//
   //  ========================================================================
   //  Copyright (c) 1995-2013 Mort Bay Consulting Pty. Ltd.
   //  ------------------------------------------------------------------------
   //  All rights reserved. This program and the accompanying materials
   //  are made available under the terms of the Eclipse Public License v1.0
   //  and Apache License v2.0 which accompanies this distribution.
   //
   //      The Eclipse Public License is available at
  //      http://www.eclipse.org/legal/epl-v10.html
  //
  //      The Apache License v2.0 is available at
  //      http://www.opensource.org/licenses/apache2.0.php
  //
  //  You may elect to redistribute this code under either of these licenses.
  //  ========================================================================
  //
  
  package org.eclipse.jetty.util.ssl;
  
  import java.io.ByteArrayInputStream;
  import java.io.ByteArrayOutputStream;
  import java.io.IOException;
  import java.io.InputStream;
  import java.net.InetAddress;
  import java.net.InetSocketAddress;
  import java.security.InvalidParameterException;
  import java.security.KeyStore;
  import java.security.SecureRandom;
  import java.security.Security;
  import java.security.cert.CRL;
  import java.security.cert.CertStore;
  import java.security.cert.Certificate;
  import java.security.cert.CollectionCertStoreParameters;
  import java.security.cert.PKIXBuilderParameters;
  import java.security.cert.X509CertSelector;
  import java.security.cert.X509Certificate;
  import java.util.Arrays;
  import java.util.Collection;
  import java.util.Collections;
  import java.util.LinkedHashSet;
  import java.util.List;
  import java.util.Set;
  import java.util.concurrent.CopyOnWriteArraySet;
  import java.util.regex.Matcher;
  import java.util.regex.Pattern;
  import javax.net.ssl.CertPathTrustManagerParameters;
  import javax.net.ssl.KeyManager;
  import javax.net.ssl.KeyManagerFactory;
  import javax.net.ssl.SSLContext;
  import javax.net.ssl.SSLEngine;
  import javax.net.ssl.SSLParameters;
  import javax.net.ssl.SSLPeerUnverifiedException;
  import javax.net.ssl.SSLServerSocket;
  import javax.net.ssl.SSLServerSocketFactory;
  import javax.net.ssl.SSLSession;
  import javax.net.ssl.SSLSocket;
  import javax.net.ssl.SSLSocketFactory;
  import javax.net.ssl.TrustManager;
  import javax.net.ssl.TrustManagerFactory;
  import javax.net.ssl.X509KeyManager;
  import javax.net.ssl.X509TrustManager;
  
  import org.eclipse.jetty.util.IO;
  import org.eclipse.jetty.util.component.AbstractLifeCycle;
  import org.eclipse.jetty.util.log.Log;
  import org.eclipse.jetty.util.log.Logger;
  import org.eclipse.jetty.util.resource.Resource;
  import org.eclipse.jetty.util.security.CertificateUtils;
  import org.eclipse.jetty.util.security.CertificateValidator;
  import org.eclipse.jetty.util.security.Password;
  
  
  /**
   * SslContextFactory is used to configure SSL connectors
   * as well as HttpClient. It holds all SSL parameters and
   * creates SSL context based on these parameters to be
   * used by the SSL connectors.
   */
  public class SslContextFactory extends AbstractLifeCycle
  {
      public final static TrustManager[] TRUST_ALL_CERTS = new X509TrustManager[]{new X509TrustManager()
      {
          public java.security.cert.X509Certificate[] getAcceptedIssuers()
          {
              return new java.security.cert.X509Certificate[]{};
          }
  
          public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType)
          {
          }
  
          public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType)
          {
          }
      }};
  
      static final Logger LOG = Log.getLogger(SslContextFactory.class);
  
     public static final String DEFAULT_KEYMANAGERFACTORY_ALGORITHM =
         (Security.getProperty("ssl.KeyManagerFactory.algorithm") == null ?
                 KeyManagerFactory.getDefaultAlgorithm() : Security.getProperty("ssl.KeyManagerFactory.algorithm"));
 
     public static final String DEFAULT_TRUSTMANAGERFACTORY_ALGORITHM =
         (Security.getProperty("ssl.TrustManagerFactory.algorithm") == null ?
                 TrustManagerFactory.getDefaultAlgorithm() : Security.getProperty("ssl.TrustManagerFactory.algorithm"));
 
     /** String name of key password property. */
     public static final String KEYPASSWORD_PROPERTY = "org.eclipse.jetty.ssl.keypassword";
 
     /** String name of keystore password property. */
     public static final String PASSWORD_PROPERTY = "org.eclipse.jetty.ssl.password";
 
     /** Excluded protocols. */
     private final Set<String> _excludeProtocols = new LinkedHashSet<>();
 
     /** Included protocols. */
     private Set<String> _includeProtocols = null;
 
     /** Excluded cipher suites. */
     private final Set<String> _excludeCipherSuites = new LinkedHashSet<>();
     /** Included cipher suites. */
     private Set<String> _includeCipherSuites = null;
 
     /** Keystore path. */
     private String _keyStorePath;
     /** Keystore provider name */
     private String _keyStoreProvider;
     /** Keystore type */
     private String _keyStoreType = "JKS";
     /** Keystore input stream */
     private InputStream _keyStoreInputStream;
 
     /** SSL certificate alias */
     private String _certAlias;
 
     /** Truststore path */
     private String _trustStorePath;
     /** Truststore provider name */
     private String _trustStoreProvider;
     /** Truststore type */
     private String _trustStoreType = "JKS";
     /** Truststore input stream */
     private InputStream _trustStoreInputStream;
 
     /** Set to true if client certificate authentication is required */
     private boolean _needClientAuth = false;
     /** Set to true if client certificate authentication is desired */
     private boolean _wantClientAuth = false;
 
     /** Keystore password */
     private transient Password _keyStorePassword;
     /** Key manager password */
     private transient Password _keyManagerPassword;
     /** Truststore password */
     private transient Password _trustStorePassword;
 
     /** SSL provider name */
     private String _sslProvider;
     /** SSL protocol name */
     private String _sslProtocol = "TLS";
 
     /** SecureRandom algorithm */
     private String _secureRandomAlgorithm;
     /** KeyManager factory algorithm */
     private String _keyManagerFactoryAlgorithm = DEFAULT_KEYMANAGERFACTORY_ALGORITHM;
     /** TrustManager factory algorithm */
     private String _trustManagerFactoryAlgorithm = DEFAULT_TRUSTMANAGERFACTORY_ALGORITHM;
 
     /** Set to true if SSL certificate validation is required */
     private boolean _validateCerts;
     /** Set to true if SSL certificate of the peer validation is required */
     private boolean _validatePeerCerts;
     /** Maximum certification path length (n - number of intermediate certs, -1 for unlimited) */
     private int _maxCertPathLength = -1;
     /** Path to file that contains Certificate Revocation List */
     private String _crlPath;
     /** Set to true to enable CRL Distribution Points (CRLDP) support */
     private boolean _enableCRLDP = false;
     /** Set to true to enable On-Line Certificate Status Protocol (OCSP) support */
     private boolean _enableOCSP = false;
     /** Location of OCSP Responder */
     private String _ocspResponderURL;
 
     /** SSL keystore */
     private KeyStore _keyStore;
     /** SSL truststore */
     private KeyStore _trustStore;
     /** Set to true to enable SSL Session caching */
     private boolean _sessionCachingEnabled = true;
     /** SSL session cache size */
     private int _sslSessionCacheSize;
     /** SSL session timeout */
     private int _sslSessionTimeout;
 
     /** SSL context */
     private SSLContext _context;
 
     /** EndpointIdentificationAlgorithm - when set to "HTTPS" hostname verification will be enabled */
     private String _endpointIdentificationAlgorithm = null;
 
     /** Whether to blindly trust certificates */
     private boolean _trustAll;
 
     /** Whether TLS renegotiation is allowed */
     private boolean _renegotiationAllowed = true;
 
     /**
      * Construct an instance of SslContextFactory
      * Default constructor for use in XmlConfiguration files
      */
     public SslContextFactory()
     {
         this(false);
     }
 
     /**
      * Construct an instance of SslContextFactory
      * Default constructor for use in XmlConfiguration files
      * @param trustAll whether to blindly trust all certificates
      * @see #setTrustAll(boolean)
      */
     public SslContextFactory(boolean trustAll)
     {
         setTrustAll(trustAll);
     }
 
     /**
      * Construct an instance of SslContextFactory
      * @param keyStorePath default keystore location
      */
     public SslContextFactory(String keyStorePath)
     {
         _keyStorePath = keyStorePath;
     }
 
     /**
      * Create the SSLContext object and start the lifecycle
      * @see org.eclipse.jetty.util.component.AbstractLifeCycle#doStart()
      */
     @Override
     protected void doStart() throws Exception
     {
         if (_context == null)
         {
             if (_keyStore==null && _keyStoreInputStream == null && _keyStorePath == null &&
                 _trustStore==null && _trustStoreInputStream == null && _trustStorePath == null )
             {
                 TrustManager[] trust_managers=null;
 
                 if (_trustAll)
                 {
                     LOG.debug("No keystore or trust store configured.  ACCEPTING UNTRUSTED CERTIFICATES!!!!!");
                     // Create a trust manager that does not validate certificate chains
                     trust_managers = TRUST_ALL_CERTS;
                 }
 
                 SecureRandom secureRandom = (_secureRandomAlgorithm == null)?null:SecureRandom.getInstance(_secureRandomAlgorithm);
                 SSLContext context = SSLContext.getInstance(_sslProtocol);
                 context.init(null, trust_managers, secureRandom);
                 _context = context;
             }
             else
             {
                 // verify that keystore and truststore
                 // parameters are set up correctly
                 checkKeyStore();
 
                 KeyStore keyStore = loadKeyStore();
                 KeyStore trustStore = loadTrustStore();
 
                 Collection<? extends CRL> crls = loadCRL(_crlPath);
 
                 if (_validateCerts && keyStore != null)
                 {
                     if (_certAlias == null)
                     {
                         List<String> aliases = Collections.list(keyStore.aliases());
                         _certAlias = aliases.size() == 1 ? aliases.get(0) : null;
                     }
 
                     Certificate cert = _certAlias == null?null:keyStore.getCertificate(_certAlias);
                     if (cert == null)
                     {
                         throw new Exception("No certificate found in the keystore" + (_certAlias==null ? "":" for alias " + _certAlias));
                     }
 
                     CertificateValidator validator = new CertificateValidator(trustStore, crls);
                     validator.setMaxCertPathLength(_maxCertPathLength);
                     validator.setEnableCRLDP(_enableCRLDP);
                     validator.setEnableOCSP(_enableOCSP);
                     validator.setOcspResponderURL(_ocspResponderURL);
                     validator.validate(keyStore, cert);
                 }
 
                 KeyManager[] keyManagers = getKeyManagers(keyStore);
                 TrustManager[] trustManagers = getTrustManagers(trustStore,crls);
 
                 SecureRandom secureRandom = (_secureRandomAlgorithm == null)?null:SecureRandom.getInstance(_secureRandomAlgorithm);
                 SSLContext context = _sslProvider == null ? SSLContext.getInstance(_sslProtocol) : SSLContext.getInstance(_sslProtocol,_sslProvider);
                 context.init(keyManagers,trustManagers,secureRandom);
                 _context = context;
             }
 
             SSLEngine engine = newSSLEngine();
             LOG.debug("Enabled Protocols {} of {}",Arrays.asList(engine.getEnabledProtocols()),Arrays.asList(engine.getSupportedProtocols()));
             if (LOG.isDebugEnabled())
                 LOG.debug("Enabled Ciphers   {} of {}",Arrays.asList(engine.getEnabledCipherSuites()),Arrays.asList(engine.getSupportedCipherSuites()));
         }
     }
 
     @Override
     protected void doStop() throws Exception
     {
         _context = null;
         super.doStop();
     }
 
     /**
      * @return The array of protocol names to exclude from
      * {@link SSLEngine#setEnabledProtocols(String[])}
      */
     public String[] getExcludeProtocols()
     {
         return _excludeProtocols.toArray(new String[_excludeProtocols.size()]);
     }
 
     /**
      * @param protocols
      *            The array of protocol names to exclude from
      *            {@link SSLEngine#setEnabledProtocols(String[])}
      */
     public void setExcludeProtocols(String... protocols)
     {
         checkNotStarted();
         _excludeProtocols.clear();
         _excludeProtocols.addAll(Arrays.asList(protocols));
     }
 
     /**
      * @param protocol Protocol names to add to {@link SSLEngine#setEnabledProtocols(String[])}
      */
     public void addExcludeProtocols(String... protocol)
     {
         checkNotStarted();
         _excludeProtocols.addAll(Arrays.asList(protocol));
     }
 
     /**
      * @return The array of protocol names to include in
      * {@link SSLEngine#setEnabledProtocols(String[])}
      */
     public String[] getIncludeProtocols()
     {
         return _includeProtocols.toArray(new String[_includeProtocols.size()]);
     }
 
     /**
      * @param protocols
      *            The array of protocol names to include in
      *            {@link SSLEngine#setEnabledProtocols(String[])}
      */
     public void setIncludeProtocols(String... protocols)
     {
         checkNotStarted();
         _includeProtocols = new LinkedHashSet<>(Arrays.asList(protocols));
     }
 
     /**
      * @return The array of cipher suite names to exclude from
      * {@link SSLEngine#setEnabledCipherSuites(String[])}
      */
     public String[] getExcludeCipherSuites()
     {
         return _excludeCipherSuites.toArray(new String[_excludeCipherSuites.size()]);
     }
 
     /**
      * You can either use the exact cipher suite name or a a regular expression.
      * @param cipherSuites
      *            The array of cipher suite names to exclude from
      *            {@link SSLEngine#setEnabledCipherSuites(String[])}
      */
     public void setExcludeCipherSuites(String... cipherSuites)
     {
         checkNotStarted();
         _excludeCipherSuites.clear();
         _excludeCipherSuites.addAll(Arrays.asList(cipherSuites));
     }
 
     /**
      * @param cipher Cipher names to add to {@link SSLEngine#setEnabledCipherSuites(String[])}
      */
     public void addExcludeCipherSuites(String... cipher)
     {
         checkNotStarted();
         _excludeCipherSuites.addAll(Arrays.asList(cipher));
     }
 
     /**
      * @return The array of cipher suite names to include in
      * {@link SSLEngine#setEnabledCipherSuites(String[])}
      */
     public String[] getIncludeCipherSuites()
     {
         return _includeCipherSuites.toArray(new String[_includeCipherSuites.size()]);
     }
 
     /**
      * You can either use the exact cipher suite name or a a regular expression.
      * @param cipherSuites
      *            The array of cipher suite names to include in
      *            {@link SSLEngine#setEnabledCipherSuites(String[])}
      */
     public void setIncludeCipherSuites(String... cipherSuites)
     {
         checkNotStarted();
         _includeCipherSuites = new LinkedHashSet<>(Arrays.asList(cipherSuites));
     }
 
     /**
      * @return The file or URL of the SSL Key store.
      */
     public String getKeyStorePath()
     {
         return _keyStorePath;
     }
 
     /**
      * @param keyStorePath
      *            The file or URL of the SSL Key store.
      */
     public void setKeyStorePath(String keyStorePath)
     {
         checkNotStarted();
         _keyStorePath = keyStorePath;
     }
 
     /**
      * @return The provider of the key store
      */
     public String getKeyStoreProvider()
     {
         return _keyStoreProvider;
     }
 
     /**
      * @param keyStoreProvider
      *            The provider of the key store
      */
     public void setKeyStoreProvider(String keyStoreProvider)
     {
         checkNotStarted();
         _keyStoreProvider = keyStoreProvider;
     }
 
     /**
      * @return The type of the key store (default "JKS")
      */
     public String getKeyStoreType()
     {
         return (_keyStoreType);
     }
 
     /**
      * @param keyStoreType
      *            The type of the key store (default "JKS")
      */
     public void setKeyStoreType(String keyStoreType)
     {
         checkNotStarted();
         _keyStoreType = keyStoreType;
     }
 
     /**
      * @return Alias of SSL certificate for the connector
      */
     public String getCertAlias()
     {
         return _certAlias;
     }
 
     /**
      * @param certAlias
      *            Alias of SSL certificate for the connector
      */
     public void setCertAlias(String certAlias)
     {
         checkNotStarted();
         _certAlias = certAlias;
     }
 
     /**
      * @return The file name or URL of the trust store location
      */
     public String getTrustStore()
     {
         return _trustStorePath;
     }
 
     /**
      * @param trustStorePath
      *            The file name or URL of the trust store location
      */
     public void setTrustStorePath(String trustStorePath)
     {
         checkNotStarted();
         _trustStorePath = trustStorePath;
     }
 
     /**
      * @return The provider of the trust store
      */
     public String getTrustStoreProvider()
     {
         return _trustStoreProvider;
     }
 
     /**
      * @param trustStoreProvider
      *            The provider of the trust store
      */
     public void setTrustStoreProvider(String trustStoreProvider)
     {
         checkNotStarted();
         _trustStoreProvider = trustStoreProvider;
     }
 
     /**
      * @return The type of the trust store (default "JKS")
      */
     public String getTrustStoreType()
     {
         return _trustStoreType;
     }
 
     /**
      * @param trustStoreType
      *            The type of the trust store (default "JKS")
      */
     public void setTrustStoreType(String trustStoreType)
     {
         checkNotStarted();
         _trustStoreType = trustStoreType;
     }
 
     /**
      * @return True if SSL needs client authentication.
      * @see SSLEngine#getNeedClientAuth()
      */
     public boolean getNeedClientAuth()
     {
         return _needClientAuth;
     }
 
     /**
      * @param needClientAuth
      *            True if SSL needs client authentication.
      * @see SSLEngine#getNeedClientAuth()
      */
     public void setNeedClientAuth(boolean needClientAuth)
     {
         checkNotStarted();
         _needClientAuth = needClientAuth;
     }
 
     /**
      * @return True if SSL wants client authentication.
      * @see SSLEngine#getWantClientAuth()
      */
     public boolean getWantClientAuth()
     {
         return _wantClientAuth;
     }
 
     /**
      * @param wantClientAuth
      *            True if SSL wants client authentication.
      * @see SSLEngine#getWantClientAuth()
      */
     public void setWantClientAuth(boolean wantClientAuth)
     {
         checkNotStarted();
         _wantClientAuth = wantClientAuth;
     }
 
     /**
      * @return true if SSL certificate has to be validated
      */
     public boolean isValidateCerts()
     {
         return _validateCerts;
     }
 
     /**
      * @param validateCerts
      *            true if SSL certificates have to be validated
      */
     public void setValidateCerts(boolean validateCerts)
     {
         checkNotStarted();
         _validateCerts = validateCerts;
     }
 
     /**
      * @return true if SSL certificates of the peer have to be validated
      */
     public boolean isValidatePeerCerts()
     {
         return _validatePeerCerts;
     }
 
     /**
      * @param validatePeerCerts
      *            true if SSL certificates of the peer have to be validated
      */
     public void setValidatePeerCerts(boolean validatePeerCerts)
     {
         checkNotStarted();
         _validatePeerCerts = validatePeerCerts;
     }
 
 
     /**
      * @param password
      *            The password for the key store
      */
     public void setKeyStorePassword(String password)
     {
         checkNotStarted();
         _keyStorePassword = Password.getPassword(PASSWORD_PROPERTY,password,null);
     }
 
     /**
      * @param password
      *            The password (if any) for the specific key within the key store
      */
     public void setKeyManagerPassword(String password)
     {
         checkNotStarted();
         _keyManagerPassword = Password.getPassword(KEYPASSWORD_PROPERTY,password,null);
     }
 
     /**
      * @param password
      *            The password for the trust store
      */
     public void setTrustStorePassword(String password)
     {
         checkNotStarted();
         _trustStorePassword = Password.getPassword(PASSWORD_PROPERTY,password,null);
     }
 
     /**
      * @return The SSL provider name, which if set is passed to
      * {@link SSLContext#getInstance(String, String)}
      */
     public String getProvider()
     {
         return _sslProvider;
     }
 
     /**
      * @param provider
      *            The SSL provider name, which if set is passed to
      *            {@link SSLContext#getInstance(String, String)}
      */
     public void setProvider(String provider)
     {
         checkNotStarted();
         _sslProvider = provider;
     }
 
     /**
      * @return The SSL protocol (default "TLS") passed to
      * {@link SSLContext#getInstance(String, String)}
      */
     public String getProtocol()
     {
         return _sslProtocol;
     }
 
     /**
      * @param protocol
      *            The SSL protocol (default "TLS") passed to
      *            {@link SSLContext#getInstance(String, String)}
      */
     public void setProtocol(String protocol)
     {
         checkNotStarted();
         _sslProtocol = protocol;
     }
 
     /**
      * @return The algorithm name, which if set is passed to
      * {@link SecureRandom#getInstance(String)} to obtain the {@link SecureRandom} instance passed to
      * {@link SSLContext#init(javax.net.ssl.KeyManager[], javax.net.ssl.TrustManager[], SecureRandom)}
      */
     public String getSecureRandomAlgorithm()
     {
         return _secureRandomAlgorithm;
     }
 
     /**
      * @param algorithm
      *            The algorithm name, which if set is passed to
      *            {@link SecureRandom#getInstance(String)} to obtain the {@link SecureRandom} instance passed to
      *            {@link SSLContext#init(javax.net.ssl.KeyManager[], javax.net.ssl.TrustManager[], SecureRandom)}
      */
     public void setSecureRandomAlgorithm(String algorithm)
     {
         checkNotStarted();
         _secureRandomAlgorithm = algorithm;
     }
 
     /**
      * @return The algorithm name (default "SunX509") used by the {@link KeyManagerFactory}
      */
     public String getSslKeyManagerFactoryAlgorithm()
     {
         return (_keyManagerFactoryAlgorithm);
     }
 
     /**
      * @param algorithm
      *            The algorithm name (default "SunX509") used by the {@link KeyManagerFactory}
      */
     public void setSslKeyManagerFactoryAlgorithm(String algorithm)
     {
         checkNotStarted();
         _keyManagerFactoryAlgorithm = algorithm;
     }
 
     /**
      * @return The algorithm name (default "SunX509") used by the {@link TrustManagerFactory}
      */
     public String getTrustManagerFactoryAlgorithm()
     {
         return (_trustManagerFactoryAlgorithm);
     }
 
     /**
      * @return True if all certificates should be trusted if there is no KeyStore or TrustStore
      */
     public boolean isTrustAll()
     {
         return _trustAll;
     }
 
     /**
      * @param trustAll True if all certificates should be trusted if there is no KeyStore or TrustStore
      */
     public void setTrustAll(boolean trustAll)
     {
         _trustAll = trustAll;
         if(trustAll)
             setEndpointIdentificationAlgorithm(null);
     }
 
     /**
      * @param algorithm
      *            The algorithm name (default "SunX509") used by the {@link TrustManagerFactory}
      *            Use the string "TrustAll" to install a trust manager that trusts all.
      */
     public void setTrustManagerFactoryAlgorithm(String algorithm)
     {
         checkNotStarted();
         _trustManagerFactoryAlgorithm = algorithm;
     }
 
     /**
      * @return whether TLS renegotiation is allowed (true by default)
      */
     public boolean isRenegotiationAllowed()
     {
         return _renegotiationAllowed;
     }
 
     /**
      * @param renegotiationAllowed whether TLS renegotiation is allowed
      */
     public void setRenegotiationAllowed(boolean renegotiationAllowed)
     {
         _renegotiationAllowed = renegotiationAllowed;
     }
 
     /**
      * @return Path to file that contains Certificate Revocation List
      */
     public String getCrlPath()
     {
         return _crlPath;
     }
 
     /**
      * @param crlPath
      *            Path to file that contains Certificate Revocation List
      */
     public void setCrlPath(String crlPath)
     {
         checkNotStarted();
         _crlPath = crlPath;
     }
 
     /**
      * @return Maximum number of intermediate certificates in
      * the certification path (-1 for unlimited)
      */
     public int getMaxCertPathLength()
     {
         return _maxCertPathLength;
     }
 
     /**
      * @param maxCertPathLength
      *            maximum number of intermediate certificates in
      *            the certification path (-1 for unlimited)
      */
     public void setMaxCertPathLength(int maxCertPathLength)
     {
         checkNotStarted();
         _maxCertPathLength = maxCertPathLength;
     }
 
     /**
      * @return The SSLContext
      */
     public SSLContext getSslContext()
     {
         if (!isStarted())
             throw new IllegalStateException(getState());
         return _context;
     }
 
     /**
      * @param sslContext
      *            Set a preconfigured SSLContext
      */
     public void setSslContext(SSLContext sslContext)
     {
         checkNotStarted();
         _context = sslContext;
     }
 
     /**
      * When set to "HTTPS" hostname verification will be enabled
      *
      * @param endpointIdentificationAlgorithm Set the endpointIdentificationAlgorithm
      */
     public void setEndpointIdentificationAlgorithm(String endpointIdentificationAlgorithm)
     {
         this._endpointIdentificationAlgorithm = endpointIdentificationAlgorithm;
     }
 
     /**
      * Override this method to provide alternate way to load a keystore.
      *
      * @return the key store instance
      * @throws Exception if the keystore cannot be loaded
      */
     protected KeyStore loadKeyStore() throws Exception
     {
         return _keyStore != null ? _keyStore : CertificateUtils.getKeyStore(_keyStoreInputStream,
                 _keyStorePath, _keyStoreType, _keyStoreProvider,
                 _keyStorePassword==null? null: _keyStorePassword.toString());
     }
 
     /**
      * Override this method to provide alternate way to load a truststore.
      *
      * @return the key store instance
      * @throws Exception if the truststore cannot be loaded
      */
     protected KeyStore loadTrustStore() throws Exception
     {
         return _trustStore != null ? _trustStore : CertificateUtils.getKeyStore(_trustStoreInputStream,
                 _trustStorePath, _trustStoreType,  _trustStoreProvider,
                 _trustStorePassword==null? null: _trustStorePassword.toString());
     }
 
     /**
      * Loads certificate revocation list (CRL) from a file.
      *
      * Required for integrations to be able to override the mechanism used to
      * load CRL in order to provide their own implementation.
      *
      * @param crlPath path of certificate revocation list file
      * @return Collection of CRL's
      * @throws Exception if the certificate revocation list cannot be loaded
      */
     protected Collection<? extends CRL> loadCRL(String crlPath) throws Exception
     {
         return CertificateUtils.loadCRL(crlPath);
     }
 
     protected KeyManager[] getKeyManagers(KeyStore keyStore) throws Exception
     {
         KeyManager[] managers = null;
 
         if (keyStore != null)
         {
             KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(_keyManagerFactoryAlgorithm);
             keyManagerFactory.init(keyStore,_keyManagerPassword == null?(_keyStorePassword == null?null:_keyStorePassword.toString().toCharArray()):_keyManagerPassword.toString().toCharArray());
             managers = keyManagerFactory.getKeyManagers();
 
             if (_certAlias != null)
             {
                 for (int idx = 0; idx < managers.length; idx++)
                 {
                     if (managers[idx] instanceof X509KeyManager)
                     {
                         managers[idx] = new AliasedX509ExtendedKeyManager(_certAlias,(X509KeyManager)managers[idx]);
                     }
                 }
             }
         }
 
         return managers;
     }
 
     protected TrustManager[] getTrustManagers(KeyStore trustStore, Collection<? extends CRL> crls) throws Exception
     {
         TrustManager[] managers = null;
         if (trustStore != null)
         {
             // Revocation checking is only supported for PKIX algorithm
             if (_validatePeerCerts && _trustManagerFactoryAlgorithm.equalsIgnoreCase("PKIX"))
             {
                 PKIXBuilderParameters pbParams = new PKIXBuilderParameters(trustStore,new X509CertSelector());
 
                 // Set maximum certification path length
                 pbParams.setMaxPathLength(_maxCertPathLength);
 
                 // Make sure revocation checking is enabled
                 pbParams.setRevocationEnabled(true);
 
                 if (crls != null && !crls.isEmpty())
                 {
                     pbParams.addCertStore(CertStore.getInstance("Collection",new CollectionCertStoreParameters(crls)));
                 }
 
                 if (_enableCRLDP)
                 {
                     // Enable Certificate Revocation List Distribution Points (CRLDP) support
                     System.setProperty("com.sun.security.enableCRLDP","true");
                 }
 
                 if (_enableOCSP)
                 {
                     // Enable On-Line Certificate Status Protocol (OCSP) support
                     Security.setProperty("ocsp.enable","true");
 
                     if (_ocspResponderURL != null)
                     {
                         // Override location of OCSP Responder
                         Security.setProperty("ocsp.responderURL", _ocspResponderURL);
                     }
                 }
 
                 TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_trustManagerFactoryAlgorithm);
                 trustManagerFactory.init(new CertPathTrustManagerParameters(pbParams));
 
                 managers = trustManagerFactory.getTrustManagers();
             }
             else
             {
                 TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_trustManagerFactoryAlgorithm);
                 trustManagerFactory.init(trustStore);
 
                 managers = trustManagerFactory.getTrustManagers();
             }
         }
 
         return managers;
     }
 
     /**
      * Check KeyStore Configuration. Ensures that if keystore has been
      * configured but there's no truststore, that keystore is
      * used as truststore.
      * @throws IllegalStateException if SslContextFactory configuration can't be used.
      */
     public void checkKeyStore()
     {
         if (_context != null)
             return;
 
         if (_keyStore == null && _keyStoreInputStream == null && _keyStorePath == null)
             throw new IllegalStateException("SSL doesn't have a valid keystore");
 
         // if the keystore has been configured but there is no
         // truststore configured, use the keystore as the truststore
         if (_trustStore == null && _trustStoreInputStream == null && _trustStorePath == null)
         {
             _trustStore = _keyStore;
             _trustStorePath = _keyStorePath;
             _trustStoreInputStream = _keyStoreInputStream;
             _trustStoreType = _keyStoreType;
             _trustStoreProvider = _keyStoreProvider;
             _trustStorePassword = _keyStorePassword;
             _trustManagerFactoryAlgorithm = _keyManagerFactoryAlgorithm;
         }
 
         // It's the same stream we cannot read it twice, so read it once in memory
         if (_keyStoreInputStream != null && _keyStoreInputStream == _trustStoreInputStream)
         {
             try
             {
                 ByteArrayOutputStream baos = new ByteArrayOutputStream();
                 IO.copy(_keyStoreInputStream, baos);
                 _keyStoreInputStream.close();
 
                 _keyStoreInputStream = new ByteArrayInputStream(baos.toByteArray());
                 _trustStoreInputStream = new ByteArrayInputStream(baos.toByteArray());
             }
             catch (Exception ex)
             {
                 throw new IllegalStateException(ex);
             }
         }
     }
 
     /**
      * Select protocols to be used by the connector
      * based on configured inclusion and exclusion lists
      * as well as enabled and supported protocols.
      * @param enabledProtocols Array of enabled protocols
      * @param supportedProtocols Array of supported protocols
      * @return Array of protocols to enable
      */
     public String[] selectProtocols(String[] enabledProtocols, String[] supportedProtocols)
     {
         Set<String> selected_protocols = new LinkedHashSet<>();
 
         // Set the starting protocols - either from the included or enabled list
         if (_includeProtocols!=null)
         {
             // Use only the supported included protocols
             for (String protocol : _includeProtocols)
                 if(Arrays.asList(supportedProtocols).contains(protocol))
                     selected_protocols.add(protocol);
         }
         else
             selected_protocols.addAll(Arrays.asList(enabledProtocols));
 
 
         // Remove any excluded protocols
         selected_protocols.removeAll(_excludeProtocols);
 
         return selected_protocols.toArray(new String[selected_protocols.size()]);
     }
 
     /**
      * Select cipher suites to be used by the connector
      * based on configured inclusion and exclusion lists
      * as well as enabled and supported cipher suite lists.
      * @param enabledCipherSuites Array of enabled cipher suites
      * @param supportedCipherSuites Array of supported cipher suites
      * @return Array of cipher suites to enable
      */
     public String[] selectCipherSuites(String[] enabledCipherSuites, String[] supportedCipherSuites)
     {
         Set<String> selected_ciphers = new CopyOnWriteArraySet<>();
 
         // Set the starting ciphers - either from the included or enabled list
         if (_includeCipherSuites!=null)
             processIncludeCipherSuites(supportedCipherSuites, selected_ciphers);
         else
             selected_ciphers.addAll(Arrays.asList(enabledCipherSuites));
 
         removeExcludedCipherSuites(selected_ciphers);
 
         return selected_ciphers.toArray(new String[selected_ciphers.size()]);
     }
 
     private void processIncludeCipherSuites(String[] supportedCipherSuites, Set<String> selected_ciphers)
     {
         for (String cipherSuite : _includeCipherSuites)
         {
             Pattern p = Pattern.compile(cipherSuite);
             for (String supportedCipherSuite : supportedCipherSuites)
             {
                 Matcher m = p.matcher(supportedCipherSuite);
                 if (m.matches())
                     selected_ciphers.add(supportedCipherSuite);
             }
         }
     }
 
     private void removeExcludedCipherSuites(Set<String> selected_ciphers)
     {
         for (String excludeCipherSuite : _excludeCipherSuites)
         {
             Pattern excludeCipherPattern = Pattern.compile(excludeCipherSuite);
             for (String selectedCipherSuite : selected_ciphers)
             {
                 Matcher m = excludeCipherPattern.matcher(selectedCipherSuite);
                 if (m.matches())
                     selected_ciphers.remove(selectedCipherSuite);
             }
         }
     }
 
     /**
      * Check if the lifecycle has been started and throw runtime exception
      */
     protected void checkNotStarted()
     {
         if (isStarted())
             throw new IllegalStateException("Cannot modify configuration when "+getState());
     }
 
     /**
      * @return true if CRL Distribution Points support is enabled
      */
     public boolean isEnableCRLDP()
     {
         return _enableCRLDP;
     }
 
     /** Enables CRL Distribution Points Support
      * @param enableCRLDP true - turn on, false - turns off
      */
     public void setEnableCRLDP(boolean enableCRLDP)
     {
         checkNotStarted();
         _enableCRLDP = enableCRLDP;
     }
 
     /**
      * @return true if On-Line Certificate Status Protocol support is enabled
      */
     public boolean isEnableOCSP()
     {
         return _enableOCSP;
     }
 
     /** Enables On-Line Certificate Status Protocol support
      * @param enableOCSP true - turn on, false - turn off
      */
     public void setEnableOCSP(boolean enableOCSP)
     {
         checkNotStarted();
         _enableOCSP = enableOCSP;
     }
 
     /**
      * @return Location of the OCSP Responder
      */
     public String getOcspResponderURL()
     {
         return _ocspResponderURL;
     }
 
     /** Set the location of the OCSP Responder.
      * @param ocspResponderURL location of the OCSP Responder
      */
     public void setOcspResponderURL(String ocspResponderURL)
     {
         checkNotStarted();
         _ocspResponderURL = ocspResponderURL;
     }
 
     /** Set the key store.
      * @param keyStore the key store to set
      */
     public void setKeyStore(KeyStore keyStore)
     {
         checkNotStarted();
         _keyStore = keyStore;
     }
 
     /** Set the trust store.
      * @param trustStore the trust store to set
      */
     public void setTrustStore(KeyStore trustStore)
     {
         checkNotStarted();
         _trustStore = trustStore;
     }
 
     /** Set the key store resource.
      * @param resource the key store resource to set
      */
     public void setKeyStoreResource(Resource resource)
     {
         checkNotStarted();
         try
         {
             _keyStoreInputStream = resource.getInputStream();
         }
         catch (IOException e)
         {
              throw new InvalidParameterException("Unable to get resource "+
                      "input stream for resource "+resource.toString());
         }
     }
 
     /** Set the trust store resource.
      * @param resource the trust store resource to set
      */
     public void setTrustStoreResource(Resource resource)
     {
         checkNotStarted();
         try
         {
             _trustStoreInputStream = resource.getInputStream();
         }
         catch (IOException e)
         {
              throw new InvalidParameterException("Unable to get resource "+
                      "input stream for resource "+resource.toString());
         }
     }
 
     /**
     * @return true if SSL Session caching is enabled
     */
     public boolean isSessionCachingEnabled()
     {
         return _sessionCachingEnabled;
     }
 
     /** Set the flag to enable SSL Session caching.
     * @param enableSessionCaching the value of the flag
     */
     public void setSessionCachingEnabled(boolean enableSessionCaching)
     {
         _sessionCachingEnabled = enableSessionCaching;
     }
 
     /** Get SSL session cache size.
      * @return SSL session cache size
      */
     public int getSslSessionCacheSize()
     {
         return _sslSessionCacheSize;
     }
 
     /** SEt SSL session cache size.
      * @param sslSessionCacheSize SSL session cache size to set
      */
     public void setSslSessionCacheSize(int sslSessionCacheSize)
     {
         _sslSessionCacheSize = sslSessionCacheSize;
     }
 
     /** Get SSL session timeout.
      * @return SSL session timeout
      */
     public int getSslSessionTimeout()
     {
         return _sslSessionTimeout;
     }
 
     /** Set SSL session timeout.
      * @param sslSessionTimeout SSL session timeout to set
      */
     public void setSslSessionTimeout(int sslSessionTimeout)
     {
         _sslSessionTimeout = sslSessionTimeout;
     }
 
 
     public SSLServerSocket newSslServerSocket(String host,int port,int backlog) throws IOException
     {
         SSLServerSocketFactory factory = _context.getServerSocketFactory();
 
         SSLServerSocket socket =
             (SSLServerSocket) (host==null ?
                         factory.createServerSocket(port,backlog):
                         factory.createServerSocket(port,backlog,InetAddress.getByName(host)));
 
         if (getWantClientAuth())
             socket.setWantClientAuth(getWantClientAuth());
         if (getNeedClientAuth())
             socket.setNeedClientAuth(getNeedClientAuth());
 
         socket.setEnabledCipherSuites(selectCipherSuites(
                                             socket.getEnabledCipherSuites(),
                                             socket.getSupportedCipherSuites()));
         socket.setEnabledProtocols(selectProtocols(socket.getEnabledProtocols(),socket.getSupportedProtocols()));
 
         return socket;
     }
 
     public SSLSocket newSslSocket() throws IOException
     {
         SSLSocketFactory factory = _context.getSocketFactory();
 
         SSLSocket socket = (SSLSocket)factory.createSocket();
 
         if (getWantClientAuth())
             socket.setWantClientAuth(getWantClientAuth());
         if (getNeedClientAuth())
             socket.setNeedClientAuth(getNeedClientAuth());
 
         socket.setEnabledCipherSuites(selectCipherSuites(
                                             socket.getEnabledCipherSuites(),
                                             socket.getSupportedCipherSuites()));
         socket.setEnabledProtocols(selectProtocols(socket.getEnabledProtocols(),socket.getSupportedProtocols()));
 
         return socket;
     }
 
     /**
      * Factory method for "scratch" {@link SSLEngine}s, usually only used for retrieving configuration
      * information such as the application buffer size or the list of protocols/ciphers.
      * <p />
      * This method should not be used for creating {@link SSLEngine}s that are used in actual socket
      * communication.
      *
      * @return a new, "scratch" {@link SSLEngine}
      */
     public SSLEngine newSSLEngine()
     {
         if (!isRunning())
             throw new IllegalStateException("!STARTED");
         SSLEngine sslEngine=_context.createSSLEngine();
         customize(sslEngine);
         return sslEngine;
     }
 
     /**
      * General purpose factory method for creating {@link SSLEngine}s, although creation of
      * {@link SSLEngine}s on the server-side should prefer {@link #newSSLEngine(InetSocketAddress)}.
      *
      * @param host the remote host
      * @param port the remote port
      * @return a new {@link SSLEngine}
      */
     public SSLEngine newSSLEngine(String host, int port)
     {
         if (!isRunning())
             throw new IllegalStateException("!STARTED");
         SSLEngine sslEngine=isSessionCachingEnabled()
             ? _context.createSSLEngine(host, port)
             : _context.createSSLEngine();
         customize(sslEngine);
         return sslEngine;
     }
 
     /**
      * Server-side only factory method for creating {@link SSLEngine}s.
      * <p />
      * If the given {@code address} is null, it is equivalent to {@link #newSSLEngine()}, otherwise
      * {@link #newSSLEngine(String, int)} is called.
      * <p />
      * If {@link #getNeedClientAuth()} is {@code true}, then the host name is passed to
      * {@link #newSSLEngine(String, int)}, possibly incurring in a reverse DNS lookup, which takes time
      * and may hang the selector (since this method is usually called by the selector thread).
      * <p />
      * Otherwise, the host address is passed to {@link #newSSLEngine(String, int)} without DNS lookup
      * penalties.
      * <p />
      * Clients that wish to create {@link SSLEngine} instances must use {@link #newSSLEngine(String, int)}.
      *
      * @param address the remote peer address
      * @return a new {@link SSLEngine}
      */
     public SSLEngine newSSLEngine(InetSocketAddress address)
     {
         if (address == null)
             return newSSLEngine();
 
         boolean useHostName = getNeedClientAuth();
         String hostName = useHostName ? address.getHostName() : address.getAddress().getHostAddress();
         return newSSLEngine(hostName, address.getPort());
     }
 
     public void customize(SSLEngine sslEngine)
     {
         SSLParameters sslParams = sslEngine.getSSLParameters();
         sslParams.setEndpointIdentificationAlgorithm(_endpointIdentificationAlgorithm);
         sslEngine.setSSLParameters(sslParams);
 
         if (getWantClientAuth())
             sslEngine.setWantClientAuth(getWantClientAuth());
         if (getNeedClientAuth())
             sslEngine.setNeedClientAuth(getNeedClientAuth());
 
         sslEngine.setEnabledCipherSuites(selectCipherSuites(
                 sslEngine.getEnabledCipherSuites(),
                 sslEngine.getSupportedCipherSuites()));
 
         sslEngine.setEnabledProtocols(selectProtocols(sslEngine.getEnabledProtocols(),sslEngine.getSupportedProtocols()));
     }
 
     public static X509Certificate[] getCertChain(SSLSession sslSession)
     {
         try
         {
             javax.security.cert.X509Certificate javaxCerts[]=sslSession.getPeerCertificateChain();
             if (javaxCerts==null||javaxCerts.length==0)
                 return null;
 
             int length=javaxCerts.length;
             X509Certificate[] javaCerts=new X509Certificate[length];
 
             java.security.cert.CertificateFactory cf=java.security.cert.CertificateFactory.getInstance("X.509");
             for (int i=0; i<length; i++)
             {
                 byte bytes[]=javaxCerts[i].getEncoded();
                 ByteArrayInputStream stream=new ByteArrayInputStream(bytes);
                 javaCerts[i]=(X509Certificate)cf.generateCertificate(stream);
             }
 
             return javaCerts;
         }
         catch (SSLPeerUnverifiedException pue)
         {
             return null;
         }
         catch (Exception e)
         {
             LOG.warn(Log.EXCEPTION,e);
             return null;
         }
     }
 
     /**
      * Given the name of a TLS/SSL cipher suite, return an int representing it effective stream
      * cipher key strength. i.e. How much entropy material is in the key material being fed into the
      * encryption routines.
      *
      * <p>
      * This is based on the information on effective key lengths in RFC 2246 - The TLS Protocol
      * Version 1.0, Appendix C. CipherSuite definitions:
      *
      * <pre>
      *                         Effective
      *     Cipher       Type    Key Bits
      *
      *     NULL       * Stream     0
      *     IDEA_CBC     Block    128
      *     RC2_CBC_40 * Block     40
      *     RC4_40     * Stream    40
      *     RC4_128      Stream   128
      *     DES40_CBC  * Block     40
      *     DES_CBC      Block     56
      *     3DES_EDE_CBC Block    168
      * </pre>
      *
      * @param cipherSuite String name of the TLS cipher suite.
      * @return int indicating the effective key entropy bit-length.
      */
     public static int deduceKeyLength(String cipherSuite)
     {
         // Roughly ordered from most common to least common.
         if (cipherSuite == null)
             return 0;
         else if (cipherSuite.contains("WITH_AES_256_"))
             return 256;
         else if (cipherSuite.contains("WITH_RC4_128_"))
             return 128;
         else if (cipherSuite.contains("WITH_AES_128_"))
             return 128;
         else if (cipherSuite.contains("WITH_RC4_40_"))
             return 40;
         else if (cipherSuite.contains("WITH_3DES_EDE_CBC_"))
             return 168;
         else if (cipherSuite.contains("WITH_IDEA_CBC_"))
             return 128;
         else if (cipherSuite.contains("WITH_RC2_CBC_40_"))
             return 40;
         else if (cipherSuite.contains("WITH_DES40_CBC_"))
             return 40;
         else if (cipherSuite.contains("WITH_DES_CBC_"))
             return 56;
         else
             return 0;
     }
 
     @Override
     public String toString()
     {
         return String.format("%s@%x(%s,%s)",
                 getClass().getSimpleName(),
                 hashCode(),
                 _keyStorePath,
                 _trustStorePath);
     }
 }