SslSocketFactoryStats generateStats(Stats::Scope& store) {

  return {ALL_SSL_SOCKET_FACTORY_STATS(POOL_COUNTER_PREFIX(store, "server_ssl_socket_factory."))};

}

                               Envoy::Ssl::ContextManager& manager, Stats::Scope& stats_scope) {

  absl::Status creation_status = absl::OkStatus();

  auto ret = std::unique_ptr<ServerSslSocketFactory>(

      new ServerSslSocketFactory(std::move(config), manager, stats_scope, creation_status));

  RETURN_IF_NOT_OK(creation_status);

  return ret;

}

    : manager_(manager), stats_scope_(stats_scope), stats_(generateStats(stats_scope)),

      config_(std::move(config)) {

  auto ctx_or_error = manager_.createSslServerContext(stats_scope_, *config_, nullptr);

  SET_AND_RETURN_IF_NOT_OK(ctx_or_error.status(), creation_status);

  ssl_ctx_ = *ctx_or_error;

  config_->setSecretUpdateCallback([this]() { return onAddOrUpdateSecret(); });

}

ServerSslSocketFactory::~ServerSslSocketFactory() { manager_.removeContext(ssl_ctx_); }

Network::TransportSocketPtr ServerSslSocketFactory::createDownstreamTransportSocket() const {

  Envoy::Ssl::ServerContextSharedPtr ssl_ctx;

  {

    absl::ReaderMutexLock l(ssl_ctx_mu_);

    ssl_ctx = ssl_ctx_;

  }

  if (ssl_ctx) {

    auto status_or_socket = SslSocket::create(std::move(ssl_ctx), InitialState::Server, nullptr,

                                              config_->createHandshaker());

    if (status_or_socket.ok()) {

      return std::move(*status_or_socket);

    }

  } else {

    ENVOY_LOG(debug, "Create NotReadySslSocket");

    stats_.downstream_context_secrets_not_ready_.inc();

    return std::make_unique<NotReadySslSocket>();

  }

}

bool ServerSslSocketFactory::implementsSecureTransport() const { return true; }

absl::Status ServerSslSocketFactory::onAddOrUpdateSecret() {

  ENVOY_LOG(debug, "Secret is updated.");

  auto ctx_or_error = manager_.createSslServerContext(stats_scope_, *config_, nullptr);

  RETURN_IF_NOT_OK(ctx_or_error.status());

  {

    absl::WriterMutexLock l(ssl_ctx_mu_);

    std::swap(*ctx_or_error, ssl_ctx_);

  }

  manager_.removeContext(*ctx_or_error);

  stats_.ssl_context_update_by_sds_.inc();

  return absl::OkStatus();

}