/*
    * ====================================================================
    * Licensed to the Apache Software Foundation (ASF) under one
    * or more contributor license agreements.  See the NOTICE file
    * distributed with this work for additional information
    * regarding copyright ownership.  The ASF licenses this file
    * to you under the Apache License, Version 2.0 (the
    * "License"); you may not use this file except in compliance
    * with the License.  You may obtain a copy of the License at
   *
   *   http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing,
   * software distributed under the License is distributed on an
   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   * KIND, either express or implied.  See the License for the
   * specific language governing permissions and limitations
   * under the License.
   * ====================================================================
   *
   * This software consists of voluntary contributions made by many
   * individuals on behalf of the Apache Software Foundation.  For more
   * information on the Apache Software Foundation, please see
   * <http://www.apache.org/>.
   *
   */
  
  package org.apache.http.nio.conn.ssl;
  
  import java.io.IOException;
  import java.security.cert.Certificate;
  import java.security.cert.X509Certificate;
  
  import javax.net.ssl.HostnameVerifier;
  import javax.net.ssl.SSLContext;
  import javax.net.ssl.SSLEngine;
  import javax.net.ssl.SSLException;
  import javax.net.ssl.SSLPeerUnverifiedException;
  import javax.net.ssl.SSLSession;
  import javax.security.auth.x500.X500Principal;
  
  import org.apache.http.HttpHost;
  import org.apache.http.conn.ssl.AllowAllHostnameVerifier;
  import org.apache.http.conn.ssl.BrowserCompatHostnameVerifier;
  import org.apache.http.conn.ssl.DefaultHostnameVerifier;
  import org.apache.http.conn.ssl.StrictHostnameVerifier;
  import org.apache.http.conn.ssl.X509HostnameVerifier;
  import org.apache.http.conn.util.PublicSuffixMatcherLoader;
  import org.apache.http.nio.conn.SchemeIOSessionStrategy;
  import org.apache.http.nio.reactor.IOSession;
  import org.apache.http.nio.reactor.ssl.SSLIOSession;
  import org.apache.http.nio.reactor.ssl.SSLMode;
  import org.apache.http.nio.reactor.ssl.SSLSetupHandler;
  import org.apache.http.ssl.SSLContexts;
  import org.apache.http.util.Args;
  import org.apache.http.util.Asserts;
  import org.apache.http.util.TextUtils;
  
  /**
   * TLS/SSL transport level security strategy.
   *
   * @since 4.0
   */
  public class SSLIOSessionStrategy implements SchemeIOSessionStrategy {
  
      /**
       * @deprecated Do not use.
       */
      @Deprecated
      public static final X509HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER =
              new AllowAllHostnameVerifier();
  
      /**
       * @deprecated Do not use.
       */
      @Deprecated
      public static final X509HostnameVerifier BROWSER_COMPATIBLE_HOSTNAME_VERIFIER =
              new BrowserCompatHostnameVerifier();
  
      /**
       * @deprecated Do not use.
       */
      @Deprecated
      public static final X509HostnameVerifier STRICT_HOSTNAME_VERIFIER =
              new StrictHostnameVerifier();
  
      private static String[] split(final String s) {
          if (TextUtils.isBlank(s)) {
              return null;
          }
          return s.split(" *, *");
      }
  
      /**
       * @since 4.1
       */
      public static HostnameVerifier getDefaultHostnameVerifier() {
          return new DefaultHostnameVerifier(PublicSuffixMatcherLoader.getDefault());
      }
 
     public static SSLIOSessionStrategy getDefaultStrategy() {
         return new SSLIOSessionStrategy(
                 SSLContexts.createDefault(),
                 getDefaultHostnameVerifier());
     }
 
     public static SSLIOSessionStrategy getSystemDefaultStrategy() {
         return new SSLIOSessionStrategy(
                 SSLContexts.createSystemDefault(),
                 split(System.getProperty("https.protocols")),
                 split(System.getProperty("https.cipherSuites")),
                 getDefaultHostnameVerifier());
     }
 
     private final SSLContext sslContext;
     private final String[] supportedProtocols;
     private final String[] supportedCipherSuites;
     private final HostnameVerifier hostnameVerifier;
 
     /**
      * @deprecated (4.1) use {@link SSLIOSessionStrategy#SSLIOSessionStrategy(
      *   javax.net.ssl.SSLContext, String[], String[], javax.net.ssl.HostnameVerifier)}
      */
     @Deprecated
     public SSLIOSessionStrategy(
             final SSLContext sslContext,
             final String[] supportedProtocols,
             final String[] supportedCipherSuites,
             final X509HostnameVerifier hostnameVerifier) {
         this(sslContext, supportedProtocols, supportedCipherSuites, (HostnameVerifier) hostnameVerifier);
     }
 
     /**
      * @deprecated (4.1)
      */
     @Deprecated
     public SSLIOSessionStrategy(
             final SSLContext sslcontext,
             final X509HostnameVerifier hostnameVerifier) {
         this(sslcontext, null, null, (HostnameVerifier) hostnameVerifier);
     }
 
     /**
      * @since 4.1
      */
     public SSLIOSessionStrategy(
             final SSLContext sslContext,
             final String[] supportedProtocols,
             final String[] supportedCipherSuites,
             final HostnameVerifier hostnameVerifier) {
         super();
         this.sslContext = Args.notNull(sslContext, "SSL context");
         this.supportedProtocols = supportedProtocols;
         this.supportedCipherSuites = supportedCipherSuites;
         this.hostnameVerifier = hostnameVerifier != null ? hostnameVerifier : getDefaultHostnameVerifier();
     }
 
     /**
      * @since 4.1
      */
     public SSLIOSessionStrategy(
             final SSLContext sslcontext,
             final HostnameVerifier hostnameVerifier) {
         this(sslcontext, null, null, hostnameVerifier);
     }
 
     public SSLIOSessionStrategy(final SSLContext sslcontext) {
         this(sslcontext, null, null, getDefaultHostnameVerifier());
     }
 
     @Override
     public SSLIOSession upgrade(final HttpHost host, final IOSession ioSession) throws IOException {
         Asserts.check(!(ioSession instanceof SSLIOSession), "I/O session is already upgraded to TLS/SSL");
         final SSLIOSession sslioSession = new SSLIOSession(
             ioSession,
             SSLMode.CLIENT,
             host,
             this.sslContext,
             new SSLSetupHandler() {
 
                 @Override
                 public void initalize(
                         final SSLEngine sslengine) throws SSLException {
                     if (supportedProtocols != null) {
                         sslengine.setEnabledProtocols(supportedProtocols);
                     }
                     if (supportedCipherSuites != null) {
                         sslengine.setEnabledCipherSuites(supportedCipherSuites);
                     }
                     initializeEngine(sslengine);
                 }
 
                 @Override
                 public void verify(
                         final IOSession ioSession,
                         final SSLSession sslsession) throws SSLException {
                     verifySession(host, ioSession, sslsession);
                 }
 
         });
         ioSession.setAttribute(SSLIOSession.SESSION_KEY, sslioSession);
         sslioSession.initialize();
         return sslioSession;
     }
 
     protected void initializeEngine(final SSLEngine engine) {
     }
 
     protected void verifySession(
             final HttpHost host,
             final IOSession ioSession,
             final SSLSession sslsession) throws SSLException {
         if (!this.hostnameVerifier.verify(host.getHostName(), sslsession)) {
             final Certificate[] certs = sslsession.getPeerCertificates();
             final X509Certificate x509 = (X509Certificate) certs[0];
             final X500Principal x500Principal = x509.getSubjectX500Principal();
             throw new SSLPeerUnverifiedException("Host name '" + host.getHostName() + "' does not match " +
                     "the certificate subject provided by the peer (" + x500Principal.toString() + ")");
         }
     }
 
     @Override
     public boolean isLayeringRequired() {
         return true;
     }
 
 }