/*

 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.

 *

 * SPDX-License-Identifier: curl

 */

/// @file

/// @brief Nonblocking OpenSSL server transport for structured HTTPS inputs.

#include "proto_fuzzer/tls_mock_server.h"

#include <openssl/ech.h>

#include <openssl/err.h>

#include <openssl/pem.h>

#include <openssl/ssl.h>

#include <sys/socket.h>

#include <cstddef>

#include <string>

#include "proto_fuzzer/tls_test_credentials.h"

namespace proto_fuzzer {

namespace {

/// Isolate the server and curl client even though both OpenSSL instances run

/// on one thread. SSL_get_error requires an empty queue before its I/O call;

/// clearing at both boundaries also prevents a server failure from changing

/// curl's subsequent error classification.

class OpenSslErrorQueueGuard {

 public:

  OpenSslErrorQueueGuard() { ERR_clear_error(); }

  ~OpenSslErrorQueueGuard() { ERR_clear_error(); }

  OpenSslErrorQueueGuard(const OpenSslErrorQueueGuard&) = delete;

  OpenSslErrorQueueGuard& operator=(const OpenSslErrorQueueGuard&) = delete;

};

/// Select the one protocol owned by this peer. A fixed server preference keeps

/// ordinary HTTPS scripts on HTTP/1.1 while allowing the proxy lane to prove

/// curl installed its HTTP/2 connection filter after TLS.

int SelectAlpn(SSL* /*ssl*/, const unsigned char** selected, unsigned char* selected_length,

               const unsigned char* client_protocols, unsigned int client_protocols_length, void* userdata) {

  const auto protocol = *static_cast<const TlsApplicationProtocol*>(userdata);

  // OpenSSL may return a pointer into the server preference list. Function-

  // local static storage keeps that result valid for the rest of the

  // handshake without reintroducing mutable transport policy as a global.

  static constexpr unsigned char http11_alpn[] = {8, 'h', 't', 't', 'p', '/', '1', '.', '1'};

  static constexpr unsigned char http2_alpn[] = {2, 'h', '2'};

  const unsigned char* server_protocols = protocol == TlsApplicationProtocol::kHttp2 ? http2_alpn : http11_alpn;

  const unsigned int server_protocols_length =

      protocol == TlsApplicationProtocol::kHttp2 ? sizeof(http2_alpn) : sizeof(http11_alpn);

  unsigned char* match = nullptr;

  unsigned char match_length = 0;

  const int result = SSL_select_next_proto(&match, &match_length, server_protocols, server_protocols_length,

                                           client_protocols, client_protocols_length);

  if (result != OPENSSL_NPN_NEGOTIATED) {

    return SSL_TLSEXT_ERR_NOACK;

  }

  *selected = match;

  *selected_length = match_length;

  return SSL_TLSEXT_ERR_OK;

}

}  // namespace

/// Own the certificate, key, session cache, ALPN policy, and observations

/// shared by every bounded connection in one Scenario. Keeping both session

/// state and its measurements here makes redirects related while preventing

/// one fuzz input from affecting the next.

class TlsServerContext {

 public:

  TlsServerContext(TlsApplicationProtocol protocol, curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain)

      : context_(nullptr),

        protocol_(protocol),

        negotiated_tls_version_(0),

        completed_handshake_count_(0),

        reused_session_count_(0),

        write_retry_count_(0),

#ifndef OPENSSL_NO_ECH

        ech_status_(SSL_ECH_STATUS_NOT_TRIED) {

#else

        ech_status_(-1) {

#endif

    OpenSslErrorQueueGuard error_guard;

    context_ = SSL_CTX_new(TLS_server_method());

    if (context_ == nullptr || !LoadCredentials(certificate_chain) || !LoadEchConfig()) {

      SSL_CTX_free(context_);

      context_ = nullptr;

      return;

    }

    (void)SSL_CTX_set_min_proto_version(context_, TLS1_2_VERSION);

    (void)SSL_CTX_set_options(context_, SSL_OP_NO_COMPRESSION);

    (void)SSL_CTX_set_session_cache_mode(context_, SSL_SESS_CACHE_SERVER);

    constexpr unsigned char session_id_context[] = "curl-fuzzer";

    (void)SSL_CTX_set_session_id_context(context_, session_id_context, sizeof(session_id_context) - 1);

    SSL_CTX_set_alpn_select_cb(context_, &SelectAlpn, &protocol_);

  }

  ~TlsServerContext() {

    OpenSslErrorQueueGuard error_guard;

    SSL_CTX_free(context_);

  }

  TlsServerContext(const TlsServerContext&) = delete;

  TlsServerContext& operator=(const TlsServerContext&) = delete;

  /// @return the configured context, or nullptr when credential setup failed.

  SSL_CTX* get() const { return context_; }

  /// Retain only scalar handshake results; SSL itself remains connection-owned.

  /// @param ssl connection that has just completed SSL_accept.

  void RecordHandshake(SSL* ssl) {

    if (ssl == nullptr) {

      return;

    }

    negotiated_tls_version_ = SSL_version(ssl);

    const unsigned char* alpn = nullptr;

    unsigned int alpn_length = 0;

    SSL_get0_alpn_selected(ssl, &alpn, &alpn_length);

    if (alpn != nullptr && alpn_length != 0) {

      negotiated_alpn_.assign(reinterpret_cast<const char*>(alpn), alpn_length);

    } else {

      negotiated_alpn_.clear();

    }

    ++completed_handshake_count_;

    if (SSL_session_reused(ssl) == 1) {

      ++reused_session_count_;

    }

#ifndef OPENSSL_NO_ECH

    char* inner_name = nullptr;

    char* outer_name = nullptr;

    ech_status_ = SSL_ech_get1_status(ssl, &inner_name, &outer_name);

    ech_inner_name_ = inner_name == nullptr ? std::string() : inner_name;

    ech_outer_name_ = outer_name == nullptr ? std::string() : outer_name;

    OPENSSL_free(inner_name);

    OPENSSL_free(outer_name);

#endif

  }

  /// Record that OpenSSL requires an identical application-write retry.

  void RecordWriteRetry() { ++write_retry_count_; }

  /// @return protocol version from the most recent completed handshake.

  int negotiated_tls_version() const { return negotiated_tls_version_; }

  /// @return number of connections that completed their handshake.

  std::size_t completed_handshake_count() const { return completed_handshake_count_; }

  /// @return number of completed handshakes that reused a session.

  std::size_t reused_session_count() const { return reused_session_count_; }

  /// @return number of application writes that OpenSSL asked to retry.

  std::size_t write_retry_count() const { return write_retry_count_; }

  /// @return ALPN protocol from the most recent completed handshake.

  const std::string& negotiated_alpn() const { return negotiated_alpn_; }

  /// @return fixed application protocol this context offers.

  TlsApplicationProtocol protocol() const { return protocol_; }

  /// @return OpenSSL ECH result from the latest completed handshake.

  int ech_status() const { return ech_status_; }

  /// @return latest decrypted inner SNI, if ECH was attempted.

  const std::string& ech_inner_name() const { return ech_inner_name_; }

  /// @return latest public outer SNI, if ECH was attempted.

  const std::string& ech_outer_name() const { return ech_outer_name_; }

 private:

  /// Append one profile-selected peer certificate without requiring it to

  /// authenticate the TLS handshake. OpenSSL transfers ownership on success;

  /// failure leaves cleanup with the caller.

  bool AddExtraChainCertificate(const char* certificate_pem) {

    BIO* certificate_bio = BIO_new_mem_buf(certificate_pem, -1);

    if (certificate_bio == nullptr) {

      return false;

    }

    X509* certificate = PEM_read_bio_X509(certificate_bio, nullptr, nullptr, nullptr);

    BIO_free(certificate_bio);

    if (certificate == nullptr) {

      return false;

    }

    if (SSL_CTX_add_extra_chain_cert(context_, certificate) != 1) {

      X509_free(certificate);

      return false;

    }

    return true;

  }

  /// Parse the checked-in test-only PEM values entirely in memory.

  bool LoadCredentials(curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain) {

    BIO* certificate_bio = BIO_new_mem_buf(tls_test_credentials::kCertificatePem, -1);

    BIO* key_bio = BIO_new_mem_buf(tls_test_credentials::kPrivateKeyPem, -1);

    if (certificate_bio == nullptr || key_bio == nullptr) {

      BIO_free(certificate_bio);

      BIO_free(key_bio);

      return false;

    }

    X509* certificate = PEM_read_bio_X509(certificate_bio, nullptr, nullptr, nullptr);

    EVP_PKEY* key = PEM_read_bio_PrivateKey(key_bio, nullptr, nullptr, nullptr);

    BIO_free(certificate_bio);

    BIO_free(key_bio);

    if (certificate == nullptr || key == nullptr) {

      X509_free(certificate);

      EVP_PKEY_free(key);

      return false;

    }

    const bool loaded = SSL_CTX_use_certificate(context_, certificate) == 1 &&

                        SSL_CTX_use_PrivateKey(context_, key) == 1 && SSL_CTX_check_private_key(context_) == 1;

    X509_free(certificate);

    EVP_PKEY_free(key);

    if (!loaded) {

      return false;

    }

    switch (certificate_chain) {

      case curl::fuzzer::proto::TLS_CERTIFICATE_CHAIN_ALL_KEY_TYPES:

        return AddExtraChainCertificate(tls_test_credentials::kRsaCertificatePem) &&

               AddExtraChainCertificate(tls_test_credentials::kDsaCertificatePem) &&

               AddExtraChainCertificate(tls_test_credentials::kDhCertificatePem);

      case curl::fuzzer::proto::TLS_CERTIFICATE_CHAIN_DEFAULT_EC:

      default:

        return true;

    }

  }

  /// Load a fixed test-only ECH private key and matching public config. This

  /// makes a successful encrypted ClientHello deterministic without DNS or

  /// filesystem state; builds configured without ECH retain the TLS mock.

  bool LoadEchConfig() {

#ifndef OPENSSL_NO_ECH

    BIO* ech_bio = BIO_new_mem_buf(tls_test_credentials::kEchConfigPem, -1);

    OSSL_ECHSTORE* store = OSSL_ECHSTORE_new(nullptr, nullptr);

    if (ech_bio == nullptr || store == nullptr) {

      BIO_free(ech_bio);

      OSSL_ECHSTORE_free(store);

      return false;

    }

    const bool loaded =

        OSSL_ECHSTORE_read_pem(store, ech_bio, OSSL_ECH_NO_RETRY) == 1 && SSL_CTX_set1_echstore(context_, store) == 1;

    BIO_free(ech_bio);

    OSSL_ECHSTORE_free(store);

    return loaded;

#else

    return true;

#endif

  }

  SSL_CTX* context_;

  TlsApplicationProtocol protocol_;

  std::string negotiated_alpn_;

  int negotiated_tls_version_;

  std::size_t completed_handshake_count_;

  std::size_t reused_session_count_;

  std::size_t write_retry_count_;

  int ech_status_;

  std::string ech_inner_name_;

  std::string ech_outer_name_;

};

namespace {

/// TLS-aware MockConnection. Application writes are queued before the client

/// starts, then encrypted only after SSL_accept has completed. This preserves

/// MockServer's useful initial_response semantics without ever putting those

/// plaintext bytes onto the TLS wire.

class TlsMockConnection final : public MockConnection {

 public:

  explicit TlsMockConnection(TlsServerContext* context)

      : ssl_(nullptr),

        context_(context),

        pending_offset_(0),

        pending_write_end_(0),

        handshake_complete_(false),

        shutdown_requested_(false),

        write_shutdown_(false),

        failed_(false) {

    OpenSslErrorQueueGuard error_guard;

    SSL_CTX* ssl_context = context_ == nullptr ? nullptr : context_->get();

    ssl_ = ssl_context == nullptr ? nullptr : SSL_new(ssl_context);

    if (ssl_ != nullptr) {

      SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);

      if (SSL_set_fd(ssl_, server_fd()) != 1) {

        SSL_free(ssl_);

        ssl_ = nullptr;

      } else {

        SSL_set_accept_state(ssl_);

      }

    }

  }

  ~TlsMockConnection() override {

    OpenSslErrorQueueGuard error_guard;

    if (ssl_ != nullptr) {

      SSL_free(ssl_);

    }

  }

  /// Require both the socketpair and its OpenSSL wrapper to be usable.

  bool ok() const override { return MockConnection::ok() && ssl_ != nullptr; }

  /// Queue bounded application bytes until the handshake can encrypt them.

  bool WriteAll(const unsigned char* data, std::size_t size) override {

    if (failed_ || (data == nullptr && size != 0) || size > pending_plaintext_.max_size() - pending_plaintext_.size()) {

      return false;

    }

    if (size != 0) {

      pending_plaintext_.append(reinterpret_cast<const char*>(data), size);

    }

    return true;

  }

  /// Advance the handshake, consume encrypted request records, flush queued

  /// response records, and finish a requested close without ever waiting.

  /// @return decrypted/application bytes plus state transitions made this turn.

  std::size_t DrainIncoming() override {

    if (!ok() || failed_) {

      return 0;

    }

    OpenSslErrorQueueGuard error_guard;

    std::size_t progress = 0;

    if (!handshake_complete_) {

      const int state_before = static_cast<int>(SSL_get_state(ssl_));

      const int result = SSL_accept(ssl_);

      // SSL_get_error must be the next OpenSSL call after failed I/O. Even a

      // state query in between would make its use formally unreliable.

      const int error = result == 1 ? SSL_ERROR_NONE : SSL_get_error(ssl_, result);

      const int state_after = static_cast<int>(SSL_get_state(ssl_));

      if (state_after != state_before) {

        ++progress;

      }

      if (result == 1) {

        handshake_complete_ = true;

        if (context_ != nullptr) {

          context_->RecordHandshake(ssl_);

        }

        ++progress;

      } else {

        if (error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE) {

          return progress;

        }

        failed_ = true;

        return progress;

      }

    }

    // A WANT result leaves SSL_write_ex in flight. OpenSSL requires the next

    // I/O operation to retry that exact write, so do not interpose SSL_read_ex

    // merely because the outer driver has yielded back to us.

    if (pending_write_end_ != 0) {

      progress += FlushPendingWrites();

      if (failed_ || pending_write_end_ != 0) {

        return progress;

      }

    }

    unsigned char request[4096];

    while (true) {

      std::size_t received = 0;

      const int result = SSL_read_ex(ssl_, request, sizeof(request), &received);

      if (result == 1 && received != 0) {

        progress += received;

        continue;

      }

      if (result != 1) {

        const int error = SSL_get_error(ssl_, result);

        if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE && error != SSL_ERROR_ZERO_RETURN) {

          failed_ = true;

        }

      }

      break;

    }

    progress += FlushPendingWrites();

    if (!failed_ && shutdown_requested_ && pending_plaintext_.empty() && !write_shutdown_) {

      const int result = SSL_shutdown(ssl_);

      if (result >= 0) {

        // The first successful call sends close_notify. The fuzzer does not

        // need to wait for the client's reciprocal alert before exposing EOF.

        (void)::shutdown(server_fd(), SHUT_WR);

        write_shutdown_ = true;

        ++progress;

      } else {

        const int error = SSL_get_error(ssl_, result);

        if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE) {

          failed_ = true;

        }

      }

    }

    return progress;

  }

  /// Defer close_notify until every queued plaintext byte has become a record.

  void ShutdownWrite() override {

    // An HTTP/2 proxy connection outlives the scripted origin response inside

    // its CONNECT stream. Half-closing TLS when the last script chunk is

    // queued would make curl observe a dead proxy rather than exercise its

    // own stream/session shutdown and GOAWAY handling.

    if (context_ != nullptr && context_->protocol() == TlsApplicationProtocol::kHttp2) {

      return;

    }

    shutdown_requested_ = true;

    (void)DrainIncoming();

  }

 private:

  /// Flush queued response bytes while preserving any OpenSSL retry boundary.

  /// @return plaintext bytes OpenSSL accepted during this call.

  std::size_t FlushPendingWrites() {

    std::size_t progress = 0;

    while (!failed_ && pending_offset_ < pending_plaintext_.size()) {

      if (pending_write_end_ == 0) {

        // Freeze one write boundary until OpenSSL accepts it. WriteAll may

        // append the next scripted chunk after WANT_READ/WANT_WRITE, but the

        // retry contract permits only pointer relocation—not changed bytes or

        // length—for the outstanding SSL_write_ex call.

        pending_write_end_ = pending_plaintext_.size();

      }

      std::size_t written = 0;

      const int result = SSL_write_ex(ssl_, pending_plaintext_.data() + pending_offset_,

                                      pending_write_end_ - pending_offset_, &written);

      if (result == 1) {

        if (written == 0) {

          failed_ = true;

          break;

        }

        pending_offset_ += written;

        progress += written;

        if (pending_offset_ == pending_write_end_) {

          pending_write_end_ = 0;

        }

        continue;

      }

      const int error = SSL_get_error(ssl_, result);

      if (error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE) {

        if (context_ != nullptr) {

          context_->RecordWriteRetry();

        }

      } else {

        failed_ = true;

      }

      break;

    }

    if (pending_offset_ == pending_plaintext_.size()) {

      pending_plaintext_.clear();

      pending_offset_ = 0;

      pending_write_end_ = 0;

    }

    return progress;

  }

  SSL* ssl_;

  TlsServerContext* context_;

  std::string pending_plaintext_;

  std::size_t pending_offset_;

  /// Exclusive end of a write that OpenSSL may require us to retry exactly.

  std::size_t pending_write_end_;

  bool handshake_complete_;

  bool shutdown_requested_;

  bool write_shutdown_;

  bool failed_;

};

}  // namespace

/// Build one reusable in-process server context per fuzz iteration.

TlsMockServer::TlsMockServer() : TlsMockServer(curl::fuzzer::proto::TLS_CERTIFICATE_CHAIN_DEFAULT_EC) {}

/// Select one bounded certificate chain while retaining HTTP/1.1 ALPN.

TlsMockServer::TlsMockServer(curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain)

    : TlsMockServer(TlsApplicationProtocol::kHttp11, certificate_chain) {}

/// Construct the shared TLS transport with one fixed ALPN outcome.

TlsMockServer::TlsMockServer(TlsApplicationProtocol protocol,

                             curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain)

    : context_(std::make_unique<TlsServerContext>(protocol, certificate_chain)), saw_live_tls_session_(false) {}

/// Release SSL objects before their owning server context. OpenSSL reference

/// counting makes the reverse order legal, but making the ownership order

/// explicit keeps future transport state from acquiring a hidden dependency.

TlsMockServer::~TlsMockServer() { ResetConnections(); }

/// Add verification to the common socket callbacks. Curl copies the blob

/// descriptor during setopt and borrows the inline certificate bytes, whose

/// program lifetime safely exceeds every easy handle.

void TlsMockServer::Install(CURL* easy) {

  MockServer::Install(easy);

  struct curl_blob trust_anchor = {const_cast<char*>(tls_test_credentials::kCertificatePem),

                                   sizeof(tls_test_credentials::kCertificatePem) - 1, CURL_BLOB_NOCOPY};

  (void)curl_easy_setopt(easy, CURLOPT_CAINFO_BLOB, &trust_anchor);

  (void)curl_easy_setopt(easy, CURLOPT_SSL_VERIFYPEER, 1L);

  (void)curl_easy_setopt(easy, CURLOPT_SSL_VERIFYHOST, 2L);

}

/// Report whether the drive reached curl's live TLS backend-query path.

bool TlsMockServer::saw_live_tls_session() const { return saw_live_tls_session_; }

/// Report the protocol selected by the latest successful server handshake.

int TlsMockServer::negotiated_tls_version() const {

  return context_ == nullptr ? 0 : context_->negotiated_tls_version();

}

/// Report how many bounded connections finished their TLS handshake.

std::size_t TlsMockServer::completed_handshake_count() const {

  return context_ == nullptr ? 0 : context_->completed_handshake_count();

}

/// Report how many later connections resumed state from this scenario.

std::size_t TlsMockServer::reused_session_count() const {

  return context_ == nullptr ? 0 : context_->reused_session_count();

}

/// Report how often response delivery reached OpenSSL's exact-retry path.

std::size_t TlsMockServer::write_retry_count() const { return context_ == nullptr ? 0 : context_->write_retry_count(); }

/// Return the latest negotiated application protocol without exposing SSL.

std::string TlsMockServer::negotiated_alpn() const {

  return context_ == nullptr ? std::string() : context_->negotiated_alpn();

}

/// Return OpenSSL's latest ECH result without exposing its SSL object.

int TlsMockServer::ech_status() const { return context_ == nullptr ? -1 : context_->ech_status(); }

/// Return the SNI that OpenSSL recovered from the encrypted ClientHello.

std::string TlsMockServer::ech_inner_name() const {

  return context_ == nullptr ? std::string() : context_->ech_inner_name();

}

/// Return the public SNI that remained in the outer ClientHello.

std::string TlsMockServer::ech_outer_name() const {

  return context_ == nullptr ? std::string() : context_->ech_outer_name();

}

/// Create the polymorphic record-layer connection consumed by MockServer.

std::unique_ptr<MockConnection> TlsMockServer::CreateConnection() {

  return std::make_unique<TlsMockConnection>(context_.get());

}

/// Query while the connection filters are attached. Stop after the first live

/// result so these coverage probes add a bounded handful of calls during the

/// handshake rather than recurring throughout every HTTP parser iteration.

/// @param easy Active easy handle whose connection filters remain attached.

void TlsMockServer::ObserveActiveTransfer(CURL* easy) {

  if (saw_live_tls_session_) {

    return;

  }

  long verify_result = 0;

  curl_off_t appconnect_time = 0;

  struct curl_certinfo* certificate_info = nullptr;

  struct curl_tlssessioninfo* tls_session = nullptr;

  (void)curl_easy_getinfo(easy, CURLINFO_SSL_VERIFYRESULT, &verify_result);

  (void)curl_easy_getinfo(easy, CURLINFO_APPCONNECT_TIME_T, &appconnect_time);

  (void)curl_easy_getinfo(easy, CURLINFO_CERTINFO, &certificate_info);

  if (curl_easy_getinfo(easy, CURLINFO_TLS_SSL_PTR, &tls_session) == CURLE_OK && tls_session != nullptr &&

      tls_session->internals != nullptr) {

    saw_live_tls_session_ = true;

  }

}

}  // namespace proto_fuzzer