package org.bouncycastle.jsse.provider;

import java.net.Socket;

import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLSocket;

import org.bouncycastle.jsse.BCExtendedSSLSession;
import org.bouncycastle.jsse.BCSSLParameters;
import org.bouncycastle.jsse.java.security.BCAlgorithmConstraints;

class TransportData
{
    static TransportData from(Socket socket)
    {
        if (!(socket instanceof SSLSocket && socket.isConnected()))
        {
            return null;
        }

        SSLSocket sslSocket = (SSLSocket)socket;

        BCSSLParameters parameters = SSLSocketUtil.importSSLParameters(sslSocket);
        if (null == parameters)
        {
            /*
             * NOTE: This will only be null before JDK 1.6 (meaning neither parameters nor handshake
             * session exist). For backward compatibility, our KeyManager/TrustManager
             * implementations will behave as if no transport was provided.
             */
            return null;
        }

        BCExtendedSSLSession handshakeSession = SSLSocketUtil.importHandshakeSession(sslSocket);

        return new TransportData(parameters, handshakeSession);
    }

    static TransportData from(SSLEngine engine)
    {
        if (null == engine)
        {
            return null;
        }

        BCSSLParameters parameters = SSLEngineUtil.importSSLParameters(engine);
        if (null == parameters)
        {
            /*
             * NOTE: This will only be null before JDK 1.6 (meaning neither parameters nor handshake
             * session exist). For backward compatibility, our KeyManager/TrustManager
             * implementations will behave as if no transport was provided.
             */
            return null;
        }

        BCExtendedSSLSession handshakeSession = SSLEngineUtil.importHandshakeSession(engine);

        return new TransportData(parameters, handshakeSession);
    }

    static BCAlgorithmConstraints getAlgorithmConstraints(TransportData transportData, boolean enableX509Constraints)
    {
        return null == transportData
            ?   new ProvAlgorithmConstraints(null, enableX509Constraints)
            :   transportData.getAlgorithmConstraints(enableX509Constraints);
    }

    private final BCSSLParameters parameters;
    private final BCExtendedSSLSession handshakeSession;

    private TransportData(BCSSLParameters parameters, BCExtendedSSLSession handshakeSession)
    {
        this.parameters = parameters;
        this.handshakeSession = handshakeSession;
    }

    BCSSLParameters getParameters()
    {
        return parameters;
    }

    BCExtendedSSLSession getHandshakeSession()
    {
        return handshakeSession;
    }

    BCAlgorithmConstraints getAlgorithmConstraints(boolean enableX509Constraints)
    {
        BCAlgorithmConstraints configAlgorithmConstraints = parameters.getAlgorithmConstraints();

        if (null == handshakeSession || !JsseUtils.isTLSv12(handshakeSession.getProtocol()))
        {
            return new ProvAlgorithmConstraints(configAlgorithmConstraints, enableX509Constraints);
        }

        String[] peerSigAlgsCert = handshakeSession.getPeerSupportedSignatureAlgorithms();

        return new ProvAlgorithmConstraints(configAlgorithmConstraints, peerSigAlgsCert, enableX509Constraints);
    }
}

@@ -1993,36 +1993,26 @@
 boolean 
-enableX509Constraint
+peerSigAlg
 s)%0A    %7B
@@ -2065,20 +2065,16 @@
     ?   
-new 
 ProvAlgo
@@ -2093,37 +2093,16 @@
 ints
-(null, enableX509Constraints)
+.DEFAULT
 %0A   
@@ -2152,36 +2152,26 @@
 traints(
-enableX509Constraint
+peerSigAlg
 s);%0A    
@@ -2699,36 +2699,26 @@
 boolean 
-enableX509Constraint
+peerSigAlg
 s)%0A    %7B
@@ -2811,24 +2811,167 @@
 nstraints();
+%0A        if (ProvAlgorithmConstraints.DEFAULT == configAlgorithmConstraints)%0A        %7B%0A            configAlgorithmConstraints = null;%0A        %7D
 %0A%0A        if
@@ -2977,17 +2977,17 @@
 f (null 
-=
+!
 = handsh
@@ -3001,12 +3001,11 @@
 ion 
-%7C%7C !
+&& 
 Jsse
@@ -3078,95 +3078,42 @@
     
-return new ProvAlgorithmConstraints(configAlgorithmConstraints, enableX509Constraints);
+String%5B%5D sigAlgsCert = peerSigAlgs
 %0A   
@@ -3117,27 +3117,24 @@
         
-%7D%0A%0A
         
 String%5B%5D
@@ -3129,34 +3129,86 @@
     
-String%5B%5D peerSigAlgsCert =
+?   handshakeSession.getPeerSupportedSignatureAlgorithms()%0A                :  
  han
@@ -3216,36 +3216,37 @@
 shakeSession.get
-Peer
+Local
 SupportedSignatu
@@ -3258,24 +3258,83 @@
 orithms();%0A%0A
+            if (null != sigAlgsCert)%0A            %7B%0A        
         retu
@@ -3397,35 +3397,212 @@
 ts, 
-peerSigAlgsCert, enableX509
+sigAlgsCert, true);%0A            %7D%0A        %7D%0A%0A        return null == configAlgorithmConstraints%0A            ?   ProvAlgorithmConstraints.DEFAULT%0A            :   new ProvAlgorithmConstraints(configAlgorithm
 Cons
@@ -3608,16 +3608,22 @@
 straints
+, true
 );%0A    %7D

Improve getAlgorithmConstraints methods