/** Associate an SSL object with a socket and return it.
 * \param sock socket descriptor to associate with an SSL object.
 * \return pointer to SSL object.
 */
SSL *
ssl_setup_socket(int sock)
{
  SSL *ssl;
  BIO *bio;

  ssl = SSL_new(ctx);
  bio = BIO_new_socket(sock, BIO_NOCLOSE);
  BIO_set_nbio(bio, 1);
  SSL_set_bio(ssl, bio, bio);
  return ssl;
}

/** Associate an SSL object with a socket and return it.
 * \param sock socket descriptor to associate with an SSL object.
 * \return pointer to SSL object.
 */
SSL *
ssl_setup_socket(int sock)
{
  SSL *ssl;
  BIO *bio;

  ssl = ssl_alloc_struct();
  bio = BIO_new_socket(sock, BIO_NOCLOSE);
  BIO_set_nbio(bio, 1);
  SSL_set_bio(ssl, bio, bio);
  return ssl;
}

SSL *ssl_new(SSL_CTX *ctx,int s)
{
  BIO *sbio;
  SSL *ssl;

  ssl = SSL_new(ctx);
  if (!ssl) return 0;
  sbio = BIO_new_socket(s,BIO_NOCLOSE);
  if (!sbio) return 0;
  SSL_set_bio(ssl,sbio,sbio);
  return ssl;
}

static protocol_t *
protocol_ssl_accept(protocol_t * p, void *options)
{
	protocol_t *newp;
	struct sockaddr_in remote;
	socklen_t addrlen;
	int ret;
	ssl_private_t *ssl_p = (ssl_private_t *) p->_protocol_p;
	ssl_private_t *new_ssl_p;
	struct sockaddr name;
	char hostname[128];
	flowop_options_t *flowop_options = (flowop_options_t *) options;
	BIO *sbio;

	newp = protocol_ssl_new();
	new_ssl_p = (ssl_private_t *) newp->_protocol_p;
	addrlen = (socklen_t) sizeof (remote);
	uperf_debug("ssl - ssl obj waiting for accept\n");
	newp->fd = accept(p->fd, (struct sockaddr *) &remote,
		&addrlen);
	if (newp->fd < 0) {
		uperf_log_msg(UPERF_LOG_ERROR, errno, "accept");
		return (NULL);
	}
	if (getnameinfo((const struct sockaddr *) & remote, addrlen,
			hostname, sizeof (hostname), NULL, 0, 0) == 0) {
		uperf_debug("ssl - Connection from %s:%d\n", hostname,
			SOCK_PORT(remote));
		strlcpy(newp->host, hostname, sizeof (newp->host));
		newp->port = SOCK_PORT(remote);
	}
	if (flowop_options) {
		if ((load_engine(flowop_options->engine)) == -1) {
			uperf_info(
"ssl - Engine %s does NOT exist! Using the default OpenSSL softtoken",
			flowop_options->engine);
		}
	}
	sbio = BIO_new_socket(newp->fd, BIO_NOCLOSE);
	if (!(new_ssl_p->ssl = SSL_new(ctx))) {
		uperf_log_msg(UPERF_LOG_ERROR, 0, "SSL_new error");
		return (NULL);
	}
	SSL_set_bio(new_ssl_p->ssl, sbio, sbio);

	ret = SSL_accept(new_ssl_p->ssl);
	if (my_ssl_error(new_ssl_p->ssl, ret) == 0) {
		return (newp);
	} else {
		return (0);
	}
}

/* Main Entry */
int main(int argc, char **argv)
{
	// init connection object
	Connection conn;
	memset(&conn, 0, sizeof(conn));
	conn.port = PORT; // assign default port
	conn.host = HOST;

	// Parse arguments
	parseArguments(argc, argv, &conn);

	// init SSL library
	conn.sslContext = initSSLContext(CLIENT_CERTIFICATE, CA_CERTIFICATE);
	SSL_CTX_set_options(conn.sslContext, SSL_OP_NO_SSLv2);
	SSL_CTX_set_cipher_list(conn.sslContext, "SHA1");

	// Connect
	if (tcpConnect(&conn) < 0){
		tcpDisconnect(&conn);
		exit(0);
	}

	SSL * ssl = SSL_new(conn.sslContext);
	BIO * sbio = BIO_new_socket(conn.socket, BIO_NOCLOSE);
	SSL_set_bio(ssl, sbio, sbio);
	int ret;

	ret = SSL_connect(ssl);
	if (ret <= 0){
		printf(FMT_CONNECT_ERR);
		handleError(ssl, ret);
	}
	else{
		// Process Message
		if (checkServerCertification(ssl) == OK){
			processMessage(ssl);
		}
	}

	// close ssl connection
	if (!SSL_shutdown(ssl)){
		tcpDisconnect(&conn);
		SSL_shutdown(ssl);
	}
	SSL_free(ssl);

	// Disconnect
	tcpDisconnect(&conn);
	destroySSLContext(conn.sslContext);
	return 1;
}

void sslsocket::complete_secure_connect()
{
    // create SSL and BIO objects and then initialize ssl client mode.
    // setup SSL session now that we have TCP connection.
    SSL_CTX* ctx = context_.ssl();

    ssl_ = SSL_new(ctx);
    if (!ssl_)
        throw std::runtime_error("SSL_new failed");

    // create new IO object
    bio_ = BIO_new_socket(socket_, BIO_NOCLOSE);
    if (!bio_)
        throw std::runtime_error("BIO_new_socket failed");

    // connect the IO object with SSL, this takes the ownership
    // of the BIO object.
    SSL_set_bio(ssl_, bio_, bio_);

    ERR_clear_error();

    // go into client mode.
    while (true)
    {
        const int ret = SSL_connect(ssl_);
        if (ret == 1)
            break;

        const int err = SSL_get_error(ssl_, ret);
        switch (err)
        {
            case SSL_ERROR_WANT_READ:
                ssl_wait_read();
                break;

            case SSL_ERROR_WANT_WRITE:
                ssl_wait_write();
                break;

            case SSL_ERROR_SYSCALL:
                if (ret == -1)
                    throw std::system_error(get_last_socket_error(), 
                        "SSL socket I/O error");
                // fallthrough intended

            default:
                throw std::runtime_error("SSL_connect failed");
        }
    }
}

herror_t
hssl_server_ssl(hsocket_t * sock)
{
  SSL *ssl;
  int ret;
  BIO *sbio;

  if (!enabled)
    return H_OK;

  log_verbose2("Starting SSL initialization for socket %d", sock->sock);

  if (!(ssl = SSL_new(context)))
  {
    log_warn1("SSL_new failed");
    return herror_new("hssl_server_ssl", HSSL_ERROR_SERVER,
                      "Cannot create SSL object");
  }
  /* SSL_set_fd(ssl, sock->sock); */

  sbio = BIO_new_socket(sock->sock, BIO_NOCLOSE);

  if (sbio == NULL)
  {
    log_error1("BIO_new_socket failed");
    return NULL;
  }
  // BIO_set_callback(sbio, hssl_bio_cb);
  sbio->method->bread = _hssl_bio_read;
  SSL_set_bio(ssl, sbio, sbio);


  if ((ret = SSL_accept(ssl)) <= 0)
  {
    herror_t err;

    log_error2("SSL_accept failed (%s)", _hssl_get_error(ssl, ret));

    err =
      herror_new("hssl_server_ssl", HSSL_ERROR_SERVER,
                 "SSL_accept failed (%s)", _hssl_get_error(ssl, ret));
    SSL_free(ssl);

    return err;
  }

  sock->ssl = ssl;

  return H_OK;
}

/*@C
      PetscHTTPSConnect - connect to a HTTPS server

    Input Parameters:
+    host - the name of the machine hosting the HTTPS server
.    port - the port number where the server is hosting, usually 443
-    ctx - value obtained with PetscSSLInitializeContext()

    Output Parameters:
+    sock - socket to connect
-    ssl - the argument passed to PetscHTTPSRequest()

    Level: advanced

.seealso: PetscOpenSocket(), PetscHTTPSRequest(), PetscSSLInitializeContext()
@*/
PetscErrorCode PetscHTTPSConnect(const char host[],int port,SSL_CTX *ctx,int *sock,SSL **ssl)
{
  BIO            *sbio;
  PetscErrorCode ierr;

  PetscFunctionBegin;
  /* Connect the TCP socket*/
  ierr = PetscOpenSocket(host,port,sock);CHKERRQ(ierr);

  /* Connect the SSL socket */
  *ssl = SSL_new(ctx);
  sbio = BIO_new_socket(*sock,BIO_NOCLOSE);
  SSL_set_bio(*ssl,sbio,sbio);
  if (SSL_connect(*ssl) <= 0) SETERRQ(PETSC_COMM_SELF,PETSC_ERR_LIB,"SSL connect error");
  PetscFunctionReturn(0);
}

int kTLSAccept(int handle,void **tlsssl,void **tlssession)
{
  BIO *bio;
  SSL *ssl;
  int ofcmode;
  bool flg;

  if(!TLSctx){return(RETURN_NG);}

  /* すでに存在するソケットを用いてBIOオブジェクトを生成する。BIOオブジェクトが破棄されてもソケットはクローズされない */
  bio=BIO_new_socket(handle,BIO_NOCLOSE);
  
  /* SSLオブジェクトを生成する */
  ssl=SSL_new(TLSctx);
  
  /* SSLオブジェクトに読み込み／書き込み用BIOオブジェクトをバインドする */
  SSL_set_bio(ssl,bio,bio);
  
  /* 認証 */
  if (SSL_accept(ssl) <= 0){
    kLogWrite(L_ERROR,"%s: Error accepting SSL connection",__FUNCTION__);
    TLSClose(ssl,0);
    return(RETURN_NG);
  }
  
  /* 非ブロックモードに変更 */
  ofcmode=fcntl(handle,F_GETFL,0);
  ofcmode|=O_NDELAY;
  if(fcntl(handle,F_SETFL,ofcmode)){
    kLogWrite(L_ERROR,"%s: Couldn't make socket nonblocking",__FUNCTION__);
    TLSClose(ssl,0);
    return(RETURN_NG);
  }
  /* Nagle アルゴリズムを無効にする */
  if(!NagleFlag){
    flg=true;
    if(setsockopt(handle,IPPROTO_TCP,TCP_NODELAY,(char*)&flg,sizeof(flg))){
      kLogWrite(L_ERROR,"%s: Couldn't setsocktopt TCP_NODELAY",__FUNCTION__);
    }
  }

  *tlsssl=(void*)ssl;
  *tlssession=(void*)SSL_get_session(ssl);
  kLogWrite(L_TLS,"%s: TLS Accept socket nonblocking OK",__FUNCTION__);
  return(RETURN_OK);
}

int
ssl_connect(thread_t * thread)
{
	SOCK *sock_obj = THREAD_ARG(thread);
	int ret;

	sock_obj->ssl = SSL_new(req->ctx);
	sock_obj->bio = BIO_new_socket(sock_obj->fd, BIO_NOCLOSE);
	BIO_set_nbio(sock_obj->bio, 1);	/* Set the Non-Blocking flag */
	SSL_set_bio(sock_obj->ssl, sock_obj->bio, sock_obj->bio);
	ret = SSL_connect(sock_obj->ssl);

	DBG("  SSL_connect return code = %d on fd:%d\n", ret, thread->u.fd);
	ssl_printerr(SSL_get_error(sock_obj->ssl, ret));

	return (ret > 0) ? 1 : 0;
}

PUBLIC int sslUpgrade(Webs *wp)
{
    WebsSocket      *sptr;
    BIO             *bio;

    assert(wp);

    sptr = socketPtr(wp->sid);
    if ((wp->ssl = SSL_new(sslctx)) == 0) {
        return -1;
    }
    if ((bio = BIO_new_socket(sptr->sock, BIO_NOCLOSE)) == 0) {
        return -1;
    }
    SSL_set_bio(wp->ssl, bio, bio);
    SSL_set_accept_state(wp->ssl);
    SSL_set_app_data(wp->ssl, (void*) wp);
    return 0;
}

R_API RSocket *r_socket_accept(RSocket *s) {
	RSocket *sock;
	socklen_t salen = sizeof (s->sa);
	if (!s) {
		return NULL;
	}
	sock = R_NEW0 (RSocket);
	if (!sock) {
		return NULL;
	}
	//signal (SIGPIPE, SIG_DFL);
	sock->fd = accept (s->fd, (struct sockaddr *)&s->sa, &salen);
	if (sock->fd == -1) {
		if (errno != EWOULDBLOCK) {
			// not just a timeout
			r_sys_perror ("accept");
		}
		free (sock);
		return NULL;
	}
#if HAVE_LIB_SSL
	sock->is_ssl = s->is_ssl;
	if (sock->is_ssl) {
		sock->sfd = NULL;
		sock->ctx = NULL;
		sock->bio = NULL;
		BIO *sbio = BIO_new_socket (sock->fd, BIO_NOCLOSE);
		sock->sfd = SSL_new (s->ctx);
		SSL_set_bio (sock->sfd, sbio, sbio);
		if (SSL_accept (sock->sfd) <= 0) {
			r_socket_free (sock);
			return NULL;
		}
		sock->bio = BIO_new (BIO_f_buffer ());
		sbio = BIO_new (BIO_f_ssl ());
		BIO_set_ssl (sbio, sock->sfd, BIO_CLOSE);
		BIO_push (sock->bio, sbio);
	}
#else
	sock->is_ssl = 0;
#endif
	return sock;
}

int connect_ssl(int socket_h, SSL_CTX *client_ctx, SSL **ssl_h, BIO **s_bio, int timeout)
{
  int dummy;

  // FIXME handle t/o
#if 0
  int rc;
  struct timeval to;
  fd_set rfds;

  FD_ZERO(&rfds);
  FD_SET(socket_h, &rfds);

  to.tv_sec  = timeout / 1000;
  to.tv_usec = (timeout - (to.tv_sec * 1000)) * 1000;

  /* wait for connection */
  rc = select(socket_h + 1, &rfds, NULL, NULL, &to);
  if (rc == 0)
    return -2;      /* timeout */
  else if (rc == -1)
  {
    if (errno == EINTR)
      return -3;      /* ^C pressed */
    else
      return -1;      /* error */
  }
#endif

  *ssl_h = SSL_new(client_ctx);
  *s_bio = BIO_new_socket(socket_h, BIO_NOCLOSE);
  SSL_set_bio(*ssl_h, *s_bio, *s_bio);
  dummy = SSL_connect(*ssl_h);
  if (dummy <= 0)
  {
    sprintf(last_error, "problem starting SSL connection: %d\n", SSL_get_error(*ssl_h, dummy));

    return -1;
  }

  return 0;
}

tls_t *tls_init_secondary(tls_t *master, int sock, int accept)
{
  tls_t *tls = tls_create(tls_slave);

  if (tls) {
    tls->ctx = master->ctx;
    tls->type = master->type;
    tls->accept = accept ? 1 : 0;
    tls->verify_outgoing = master->verify_outgoing;
    tls->verify_incoming = master->verify_incoming;
    tls->verify_subj_out = master->verify_subj_out;
    tls->verify_subj_in  = master->verify_subj_in;
    tls->verify_date     = master->verify_date;
    tls->x509_verified   = master->x509_verified;

    if (!(tls->read_buffer = su_alloc(tls->home, tls_buffer_size)))
      su_home_unref(tls->home), tls = NULL;
  }
  if (!tls)
    return tls;

  assert(sock != -1);

  tls->bio_con = BIO_new_socket(sock, BIO_NOCLOSE);
  tls->con = SSL_new(tls->ctx);

  if (tls->con == NULL) {
    tls_log_errors(1, "tls_init_secondary", 0);
    tls_free(tls);
    errno = EIO;
    return NULL;
  }

  SSL_set_bio(tls->con, tls->bio_con, tls->bio_con);
  SSL_set_mode(tls->con, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
  SSL_set_ex_data(tls->con, tls_ex_data_idx, tls);

  su_setblocking(sock, 0);

  return tls;
}

//
// Constructor
//
SSLSocket::SSLSocket(const InetAddress& address, in_port_t port, SSLContext* context)
  throw(IOException, SystemException)
  : Socket(address, port), _context(context), _session(NULL)
{
  // TODO: check if context is != NULL

  /* Connect the SSL socket */
  _ssl  = SSL_new(_context->_ctx);
  _sbio = BIO_new_socket(_impl->_fd, BIO_NOCLOSE);
  SSL_set_bio(_ssl, _sbio, _sbio);

  //SSL_set_connect_state(_ssl);

  // Verify certificate
  if (SSL_get_verify_result(_ssl) != X509_V_OK) {
    throw IOException("SSLSocket: Certificate doesn't verified");
  }

  _session_creation = true;
  _use_client_mode = true;
}

void net::ssl::SSLConnection::setupSocket(const std::string& hostName)
{
    net::Socket_T fd = mSocket->getHandle();
    BIO *sbio = BIO_new_socket(fd, BIO_NOCLOSE);
    SSL_set_bio(mSSL, sbio, sbio);
    int val = SSL_connect(mSSL);
    if(val <= 0)
    {
#if defined(__DEBUG_SOCKET)
        if(SSL_get_error(mSSL, val) == SSL_ERROR_WANT_CONNECT)
            printf("ERROR_WANT_CONNECT\n");
        else if(SSL_get_error(mSSL, val) == SSL_ERROR_ZERO_RETURN)
            printf("ERROR_ZERO_RETURN\n");
        else if(SSL_get_error(mSSL, val) == SSL_ERROR_SSL)
        {
            printf("ERROR_SSL: ");
            char buffer[120];
            ERR_error_string(val, buffer);
            BIO_printf(mBioErr, "%s\n", buffer);
        }
        else if(SSL_get_error(mSSL, val) == SSL_ERROR_SYSCALL)
        {
            printf("ERROR_SYSCALL: ");
            char buffer[120];
            ERR_error_string(val, buffer);
            BIO_printf(mBioErr, "%s\n", buffer);
        }
        else if(SSL_get_error(mSSL, val) == SSL_ERROR_NONE)
            printf("NO ERROR: WHY AM I HERE?\n");
#endif

        throw net::ssl::SSLException
            (Ctxt(FmtX("SSL_connect failed: %d", SSL_get_error(mSSL, val))));
    }
    
    if(mServerAuthentication)
    {
        verifyCertificate(hostName);
    }
}

/*
    Upgrade a socket to use SSL
 */
PUBLIC int sslUpgrade(Webs *wp)
{
    WebsSocket      *sptr;
    BIO             *bio;

    assert(wp);

    sptr = socketPtr(wp->sid);
    if ((wp->ssl = SSL_new(sslctx)) == 0) {
        return -1;
    }
    /*
        Create a socket bio. We don't use the BIO except as storage for the fd.
     */
    if ((bio = BIO_new_socket((int) sptr->sock, BIO_NOCLOSE)) == 0) {
        return -1;
    }
    SSL_set_bio(wp->ssl, bio, bio);
    SSL_set_accept_state(wp->ssl);
    SSL_set_app_data(wp->ssl, (void*) wp);
    return 0;
}

int connect_ssl(int fd, SSL_CTX *client_ctx, SSL **ssl_h, BIO **s_bio, double timeout, double *ssl_handshake)
{
	int dummy = -1;
	double dstart = get_ts();

	struct timeval tv;
	tv.tv_sec  = (long)(timeout / 1000.0);
	tv.tv_usec = (long)(timeout * 1000.0) % 1000000;

	*ssl_handshake = -1.0;

	if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof tv) == -1)
	{
		set_error(gettext("problem setting receive timeout (%s)"), strerror(errno));
		return -1;
	}

	if (setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof tv) == -1)
	{
		set_error(gettext("problem setting transmit timeout (%s)"), strerror(errno));
		return -1;
	}

	*ssl_h = SSL_new(client_ctx);

	*s_bio = BIO_new_socket(fd, BIO_NOCLOSE);
	SSL_set_bio(*ssl_h, *s_bio, *s_bio);

	dummy = SSL_connect(*ssl_h);
	if (dummy <= 0)
	{
		set_error(gettext("problem starting SSL connection: %d"), SSL_get_error(*ssl_h, dummy));
		return -1;
	}

	*ssl_handshake = get_ts() - dstart;

	return 0;
}

void SSLSocket::attach() {
    ssl_internal_stack *stack;
    if(idata != 0) {
        stack = (ssl_internal_stack *)idata;
        delete stack;
    }
    stack = new ssl_internal_stack();
    stack->ssl = SSL_new((SSL_CTX *)ctx.getInternal());
    stack->sbio=BIO_new_socket(tsock,BIO_NOCLOSE);
    if(stack->sbio == 0x00)
        throw SSLSocketAddIOFailure();
    SSL_set_bio(stack->ssl, stack->sbio, stack->sbio);
    if(SSL_connect(stack->ssl) <= 0)
        throw SSLConnectFailed();
    //Verify certificate now
    int vres;
    if((vres = SSL_get_verify_result(stack->ssl)) != X509_V_OK) {
#ifdef USE_DEBUG
        ::X509 *x5;
        x5 = SSL_get_peer_certificate(stack->ssl);
        X509 cert(x5);
        X509_free(x5);
#endif
        switch(vres) {
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
            throw X509IssuerCertificateNotFound();
        case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
            throw X509UnableToDecryptCertificate();
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
#ifdef USE_DEBUG
            debugmsg(this, "Certificate not found locally.\n");
#endif
            throw CertificateIssuerNotFoundLocally();
        default:
            throw SSLInvalidCertificate();
        }
    }
}

CONN *establish_connection(char *addr, char *port)
{
    // Blank connection structure
    CONN *conn = malloc(sizeof (CONN));
    // Initialise connection
    init_conn(conn);
    // Load certificates
    load_certs(conn);
    // Create new SSL structure
    conn->ssl = SSL_new(conn->ctx);
    
    struct addrinfo hints, *res;
    
    memset(&hints, 0, sizeof hints);
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    
    getaddrinfo(addr, port, &hints, &res);
    
    conn->sd = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
    
    // Connect to server
    if(connect(conn->sd, res->ai_addr, res->ai_addrlen) != 0) {
        perror("connection");
    }
    
    // Set BIO into SSL structure
    conn->bio = BIO_new_socket(conn->sd, BIO_NOCLOSE);
    SSL_set_bio(conn->ssl, conn->bio, conn->bio);
    
    // Perform handshake
    if(SSL_connect(conn->ssl) != 1) {
        perror("handshake\n");
    }
    
    printf("Connection Established\n");
    return conn;
}