/*

 * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

import com.sun.net.httpserver.BasicAuthenticator;

import com.sun.net.httpserver.Filter;

import com.sun.net.httpserver.Headers;

import com.sun.net.httpserver.HttpContext;

import com.sun.net.httpserver.HttpExchange;

import com.sun.net.httpserver.HttpHandler;

import com.sun.net.httpserver.HttpServer;

import com.sun.net.httpserver.HttpsConfigurator;

import com.sun.net.httpserver.HttpsParameters;

import com.sun.net.httpserver.HttpsServer;

import java.io.IOException;

import java.io.InputStream;

import java.io.OutputStream;

import java.io.OutputStreamWriter;

import java.io.PrintWriter;

import java.io.Writer;

import java.math.BigInteger;

import java.net.Authenticator;

import java.net.HttpURLConnection;

import java.net.InetAddress;

import java.net.InetSocketAddress;

import java.net.MalformedURLException;

import java.net.PasswordAuthentication;

import java.net.ServerSocket;

import java.net.Socket;

import java.net.SocketAddress;

import java.net.URI;

import java.net.URISyntaxException;

import java.net.URL;

import java.nio.charset.StandardCharsets;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.time.Instant;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.Base64;

import java.util.List;

import java.util.Locale;

import java.util.Objects;

import java.util.Optional;

import java.util.Random;

import java.util.concurrent.CompletableFuture;

import java.util.concurrent.CopyOnWriteArrayList;

import java.util.concurrent.atomic.AtomicInteger;

import java.util.stream.Collectors;

import java.util.stream.Stream;

import javax.net.ssl.SSLContext;

import sun.net.www.HeaderParser;

/**

 * A simple HTTP server that supports Basic or Digest authentication.

 * By default this server will echo back whatever is present

 * in the request body. Note that the Digest authentication is

 * a test implementation implemented only for tests purposes.

 * @author danielfuchs

 */

public class DigestEchoServer {

    public static final boolean DEBUG =

            Boolean.parseBoolean(System.getProperty("test.debug", "false"));

    public enum HttpAuthType {

        SERVER, PROXY, SERVER307, PROXY305

        /* add PROXY_AND_SERVER and SERVER_PROXY_NONE */

    };

    public enum HttpAuthSchemeType { NONE, BASICSERVER, BASIC, DIGEST };

    public static final HttpAuthType DEFAULT_HTTP_AUTH_TYPE = HttpAuthType.SERVER;

    public static final String DEFAULT_PROTOCOL_TYPE = "https";

    public static final HttpAuthSchemeType DEFAULT_SCHEME_TYPE = HttpAuthSchemeType.DIGEST;

    public static class HttpTestAuthenticator extends Authenticator {

        private final String realm;

        private final String username;

        // Used to prevent incrementation of 'count' when calling the

        // authenticator from the server side.

        private final ThreadLocal<Boolean> skipCount = new ThreadLocal<>();

        // count will be incremented every time getPasswordAuthentication()

        // is called from the client side.

        final AtomicInteger count = new AtomicInteger();

        public HttpTestAuthenticator(String realm, String username) {

            this.realm = realm;

            this.username = username;

        }

        @Override

        protected PasswordAuthentication getPasswordAuthentication() {

            if (skipCount.get() == null || skipCount.get().booleanValue() == false) {

                System.out.println("Authenticator called: " + count.incrementAndGet());

            }

            return new PasswordAuthentication(getUserName(),

                    new char[] {'d','e','n', 't'});

        }

        // Called by the server side to get the password of the user

        // being authentified.

        public final char[] getPassword(String user) {

            if (user.equals(username)) {

                skipCount.set(Boolean.TRUE);

                try {

                    return getPasswordAuthentication().getPassword();

                } finally {

                    skipCount.set(Boolean.FALSE);

                }

            }

            throw new SecurityException("User unknown: " + user);

        }

        public final String getUserName() {

            return username;

        }

        public final String getRealm() {

            return realm;

        }

    }

    public static final HttpTestAuthenticator AUTHENTICATOR;

    static {

        AUTHENTICATOR = new HttpTestAuthenticator("earth", "arthur");

    }

    final HttpServer       serverImpl; // this server endpoint

    final DigestEchoServer redirect;   // the target server where to redirect 3xx

    final HttpHandler      delegate;   // unused

    private DigestEchoServer(HttpServer server, DigestEchoServer target,

                           HttpHandler delegate) {

        this.serverImpl = server;

        this.redirect = target;

        this.delegate = delegate;

    }

    public static void main(String[] args)

            throws IOException {

        DigestEchoServer server = create(DEFAULT_PROTOCOL_TYPE,

                DEFAULT_HTTP_AUTH_TYPE,

                AUTHENTICATOR,

                DEFAULT_SCHEME_TYPE);

        try {

            System.out.println("Server created at " + server.getAddress());

            System.out.println("Strike <Return> to exit");

            System.in.read();

        } finally {

            System.out.println("stopping server");

            server.stop();

        }

    }

    private static String toString(Headers headers) {

        return headers.entrySet().stream()

                .map((e) -> e.getKey() + ": " + e.getValue())

                .collect(Collectors.joining("\n"));

    }

    public static DigestEchoServer create(String protocol,

                                          HttpAuthType authType,

                                          HttpAuthSchemeType schemeType)

            throws IOException {

        return create(protocol, authType, AUTHENTICATOR, schemeType);

    }

    public static DigestEchoServer create(String protocol,

                                          HttpAuthType authType,

                                          HttpTestAuthenticator auth,

                                          HttpAuthSchemeType schemeType)

            throws IOException {

        return create(protocol, authType, auth, schemeType, null);

    }

    public static DigestEchoServer create(String protocol,

                                        HttpAuthType authType,

                                        HttpTestAuthenticator auth,

                                        HttpAuthSchemeType schemeType,

                                        HttpHandler delegate)

            throws IOException {

        Objects.requireNonNull(authType);

        Objects.requireNonNull(auth);

        switch(authType) {

            // A server that performs Server Digest authentication.

            case SERVER: return createServer(protocol, authType, auth,

                                             schemeType, delegate, "/");

            // A server that pretends to be a Proxy and performs

            // Proxy Digest authentication. If protocol is HTTPS,

            // then this will create a HttpsProxyTunnel that will

            // handle the CONNECT request for tunneling.

            case PROXY: return createProxy(protocol, authType, auth,

                                           schemeType, delegate, "/");

            // A server that sends 307 redirect to a server that performs

            // Digest authentication.

            // Note: 301 doesn't work here because it transforms POST into GET.

            case SERVER307: return createServerAndRedirect(protocol,

                                                        HttpAuthType.SERVER,

                                                        auth, schemeType,

                                                        delegate, 307);

            // A server that sends 305 redirect to a proxy that performs

            // Digest authentication.

            // Note: this is not correctly stubbed/implemented in this test.

            case PROXY305:  return createServerAndRedirect(protocol,

                                                        HttpAuthType.PROXY,

                                                        auth, schemeType,

                                                        delegate, 305);

            default:

                throw new InternalError("Unknown server type: " + authType);

        }

    }

    /**

     * The SocketBindableFactory ensures that the local port used by an HttpServer

     * or a proxy ServerSocket previously created by the current test/VM will not

     * get reused by a subsequent test in the same VM.

     * This is to avoid having the test client trying to reuse cached connections.

     */

    private static abstract class SocketBindableFactory<B> {

        private static final int MAX = 10;

        private static final CopyOnWriteArrayList<String> addresses =

                new CopyOnWriteArrayList<>();

        protected B createInternal() throws IOException {

            final int max = addresses.size() + MAX;

            final List<B> toClose = new ArrayList<>();

            try {

                for (int i = 1; i <= max; i++) {

                    B bindable = createBindable();

                    SocketAddress address = getAddress(bindable);

                    String key = address.toString();

                    if (addresses.addIfAbsent(key)) {

                        System.out.println("Socket bound to: " + key

                                + " after " + i + " attempt(s)");

                        return bindable;

                    }

                    System.out.println("warning: address " + key

                            + " already used. Retrying bind.");

                    // keep the port bound until we get a port that we haven't

                    // used already

                    toClose.add(bindable);

                }

            } finally {

                // if we had to retry, then close the socket we're not

                // going to use.

                for (B b : toClose) {

                    try { close(b); } catch (Exception x) { /* ignore */ }

                }

            }

            throw new IOException("Couldn't bind socket after " + max + " attempts: "

                    + "addresses used before: " + addresses);

        }

        protected abstract B createBindable() throws IOException;

        protected abstract SocketAddress getAddress(B bindable);

        protected abstract void close(B bindable) throws IOException;

    }

    /*

     * Used to create ServerSocket for a proxy.

     */

    private static final class ServerSocketFactory

    extends SocketBindableFactory<ServerSocket> {

        private static final ServerSocketFactory instance = new ServerSocketFactory();

        static ServerSocket create() throws IOException {

            return instance.createInternal();

        }

        @Override

        protected ServerSocket createBindable() throws IOException {

            return new ServerSocket(0, 0, InetAddress.getByName("127.0.0.1"));

        }

        @Override

        protected SocketAddress getAddress(ServerSocket socket) {

            return socket.getLocalSocketAddress();

        }

        @Override

        protected void close(ServerSocket socket) throws IOException {

            socket.close();

        }

    }

    /*

     * Used to create HttpServer for a NTLMTestServer.

     */

    private static abstract class WebServerFactory<S extends HttpServer>

            extends SocketBindableFactory<S> {

        @Override

        protected S createBindable() throws IOException {

            S server = newHttpServer();

            server.bind(new InetSocketAddress("127.0.0.1", 0), 0);

            return server;

        }

        @Override

        protected SocketAddress getAddress(S server) {

            return server.getAddress();

        }

        @Override

        protected void close(S server) throws IOException {

            server.stop(1);

        }

        /*

         * Returns a HttpServer or a HttpsServer in different subclasses.

         */

        protected abstract S newHttpServer() throws IOException;

    }

    private static final class HttpServerFactory extends WebServerFactory<HttpServer> {

        private static final HttpServerFactory instance = new HttpServerFactory();

        static HttpServer create() throws IOException {

            return instance.createInternal();

        }

        @Override

        protected HttpServer newHttpServer() throws IOException {

            return HttpServer.create();

        }

    }

    private static final class HttpsServerFactory extends WebServerFactory<HttpsServer> {

        private static final HttpsServerFactory instance = new HttpsServerFactory();

        static HttpsServer create() throws IOException {

            return instance.createInternal();

        }

        @Override

        protected HttpsServer newHttpServer() throws IOException {

            return HttpsServer.create();

        }

    }

    static HttpServer createHttpServer(String protocol) throws IOException {

        final HttpServer server;

        if ("http".equalsIgnoreCase(protocol)) {

            server = HttpServerFactory.create();

        } else if ("https".equalsIgnoreCase(protocol)) {

            server = configure(HttpsServerFactory.create());

        } else {

            throw new InternalError("unsupported protocol: " + protocol);

        }

        return server;

    }

    static HttpsServer configure(HttpsServer server) throws IOException {

        try {

            SSLContext ctx = SSLContext.getDefault();

            server.setHttpsConfigurator(new Configurator(ctx));

        } catch (NoSuchAlgorithmException ex) {

            throw new IOException(ex);

        }

        return server;

    }

    static void setContextAuthenticator(HttpContext ctxt,

                                        HttpTestAuthenticator auth) {

        final String realm = auth.getRealm();

        com.sun.net.httpserver.Authenticator authenticator =

            new BasicAuthenticator(realm) {

                @Override

                public boolean checkCredentials(String username, String pwd) {

                    return auth.getUserName().equals(username)

                           && new String(auth.getPassword(username)).equals(pwd);

                }

        };

        ctxt.setAuthenticator(authenticator);

    }

    public static DigestEchoServer createServer(String protocol,

                                        HttpAuthType authType,

                                        HttpTestAuthenticator auth,

                                        HttpAuthSchemeType schemeType,

                                        HttpHandler delegate,

                                        String path)

            throws IOException {

        Objects.requireNonNull(authType);

        Objects.requireNonNull(auth);

        HttpServer impl = createHttpServer(protocol);

        final DigestEchoServer server = new DigestEchoServer(impl, null, delegate);

        final HttpHandler hh = server.createHandler(schemeType, auth, authType, false);

        HttpContext ctxt = impl.createContext(path, hh);

        server.configureAuthentication(ctxt, schemeType, auth, authType);

        impl.start();

        return server;

    }

    public static DigestEchoServer createProxy(String protocol,

                                        HttpAuthType authType,

                                        HttpTestAuthenticator auth,

                                        HttpAuthSchemeType schemeType,

                                        HttpHandler delegate,

                                        String path)

            throws IOException {

        Objects.requireNonNull(authType);

        Objects.requireNonNull(auth);

        HttpServer impl = createHttpServer(protocol);

        final DigestEchoServer server = "https".equalsIgnoreCase(protocol)

                ? new HttpsProxyTunnel(impl, null, delegate)

                : new DigestEchoServer(impl, null, delegate);

        final HttpHandler hh = server.createHandler(HttpAuthSchemeType.NONE,

                                    null, HttpAuthType.SERVER,

                                         server instanceof HttpsProxyTunnel);

        HttpContext ctxt = impl.createContext(path, hh);

        server.configureAuthentication(ctxt, schemeType, auth, authType);

        impl.start();

        return server;

    }

    public static DigestEchoServer createServerAndRedirect(

                                        String protocol,

                                        HttpAuthType targetAuthType,

                                        HttpTestAuthenticator auth,

                                        HttpAuthSchemeType schemeType,

                                        HttpHandler targetDelegate,

                                        int code300)

            throws IOException {

        Objects.requireNonNull(targetAuthType);

        Objects.requireNonNull(auth);

        // The connection between client and proxy can only

        // be a plain connection: SSL connection to proxy

        // is not supported by our client connection.

        String targetProtocol = targetAuthType == HttpAuthType.PROXY

                                          ? "http"

                                          : protocol;

        DigestEchoServer redirectTarget =

                (targetAuthType == HttpAuthType.PROXY)

                ? createProxy(protocol, targetAuthType,

                              auth, schemeType, targetDelegate, "/")

                : createServer(targetProtocol, targetAuthType,

                               auth, schemeType, targetDelegate, "/");

        HttpServer impl = createHttpServer(protocol);

        final DigestEchoServer redirectingServer =

                 new DigestEchoServer(impl, redirectTarget, null);

        InetSocketAddress redirectAddr = redirectTarget.getAddress();

        URL locationURL = url(targetProtocol, redirectAddr, "/");

        final HttpHandler hh = redirectingServer.create300Handler(locationURL,

                                             HttpAuthType.SERVER, code300);

        impl.createContext("/", hh);

        impl.start();

        return redirectingServer;

    }

    public InetSocketAddress getAddress() {

        return serverImpl.getAddress();

    }

    public InetSocketAddress getServerAddress() {

        return serverImpl.getAddress();

    }

    public InetSocketAddress getProxyAddress() {

        return serverImpl.getAddress();

    }

    public void stop() {

        serverImpl.stop(0);

        if (redirect != null) {

            redirect.stop();

        }

    }

    protected void writeResponse(HttpExchange he) throws IOException {

        if (delegate == null) {

            he.sendResponseHeaders(HttpURLConnection.HTTP_OK, 0);

            he.getResponseBody().write(he.getRequestBody().readAllBytes());

        } else {

            delegate.handle(he);

        }

    }

    private HttpHandler createHandler(HttpAuthSchemeType schemeType,

                                      HttpTestAuthenticator auth,

                                      HttpAuthType authType,

                                      boolean tunelled) {

        return new HttpNoAuthHandler(authType, tunelled);

    }

    void configureAuthentication(HttpContext ctxt,

                            HttpAuthSchemeType schemeType,

                            HttpTestAuthenticator auth,

                            HttpAuthType authType) {

        switch(schemeType) {

            case DIGEST:

                // DIGEST authentication is handled by the handler.

                ctxt.getFilters().add(new HttpDigestFilter(auth, authType));

                break;

            case BASIC:

                // BASIC authentication is handled by the filter.

                ctxt.getFilters().add(new HttpBasicFilter(auth, authType));

                break;

            case BASICSERVER:

                switch(authType) {

                    case PROXY: case PROXY305:

                        // HttpServer can't support Proxy-type authentication