////////////////////////////////////////////////////////////////////////////////
/// @brief application https server feature
///
/// @file
///
/// DISCLAIMER
///
/// Copyright 2004-2012 triAGENS GmbH, Cologne, Germany
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///     http://www.apache.org/licenses/LICENSE-2.0
///
/// Unless required by applicable law or agreed to in writing, software
/// distributed under the License is distributed on an "AS IS" BASIS,
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
/// See the License for the specific language governing permissions and
/// limitations under the License.
///
/// Copyright holder is triAGENS GmbH, Cologne, Germany
///
/// @author Dr. Frank Celler
/// @author Copyright 2010-2012, triAGENS GmbH, Cologne, Germany
////////////////////////////////////////////////////////////////////////////////

#include "ApplicationHttpsServer.h"

#include <openssl/err.h>

#include "Basics/delete_object.h"
#include "Basics/Random.h"
#include "Dispatcher/ApplicationDispatcher.h"
#include "HttpServer/HttpHandlerFactory.h"
#include "HttpServer/HttpHandler.h"
#include "HttpsServer/HttpsServer.h"
#include "Logger/Logger.h"
#include "Scheduler/ApplicationScheduler.h"

using namespace triagens::basics;
using namespace triagens::rest;
using namespace std;

// -----------------------------------------------------------------------------
// --SECTION--                                                 private functions
// -----------------------------------------------------------------------------

namespace {
  string lastSSLError () {
    char buf[122];
    memset(buf, 0, sizeof(buf));

    unsigned long err = ERR_get_error();
    ERR_error_string_n(err, buf, sizeof(buf) - 1);

    return string(buf);
  }
}

// -----------------------------------------------------------------------------
// --SECTION--                                                   private classes
// -----------------------------------------------------------------------------

namespace {
  class BIOGuard {
    public:
      BIOGuard(BIO *bio)
        : _bio(bio) {
      }

      ~BIOGuard() {
        BIO_free(_bio);
      }

    public:
      BIO *_bio;
  };
}

// -----------------------------------------------------------------------------
// --SECTION--                                      constructors and destructors
// -----------------------------------------------------------------------------

////////////////////////////////////////////////////////////////////////////////
/// @addtogroup HttpServer
/// @{
////////////////////////////////////////////////////////////////////////////////

////////////////////////////////////////////////////////////////////////////////
/// @brief constructor
////////////////////////////////////////////////////////////////////////////////

ApplicationHttpsServer::ApplicationHttpsServer (ApplicationServer* applicationServer,
                                                ApplicationScheduler* applicationScheduler,
                                                ApplicationDispatcher* applicationDispatcher)
  : ApplicationFeature("HttpsServer"),
    _applicationServer(applicationServer),
    _applicationScheduler(applicationScheduler),
    _applicationDispatcher(applicationDispatcher),
    _showPort(true),
    _requireKeepAlive(false),
    _sslProtocol(3),
    _sslCacheMode(0),
    _sslOptions(SSL_OP_TLS_ROLLBACK_BUG),
    _sslContext(0) {
}

////////////////////////////////////////////////////////////////////////////////
/// @brief destructor
////////////////////////////////////////////////////////////////////////////////

ApplicationHttpsServer::~ApplicationHttpsServer () {
  for_each(_httpsServers.begin(), _httpsServers.end(), DeleteObject());
}

////////////////////////////////////////////////////////////////////////////////
/// @}
////////////////////////////////////////////////////////////////////////////////

// -----------------------------------------------------------------------------
// --SECTION--                                                    public methods
// -----------------------------------------------------------------------------

////////////////////////////////////////////////////////////////////////////////
/// @addtogroup HttpServer
/// @{
////////////////////////////////////////////////////////////////////////////////

////////////////////////////////////////////////////////////////////////////////
/// @brief shows the port options
////////////////////////////////////////////////////////////////////////////////

void ApplicationHttpsServer::showPortOptions (bool value) {
  _showPort = value;
}

////////////////////////////////////////////////////////////////////////////////
/// @brief adds a https address:port
////////////////////////////////////////////////////////////////////////////////

AddressPort ApplicationHttpsServer::addPort (string const& name) {
  AddressPort ap;

  if (! ap.split(name)) {
    LOGGER_ERROR << "unknown server:port definition '" << name << "'";
  }
  else {
    _httpsAddressPorts.push_back(ap);
  }

  return ap;
}

////////////////////////////////////////////////////////////////////////////////
/// @brief builds the https server
////////////////////////////////////////////////////////////////////////////////

HttpsServer* ApplicationHttpsServer::buildServer (HttpHandlerFactory* httpHandlerFactory) {
  return buildServer(httpHandlerFactory, _httpsAddressPorts);
}

////////////////////////////////////////////////////////////////////////////////
/// @brief builds the https server
////////////////////////////////////////////////////////////////////////////////

HttpsServer* ApplicationHttpsServer::buildServer (HttpHandlerFactory* httpHandlerFactory, vector<AddressPort> const& ports) {
  if (ports.empty()) {
    delete httpHandlerFactory;
    return 0;
  }
  else {
    return buildHttpsServer(httpHandlerFactory, ports);
  }
}

////////////////////////////////////////////////////////////////////////////////
/// @}
////////////////////////////////////////////////////////////////////////////////

// -----------------------------------------------------------------------------
// --SECTION--                                        ApplicationFeature methods
// -----------------------------------------------------------------------------

////////////////////////////////////////////////////////////////////////////////
/// @addtogroup ApplicationServer
/// @{
////////////////////////////////////////////////////////////////////////////////

////////////////////////////////////////////////////////////////////////////////
/// {@inheritDoc}
////////////////////////////////////////////////////////////////////////////////

void ApplicationHttpsServer::setupOptions (map<string, ProgramOptionsDescription>& options) {
  if (_showPort) {
    options[ApplicationServer::OPTIONS_SERVER + ":help-ssl"]
      ("server.secure", &_httpsPorts, "listen port or address:port")
    ;
  }

  options[ApplicationServer::OPTIONS_SERVER + ":help-ssl"]
    ("server.secure-require-keep-alive", "close connection, if keep-alive is missing")
    ("server.keyfile", &_httpsKeyfile, "keyfile for SSL connections")
    ("server.cafile", &_cafile, "file containing the CA certificates of clients")
    ("server.ssl-protocol", &_sslProtocol, "1 = SSLv2, 2 = SSLv3, 3 = SSLv23, 4 = TLSv1")
    ("server.ssl-cache-mode", &_sslCacheMode, "0 = off, 1 = client, 2 = server")
    ("server.ssl-options", &_sslOptions, "ssl options, see OpenSSL documentation")
  ;
}

////////////////////////////////////////////////////////////////////////////////
/// {@inheritDoc}
////////////////////////////////////////////////////////////////////////////////

bool ApplicationHttpsServer::parsePhase2 (ProgramOptions& options) {

  // check keep alive
  if (options.has("server.secure-require-keep-alive")) {
    _requireKeepAlive= true;
  }


  // add ports
  for (vector<string>::const_iterator i = _httpsPorts.begin();  i != _httpsPorts.end();  ++i) {
    addPort(*i);
  }


  // create the ssl context (if possible)
  bool ok = createSslContext();

  if (! ok) {
    return false;
  }

  // and return
  return true;
}

////////////////////////////////////////////////////////////////////////////////
/// @}
////////////////////////////////////////////////////////////////////////////////

// -----------------------------------------------------------------------------
// --SECTION--                                                 protected methods
// -----------------------------------------------------------------------------

////////////////////////////////////////////////////////////////////////////////
/// @addtogroup HttpServer
/// @{
////////////////////////////////////////////////////////////////////////////////

HttpsServer* ApplicationHttpsServer::buildHttpsServer (HttpHandlerFactory* httpHandlerFactory,
                                                       vector<AddressPort> const& ports) {
  Scheduler* scheduler = _applicationScheduler->scheduler();

  if (scheduler == 0) {
    LOGGER_FATAL << "no scheduler is known, cannot create https server";
    TRI_ShutdownLogging();
    exit(EXIT_FAILURE);
  }

  Dispatcher* dispatcher = 0;

  if (_applicationDispatcher != 0) {
    dispatcher = _applicationDispatcher->dispatcher();
  }

  // check the ssl context
  if (_sslContext == 0) {
    LOGGER_FATAL << "no ssl context is known, cannot create https server";
    TRI_ShutdownLogging();
    exit(EXIT_FAILURE);
  }

  // create new server
  HttpsServer* httpsServer = new HttpsServer(scheduler, dispatcher, _sslContext);

  httpsServer->setHandlerFactory(httpHandlerFactory);

  if (_requireKeepAlive) {
    httpsServer->setCloseWithoutKeepAlive(true);
  }

  // keep a list of active server
  _httpsServers.push_back(httpsServer);

  // open http ports
  deque<AddressPort> addresses;
  addresses.insert(addresses.begin(), ports.begin(), ports.end());

  _applicationServer->raisePrivileges();

  while (! addresses.empty()) {
    AddressPort ap = addresses[0];
    addresses.pop_front();

    string bindAddress = ap._address;
    int port = ap._port;

    bool result;

    if (bindAddress.empty()) {
      LOGGER_TRACE << "trying to open port " << port << " for https requests";

      result = httpsServer->addPort(port, _applicationScheduler->addressReuseAllowed());
    }
    else {
      LOGGER_TRACE << "trying to open address " << bindAddress
                   << " on port " << port
                   << " for https requests";

      result = httpsServer->addPort(bindAddress, port, _applicationScheduler->addressReuseAllowed());
    }

    if (result) {
      LOGGER_DEBUG << "opened port " << port << " for " << (bindAddress.empty() ? "any" : bindAddress);
    }
    else {
      LOGGER_TRACE << "failed to open port " << port << " for " << (bindAddress.empty() ? "any" : bindAddress);
      addresses.push_back(ap);

      if (scheduler->isShutdownInProgress()) {
        addresses.clear();
      }
      else {
        sleep(1);
      }
    }
  }

  _applicationServer->dropPrivileges();

  return httpsServer;
}

////////////////////////////////////////////////////////////////////////////////
/// @}
////////////////////////////////////////////////////////////////////////////////

// -----------------------------------------------------------------------------
// --SECTION--                                                   private methods
// -----------------------------------------------------------------------------

////////////////////////////////////////////////////////////////////////////////
/// @addtogroup HttpServer
/// @{
////////////////////////////////////////////////////////////////////////////////

////////////////////////////////////////////////////////////////////////////////
/// @brief creates an ssl context
////////////////////////////////////////////////////////////////////////////////

bool ApplicationHttpsServer::createSslContext () {

  // check keyfile
  if (_httpsKeyfile.empty()) {
    return true;
  }


  // create context
  _sslContext = HttpsServer::sslContext(HttpsServer::protocol_e(_sslProtocol), _httpsKeyfile);

  if (_sslContext == 0) {
    LOGGER_ERROR << "failed to create SSL context, cannot create a HTTPS server";
    return false;
  }

  // set cache mode
  SSL_CTX_set_session_cache_mode(_sslContext, _sslCacheMode);
  LOGGER_INFO << "using SSL session cache mode: " << _sslCacheMode;

  // set options
  SSL_CTX_set_options(_sslContext, _sslOptions);
  LOGGER_INFO << "using SSL options: " << _sslOptions;


  // set ssl context
  Random::UniformCharacter r("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789");
  string rctx = r.random(SSL_MAX_SSL_SESSION_ID_LENGTH);

  int res = SSL_CTX_set_session_id_context(_sslContext, (unsigned char const*) StringUtils::duplicate(rctx), rctx.size());

  if (res != 1) {
    LOGGER_FATAL << "cannot set SSL session id context '" << rctx << "'";
    LOGGER_ERROR << lastSSLError();
    return false;
  }

  // check CA
  if (! _cafile.empty()) {
    LOGGER_TRACE << "trying to load CA certificates from '" << _cafile << "'";

    int res = SSL_CTX_load_verify_locations(_sslContext, _cafile.c_str(), 0);

    if (res == 0) {
      LOGGER_FATAL << "cannot load CA certificates from '" << _cafile << "'";
      LOGGER_ERROR << lastSSLError();
      return false;
    }

    STACK_OF(X509_NAME) * certNames;

    certNames = SSL_load_client_CA_file(_cafile.c_str());

    if (certNames == 0) {
      LOGGER_FATAL << "cannot load CA certificates from '" << _cafile << "'";
      LOGGER_ERROR << lastSSLError();
      return false;
    }

    if (TRI_IsTraceLogging(__FILE__)) {
      for (int i = 0;  i < sk_X509_NAME_num(certNames);  ++i) {
        X509_NAME* cert = sk_X509_NAME_value(certNames, i);

        if (cert) {
          BIOGuard bout(BIO_new(BIO_s_mem()));

          X509_NAME_print_ex(bout._bio, cert, 0, (XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV | ASN1_STRFLGS_UTF8_CONVERT) & ~ASN1_STRFLGS_ESC_MSB);

          char* r;
          long len = BIO_get_mem_data(bout._bio, &r);

          LOGGER_TRACE << "name: " << string(r, len);
        }
      }
    }

    SSL_CTX_set_client_CA_list(_sslContext, certNames);
  }

  return true;
}

////////////////////////////////////////////////////////////////////////////////
/// @}
////////////////////////////////////////////////////////////////////////////////

// -----------------------------------------------------------------------------
// --SECTION--                                                       END-OF-FILE
// -----------------------------------------------------------------------------

// Local Variables:
// mode: outline-minor
// outline-regexp: "^\\(/// @brief\\|/// {@inheritDoc}\\|/// @addtogroup\\|// --SECTION--\\|/// @\\}\\)"
// End: