/*

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

//

// Please run in othervm mode.  SunJSSE does not support dynamic system

// properties, no way to re-use system properties in samevm/agentvm mode.

//

/*

 * @test

 * @bug 8161106 8170329

 * @modules jdk.crypto.ec

 * @summary Improve SSLSocket test template

 * @run main/othervm SSLSocketTemplate

 */

import java.io.ByteArrayInputStream;

import java.io.InputStream;

import java.io.IOException;

import java.io.OutputStream;

import javax.net.ssl.KeyManagerFactory;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLServerSocket;

import javax.net.ssl.SSLServerSocketFactory;

import javax.net.ssl.SSLSocket;

import javax.net.ssl.SSLSocketFactory;

import javax.net.ssl.TrustManagerFactory;

import java.net.InetSocketAddress;

import java.net.SocketTimeoutException;

import java.security.KeyStore;

import java.security.PrivateKey;

import java.security.KeyFactory;

import java.security.cert.Certificate;

import java.security.cert.CertificateFactory;

import java.security.spec.PKCS8EncodedKeySpec;

import java.util.Base64;

import java.util.concurrent.CountDownLatch;

import java.util.concurrent.TimeUnit;

/**

 * Template to help speed your client/server tests.

 *

 * Two examples that use this template:

 *    test/sun/security/ssl/ServerHandshaker/AnonCipherWithWantClientAuth.java

 *    test/sun/net/www/protocol/https/HttpsClient/ServerIdentityTest.java

 */

public class SSLSocketTemplate {

    /*

     * ==================

     * Run the test case.

     */

    public static void main(String[] args) throws Exception {

        (new SSLSocketTemplate()).run();

    }

    /*

     * Run the test case.

     */

    public void run() throws Exception {

        bootup();

    }

    /*

     * Define the server side application of the test for the specified socket.

     */

    protected void runServerApplication(SSLSocket socket) throws Exception {

        // here comes the test logic

        InputStream sslIS = socket.getInputStream();

        OutputStream sslOS = socket.getOutputStream();

        sslIS.read();

        sslOS.write(85);

        sslOS.flush();

    }

    /*

     * Define the client side application of the test for the specified socket.

     * This method is used if the returned value of

     * isCustomizedClientConnection() is false.

     *

     * @param socket may be null is no client socket is generated.

     *

     * @see #isCustomizedClientConnection()

     */

    protected void runClientApplication(SSLSocket socket) throws Exception {

        InputStream sslIS = socket.getInputStream();

        OutputStream sslOS = socket.getOutputStream();

        sslOS.write(280);

        sslOS.flush();

        sslIS.read();

    }

    /*

     * Define the client side application of the test for the specified

     * server port.  This method is used if the returned value of

     * isCustomizedClientConnection() is true.

     *

     * Note that the client need to connect to the server port by itself

     * for the actual message exchange.

     *

     * @see #isCustomizedClientConnection()

     */

    protected void runClientApplication(int serverPort) throws Exception {

        // blank

    }

    /*

     * Create an instance of SSLContext for client use.

     */

    protected SSLContext createClientSSLContext() throws Exception {

        return createSSLContext(trustedCertStrs,

                endEntityCertStrs, endEntityPrivateKeys,

                endEntityPrivateKeyNames,

                getClientContextParameters());

    }

    /*

     * Create an instance of SSLContext for server use.

     */

    protected SSLContext createServerSSLContext() throws Exception {

        return createSSLContext(trustedCertStrs,

                endEntityCertStrs, endEntityPrivateKeys,

                endEntityPrivateKeyNames,

                getServerContextParameters());

    }

    /*

     * The parameters used to configure SSLContext.

     */

    protected static final class ContextParameters {

        final String contextProtocol;

        final String tmAlgorithm;

        final String kmAlgorithm;

        ContextParameters(String contextProtocol,

                String tmAlgorithm, String kmAlgorithm) {

            this.contextProtocol = contextProtocol;

            this.tmAlgorithm = tmAlgorithm;

            this.kmAlgorithm = kmAlgorithm;

        }

    }

    /*

     * Get the client side parameters of SSLContext.

     */

    protected ContextParameters getClientContextParameters() {

        return new ContextParameters("TLS", "PKIX", "NewSunX509");

    }

    /*

     * Get the server side parameters of SSLContext.

     */

    protected ContextParameters getServerContextParameters() {

        return new ContextParameters("TLS", "PKIX", "NewSunX509");

    }

    /*

     * Does the client side use customized connection other than

     * explicit Socket.connect(), for example, URL.openConnection()?

     */

    protected boolean isCustomizedClientConnection() {

        return false;

    }

    /*

     * Configure the server side socket.

     */

    protected void configureServerSocket(SSLServerSocket socket) {

    }

    /*

     * =============================================

     * Define the client and server side operations.

     *

     * If the client or server is doing some kind of object creation

     * that the other side depends on, and that thread prematurely

     * exits, you may experience a hang.  The test harness will

     * terminate all hung threads after its timeout has expired,

     * currently 3 minutes by default, but you might try to be

     * smart about it....

     */

    /*

     * Is the server ready to serve?

     */

    private final CountDownLatch serverCondition = new CountDownLatch(1);

    /*

     * Is the client ready to handshake?

     */

    private final CountDownLatch clientCondition = new CountDownLatch(1);

    /*

     * What's the server port?  Use any free port by default

     */

    private volatile int serverPort = 0;

    /*

     * Define the server side of the test.

     */

    private void doServerSide() throws Exception {

        // kick start the server side service

        SSLContext context = createServerSSLContext();

        SSLServerSocketFactory sslssf = context.getServerSocketFactory();

        SSLServerSocket sslServerSocket =

                (SSLServerSocket)sslssf.createServerSocket(serverPort);

        configureServerSocket(sslServerSocket);

        serverPort = sslServerSocket.getLocalPort();

        // Signal the client, the server is ready to accept connection.

        serverCondition.countDown();

        // Try to accept a connection in 30 seconds.

        SSLSocket sslSocket;

        try {

            sslServerSocket.setSoTimeout(30000);

            sslSocket = (SSLSocket)sslServerSocket.accept();

        } catch (SocketTimeoutException ste) {

            // Ignore the test case if no connection within 30 seconds.

            System.out.println(

                "No incoming client connection in 30 seconds. " +

                "Ignore in server side.");

            return;

        } finally {

            sslServerSocket.close();

        }

        // handle the connection

        try {

            // Is it the expected client connection?

            //

            // Naughty test cases or third party routines may try to

            // connection to this server port unintentionally.  In

            // order to mitigate the impact of unexpected client

            // connections and avoid intermittent failure, it should

            // be checked that the accepted connection is really linked

            // to the expected client.

            boolean clientIsReady =

                    clientCondition.await(30L, TimeUnit.SECONDS);

            if (clientIsReady) {

                // Run the application in server side.

                runServerApplication(sslSocket);

            } else {    // Otherwise, ignore

                // We don't actually care about plain socket connections

                // for TLS communication testing generally.  Just ignore

                // the test if the accepted connection is not linked to

                // the expected client or the client connection timeout

                // in 30 seconds.

                System.out.println(

                        "The client is not the expected one or timeout. " +

                        "Ignore in server side.");

            }

        } finally {

            sslSocket.close();

        }

    }

    /*

     * Define the client side of the test.

     */

    private void doClientSide() throws Exception {

        // Wait for server to get started.

        //

        // The server side takes care of the issue if the server cannot

        // get started in 90 seconds.  The client side would just ignore

        // the test case if the serer is not ready.

        boolean serverIsReady =

                serverCondition.await(90L, TimeUnit.SECONDS);

        if (!serverIsReady) {

            System.out.println(

                    "The server is not ready yet in 90 seconds. " +

                    "Ignore in client side.");

            return;

        }

        if (isCustomizedClientConnection()) {

            // Signal the server, the client is ready to communicate.

            clientCondition.countDown();

            // Run the application in client side.

            runClientApplication(serverPort);

            return;

        }

        SSLContext context = createClientSSLContext();

        SSLSocketFactory sslsf = context.getSocketFactory();

        try (SSLSocket sslSocket = (SSLSocket)sslsf.createSocket()) {

            try {

                sslSocket.connect(

                        new InetSocketAddress("localhost", serverPort), 15000);

            } catch (IOException ioe) {

                // The server side may be impacted by naughty test cases or

                // third party routines, and cannot accept connections.

                //

                // Just ignore the test if the connection cannot be

                // established.

                System.out.println(

                        "Cannot make a connection in 15 seconds. " +

                        "Ignore in client side.");

                return;

            }

            // OK, here the client and server get connected.

            // Signal the server, the client is ready to communicate.

            clientCondition.countDown();

            // There is still a chance in theory that the server thread may

            // wait client-ready timeout and then quit.  The chance should

            // be really rare so we don't consider it until it becomes a

            // real problem.

            // Run the application in client side.

            runClientApplication(sslSocket);

        }

    }

    /*

     * =============================================

     * Stuffs to customize the SSLContext instances.

     */

    /*

     * =======================================

     * Certificates and keys used in the test.

     */

    // Trusted certificates.

    private final static String[] trustedCertStrs = {

        // SHA256withECDSA, curve prime256v1

        // Validity

        //    Not Before: Nov 25 04:19:51 2016 GMT

        //    Not After : Nov  5 04:19:51 2037 GMT

        // Subject Key Identifier:

        //    CA:48:E8:00:C1:42:BD:59:9B:79:D9:B4:B4:CE:3F:68:0C:C8:C4:0C

        "-----BEGIN CERTIFICATE-----\n" +

        "MIICHDCCAcGgAwIBAgIJAJtKs6ZEcVjxMAoGCCqGSM49BAMCMDsxCzAJBgNVBAYT\n" +

        "AlVTMQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2VyaXZj\n" +

        "ZTAeFw0xNjExMjUwNDE5NTFaFw0zNzExMDUwNDE5NTFaMDsxCzAJBgNVBAYTAlVT\n" +

        "MQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2VyaXZjZTBZ\n" +

        "MBMGByqGSM49AgEGCCqGSM49AwEHA0IABKMO/AFDHZia65RaqMIBX7WBdtzFj8fz\n" +

        "ggqMADLJhoszS6qfTUDYskETw3uHfB3KAOENsoKX446qFFPuVjxS1aejga0wgaow\n" +

        "HQYDVR0OBBYEFMpI6ADBQr1Zm3nZtLTOP2gMyMQMMGsGA1UdIwRkMGKAFMpI6ADB\n" +

        "Qr1Zm3nZtLTOP2gMyMQMoT+kPTA7MQswCQYDVQQGEwJVUzENMAsGA1UEChMESmF2\n" +

        "YTEdMBsGA1UECxMUU3VuSlNTRSBUZXN0IFNlcml2Y2WCCQCbSrOmRHFY8TAPBgNV\n" +

        "HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAKBggqhkjOPQQDAgNJADBGAiEA5cJ/\n" +

        "jirBbXxzpZ6kdp/Zb/yrIBnr4jiPGJTLgRTb8s4CIQChUDfP1Zqg0qJVfqFNaL4V\n" +

        "a0EAeJHXGZnvCGGqHzoxkg==\n" +

        "-----END CERTIFICATE-----",

        // SHA256withRSA, 2048 bits

        // Validity

        // Subject Key Identifier:

        "-----BEGIN CERTIFICATE-----\n" +

        "-----END CERTIFICATE-----",

        // SHA256withDSA, 2048 bits

        // Validity

        //     Not Before: Nov 25 04:19:56 2016 GMT

        //     Not After : Nov  5 04:19:56 2037 GMT

        // Subject Key Identifier:

        //     19:46:10:43:24:6A:A5:14:BE:E2:92:01:79:F0:4C:5F:E1:AE:81:B5

        "-----BEGIN CERTIFICATE-----\n" +

        "MIIFCzCCBLGgAwIBAgIJAOnEn6YZD/sAMAsGCWCGSAFlAwQDAjA7MQswCQYDVQQG\n" +

        "EwJVUzENMAsGA1UEChMESmF2YTEdMBsGA1UECxMUU3VuSlNTRSBUZXN0IFNlcml2\n" +

        "Y2UwHhcNMTYxMTI1MDQxOTU2WhcNMzcxMTA1MDQxOTU2WjA7MQswCQYDVQQGEwJV\n" +

        "UzENMAsGA1UEChMESmF2YTEdMBsGA1UECxMUU3VuSlNTRSBUZXN0IFNlcml2Y2Uw\n" +

        "ggNGMIICOQYHKoZIzjgEATCCAiwCggEBAJa17ZYdIChv5yeYuPK3zXxgUEGGsdUD\n" +

        "AzfQUxtMryCtc3aNgWLxsN1/QYvp9v+hh4twnG20VemCEH9Qlx06Pxg74DwSOA83\n" +

        "SecO2y7cdgmrHpep9drxKbXVZafwBhbTSwhV+IDO7EO6+LaRvZuya/YOqNIE9ENx\n" +

        "FVk0NrNsDB6pfDEXZsCZALMN2mcl8KGn1q7vdzJQUEV7F6uLGP33znVfmQyWJH3Y\n" +

        "W09WVCFXHvDzZHGXDO2O2QwIU1B5AsXnOGeLnKgXzErCoNKwUbVFP0W0OVeJo4pc\n" +

        "ZfL/8TVELGG90AuuH1V3Gsq6PdzCDPw4Uv/v5m7/6kwXqBQxAJA7jhMCIQCORIGV\n" +

        "mHy5nBLRhIP4vC7vsTxb4CTApPVmZeL5gTIwtQKCAQB2VZLY22k2+IQM6deRGK3L\n" +

        "l7tPChGrKnGmTbtUThIza70Sp9DmTBiLzMEY+IgG8kYuT5STVxWjs0cxXCKZGMQW\n" +

        "tioMtiXPA2M3HA0/8E0mDLSmzb0RAd2xxnDyGsuqo1eVmx7PLjN3bn3EjhD/+j3d\n" +

        "Jx3ZVScMGyq7sVWppUvpudEXi+2etf6GUHjrcX27juo7u4zQ1ezC/HYG1H+jEFqG\n" +

        "hdQ6b7H+LBHZH9LegOyIZTMrzAY/TwIr77sXrNJWRoxmDErKB+8bRDybYhNJswlZ\n" +

        "m0N5YYUlPmepgbl6XzwCv0y0d81h3bayqIPLXEUtRAl9GuM0hNAlA1Y+qSn9xLFY\n" +

        "A4IBBQACggEAZgWC0uflwqQQP1GRU1tolmFZwyVtKre7SjYgCeQBrOa0Xnj/SLaD\n" +

        "g1HZ1oH0hccaR/45YouJiCretbbsQ77KouldGSGqTHJgRL75Y2z5uvxa60+YxZ0Z\n" +

        "v8xvZnj4seyOjgJLxSSYSPl5n/F70RaNiCLVz/kGe6OQ8KoAeQjdDTOHXCegO9KX\n" +

        "tvhM7EaYc8CII9OIR7S7PXJW0hgLKynZcu/Unh02aM0ABh/uLmw1+tvo8e8KTp98\n" +

        "NKYSVf6kV3/ya58n4h64UbIYL08JoKUM/5SFETcKAZTU0YKZbpWTM79oJMr8oYVk\n" +

        "P9jKitNsXq0Xkzt5dSO0kfu/kM7zpnaFsqOBrTCBqjAdBgNVHQ4EFgQUGUYQQyRq\n" +

        "pRS+4pIBefBMX+GugbUwawYDVR0jBGQwYoAUGUYQQyRqpRS+4pIBefBMX+GugbWh\n" +

        "P6Q9MDsxCzAJBgNVBAYTAlVTMQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5K\n" +

        "U1NFIFRlc3QgU2VyaXZjZYIJAOnEn6YZD/sAMA8GA1UdEwEB/wQFMAMBAf8wCwYD\n" +

        "VR0PBAQDAgEGMAsGCWCGSAFlAwQDAgNHADBEAiAwBafz5RRR9nc4cCYoYuBlT/D9\n" +

        "9eayhkjhBY/zYunypwIgNp/JnFR88/T4hh36QfSKBGXId9RBCM6uaOkOKnEGkps=\n" +

        "-----END CERTIFICATE-----"

        };

    // End entity certificate.

    private final static String[] endEntityCertStrs = {

        // SHA256withECDSA, curve prime256v1

        // Validity

        //     Not Before: Nov 25 04:19:51 2016 GMT

        //     Not After : Aug 12 04:19:51 2036 GMT

        // Authority Key Identifier:

        //     CA:48:E8:00:C1:42:BD:59:9B:79:D9:B4:B4:CE:3F:68:0C:C8:C4:0C

        "-----BEGIN CERTIFICATE-----\n" +

        "MIIB1zCCAXygAwIBAgIJAPFq2QL/nUNZMAoGCCqGSM49BAMCMDsxCzAJBgNVBAYT\n" +

        "AlVTMQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2VyaXZj\n" +

        "ZTAeFw0xNjExMjUwNDE5NTFaFw0zNjA4MTIwNDE5NTFaMFUxCzAJBgNVBAYTAlVT\n" +

        "MQ0wCwYDVQQKDARKYXZhMR0wGwYDVQQLDBRTdW5KU1NFIFRlc3QgU2VyaXZjZTEY\n" +

        "MBYGA1UEAwwPUmVncmVzc2lvbiBUZXN0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD\n" +

        "QgAE4yvRGVvy9iVATyuHPJVdX6+lh/GLm/sRJ5qLT/3PVFOoNIvlEVNiARo7xhyj\n" +

        "2p6bnf32gNg5Ye+QCw20VUv9E6NPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSO\n" +

        "hHlHZQp9hyBfSGTSQWeszqMXejAfBgNVHSMEGDAWgBTKSOgAwUK9WZt52bS0zj9o\n" +

        "DMjEDDAKBggqhkjOPQQDAgNJADBGAiEAu3t6cvFglBAZfkhZlEwB04ZjUFqyfiRj\n" +

        "4Hr275E4ZoQCIQDUEonJHlmA19J6oobfR5lYsmoqPm1r0DPm/IiNNKGKKA==\n" +

        "-----END CERTIFICATE-----",

        // SHA256withRSA, 2048 bits

        // Validity

        // Authority Key Identifier:

        "-----BEGIN CERTIFICATE-----\n" +