/*

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.testlibrary;

import java.io.*;

import java.net.*;

import java.security.*;

import java.security.cert.CRLReason;

import java.security.cert.X509Certificate;

import java.security.cert.Extension;

import java.security.cert.CertificateException;

import java.security.cert.CertificateEncodingException;

import java.security.Signature;

import java.util.*;

import java.util.concurrent.*;

import java.text.SimpleDateFormat;

import java.math.BigInteger;

import sun.security.x509.*;

import sun.security.x509.PKIXExtensions;

import sun.security.provider.certpath.ResponderId;

import sun.security.provider.certpath.CertId;

import sun.security.provider.certpath.OCSPResponse;

import sun.security.provider.certpath.OCSPResponse.ResponseStatus;

import sun.security.util.Debug;

import sun.security.util.DerInputStream;

import sun.security.util.DerOutputStream;

import sun.security.util.DerValue;

import sun.security.util.ObjectIdentifier;

/**

 * This is a simple OCSP server designed to listen and respond to incoming

 * requests.

 */

public class SimpleOCSPServer {

    private final Debug debug = Debug.getInstance("oserv");

    private static final ObjectIdentifier OCSP_BASIC_RESPONSE_OID =

            ObjectIdentifier.newInternal(

                    new int[] { 1, 3, 6, 1, 5, 5, 7, 48, 1, 1});

    private static final SimpleDateFormat utcDateFmt =

            new SimpleDateFormat("MMM dd yyyy, HH:mm:ss z");

    // CertStatus values

    public static enum CertStatus {

        CERT_STATUS_GOOD,

        CERT_STATUS_REVOKED,

        CERT_STATUS_UNKNOWN,

    }

    // Fields used for the networking portion of the responder

    private ServerSocket servSocket;

    private InetAddress listenAddress;

    private int listenPort;

    // Keystore information (certs, keys, etc.)

    private KeyStore keystore;

    private X509Certificate issuerCert;

    private X509Certificate signerCert;

    private PrivateKey signerKey;

    // Fields used for the operational portions of the server

    private boolean logEnabled = false;

    private ExecutorService threadPool;

    private volatile boolean started = false;

    private volatile boolean receivedShutdown = false;

    private long delayMsec = 0;

    // Fields used in the generation of responses

    private long nextUpdateInterval = -1;

    private Date nextUpdate = null;

    private ResponderId respId;

    private AlgorithmId sigAlgId;

    private Map<CertId, CertStatusInfo> statusDb =

            Collections.synchronizedMap(new HashMap<>());

    /**

     * Construct a SimpleOCSPServer using keystore, password, and alias

     * parameters.

     *

     * @param ks the keystore to be used

     * @param password the password to access key material in the keystore

     * @param issuerAlias the alias of the issuer certificate

     * @param signerAlias the alias of the signer certificate and key.  A

     * value of {@code null} means that the {@code issuerAlias} will be used

     * to look up the signer key.

     *

     * @throws GeneralSecurityException if there are problems accessing the

     * keystore or finding objects within the keystore.

     * @throws IOException if a {@code ResponderId} cannot be generated from

     * the signer certificate.

     */

    public SimpleOCSPServer(KeyStore ks, String password, String issuerAlias,

            String signerAlias) throws GeneralSecurityException, IOException {

        this(null, 0, ks, password, issuerAlias, signerAlias);

    }

    /**

     * Construct a SimpleOCSPServer using specific network parameters,

     * keystore, password, and alias.

     *

     * @param addr the address to bind the server to.  A value of {@code null}

     * means the server will bind to all interfaces.

     * @param port the port to listen on.  A value of {@code 0} will mean that

     * the server will randomly pick an open ephemeral port to bind to.

     * @param ks the keystore to be used

     * @param password the password to access key material in the keystore

     * @param issuerAlias the alias of the issuer certificate

     * @param signerAlias the alias of the signer certificate and key.  A

     * value of {@code null} means that the {@code issuerAlias} will be used

     * to look up the signer key.

     *

     * @throws GeneralSecurityException if there are problems accessing the

     * keystore or finding objects within the keystore.

     * @throws IOException if a {@code ResponderId} cannot be generated from

     * the signer certificate.

     */

    public SimpleOCSPServer(InetAddress addr, int port, KeyStore ks,

            String password, String issuerAlias, String signerAlias)

            throws GeneralSecurityException, IOException {

        Objects.requireNonNull(ks, "Null keystore provided");

        Objects.requireNonNull(issuerAlias, "Null issuerName provided");

        utcDateFmt.setTimeZone(TimeZone.getTimeZone("GMT"));

        keystore = ks;

        issuerCert = (X509Certificate)ks.getCertificate(issuerAlias);

        if (issuerCert == null) {

            throw new IllegalArgumentException("Certificate for alias " +

                    issuerAlias + " not found");

        }

        if (signerAlias != null) {

            signerCert = (X509Certificate)ks.getCertificate(signerAlias);

            if (signerCert == null) {

                throw new IllegalArgumentException("Certificate for alias " +

                    signerAlias + " not found");

            }

            signerKey = (PrivateKey)ks.getKey(signerAlias,

                    password.toCharArray());

            if (signerKey == null) {

                throw new IllegalArgumentException("PrivateKey for alias " +

                    signerAlias + " not found");

            }

        } else {

            signerCert = issuerCert;

            signerKey = (PrivateKey)ks.getKey(issuerAlias,

                    password.toCharArray());

            if (signerKey == null) {

                throw new IllegalArgumentException("PrivateKey for alias " +

                    issuerAlias + " not found");

            }

        }

        sigAlgId = AlgorithmId.get("Sha256withRSA");

        respId = new ResponderId(signerCert.getSubjectX500Principal());

        listenAddress = addr;

        listenPort = port;

    }

    /**

     * Start the server.  The server will bind to the specified network

     * address and begin listening for incoming connections.

     *

     * @throws IOException if any number of things go wonky.

     */

    public synchronized void start() throws IOException {

        // You cannot start the server twice.

        if (started) {

            log("Server has already been started");

            return;

        } else {

            started = true;

        }

        // Create and start the thread pool

        threadPool = Executors.newFixedThreadPool(32, new ThreadFactory() {

            @Override

            public Thread newThread(Runnable r) {

                Thread t = Executors.defaultThreadFactory().newThread(r);

                t.setDaemon(true);

                return t;

            }

        });

        threadPool.submit(new Runnable() {

            @Override

            public void run() {

                try (ServerSocket sSock = new ServerSocket()) {

                    servSocket = sSock;

                    servSocket.setReuseAddress(true);

                    servSocket.setSoTimeout(500);

                    servSocket.bind(new InetSocketAddress(listenAddress,

                            listenPort), 128);

                    log("Listening on " + servSocket.getLocalSocketAddress());

                    // Update the listenPort with the new port number.  If

                    // the server is restarted, it will bind to the same

                    // port rather than picking a new one.

                    listenPort = servSocket.getLocalPort();

                    // Main dispatch loop

                    while (!receivedShutdown) {

                        try {

                            Socket newConnection = servSocket.accept();

                            threadPool.submit(new OcspHandler(newConnection));

                        } catch (SocketTimeoutException timeout) {

                            // Nothing to do here.  If receivedShutdown

                            // has changed to true then the loop will

                            // exit on its own.

                        } catch (IOException ioe) {

                            // Something bad happened, log and force a shutdown

                            log("Unexpected Exception: " + ioe);

                            stop();

                        }

                    }

                    log("Shutting down...");

                    threadPool.shutdown();

                } catch (IOException ioe) {

                    err(ioe);

                }

            }

        });

    }

    /**

     * Stop the OCSP server.

     */

    public synchronized void stop() {

        if (started) {

            receivedShutdown = true;

            log("Received shutdown notification");

        }

    }

    /**

     * Print {@code SimpleOCSPServer} operating parameters.

     *

     * @return the {@code SimpleOCSPServer} operating parameters in

     * {@code String} form.

     */

    @Override

    public String toString() {

        StringBuilder sb = new StringBuilder();

        sb.append("OCSP Server:\n");

        sb.append("----------------------------------------------\n");

        sb.append("issuer: ").append(issuerCert.getSubjectX500Principal()).

                append("\n");

        sb.append("signer: ").append(signerCert.getSubjectX500Principal()).

                append("\n");

        sb.append("ResponderId: ").append(respId).append("\n");

        sb.append("----------------------------------------------");

        return sb.toString();

    }

    /**

     * Helpful debug routine to hex dump byte arrays.

     *

     * @param data the array of bytes to dump to stdout.

     *

     * @return the hexdump of the byte array

     */

    private static String dumpHexBytes(byte[] data) {

        return dumpHexBytes(data, 16, "\n", " ");

    }

    /**

     *

     * @param data the array of bytes to dump to stdout.

     * @param itemsPerLine the number of bytes to display per line

     * if the {@code lineDelim} character is blank then all bytes will be

     * printed on a single line.

     * @param lineDelim the delimiter between lines

     * @param itemDelim the delimiter between bytes

     *

     * @return The hexdump of the byte array

     */

    private static String dumpHexBytes(byte[] data, int itemsPerLine,

            String lineDelim, String itemDelim) {

        StringBuilder sb = new StringBuilder();

        if (data != null) {

            for (int i = 0; i < data.length; i++) {

                if (i % itemsPerLine == 0 && i != 0) {

                    sb.append(lineDelim);

                }

                sb.append(String.format("%02X", data[i])).append(itemDelim);

            }

        }

        return sb.toString();

    }

    /**

     * Enable or disable the logging feature.

     *

     * @param enable {@code true} to enable logging, {@code false} to

     * disable it.  The setting must be activated before the server calls

     * its start method.  Any calls after that have no effect.

     */

    public void enableLog(boolean enable) {

        if (!started) {

            logEnabled = enable;

        }

    }

    /**

     * Sets the nextUpdate interval.  Intervals will be calculated relative

     * to the server startup time.  When first set, the nextUpdate date is

     * calculated based on the current time plus the interval.  After that,

     * calls to getNextUpdate() will return this date if it is still

     * later than current time.  If not, the Date will be updated to the

     * next interval that is later than current time.  This value must be set

     * before the server has had its start method called.  Calls made after

     * the server has been started have no effect.

     *

     * @param interval the recurring time interval in seconds used to

     * calculate nextUpdate times.   A value less than or equal to 0 will

     * disable the nextUpdate feature.

     */

    public synchronized void setNextUpdateInterval(long interval) {

        if (!started) {

            if (interval <= 0) {

                nextUpdateInterval = -1;

                nextUpdate = null;

                log("nexUpdate support has been disabled");

            } else {

                nextUpdateInterval = interval * 1000;

                nextUpdate = new Date(System.currentTimeMillis() +

                        nextUpdateInterval);

                log("nextUpdate set to " + nextUpdate);

            }

        }

    }

    /**

     * Return the nextUpdate {@code Date} object for this server.  If the

     * nextUpdate date has already passed, set a new nextUpdate based on

     * the nextUpdate interval and return that date.

     *

     * @return a {@code Date} object set to the nextUpdate field for OCSP

     * responses.

     */

    private synchronized Date getNextUpdate() {

        if (nextUpdate != null && nextUpdate.before(new Date())) {

            long nuEpochTime = nextUpdate.getTime();

            long currentTime = System.currentTimeMillis();

            // Keep adding nextUpdate intervals until you reach a date

            // that is later than current time.

            while (currentTime >= nuEpochTime) {

                nuEpochTime += nextUpdateInterval;

            }

            // Set the nextUpdate for future threads

            nextUpdate = new Date(nuEpochTime);

            log("nextUpdate updated to new value: " + nextUpdate);

        }

        return nextUpdate;

    }

    /**

     * Add entries into the responder's status database.

     *

     * @param newEntries a map of {@code CertStatusInfo} objects, keyed on

     * their serial number (as a {@code BigInteger}).  All serial numbers

     * are assumed to have come from this responder's issuer certificate.

     *

     * @throws IOException if a CertId cannot be generated.

     */

    public void updateStatusDb(Map<BigInteger, CertStatusInfo> newEntries)

            throws IOException {

         if (newEntries != null) {

            for (BigInteger serial : newEntries.keySet()) {

                CertStatusInfo info = newEntries.get(serial);

                if (info != null) {

                    CertId cid = new CertId(issuerCert,

                            new SerialNumber(serial));

                    statusDb.put(cid, info);

                    log("Added entry for serial " + serial + "(" +

                            info.getType() + ")");

                }

            }

        }

    }

    /**

     * Check the status database for revocation information one one or more

     * certificates.

     *

     * @param reqList the list of {@code LocalSingleRequest} objects taken

     * from the incoming OCSP request.

     *

     * @return a {@code Map} of {@code CertStatusInfo} objects keyed by their

     * {@code CertId} values, for each single request passed in.  Those

     * CertIds not found in the statusDb will have returned List members with

     * a status of UNKNOWN.

     */

    private Map<CertId, CertStatusInfo> checkStatusDb(

            List<LocalOcspRequest.LocalSingleRequest> reqList) {

        // TODO figure out what, if anything to do with request extensions

        Map<CertId, CertStatusInfo> returnMap = new HashMap<>();

        for (LocalOcspRequest.LocalSingleRequest req : reqList) {

            CertId cid = req.getCertId();

            CertStatusInfo info = statusDb.get(cid);

            if (info != null) {

                log("Status for SN " + cid.getSerialNumber() + ": " +

                        info.getType());

                returnMap.put(cid, info);

            } else {

                log("Status for SN " + cid.getSerialNumber() +

                        " not found, using CERT_STATUS_UNKNOWN");

                returnMap.put(cid,

                        new CertStatusInfo(CertStatus.CERT_STATUS_UNKNOWN));

            }

        }

        return Collections.unmodifiableMap(returnMap);

    }

    /**

     * Set the digital signature algorithm used to sign OCSP responses.

     *

     * @param algName The algorithm name

     *

     * @throws NoSuchAlgorithmException if the algorithm name is invalid.

     */

    public void setSignatureAlgorithm(String algName)

            throws NoSuchAlgorithmException {

        if (!started) {

            sigAlgId = AlgorithmId.get(algName);

        }

    }

    /**

     * Get the port the OCSP server is running on.

     *

     * @return the port that the OCSP server is running on, or -1 if the

     * server has not yet been bound to a port.

     */

    public int getPort() {

            InetSocketAddress inetSock =

                    (InetSocketAddress)servSocket.getLocalSocketAddress();

            return inetSock.getPort();

        } else {

            return -1;

        }

    }

    /**

     * Set a delay between the reception of the request and production of

     * the response.

     *

     * @param delayMillis the number of milliseconds to wait before acting

     * on the incoming request.

     */

    public void setDelay(long delayMillis) {

        if (!started) {

            delayMsec = delayMillis > 0 ? delayMillis : 0;

            if (delayMsec > 0) {

                log("OCSP latency set to " + delayMsec + " milliseconds.");

            } else {

                log("OCSP latency disabled");

            }

        }

    }

    /**

     * Log a message to stdout.

     *

     * @param message the message to log

     */

    private synchronized void log(String message) {

        if (logEnabled || debug != null) {

            System.out.println("[" + Thread.currentThread().getName() + "]: " +

                    message);

        }

    }

    /**

     * Log an error message on the stderr stream.

     *