/*

 * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

import javax.net.ssl.KeyManagerFactory;

import javax.net.ssl.SNIHostName;

import javax.net.ssl.SNIMatcher;

import javax.net.ssl.SNIServerName;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLEngine;

import javax.net.ssl.SSLSession;

import javax.net.ssl.SSLEngineResult;

import javax.net.ssl.SSLEngineResult.HandshakeStatus;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLParameters;

import javax.net.ssl.TrustManagerFactory;

import java.io.File;

import java.io.FileInputStream;

import java.io.IOException;

import java.nio.ByteBuffer;

import java.security.KeyManagementException;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.NoSuchAlgorithmException;

import java.security.UnrecoverableKeyException;

import java.security.cert.CertificateException;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.HashMap;

import java.util.LinkedList;

import java.util.List;

import java.util.Map;

/**

 * Basic class to inherit SSLEngine test cases from it. Tests apply for

 * the TLS or DTLS security protocols and their versions.

 */

abstract public class SSLEngineTestCase {

    public enum Ciphers {

        /**

         * Ciphers supported by the tested SSLEngine without those with

         * kerberos authentication.

         */

        SUPPORTED_NON_KRB_CIPHERS(SSLEngineTestCase.SUPPORTED_NON_KRB_CIPHERS,

                "Supported non kerberos"),

        /**

         * Ciphers supported by the tested SSLEngine without those with

         * kerberos authentication and without those with SHA256 ans SHA384.

         */

        SUPPORTED_NON_KRB_NON_SHA_CIPHERS(

                SSLEngineTestCase.SUPPORTED_NON_KRB_NON_SHA_CIPHERS,

                "Supported non kerberos non SHA256 and SHA384"),

        /**

         * Ciphers supported by the tested SSLEngine with kerberos

         * authentication.

         */

        SUPPORTED_KRB_CIPHERS(SSLEngineTestCase.SUPPORTED_KRB_CIPHERS,

                "Supported kerberos"),

        /**

         * Ciphers enabled by default for the tested SSLEngine without kerberos

         * and anon.

         */

        ENABLED_NON_KRB_NOT_ANON_CIPHERS(

                SSLEngineTestCase.ENABLED_NON_KRB_NOT_ANON_CIPHERS,

                "Enabled by default non kerberos not anonymous"),

        /**

         * Ciphers unsupported by the tested SSLEngine.

         */

        UNSUPPORTED_CIPHERS(SSLEngineTestCase.UNSUPPORTED_CIPHERS,

                "Unsupported");

        Ciphers(String[] ciphers, String description) {

            this.ciphers = ciphers;

            this.description = description;

        }

        final String[] ciphers;

        final String description;

    }

    /**

     * Enumeration used to distinguish handshake mode in

     * {@link SSLEngineTestCase#doHandshake(javax.net.ssl.SSLEngine,

     * javax.net.ssl.SSLEngine, int, SSLEngineTestCase.HandshakeMode, boolean)

     * SSLEngineTestCase.doHandshake} method.

     */

    public enum HandshakeMode {

        /**

         * Initial handshake done for the first time: both engines call

         * {@link SSLEngine#beginHandshake()} method.

         */

        INITIAL_HANDSHAKE,

        /**

         * Repeated handshake done by client: client engine calls

         * {@link SSLEngine#beginHandshake()} method.

         */

        REHANDSHAKE_BEGIN_CLIENT,

        /**

         * Repeated handshake done by server: server engine calls

         * {@link SSLEngine#beginHandshake()} method.

         */

        REHANDSHAKE_BEGIN_SERVER;

    }

    /**

     * Security protocol to be tested: "TLS" or "DTLS" or their versions,

     * e.g. "TLSv1", "TLSv1.1", "TLSv1.2", "DTLSv1.0", "DTLSv1.2".

     */

    public static final String TESTED_SECURITY_PROTOCOL

            = System.getProperty("test.security.protocol", "TLS");

    /**

     * Test mode: "norm", "norm_sni" or "krb".

     * Modes "norm" and "norm_sni" are used to run

     * with all supported non-kerberos ciphers.

     * Mode "krb" is used to run with kerberos ciphers.

     */

    public static final String TEST_MODE

            = System.getProperty("test.mode", "norm");

    private static final String FS = System.getProperty("file.separator", "/");

    private static final String PATH_TO_STORES = ".." + FS + "etc";

    private static final String KEY_STORE_FILE = "keystore";

    private static final String TRUST_STORE_FILE = "truststore";

    private static final String PASSWD = "passphrase";

    private static final String KEY_FILE_NAME

            = System.getProperty("test.src", ".") + FS + PATH_TO_STORES

            + FS + KEY_STORE_FILE;

    private static final String TRUST_FILE_NAME

            = System.getProperty("test.src", ".") + FS + PATH_TO_STORES

            + FS + TRUST_STORE_FILE;

    // Need an enhancement to use none-static mutable global variables.

    private static ByteBuffer net;

    private static boolean doUnwrapForNotHandshakingStatus;

    private static boolean endHandshakeLoop = false;

    private static final int MAX_HANDSHAKE_LOOPS = 100;

    private static final String EXCHANGE_MSG_SENT = "Hello, peer!";

    private static final String TEST_SRC = System.getProperty("test.src", ".");

    private static final String KTAB_FILENAME = "krb5.keytab.data";

    private static final String KRB_REALM = "TEST.REALM";

    private static final String KRBTGT_PRINCIPAL = "krbtgt/" + KRB_REALM;

    private static final String KRB_USER = "USER";

    private static final String KRB_USER_PASSWORD = "password";

    private static final String KRB_USER_PRINCIPAL = KRB_USER + "@" + KRB_REALM;

    private static final String KRB5_CONF_FILENAME = "krb5.conf";

    private static final String PATH_TO_COMMON = ".." + FS + "TLSCommon";

    private static final String JAAS_CONF_FILE = PATH_TO_COMMON

            + FS + "jaas.conf";

    private static final int DELAY = 1000;

    private static final String HOST = "localhost";

    private static final String SERVER_NAME = "service.localhost";

    private static final String SNI_PATTERN = ".*";

    private static final String[] SUPPORTED_NON_KRB_CIPHERS;

    static {

        try {

            String[] allSupportedCiphers = getContext()

                    .createSSLEngine().getSupportedCipherSuites();

            List<String> supportedCiphersList = new LinkedList<>();

            for (String cipher : allSupportedCiphers) {

                if (!cipher.contains("KRB5")

                    && !cipher.contains("TLS_EMPTY_RENEGOTIATION_INFO_SCSV")) {

                    supportedCiphersList.add(cipher);

                }

            }

            SUPPORTED_NON_KRB_CIPHERS =

                    supportedCiphersList.toArray(new String[0]);

        } catch (Exception ex) {

            throw new Error("Unexpected issue", ex);

        }

    }

    private static final String[] SUPPORTED_NON_KRB_NON_SHA_CIPHERS;

    static {

        try {

            String[] allSupportedCiphers = getContext()

                    .createSSLEngine().getSupportedCipherSuites();

            List<String> supportedCiphersList = new LinkedList<>();

            for (String cipher : allSupportedCiphers) {

                if (!cipher.contains("KRB5")

                        && !cipher.contains("TLS_EMPTY_RENEGOTIATION_INFO_SCSV")

                        && !cipher.endsWith("_SHA256")

                        && !cipher.endsWith("_SHA384")) {

                    supportedCiphersList.add(cipher);

                }

            }

            SUPPORTED_NON_KRB_NON_SHA_CIPHERS

                    = supportedCiphersList.toArray(new String[0]);

        } catch (Exception ex) {

            throw new Error("Unexpected issue", ex);

        }

    }

    private static final String[] SUPPORTED_KRB_CIPHERS;

    static {

        try {

            String[] allSupportedCiphers = getContext()

                    .createSSLEngine().getSupportedCipherSuites();

            List<String> supportedCiphersList = new LinkedList<>();

            for (String cipher : allSupportedCiphers) {

                if (cipher.contains("KRB5")

                    && !cipher.contains("TLS_EMPTY_RENEGOTIATION_INFO_SCSV")) {

                    supportedCiphersList.add(cipher);

                }

            }

            SUPPORTED_KRB_CIPHERS = supportedCiphersList.toArray(new String[0]);

        } catch (Exception ex) {

            throw new Error("Unexpected issue", ex);

        }

    }

    private static final String[] ENABLED_NON_KRB_NOT_ANON_CIPHERS;

    static {

        try {

            SSLEngine temporary = getContext().createSSLEngine();

            temporary.setUseClientMode(true);

            String[] enabledCiphers = temporary.getEnabledCipherSuites();

            List<String> enabledCiphersList = new LinkedList<>();

            for (String cipher : enabledCiphers) {

                if (!cipher.contains("anon") && !cipher.contains("KRB5")

                    && !cipher.contains("TLS_EMPTY_RENEGOTIATION_INFO_SCSV")) {

                    enabledCiphersList.add(cipher);

                }

            }

            ENABLED_NON_KRB_NOT_ANON_CIPHERS =

                    enabledCiphersList.toArray(new String[0]);

        } catch (Exception ex) {

            throw new Error("Unexpected issue", ex);

        }

    }

    private static final String[] UNSUPPORTED_CIPHERS = {

            "SSL_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA",

            "SSL_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA",

            "SSL_DHE_DSS_WITH_RC4_128_SHA",

            "SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",

            "SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA",

            "SSL_DH_DSS_WITH_DES_CBC_SHA",

            "SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",

            "SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA",

            "SSL_DH_RSA_WITH_DES_CBC_SHA",

            "SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA",

            "SSL_FORTEZZA_DMS_WITH_NULL_SHA",

            "SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA",

            "SSL_RSA_EXPORT1024_WITH_RC4_56_SHA",

            "SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5",

            "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA",

            "SSL_RSA_FIPS_WITH_DES_CBC_SHA",

            "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",

            "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",

            "TLS_KRB5_WITH_IDEA_CBC_MD5",

            "TLS_KRB5_WITH_IDEA_CBC_SHA",

            "SSL_RSA_WITH_IDEA_CBC_SHA",

            "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",

            "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",

            "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",

            "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"

    };

    private final int maxPacketSize;

    /**

     * Constructs test case with the given MFLN maxMacketSize.

     *

     * @param maxPacketSize - MLFN extension max packet size.

     */

    public SSLEngineTestCase(int maxPacketSize) {

        this.maxPacketSize = maxPacketSize;

    }

    /**

     * Constructs test case with {@code maxPacketSize = 0}.

     */

    public SSLEngineTestCase() {

        this.maxPacketSize = 0;

    }

    /**

     * Wraps data with the specified engine.

     *

     * @param engine        - SSLEngine that wraps data.

     * @param wrapper       - Set wrapper id, e.g. "server" of "client".

     *                        Used for logging only.

     * @param maxPacketSize - Max packet size to check that MFLN extension

     *                        works or zero for no check.

     * @param app           - Buffer with data to wrap.

     * @return - Buffer with wrapped data.

     * @throws SSLException - thrown on engine errors.

     */

    public static ByteBuffer doWrap(SSLEngine engine, String wrapper,

                                    int maxPacketSize, ByteBuffer app)

            throws SSLException {

        return doWrap(engine, wrapper, maxPacketSize,

                app, SSLEngineResult.Status.OK, null);

    }

    /**

     * Wraps data with the specified engine.

     *

     * @param engine        - SSLEngine that wraps data.

     * @param wrapper       - Set wrapper id, e.g. "server" of "client".

     *                        Used for logging only.

     * @param maxPacketSize - Max packet size to check that MFLN extension

     *                        works or zero for no check.

     * @param app           - Buffer with data to wrap.

     * @param result        - Array which first element will be used to

     *                        output wrap result object.

     * @return - Buffer with wrapped data.

     * @throws SSLException - thrown on engine errors.

     */

    public static ByteBuffer doWrap(SSLEngine engine, String wrapper,

                                    int maxPacketSize, ByteBuffer app,

                                    SSLEngineResult[] result)

            throws SSLException {

        return doWrap(engine, wrapper, maxPacketSize,

                app, SSLEngineResult.Status.OK, result);

    }

    /**

     * Wraps data with the specified engine.

     *

     * @param engine        - SSLEngine that wraps data.

     * @param wrapper       - Set wrapper id, e.g. "server" of "client".

     *                        Used for logging only.

     * @param maxPacketSize - Max packet size to check that MFLN extension

     *                        works or zero for no check.

     * @param app           - Buffer with data to wrap.

     * @param wantedStatus  - Specifies expected result status of wrapping.

     * @return - Buffer with wrapped data.

     * @throws SSLException - thrown on engine errors.

     */

    public static ByteBuffer doWrap(SSLEngine engine, String wrapper,

                                    int maxPacketSize, ByteBuffer app,

                                    SSLEngineResult.Status wantedStatus)

            throws SSLException {

        return doWrap(engine, wrapper, maxPacketSize,

                app, wantedStatus, null);

    }

    /**

     * Wraps data with the specified engine.

     *

     * @param engine        - SSLEngine that wraps data.

     * @param wrapper       - Set wrapper id, e.g. "server" of "client".

     *                        Used for logging only.

     * @param maxPacketSize - Max packet size to check that MFLN extension

     *                        works or zero for no check.

     * @param app           - Buffer with data to wrap.

     * @param wantedStatus  - Specifies expected result status of wrapping.

     * @param result        - Array which first element will be used to output

     *                        wrap result object.

     * @return - Buffer with wrapped data.

     * @throws SSLException - thrown on engine errors.

     */

    public static ByteBuffer doWrap(SSLEngine engine, String wrapper,

                                    int maxPacketSize, ByteBuffer app,

                                    SSLEngineResult.Status wantedStatus,

                                    SSLEngineResult[] result)

            throws SSLException {

        ByteBuffer net = ByteBuffer.allocate(engine.getSession()

                .getPacketBufferSize());

        SSLEngineResult r = engine.wrap(app, net);

        net.flip();

        int length = net.remaining();

        System.out.println(wrapper + " wrapped " + length + " bytes.");

        System.out.println(wrapper + " handshake status is "

                + engine.getHandshakeStatus());

        if (maxPacketSize < length && maxPacketSize != 0) {

            throw new AssertionError("Handshake wrapped net buffer length "

                    + length + " exceeds maximum packet size "

                    + maxPacketSize);

        }

        checkResult(r, wantedStatus);

        if (result != null && result.length > 0) {

            result[0] = r;

        }

        return net;

    }

    /**

     * Unwraps data with the specified engine.

     *

     * @param engine    - SSLEngine that unwraps data.

     * @param unwrapper - Set unwrapper id, e.g. "server" of "client". Used for

     *                  logging only.

     * @param net       - Buffer with data to unwrap.

     * @return - Buffer with unwrapped data.

     * @throws SSLException - thrown on engine errors.

     */

    public static ByteBuffer doUnWrap(SSLEngine engine, String unwrapper,

            ByteBuffer net) throws SSLException {

        return doUnWrap(engine, unwrapper,

                net, SSLEngineResult.Status.OK, null);

    }

    /**

     * Unwraps data with the specified engine.

     *

     * @param engine    - SSLEngine that unwraps data.

     * @param unwrapper - Set unwrapper id, e.g. "server" of "client". Used for

     *                  logging only.

     * @param net       - Buffer with data to unwrap.

     * @param result    - Array which first element will be used to output wrap

     *                  result object.

     * @return - Buffer with unwrapped data.

     * @throws SSLException - thrown on engine errors.

     */

    public static ByteBuffer doUnWrap(SSLEngine engine, String unwrapper,

            ByteBuffer net, SSLEngineResult[] result) throws SSLException {

        return doUnWrap(engine, unwrapper,

                net, SSLEngineResult.Status.OK, result);

    }

    /**

     * Unwraps data with the specified engine.

     *

     * @param engine       - SSLEngine that unwraps data.

     * @param unwrapper    - Set unwrapper id, e.g. "server" of "client".

     *                     Used for logging only.

     * @param net          - Buffer with data to unwrap.

     * @param wantedStatus - Specifies expected result status of wrapping.

     * @return - Buffer with unwrapped data.

     * @throws SSLException - thrown on engine errors.

     */

    public static ByteBuffer doUnWrap(SSLEngine engine, String unwrapper,

            ByteBuffer net,

            SSLEngineResult.Status wantedStatus) throws SSLException {

        return doUnWrap(engine, unwrapper, net, wantedStatus, null);

    }

    /**

     * Unwraps data with the specified engine.

     *

     * @param engine       - SSLEngine that unwraps data.

     * @param unwrapper    - Set unwrapper id, e.g. "server" of "client".

     *                       Used for logging only.

     * @param net          - Buffer with data to unwrap.

     * @param wantedStatus - Specifies expected result status of wrapping.

     * @param result       - Array which first element will be used to output

     *                       wrap result object.

     * @return - Buffer with unwrapped data.

     * @throws SSLException - thrown on engine errors.

     */

    public static ByteBuffer doUnWrap(SSLEngine engine, String unwrapper,

            ByteBuffer net, SSLEngineResult.Status wantedStatus,

            SSLEngineResult[] result) throws SSLException {

        ByteBuffer app = ByteBuffer.allocate(

                engine.getSession().getApplicationBufferSize());

        int length = net.remaining();

        System.out.println(unwrapper + " unwrapping " + length + " bytes...");

        SSLEngineResult r = engine.unwrap(net, app);

        app.flip();

        System.out.println(unwrapper + " handshake status is "

                + engine.getHandshakeStatus());

        checkResult(r, wantedStatus);

        if (result != null && result.length > 0) {

            result[0] = r;

        }

        return app;

    }

    /**

     * Does the handshake of the two specified engines according to the

     * {@code mode} specified.

     *

     * @param clientEngine  - Client SSLEngine.

     * @param serverEngine  - Server SSLEngine.

     * @param maxPacketSize - Maximum packet size for MFLN of zero for no limit.

     * @param mode          - Handshake mode according to

     *                        {@link HandshakeMode} enum.

     * @throws SSLException - thrown on engine errors.

     */

    public static void doHandshake(SSLEngine clientEngine,

        SSLEngine serverEngine,

        int maxPacketSize, HandshakeMode mode) throws SSLException {

        doHandshake(clientEngine, serverEngine, maxPacketSize, mode, false);

    }

    /**

     * Does the handshake of the two specified engines according to the

     * {@code mode} specified.

     *

     * @param clientEngine          - Client SSLEngine.

     * @param serverEngine          - Server SSLEngine.

     * @param maxPacketSize         - Maximum packet size for MFLN of zero

     *                                for no limit.

     * @param mode                  - Handshake mode according to

     *                                {@link HandshakeMode} enum.

     * @param enableReplicatedPacks - Set {@code true} to enable replicated

     *                                packet sending.