io.netty.internal.tcnative.SSLContext;
import io.netty.internal.tcnative.SniHostNameMatcher;
import io.netty.util.internal.ObjectUtil;
import io.netty.util.internal.PlatformDependent;
import io.netty.util.internal.logging.InternalLogger;
import io.netty.util.internal.logging.InternalLoggerFactory;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLException;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509ExtendedKeyManager;
import javax.net.ssl.X509ExtendedTrustManager;
import javax.net.ssl.X509KeyManager;
import javax.net.ssl.X509TrustManager;

/* JADX INFO: loaded from: classes.dex */
public final class ReferenceCountedOpenSslServerContext extends ReferenceCountedOpenSslContext {
    private final OpenSslKeyMaterialManager keyMaterialManager;
    private final OpenSslServerSessionContext sessionContext;
    private static final InternalLogger logger = InternalLoggerFactory.getInstance((Class<?>) ReferenceCountedOpenSslServerContext.class);
    private static final byte[] ID = {110, 101, 116, 116, 121};

    public static final class ExtendedTrustManagerVerifyCallback extends ReferenceCountedOpenSslContext.AbstractCertificateVerifier {
        private final X509ExtendedTrustManager manager;

        public ExtendedTrustManagerVerifyCallback(OpenSslEngineMap openSslEngineMap, X509ExtendedTrustManager x509ExtendedTrustManager) {
            super(openSslEngineMap);
            this.manager = x509ExtendedTrustManager;
        }

        @Override // io.netty.handler.ssl.ReferenceCountedOpenSslContext.AbstractCertificateVerifier
        public void verify(ReferenceCountedOpenSslEngine referenceCountedOpenSslEngine, X509Certificate[] x509CertificateArr, String str) throws CertificateException {
            this.manager.checkClientTrusted(x509CertificateArr, str, referenceCountedOpenSslEngine);
        }
    }

    public static final class OpenSslSniHostnameMatcher implements SniHostNameMatcher {
        private final OpenSslEngineMap engineMap;

        public OpenSslSniHostnameMatcher(OpenSslEngineMap openSslEngineMap) {
            this.engineMap = openSslEngineMap;
        }

        public boolean match(long j2, String str) {
            ReferenceCountedOpenSslEngine referenceCountedOpenSslEngine = this.engineMap.get(j2);
            if (referenceCountedOpenSslEngine != null) {
                return referenceCountedOpenSslEngine.checkSniHostnameMatch(str);
            }
            ReferenceCountedOpenSslServerContext.logger.warn("No ReferenceCountedOpenSslEngine found for SSL pointer: {}", Long.valueOf(j2));
            return false;
        }
    }

    public static final class ServerContext {
        public OpenSslKeyMaterialManager keyMaterialManager;
        public OpenSslServerSessionContext sessionContext;
    }

    public static final class TrustManagerVerifyCallback extends ReferenceCountedOpenSslContext.AbstractCertificateVerifier {
        private final X509TrustManager manager;

        public TrustManagerVerifyCallback(OpenSslEngineMap openSslEngineMap, X509TrustManager x509TrustManager) {
            super(openSslEngineMap);
            this.manager = x509TrustManager;
        }

        @Override // io.netty.handler.ssl.ReferenceCountedOpenSslContext.AbstractCertificateVerifier
        public void verify(ReferenceCountedOpenSslEngine referenceCountedOpenSslEngine, X509Certificate[] x509CertificateArr, String str) throws CertificateException {
            this.manager.checkClientTrusted(x509CertificateArr, str);
        }
    }

    public ReferenceCountedOpenSslServerContext(X509Certificate[] x509CertificateArr, TrustManagerFactory trustManagerFactory, X509Certificate[] x509CertificateArr2, PrivateKey privateKey, String str, KeyManagerFactory keyManagerFactory, Iterable<String> iterable, CipherSuiteFilter cipherSuiteFilter, ApplicationProtocolConfig applicationProtocolConfig, long j2, long j3, ClientAuth clientAuth, String[] strArr, boolean z2, boolean z3) {
        this(x509CertificateArr, trustManagerFactory, x509CertificateArr2, privateKey, str, keyManagerFactory, iterable, cipherSuiteFilter, ReferenceCountedOpenSslContext.toNegotiator(applicationProtocolConfig), j2, j3, clientAuth, strArr, z2, z3);
    }

    private ReferenceCountedOpenSslServerContext(X509Certificate[] x509CertificateArr, TrustManagerFactory trustManagerFactory, X509Certificate[] x509CertificateArr2, PrivateKey privateKey, String str, KeyManagerFactory keyManagerFactory, Iterable<String> iterable, CipherSuiteFilter cipherSuiteFilter, OpenSslApplicationProtocolNegotiator openSslApplicationProtocolNegotiator, long j2, long j3, ClientAuth clientAuth, String[] strArr, boolean z2, boolean z3) {
        super(iterable, cipherSuiteFilter, openSslApplicationProtocolNegotiator, j2, j3, 1, (Certificate[]) x509CertificateArr2, clientAuth, strArr, z2, z3, true);
        try {
            ServerContext serverContextNewSessionContext = newSessionContext(this, this.ctx, this.engineMap, x509CertificateArr, trustManagerFactory, x509CertificateArr2, privateKey, str, keyManagerFactory);
            this.sessionContext = serverContextNewSessionContext.sessionContext;
            this.keyMaterialManager = serverContextNewSessionContext.keyMaterialManager;
        } catch (Throwable th) {
            release();
            throw th;
        }
    }

    public static ServerContext newSessionContext(ReferenceCountedOpenSslContext referenceCountedOpenSslContext, long j2, OpenSslEngineMap openSslEngineMap, X509Certificate[] x509CertificateArr, TrustManagerFactory trustManagerFactory, X509Certificate[] x509CertificateArr2, PrivateKey privateKey, String str, KeyManagerFactory keyManagerFactory) throws SSLException {
        ServerContext serverContext = new ServerContext();
        try {
            SSLContext.setVerify(j2, 0, 10);
            if (OpenSsl.useKeyManagerFactory()) {
                if (keyManagerFactory == null) {
                    keyManagerFactory = SslContext.buildKeyManagerFactory(x509CertificateArr2, privateKey, str, keyManagerFactory);
                }
                X509KeyManager x509KeyManagerChooseX509KeyManager = ReferenceCountedOpenSslContext.chooseX509KeyManager(keyManagerFactory.getKeyManagers());
                serverContext.keyMaterialManager = ReferenceCountedOpenSslContext.useExtendedKeyManager(x509KeyManagerChooseX509KeyManager) ? new OpenSslExtendedKeyMaterialManager((X509ExtendedKeyManager) x509KeyManagerChooseX509KeyManager, str) : new OpenSslKeyMaterialManager(x509KeyManagerChooseX509KeyManager, str);
            } else {
                if (keyManagerFactory != null) {
                    throw new IllegalArgumentException("KeyManagerFactory not supported");
                }
                ObjectUtil.checkNotNull(x509CertificateArr2, "keyCertChain");
                ReferenceCountedOpenSslContext.setKeyMaterial(j2, x509CertificateArr2, privateKey, str);
            }
            try {
                if (x509CertificateArr != null) {
                    trustManagerFactory = SslContext.buildTrustManagerFactory(x509CertificateArr, trustManagerFactory);
                } else if (trustManagerFactory == null) {
                    trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                    trustManagerFactory.init((KeyStore) null);
                }
                X509TrustManager x509TrustManagerChooseTrustManager = ReferenceCountedOpenSslContext.chooseTrustManager(trustManagerFactory.getTrustManagers());
                SSLContext.setCertVerifyCallback(j2, ReferenceCountedOpenSslContext.useExtendedTrustManager(x509TrustManagerChooseTrustManager) ? new ExtendedTrustManagerVerifyCallback(openSslEngineMap, (X509ExtendedTrustManager) x509TrustManagerChooseTrustManager) : new TrustManagerVerifyCallback(openSslEngineMap, x509TrustManagerChooseTrustManager));
                X509Certificate[] acceptedIssuers = x509TrustManagerChooseTrustManager.getAcceptedIssuers();
                if (acceptedIssuers != null && acceptedIssuers.length > 0) {
                    long bio = 0;
                    try {
                        bio = ReferenceCountedOpenSslContext.toBIO(acceptedIssuers);
                        if (!SSLContext.setCACertificateBio(j2, bio)) {
                            throw new SSLException("unable to setup accepted issuers for trustmanager " + x509TrustManagerChooseTrustManager);
                        }
                    } finally {
                        ReferenceCountedOpenSslContext.freeBio(bio);
                    }
                }
                if (PlatformDependent.javaVersion() >= 8) {
                    SSLContext.setSniHostnameMatcher(j2, new OpenSslSniHostnameMatcher(openSslEngineMap));
                }
                OpenSslServerSessionContext openSslServerSessionContext = new OpenSslServerSessionContext(referenceCountedOpenSslContext);
                serverContext.sessionContext = openSslServerSessionContext;
                openSslServerSessionContext.setSessionIdContext(ID);
                return serverContext;
            } catch (SSLException e2) {
                throw e2;
            } catch (Exception e3) {
                throw new SSLException("unable to setup trustmanager", e3);
            }
        } catch (Exception e4) {
            throw new SSLException("failed to set certificate and key", e4);
        }
    }

    @Override // io.netty.handler.ssl.ReferenceCountedOpenSslContext
    public OpenSslKeyMaterialManager keyMaterialManager() {
        return this.keyMaterialManager;
    }

    @Override // io.netty.handler.ssl.ReferenceCountedOpenSslContext, io.netty.handler.ssl.SslContext
    public OpenSslServerSessionContext sessionContext() {
        return this.sessionContext;
    }
}