using System;
using System.Collections;
using System.Globalization;
using System.Security.Cryptography.X509Certificates;
using System.Text.RegularExpressions;
using Mono.Security.X509;
using Mono.Security.X509.Extensions;

namespace Mono.Security.Protocol.Tls.Handshake.Client
{
	// Token: 0x020000AC RID: 172
	internal class TlsServerCertificate : HandshakeMessage
	{
		// Token: 0x06000679 RID: 1657 RVA: 0x0002401C File Offset: 0x0002221C
		public TlsServerCertificate(Context context, byte[] buffer)
			: base(context, HandshakeType.Certificate, buffer)
		{
		}

		// Token: 0x0600067A RID: 1658 RVA: 0x00024028 File Offset: 0x00022228
		public override void Update()
		{
			base.Update();
			base.Context.ServerSettings.Certificates = this.certificates;
			base.Context.ServerSettings.UpdateCertificateRSA();
		}

		// Token: 0x0600067B RID: 1659 RVA: 0x00024064 File Offset: 0x00022264
		protected override void ProcessAsSsl3()
		{
			this.ProcessAsTls1();
		}

		// Token: 0x0600067C RID: 1660 RVA: 0x0002406C File Offset: 0x0002226C
		protected override void ProcessAsTls1()
		{
			this.certificates = new Mono.Security.X509.X509CertificateCollection();
			int i = 0;
			int num = base.ReadInt24();
			while (i < num)
			{
				int num2 = base.ReadInt24();
				i += 3;
				if (num2 > 0)
				{
					byte[] array = base.ReadBytes(num2);
					Mono.Security.X509.X509Certificate x509Certificate = new Mono.Security.X509.X509Certificate(array);
					this.certificates.Add(x509Certificate);
					i += num2;
				}
			}
			this.validateCertificates(this.certificates);
		}

		// Token: 0x0600067D RID: 1661 RVA: 0x000240DC File Offset: 0x000222DC
		private bool checkCertificateUsage(Mono.Security.X509.X509Certificate cert)
		{
			ClientContext clientContext = (ClientContext)base.Context;
			if (cert.Version < 3)
			{
				return true;
			}
			KeyUsages keyUsages = KeyUsages.none;
			switch (clientContext.Negotiating.Cipher.ExchangeAlgorithmType)
			{
			case ExchangeAlgorithmType.DiffieHellman:
				keyUsages = KeyUsages.keyAgreement;
				break;
			case ExchangeAlgorithmType.Fortezza:
				return false;
			case ExchangeAlgorithmType.RsaKeyX:
				keyUsages = KeyUsages.keyEncipherment;
				break;
			case ExchangeAlgorithmType.RsaSign:
				keyUsages = KeyUsages.digitalSignature;
				break;
			}
			KeyUsageExtension keyUsageExtension = null;
			ExtendedKeyUsageExtension extendedKeyUsageExtension = null;
			Mono.Security.X509.X509Extension x509Extension = cert.Extensions["2.5.29.15"];
			if (x509Extension != null)
			{
				keyUsageExtension = new KeyUsageExtension(x509Extension);
			}
			x509Extension = cert.Extensions["2.5.29.37"];
			if (x509Extension != null)
			{
				extendedKeyUsageExtension = new ExtendedKeyUsageExtension(x509Extension);
			}
			if (keyUsageExtension != null && extendedKeyUsageExtension != null)
			{
				return keyUsageExtension.Support(keyUsages) && (extendedKeyUsageExtension.KeyPurpose.Contains("1.3.6.1.5.5.7.3.1") || extendedKeyUsageExtension.KeyPurpose.Contains("2.16.840.1.113730.4.1"));
			}
			if (keyUsageExtension != null)
			{
				return keyUsageExtension.Support(keyUsages);
			}
			if (extendedKeyUsageExtension != null)
			{
				return extendedKeyUsageExtension.KeyPurpose.Contains("1.3.6.1.5.5.7.3.1") || extendedKeyUsageExtension.KeyPurpose.Contains("2.16.840.1.113730.4.1");
			}
			x509Extension = cert.Extensions["2.16.840.1.113730.1.1"];
			if (x509Extension != null)
			{
				NetscapeCertTypeExtension netscapeCertTypeExtension = new NetscapeCertTypeExtension(x509Extension);
				return netscapeCertTypeExtension.Support(NetscapeCertTypeExtension.CertTypes.SslServer);
			}
			return true;
		}

		// Token: 0x0600067E RID: 1662 RVA: 0x00024248 File Offset: 0x00022448
		private static void VerifyOSX(Mono.Security.X509.X509CertificateCollection certificates)
		{
		}

		// Token: 0x0600067F RID: 1663 RVA: 0x0002424C File Offset: 0x0002244C
		private void validateCertificates(Mono.Security.X509.X509CertificateCollection certificates)
		{
			ClientContext clientContext = (ClientContext)base.Context;
			AlertDescription alertDescription = AlertDescription.BadCertificate;
			if (clientContext.SslStream.HaveRemoteValidation2Callback)
			{
				ValidationResult validationResult = clientContext.SslStream.RaiseServerCertificateValidation2(certificates);
				if (validationResult.Trusted)
				{
					return;
				}
				long num = (long)validationResult.ErrorCode;
				long num2 = num;
				if (num2 != (long)((ulong)(-2146762487)))
				{
					if (num2 != (long)((ulong)(-2146762486)))
					{
						if (num2 != (long)((ulong)(-2146762495)))
						{
							alertDescription = AlertDescription.CertificateUnknown;
						}
						else
						{
							alertDescription = AlertDescription.CertificateExpired;
						}
					}
					else
					{
						alertDescription = AlertDescription.UnknownCA;
					}
				}
				else
				{
					alertDescription = AlertDescription.UnknownCA;
				}
				string text = string.Format("0x{0:x}", num);
				throw new TlsException(alertDescription, "Invalid certificate received from server. Error code: " + text);
			}
			else
			{
				Mono.Security.X509.X509Certificate x509Certificate = certificates[0];
				global::System.Security.Cryptography.X509Certificates.X509Certificate x509Certificate2 = new global::System.Security.Cryptography.X509Certificates.X509Certificate(x509Certificate.RawData);
				ArrayList arrayList = new ArrayList();
				if (!this.checkCertificateUsage(x509Certificate))
				{
					arrayList.Add(-2146762490);
				}
				if (!this.checkServerIdentity(x509Certificate))
				{
					arrayList.Add(-2146762481);
				}
				Mono.Security.X509.X509CertificateCollection x509CertificateCollection = new Mono.Security.X509.X509CertificateCollection(certificates);
				x509CertificateCollection.Remove(x509Certificate);
				Mono.Security.X509.X509Chain x509Chain = new Mono.Security.X509.X509Chain(x509CertificateCollection);
				bool flag = false;
				try
				{
					flag = x509Chain.Build(x509Certificate);
				}
				catch (Exception)
				{
					flag = false;
				}
				if (!flag)
				{
					Mono.Security.X509.X509ChainStatusFlags status = x509Chain.Status;
					if (status != Mono.Security.X509.X509ChainStatusFlags.NotTimeValid)
					{
						if (status != Mono.Security.X509.X509ChainStatusFlags.NotTimeNested)
						{
							if (status != Mono.Security.X509.X509ChainStatusFlags.NotSignatureValid)
							{
								if (status != Mono.Security.X509.X509ChainStatusFlags.UntrustedRoot)
								{
									if (status != Mono.Security.X509.X509ChainStatusFlags.InvalidBasicConstraints)
									{
										if (status != Mono.Security.X509.X509ChainStatusFlags.PartialChain)
										{
											alertDescription = AlertDescription.CertificateUnknown;
											arrayList.Add((int)x509Chain.Status);
										}
										else
										{
											alertDescription = AlertDescription.UnknownCA;
											arrayList.Add(-2146762486);
										}
									}
									else
									{
										arrayList.Add(-2146869223);
									}
								}
								else
								{
									alertDescription = AlertDescription.UnknownCA;
									arrayList.Add(-2146762487);
								}
							}
							else
							{
								arrayList.Add(-2146869232);
							}
						}
						else
						{
							arrayList.Add(-2146762494);
						}
					}
					else
					{
						alertDescription = AlertDescription.CertificateExpired;
						arrayList.Add(-2146762495);
					}
				}
				int[] array = (int[])arrayList.ToArray(typeof(int));
				if (!clientContext.SslStream.RaiseServerCertificateValidation(x509Certificate2, array))
				{
					throw new TlsException(alertDescription, "Invalid certificate received from server.");
				}
				return;
			}
		}

		// Token: 0x06000680 RID: 1664 RVA: 0x000244F0 File Offset: 0x000226F0
		private bool checkServerIdentity(Mono.Security.X509.X509Certificate cert)
		{
			ClientContext clientContext = (ClientContext)base.Context;
			string targetHost = clientContext.ClientSettings.TargetHost;
			Mono.Security.X509.X509Extension x509Extension = cert.Extensions["2.5.29.17"];
			if (x509Extension != null)
			{
				SubjectAltNameExtension subjectAltNameExtension = new SubjectAltNameExtension(x509Extension);
				foreach (string text in subjectAltNameExtension.DNSNames)
				{
					if (TlsServerCertificate.Match(targetHost, text))
					{
						return true;
					}
				}
				foreach (string text2 in subjectAltNameExtension.IPAddresses)
				{
					if (text2 == targetHost)
					{
						return true;
					}
				}
			}
			return this.checkDomainName(cert.SubjectName);
		}

		// Token: 0x06000681 RID: 1665 RVA: 0x000245B0 File Offset: 0x000227B0
		private bool checkDomainName(string subjectName)
		{
			ClientContext clientContext = (ClientContext)base.Context;
			string text = string.Empty;
			Regex regex = new Regex("CN\\s*=\\s*([^,]*)");
			MatchCollection matchCollection = regex.Matches(subjectName);
			if (matchCollection.Count == 1 && matchCollection[0].Success)
			{
				text = matchCollection[0].Groups[1].Value.ToString();
			}
			return TlsServerCertificate.Match(clientContext.ClientSettings.TargetHost, text);
		}

		// Token: 0x06000682 RID: 1666 RVA: 0x00024630 File Offset: 0x00022830
		private static bool Match(string hostname, string pattern)
		{
			int num = pattern.IndexOf('*');
			if (num == -1)
			{
				return string.Compare(hostname, pattern, true, CultureInfo.InvariantCulture) == 0;
			}
			if (num != pattern.Length - 1 && pattern[num + 1] != '.')
			{
				return false;
			}
			int num2 = pattern.IndexOf('*', num + 1);
			if (num2 != -1)
			{
				return false;
			}
			string text = pattern.Substring(num + 1);
			int num3 = hostname.Length - text.Length;
			if (num3 <= 0)
			{
				return false;
			}
			if (string.Compare(hostname, num3, text, 0, text.Length, true, CultureInfo.InvariantCulture) != 0)
			{
				return false;
			}
			if (num == 0)
			{
				int num4 = hostname.IndexOf('.');
				return num4 == -1 || num4 >= hostname.Length - text.Length;
			}
			string text2 = pattern.Substring(0, num);
			return string.Compare(hostname, 0, text2, 0, text2.Length, true, CultureInfo.InvariantCulture) == 0;
		}

		// Token: 0x0400031F RID: 799
		private Mono.Security.X509.X509CertificateCollection certificates;
	}
}