/*

 * Copyright (c) 2016, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

import com.sun.net.httpserver.BasicAuthenticator;

import com.sun.net.httpserver.Filter;

import com.sun.net.httpserver.Headers;

import com.sun.net.httpserver.HttpContext;

import com.sun.net.httpserver.HttpExchange;

import com.sun.net.httpserver.HttpHandler;

import com.sun.net.httpserver.HttpServer;

import com.sun.net.httpserver.HttpsConfigurator;

import com.sun.net.httpserver.HttpsParameters;

import com.sun.net.httpserver.HttpsServer;

import java.io.IOException;

import java.io.InputStream;

import java.io.OutputStream;

import java.io.OutputStreamWriter;

import java.io.PrintWriter;

import java.io.Writer;

import java.math.BigInteger;

import java.net.HttpURLConnection;

import java.net.InetAddress;

import java.net.InetSocketAddress;

import java.net.MalformedURLException;

import java.net.ServerSocket;

import java.net.Socket;

import java.net.SocketAddress;

import java.net.URL;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.time.Instant;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.Base64;

import java.util.List;

import java.util.Objects;

import java.util.Random;

import java.util.concurrent.CopyOnWriteArrayList;

import java.util.stream.Collectors;

import javax.net.ssl.SSLContext;

import sun.net.www.HeaderParser;

/**

 * A simple HTTP server that supports Digest authentication.

 * By default this server will echo back whatever is present

 * in the request body.

 * @author danielfuchs

 */

public class HTTPTestServer extends HTTPTest {

    final HttpServer      serverImpl; // this server endpoint

    final HTTPTestServer  redirect;   // the target server where to redirect 3xx

    final HttpHandler     delegate;   // unused

    private HTTPTestServer(HttpServer server, HTTPTestServer target,

                           HttpHandler delegate) {

        this.serverImpl = server;

        this.redirect = target;

        this.delegate = delegate;

    }

    public static void main(String[] args)

            throws IOException {

           HTTPTestServer server = create(HTTPTest.DEFAULT_PROTOCOL_TYPE,

                                          HTTPTest.DEFAULT_HTTP_AUTH_TYPE,

                                          HTTPTest.AUTHENTICATOR,

                                          HTTPTest.DEFAULT_SCHEME_TYPE);

           try {

               System.out.println("Server created at " + server.getAddress());

               System.out.println("Strike <Return> to exit");

               System.in.read();

           } finally {

               System.out.println("stopping server");

               server.stop();

           }

    }

    private static String toString(Headers headers) {

        return headers.entrySet().stream()

                .map((e) -> e.getKey() + ": " + e.getValue())

                .collect(Collectors.joining("\n"));

    }

    public static HTTPTestServer create(HttpProtocolType protocol,

                                        HttpAuthType authType,

                                        HttpTestAuthenticator auth,

                                        HttpSchemeType schemeType)

            throws IOException {

        return create(protocol, authType, auth, schemeType, null);

    }

    public static HTTPTestServer create(HttpProtocolType protocol,

                                        HttpAuthType authType,

                                        HttpTestAuthenticator auth,

                                        HttpSchemeType schemeType,

                                        HttpHandler delegate)

            throws IOException {

        Objects.requireNonNull(authType);

        Objects.requireNonNull(auth);

        switch(authType) {

            // A server that performs Server Digest authentication.

            case SERVER: return createServer(protocol, authType, auth,

                                             schemeType, delegate, "/");

            // A server that pretends to be a Proxy and performs

            // Proxy Digest authentication. If protocol is HTTPS,

            // then this will create a HttpsProxyTunnel that will

            // handle the CONNECT request for tunneling.

            case PROXY: return createProxy(protocol, authType, auth,

                                           schemeType, delegate, "/");

            // A server that sends 307 redirect to a server that performs

            // Digest authentication.

            // Note: 301 doesn't work here because it transforms POST into GET.

            case SERVER307: return createServerAndRedirect(protocol,

                                                        HttpAuthType.SERVER,

                                                        auth, schemeType,

                                                        delegate, 307);

            // A server that sends 305 redirect to a proxy that performs

            // Digest authentication.

            case PROXY305:  return createServerAndRedirect(protocol,

                                                        HttpAuthType.PROXY,

                                                        auth, schemeType,

                                                        delegate, 305);

            default:

                throw new InternalError("Unknown server type: " + authType);

        }

    }

    /**

     * The SocketBindableFactory ensures that the local port used by an HttpServer

     * or a proxy ServerSocket previously created by the current test/VM will not

     * get reused by a subsequent test in the same VM. This is to avoid having the

     * AuthCache reuse credentials from previous tests - which would invalidate the

     * assumptions made by the current test on when the default authenticator should

     * be called.

     */

    private static abstract class SocketBindableFactory<B> {

        private static final int MAX = 10;

        private static final CopyOnWriteArrayList<String> addresses =

            new CopyOnWriteArrayList<>();

        protected B createInternal() throws IOException {

            final int max = addresses.size() + MAX;

            final List<B> toClose = new ArrayList<>();

            try {

                for (int i = 1; i <= max; i++) {

                    B bindable = createBindable();

                    SocketAddress address = getAddress(bindable);

                    String key = toString(address);

                    if (addresses.addIfAbsent(key)) {

                       System.out.println("Socket bound to: " + key

                                          + " after " + i + " attempt(s)");

                       return bindable;

                    }

                    System.out.println("warning: address " + key

                                       + " already used. Retrying bind.");

                    // keep the port bound until we get a port that we haven't

                    // used already

                    toClose.add(bindable);

                }

            } finally {

                // if we had to retry, then close the socket we're not

                // going to use.

                for (B b : toClose) {

                  try { close(b); } catch (Exception x) { /* ignore */ }

                }

            }

            throw new IOException("Couldn't bind socket after " + max + " attempts: "

                                  + "addresses used before: " + addresses);

        }

        private static String toString(SocketAddress address) {

            // We don't rely on address.toString(): sometimes it can be

            // "/127.0.0.1:port", sometimes it can be "localhost/127.0.0.1:port"

            // Instead we compose our own string representation:

            InetSocketAddress candidate = (InetSocketAddress) address;

            String hostAddr = candidate.getAddress().getHostAddress();

            if (hostAddr.contains(":")) hostAddr = "[" + hostAddr + "]";

            return hostAddr + ":" + candidate.getPort();

        }

        protected abstract B createBindable() throws IOException;

        protected abstract SocketAddress getAddress(B bindable);

        protected abstract void close(B bindable) throws IOException;

    }

    /*

     * Used to create ServerSocket for a proxy.

     */

    private static final class ServerSocketFactory

            extends SocketBindableFactory<ServerSocket> {

        private static final ServerSocketFactory instance = new ServerSocketFactory();

        static ServerSocket create() throws IOException {

            return instance.createInternal();

        }

        @Override

        protected ServerSocket createBindable() throws IOException {

            InetAddress address = InetAddress.getLoopbackAddress();

            return new ServerSocket(0, 0, address);

        }

        @Override

        protected SocketAddress getAddress(ServerSocket socket) {

            return socket.getLocalSocketAddress();

        }

        @Override

        protected void close(ServerSocket socket) throws IOException {

            socket.close();

        }

    }

    /*

     * Used to create HttpServer for a NTLMTestServer.

     */

    private static abstract class WebServerFactory<S extends HttpServer>

            extends SocketBindableFactory<S> {

        @Override

        protected S createBindable() throws IOException {

            S server = newHttpServer();

            InetAddress address = InetAddress.getLoopbackAddress();

            server.bind(new InetSocketAddress(address, 0), 0);

            return server;

        }

        @Override

        protected SocketAddress getAddress(S server) {

            return server.getAddress();

        }

        @Override

        protected void close(S server) throws IOException {

            server.stop(1);

        }

        /*

         * Returns a HttpServer or a HttpsServer in different subclasses.

         */

        protected abstract S newHttpServer() throws IOException;

    }

    private static final class HttpServerFactory extends WebServerFactory<HttpServer> {

        private static final HttpServerFactory instance = new HttpServerFactory();

        static HttpServer create() throws IOException {

            return instance.createInternal();

        }

        @Override

        protected HttpServer newHttpServer() throws IOException {

            return HttpServer.create();

        }

    }

    private static final class HttpsServerFactory extends WebServerFactory<HttpsServer> {

        private static final HttpsServerFactory instance = new HttpsServerFactory();

        static HttpsServer create() throws IOException {

            return instance.createInternal();

        }

        @Override

        protected HttpsServer newHttpServer() throws IOException {

            return HttpsServer.create();

        }

    }

    static HttpServer createHttpServer(HttpProtocolType protocol) throws IOException {

        switch (protocol) {

            case HTTP:  return HttpServerFactory.create();

            case HTTPS: return configure(HttpsServerFactory.create());

            default: throw new InternalError("Unsupported protocol " + protocol);

        }

    }

    static HttpsServer configure(HttpsServer server) throws IOException {

        try {

            SSLContext ctx = SSLContext.getDefault();

            server.setHttpsConfigurator(new Configurator(ctx));

        } catch (NoSuchAlgorithmException ex) {

            throw new IOException(ex);

        }

        return server;

    }

    static void setContextAuthenticator(HttpContext ctxt,

                                        HttpTestAuthenticator auth) {

        final String realm = auth.getRealm();

        com.sun.net.httpserver.Authenticator authenticator =

            new BasicAuthenticator(realm) {

                @Override

                public boolean checkCredentials(String username, String pwd) {

                    return auth.getUserName().equals(username)

                           && new String(auth.getPassword(username)).equals(pwd);

                }

        };

        ctxt.setAuthenticator(authenticator);

    }

    public static HTTPTestServer createServer(HttpProtocolType protocol,

                                        HttpAuthType authType,

                                        HttpTestAuthenticator auth,

                                        HttpSchemeType schemeType,

                                        HttpHandler delegate,

                                        String path)

            throws IOException {

        Objects.requireNonNull(authType);

        Objects.requireNonNull(auth);

        HttpServer impl = createHttpServer(protocol);

        final HTTPTestServer server = new HTTPTestServer(impl, null, delegate);

        final HttpHandler hh = server.createHandler(schemeType, auth, authType);

        HttpContext ctxt = impl.createContext(path, hh);

        server.configureAuthentication(ctxt, schemeType, auth, authType);

        impl.start();

        return server;

    }

    public static HTTPTestServer createProxy(HttpProtocolType protocol,

                                        HttpAuthType authType,

                                        HttpTestAuthenticator auth,

                                        HttpSchemeType schemeType,

                                        HttpHandler delegate,

                                        String path)

            throws IOException {

        Objects.requireNonNull(authType);

        Objects.requireNonNull(auth);

        HttpServer impl = createHttpServer(protocol);

        final HTTPTestServer server = protocol == HttpProtocolType.HTTPS

                ? new HttpsProxyTunnel(impl, null, delegate)

                : new HTTPTestServer(impl, null, delegate);

        final HttpHandler hh = server.createHandler(schemeType, auth, authType);

        HttpContext ctxt = impl.createContext(path, hh);

        server.configureAuthentication(ctxt, schemeType, auth, authType);

        impl.start();

        return server;

    }

    public static HTTPTestServer createServerAndRedirect(

                                        HttpProtocolType protocol,

                                        HttpAuthType targetAuthType,

                                        HttpTestAuthenticator auth,

                                        HttpSchemeType schemeType,

                                        HttpHandler targetDelegate,

                                        int code300)

            throws IOException {

        Objects.requireNonNull(targetAuthType);

        Objects.requireNonNull(auth);

        // The connection between client and proxy can only

        // be a plain connection: SSL connection to proxy

        // is not supported by our client connection.

        HttpProtocolType targetProtocol = targetAuthType == HttpAuthType.PROXY

                                          ? HttpProtocolType.HTTP

                                          : protocol;

        HTTPTestServer redirectTarget =

                (targetAuthType == HttpAuthType.PROXY)

                ? createProxy(protocol, targetAuthType,

                              auth, schemeType, targetDelegate, "/")

                : createServer(targetProtocol, targetAuthType,

                               auth, schemeType, targetDelegate, "/");

        HttpServer impl = createHttpServer(protocol);

        final HTTPTestServer redirectingServer =

                 new HTTPTestServer(impl, redirectTarget, null);

        InetSocketAddress redirectAddr = redirectTarget.getAddress();

        URL locationURL = url(targetProtocol, redirectAddr, "/");

        final HttpHandler hh = redirectingServer.create300Handler(locationURL,

                                             HttpAuthType.SERVER, code300);

        impl.createContext("/", hh);

        impl.start();

        return redirectingServer;

    }

    public InetSocketAddress getAddress() {

        return serverImpl.getAddress();

    }

    public InetSocketAddress getProxyAddress() {

        return serverImpl.getAddress();

    }

    public void stop() {

        serverImpl.stop(0);

        if (redirect != null) {

            redirect.stop();

        }

    }

    protected void writeResponse(HttpExchange he) throws IOException {

        if (delegate == null) {

            he.sendResponseHeaders(HttpURLConnection.HTTP_OK, 0);

            he.getResponseBody().write(he.getRequestBody().readAllBytes());

        } else {

            delegate.handle(he);

        }

    }

    private HttpHandler createHandler(HttpSchemeType schemeType,

                                      HttpTestAuthenticator auth,

                                      HttpAuthType authType) {

        return new HttpNoAuthHandler(authType);

    }

    private void configureAuthentication(HttpContext ctxt,

                            HttpSchemeType schemeType,

                            HttpTestAuthenticator auth,

                            HttpAuthType authType) {

        switch(schemeType) {

            case DIGEST:

                // DIGEST authentication is handled by the handler.

                ctxt.getFilters().add(new HttpDigestFilter(auth, authType));

                break;

            case BASIC:

                // BASIC authentication is handled by the filter.

                ctxt.getFilters().add(new HttpBasicFilter(auth, authType));

                break;

            case BASICSERVER:

                switch(authType) {

                    case PROXY: case PROXY305:

                        // HttpServer can't support Proxy-type authentication

                        // => we do as if BASIC had been specified, and we will

                        //    handle authentication in the handler.

                        ctxt.getFilters().add(new HttpBasicFilter(auth, authType));

                        break;

                    case SERVER: case SERVER307:

                        // Basic authentication is handled by HttpServer

                        // directly => the filter should not perform

                        // authentication again.

                        setContextAuthenticator(ctxt, auth);

                        ctxt.getFilters().add(new HttpNoAuthFilter(authType));

                        break;

                    default:

                        throw new InternalError("Invalid combination scheme="

                             + schemeType + " authType=" + authType);

                }

            case NONE:

                // No authentication at all.

                ctxt.getFilters().add(new HttpNoAuthFilter(authType));

                break;

            default:

                throw new InternalError("No such scheme: " + schemeType);

        }

    }

    private HttpHandler create300Handler(URL proxyURL,

        HttpAuthType type, int code300) throws MalformedURLException {

        return new Http3xxHandler(proxyURL, type, code300);

    }

    // Abstract HTTP filter class.

    private abstract static class AbstractHttpFilter extends Filter {

        final HttpAuthType authType;

        final String type;

        public AbstractHttpFilter(HttpAuthType authType, String type) {

            this.authType = authType;

            this.type = type;

        }

        String getLocation() {

            return "Location";

        }

        String getAuthenticate() {

            return authType == HttpAuthType.PROXY

                    ? "Proxy-Authenticate" : "WWW-Authenticate";

        }

        String getAuthorization() {

            return authType == HttpAuthType.PROXY

                    ? "Proxy-Authorization" : "Authorization";

        }

        int getUnauthorizedCode() {

            return authType == HttpAuthType.PROXY

                    ? HttpURLConnection.HTTP_PROXY_AUTH

                    : HttpURLConnection.HTTP_UNAUTHORIZED;

        }

        String getKeepAlive() {

            return "keep-alive";

        }

        String getConnection() {

            return authType == HttpAuthType.PROXY

                    ? "Proxy-Connection" : "Connection";

        }

        protected abstract boolean isAuthentified(HttpExchange he) throws IOException;

        protected abstract void requestAuthentication(HttpExchange he) throws IOException;

        protected void accept(HttpExchange he, Chain chain) throws IOException {

            chain.doFilter(he);

        }

        @Override