absl::string_view NotReadySslSocket::failureReason() const { return NotReadyReason; }

                  Upstream::HostDescriptionConstSharedPtr host) {

  std::unique_ptr<SslSocket> socket(new SslSocket(ctx, transport_socket_options));

  auto status = socket->initialize(state, handshaker_factory_cb, host);

  if (status.ok()) {

    return socket;

  } else {

    return status;

  }

}

    : transport_socket_options_(transport_socket_options),

      ctx_(std::dynamic_pointer_cast<ContextImpl>(ctx)) {}

                                   Upstream::HostDescriptionConstSharedPtr host) {

  auto status_or_ssl = ctx_->newSsl(transport_socket_options_, host);

  if (!status_or_ssl.ok()) {

    return status_or_ssl.status();

  }

  info_ = std::dynamic_pointer_cast<SslHandshakerImpl>(handshaker_factory_cb(

      std::move(status_or_ssl.value()), ctx_->sslExtendedSocketInfoIndex(), this));

  if (state == InitialState::Client) {

    SSL_set_connect_state(rawSsl());

  } else {

    ASSERT(state == InitialState::Server);

    SSL_set_accept_state(rawSsl());

  }

  return absl::OkStatus();

}

void SslSocket::setTransportSocketCallbacks(Network::TransportSocketCallbacks& callbacks) {

  ASSERT(!callbacks_);

  callbacks_ = &callbacks;

  for (auto const& provider : ctx_->getPrivateKeyMethodProviders()) {

    provider->registerPrivateKeyMethod(rawSsl(), *this, callbacks_->connection().dispatcher());

  }

  BIO* bio = BIO_new_io_handle(&callbacks_->ioHandle());

  SSL_set_bio(rawSsl(), bio, bio);

  SSL_set_ex_data(rawSsl(), ContextImpl::sslSocketIndex(), static_cast<void*>(callbacks_));

}

SslSocket::ReadResult SslSocket::sslReadIntoSlice(Buffer::RawSlice& slice) {

  ReadResult result;

  uint8_t* mem = static_cast<uint8_t*>(slice.mem_);

  size_t remaining = slice.len_;

  while (remaining > 0) {

    int rc = SSL_read(rawSsl(), mem, remaining);

    ENVOY_CONN_LOG(trace, "ssl read returns: {}", callbacks_->connection(), rc);

    if (rc > 0) {

      ASSERT(static_cast<size_t>(rc) <= remaining);

      mem += rc;

      remaining -= rc;

      result.bytes_read_ += rc;

    } else {

      result.error_ = absl::make_optional<int>(rc);

      break;

    }

  }

  return result;

}

Network::IoResult SslSocket::doRead(Buffer::Instance& read_buffer) {

  if (info_->state() != Ssl::SocketState::HandshakeComplete &&

      info_->state() != Ssl::SocketState::ShutdownSent) {

    PostIoAction action = doHandshake();

    if (action == PostIoAction::Close || info_->state() != Ssl::SocketState::HandshakeComplete) {

      return {action, 0, false};

    }

  }

  bool keep_reading = true;

  bool end_stream = false;

  PostIoAction action = PostIoAction::KeepOpen;

  uint64_t bytes_read = 0;

  while (keep_reading) {

    uint64_t bytes_read_this_iteration = 0;

    Buffer::Reservation reservation = read_buffer.reserveForRead();

    for (uint64_t i = 0; i < reservation.numSlices(); i++) {

      auto result = sslReadIntoSlice(reservation.slices()[i]);

      bytes_read_this_iteration += result.bytes_read_;

      if (result.error_.has_value()) {

        keep_reading = false;

        int err = SSL_get_error(rawSsl(), result.error_.value());

        ENVOY_CONN_LOG(trace, "ssl error occurred while read: {}", callbacks_->connection(),

                       Utility::getErrorDescription(err));

        switch (err) {

        case SSL_ERROR_WANT_READ:

          break;

        case SSL_ERROR_ZERO_RETURN:

          end_stream = true;

          break;

        case SSL_ERROR_SYSCALL:

          if (result.error_.value() == 0) {

            end_stream = true;

            break;

          }

        default:

          drainErrorQueue();

          action = PostIoAction::Close;

          break;

        }

        break;

      }

    }

    reservation.commit(bytes_read_this_iteration);

    if (bytes_read_this_iteration > 0 && callbacks_->shouldDrainReadBuffer()) {

      callbacks_->setTransportSocketIsReadable();

      keep_reading = false;

    }

    bytes_read += bytes_read_this_iteration;

  }

  ENVOY_CONN_LOG(trace, "ssl read {} bytes", callbacks_->connection(), bytes_read);

  return {action, bytes_read, end_stream};

}

void SslSocket::onPrivateKeyMethodComplete() { resumeHandshake(); }

void SslSocket::resumeHandshake() {

  ASSERT(callbacks_ != nullptr && callbacks_->connection().dispatcher().isThreadSafe());

  ASSERT(info_->state() == Ssl::SocketState::HandshakeInProgress);

  PostIoAction action = doHandshake();

  if (action == PostIoAction::Close) {

    ENVOY_CONN_LOG(debug, "async handshake completion error", callbacks_->connection());

    callbacks_->connection().close(Network::ConnectionCloseType::FlushWrite,

                                   "failed_resuming_async_handshake");

  }

}

Network::Connection& SslSocket::connection() const { return callbacks_->connection(); }

void SslSocket::onSuccess(SSL* ssl) {

  ctx_->logHandshake(ssl);

  if (callbacks_->connection().streamInfo().upstreamInfo()) {

    callbacks_->connection()

        .streamInfo()

        .upstreamInfo()

        ->upstreamTiming()

        .onUpstreamHandshakeComplete(callbacks_->connection().dispatcher().timeSource());

  } else {

    callbacks_->connection().streamInfo().downstreamTiming().onDownstreamHandshakeComplete(

        callbacks_->connection().dispatcher().timeSource());

  }

  callbacks_->raiseEvent(Network::ConnectionEvent::Connected);

}

void SslSocket::onFailure() { drainErrorQueue(); }

PostIoAction SslSocket::doHandshake() { return info_->doHandshake(); }

void SslSocket::drainErrorQueue() {

  bool saw_error = false;

  bool saw_counted_error = false;

  bool saw_cert_verify_failed = false;

  bool saw_no_client_cert = false;

  while (uint64_t err = ERR_get_error()) {

    if (ERR_GET_LIB(err) == ERR_LIB_SSL) {

      if (ERR_GET_REASON(err) == SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE) {

        ctx_->stats().fail_verify_no_cert_.inc();

        saw_counted_error = true;

        saw_no_client_cert = true;

      } else if (ERR_GET_REASON(err) == SSL_R_CERTIFICATE_VERIFY_FAILED) {

        saw_counted_error = true;

        saw_cert_verify_failed = true;

      }

    } else if (ERR_GET_LIB(err) == ERR_LIB_SYS) {

      saw_counted_error = true;

    }

    saw_error = true;

    if (failure_reason_.empty()) {

      failure_reason_ = "TLS_error:";

    }

    absl::StrAppend(&failure_reason_, "|", err, ":",

                    absl::NullSafeStringView(ERR_lib_error_string(err)), ":",

                    absl::NullSafeStringView(ERR_func_error_string(err)), ":",

                    absl::NullSafeStringView(ERR_reason_error_string(err)));

  }

  if (!saw_error) {

    return;

  }

  bool added_detail = false;

  if (saw_cert_verify_failed) {

    auto* extended_socket_info = reinterpret_cast<Envoy::Ssl::SslExtendedSocketInfo*>(

        SSL_get_ex_data(rawSsl(), ContextImpl::sslExtendedSocketInfoIndex()));

    if (extended_socket_info != nullptr) {

      absl::string_view cert_validation_error = extended_socket_info->certificateValidationError();

      if (!cert_validation_error.empty()) {

        absl::StrAppend(&failure_reason_, ":", cert_validation_error);

        added_detail = true;

      }

    }

  }

  if (!added_detail && saw_no_client_cert) {

    absl::StrAppend(&failure_reason_, ":peer did not provide required client certificate");

  }

  if (!failure_reason_.empty()) {

    absl::StrAppend(&failure_reason_, ":TLS_error_end");

    ENVOY_CONN_LOG(debug, "remote address:{},{}", callbacks_->connection(),

                   callbacks_->connection().connectionInfoProvider().remoteAddress()->asString(),

                   failure_reason_);

  }

  if (!saw_counted_error) {

    ctx_->stats().connection_error_.inc();

  }

}

Network::IoResult SslSocket::doWrite(Buffer::Instance& write_buffer, bool end_stream) {

  ASSERT(info_->state() != Ssl::SocketState::ShutdownSent || write_buffer.length() == 0);

  if (info_->state() != Ssl::SocketState::HandshakeComplete &&

      info_->state() != Ssl::SocketState::ShutdownSent) {

    PostIoAction action = doHandshake();

    if (action == PostIoAction::Close || info_->state() != Ssl::SocketState::HandshakeComplete) {

      return {action, 0, false};

    }

  }

  uint64_t bytes_to_write;

  if (bytes_to_retry_) {

    bytes_to_write = bytes_to_retry_;

    bytes_to_retry_ = 0;

  } else {

    bytes_to_write = std::min(write_buffer.length(), static_cast<uint64_t>(16384));

  }

  uint64_t total_bytes_written = 0;

  while (bytes_to_write > 0) {

    ASSERT(bytes_to_write <= write_buffer.length());

    int rc = SSL_write(rawSsl(), write_buffer.linearize(bytes_to_write), bytes_to_write);

    ENVOY_CONN_LOG(trace, "ssl write returns: {}", callbacks_->connection(), rc);

    if (rc > 0) {

      ASSERT(rc == static_cast<int>(bytes_to_write));

      total_bytes_written += rc;

      write_buffer.drain(rc);

      bytes_to_write = std::min(write_buffer.length(), static_cast<uint64_t>(16384));

    } else {

      int err = SSL_get_error(rawSsl(), rc);

      ENVOY_CONN_LOG(trace, "ssl error occurred while write: {}", callbacks_->connection(),

                     Utility::getErrorDescription(err));

      switch (err) {

      case SSL_ERROR_WANT_WRITE:

        bytes_to_retry_ = bytes_to_write;

        break;

      default:

        drainErrorQueue();

        return {PostIoAction::Close, total_bytes_written, false};

      }

      break;

    }

  }

  if (write_buffer.length() == 0 && end_stream) {

    shutdownSsl();

  }

  return {PostIoAction::KeepOpen, total_bytes_written, false};

}

void SslSocket::onConnected() { ASSERT(info_->state() == Ssl::SocketState::PreHandshake); }

Ssl::ConnectionInfoConstSharedPtr SslSocket::ssl() const { return info_; }

void SslSocket::shutdownSsl() {

  ASSERT(info_->state() != Ssl::SocketState::PreHandshake);

  if (info_->state() != Ssl::SocketState::ShutdownSent &&

      callbacks_->connection().state() != Network::Connection::State::Closed) {

    int rc = SSL_shutdown(rawSsl());

    ENVOY_CONN_LOG(debug, "SSL shutdown: rc={}", callbacks_->connection(), rc);

    drainErrorQueue();

    info_->setState(Ssl::SocketState::ShutdownSent);

  }

}

void SslSocket::shutdownBasic() {

  if (info_->state() != Ssl::SocketState::ShutdownSent &&

      callbacks_->connection().state() != Network::Connection::State::Closed) {

    callbacks_->ioHandle().shutdown(ENVOY_SHUT_WR);

    drainErrorQueue();

    info_->setState(Ssl::SocketState::ShutdownSent);

  }

}

void SslSocket::closeSocket(Network::ConnectionEvent) {

  for (auto const& provider : ctx_->getPrivateKeyMethodProviders()) {

    provider->unregisterPrivateKeyMethod(rawSsl());

  }

  if (info_->state() == Ssl::SocketState::HandshakeInProgress ||

      info_->state() == Ssl::SocketState::HandshakeComplete) {

    shutdownSsl();

  } else {

    shutdownBasic();

  }

}

std::string SslSocket::protocol() const { return ssl()->alpn(); }

absl::string_view SslSocket::failureReason() const { return failure_reason_; }

void SslSocket::onAsynchronousCertValidationComplete() {

  ENVOY_CONN_LOG(debug, "Async cert validation completed", callbacks_->connection());

  if (info_->state() == Ssl::SocketState::HandshakeInProgress) {

    resumeHandshake();

  }

}

void SslSocket::onAsynchronousCertificateSelectionComplete() {

  ENVOY_CONN_LOG(debug, "Async cert selection completed", callbacks_->connection());

  if (info_->state() != Ssl::SocketState::HandshakeInProgress) {

  resumeHandshake();

}