/*

 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.

 *

 * SPDX-License-Identifier: curl

 */

/// @file

/// @brief Nonblocking OpenSSL server transport for structured HTTPS inputs.

#include "proto_fuzzer/tls_mock_server.h"

#include <openssl/bio.h>

#include <openssl/ech.h>

#include <openssl/err.h>

#include <openssl/ssl.h>

#include <sys/socket.h>

#include <cstddef>

#include <cstring>

#include <string>

#include <vector>

#include "proto_fuzzer/tls_test_credential_cache.h"

#include "proto_fuzzer/tls_test_credentials.h"

namespace proto_fuzzer {

namespace {

constexpr std::size_t kMaxSessionExportAttempts = 8;

constexpr std::size_t kMaxSessionHashSize = 128;

constexpr std::size_t kMaxSessionDataSize = 16 * 1024;

/// The TLS carrier always uses OpenSSL on its server side, but the HTTPS seed

/// corpus is also replayed by curl clients built with GnuTLS and mbedTLS.

/// Backend-specific handshake terminals must not replace their ordinary peer.

bool CurlClientUsesOpenSsl() {

  const curl_version_info_data* version = curl_version_info(CURLVERSION_NOW);

  constexpr char kOpenSslPrefix[] = "OpenSSL/";

  return version != nullptr && version->ssl_version != nullptr &&

         std::strncmp(version->ssl_version, kOpenSslPrefix, sizeof(kOpenSslPrefix) - 1) == 0;

}

/// Own the only export retained by one probe. curl owns every pointer passed

/// to the callback, so both binary fields must be copied before it returns.

struct ExportedSession {

  std::vector<unsigned char> salted_hash;

  std::vector<unsigned char> session_data;

};

/// Retain at most one bounded ticket while allowing curl to finish its cache

/// walk. Importing here would recurse into the already-locked session cache.

CURLcode CaptureExportedSession(CURL* /*easy*/, void* user_data, const char* /*session_key*/,

                                const unsigned char* salted_hash, std::size_t salted_hash_size,

                                const unsigned char* session_data, std::size_t session_data_size,

                                curl_off_t /*valid_until*/, int /*ietf_tls_id*/, const char* /*alpn*/,

                                std::size_t /*early_data_max*/) {

  auto* exported = static_cast<ExportedSession*>(user_data);

  if (!exported->session_data.empty() || salted_hash == nullptr || salted_hash_size == 0 ||

      salted_hash_size > kMaxSessionHashSize || session_data == nullptr || session_data_size == 0 ||

      session_data_size > kMaxSessionDataSize) {

    return CURLE_OK;

  }

  exported->salted_hash.assign(salted_hash, salted_hash + salted_hash_size);

  exported->session_data.assign(session_data, session_data + session_data_size);

  return CURLE_OK;

}

/// Isolate the server and curl client even though both OpenSSL instances run

/// on one thread. SSL_get_error requires an empty queue before its I/O call;

/// clearing at both boundaries also prevents a server failure from changing

/// curl's subsequent error classification.

class OpenSslErrorQueueGuard {

 public:

  OpenSslErrorQueueGuard() { ERR_clear_error(); }

  ~OpenSslErrorQueueGuard() { ERR_clear_error(); }

  OpenSslErrorQueueGuard(const OpenSslErrorQueueGuard&) = delete;

  OpenSslErrorQueueGuard& operator=(const OpenSslErrorQueueGuard&) = delete;

};

/// Select the one protocol owned by this peer. A fixed server preference keeps

/// ordinary HTTPS scripts on HTTP/1.1 while allowing the proxy lane to prove

/// curl installed its HTTP/2 connection filter after TLS.

int SelectAlpn(SSL* /*ssl*/, const unsigned char** selected, unsigned char* selected_length,

               const unsigned char* client_protocols, unsigned int client_protocols_length, void* userdata) {

  const auto protocol = *static_cast<const TlsApplicationProtocol*>(userdata);

  // OpenSSL may return a pointer into the server preference list. Function-

  // local static storage keeps that result valid for the rest of the

  // handshake without reintroducing mutable transport policy as a global.

  static constexpr unsigned char http11_alpn[] = {8, 'h', 't', 't', 'p', '/', '1', '.', '1'};

  static constexpr unsigned char http2_alpn[] = {2, 'h', '2'};

  const unsigned char* server_protocols = protocol == TlsApplicationProtocol::kHttp2 ? http2_alpn : http11_alpn;

  const unsigned int server_protocols_length =

      protocol == TlsApplicationProtocol::kHttp2 ? sizeof(http2_alpn) : sizeof(http11_alpn);

  unsigned char* match = nullptr;

  unsigned char match_length = 0;

  const int result = SSL_select_next_proto(&match, &match_length, server_protocols, server_protocols_length,

                                           client_protocols, client_protocols_length);

  if (result != OPENSSL_NPN_NEGOTIATED) {

    return SSL_TLSEXT_ERR_NOACK;

  }

  *selected = match;

  *selected_length = match_length;

  return SSL_TLSEXT_ERR_OK;

}

}  // namespace

/// Own the certificate, key, session cache, ALPN policy, and observations

/// shared by every bounded connection in one Scenario. Keeping both session

/// state and its measurements here makes redirects related while preventing

/// one fuzz input from affecting the next.

class TlsServerContext {

 public:

  // Doxygen's no-preprocessing pass would see both conditional body openings.

  // Skip this implementation-only constructor to preserve the enclosing scope.

  /// @cond

  TlsServerContext(TlsApplicationProtocol protocol, curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain,

                   TlsGroupPolicy group_policy)

      : context_(nullptr),

        protocol_(protocol),

        group_policy_(group_policy),

        negotiated_tls_version_(0),

        completed_handshake_count_(0),

        reused_session_count_(0),

        write_retry_count_(0),

#ifndef OPENSSL_NO_ECH

        ech_status_(SSL_ECH_STATUS_NOT_TRIED) {

#else

        ech_status_(-1) {

#endif

    OpenSslErrorQueueGuard error_guard;

    context_ = SSL_CTX_new(TLS_server_method());

    if (context_ == nullptr || !ApplyGroupPolicy() || !InstallCachedTlsTestCredentials(context_, certificate_chain) ||

        !LoadEchConfig()) {

      SSL_CTX_free(context_);

      context_ = nullptr;

      return;

    }

    (void)SSL_CTX_set_min_proto_version(context_, TLS1_2_VERSION);

    (void)SSL_CTX_set_options(context_, SSL_OP_NO_COMPRESSION);

    (void)SSL_CTX_set_session_cache_mode(context_, SSL_SESS_CACHE_SERVER);

    constexpr unsigned char session_id_context[] = "curl-fuzzer";

    (void)SSL_CTX_set_session_id_context(context_, session_id_context, sizeof(session_id_context) - 1);

    SSL_CTX_set_alpn_select_cb(context_, &SelectAlpn, &protocol_);

  }

  /// @endcond

  ~TlsServerContext() {

    OpenSslErrorQueueGuard error_guard;

    SSL_CTX_free(context_);

  }

  TlsServerContext(const TlsServerContext&) = delete;

  TlsServerContext& operator=(const TlsServerContext&) = delete;

  /// @return the configured context, or nullptr when credential setup failed.

  SSL_CTX* get() const { return context_; }

  /// Retain only scalar handshake results; SSL itself remains connection-owned.

  /// @param ssl connection that has just completed SSL_accept.

  void RecordHandshake(SSL* ssl) {

    if (ssl == nullptr) {

      return;

    }

    negotiated_tls_version_ = SSL_version(ssl);

    const unsigned char* alpn = nullptr;

    unsigned int alpn_length = 0;

    SSL_get0_alpn_selected(ssl, &alpn, &alpn_length);

    if (alpn != nullptr && alpn_length != 0) {

      negotiated_alpn_.assign(reinterpret_cast<const char*>(alpn), alpn_length);

    } else {

      negotiated_alpn_.clear();

    }

    ++completed_handshake_count_;

    if (SSL_session_reused(ssl) == 1) {

      ++reused_session_count_;

    }

    const int negotiated_group = SSL_get_negotiated_group(ssl);

    const char* group_name = negotiated_group == 0 ? nullptr : SSL_group_to_name(ssl, negotiated_group);

    negotiated_group_ = group_name == nullptr ? std::string() : group_name;

#ifndef OPENSSL_NO_ECH

    char* inner_name = nullptr;

    char* outer_name = nullptr;

    ech_status_ = SSL_ech_get1_status(ssl, &inner_name, &outer_name);

    ech_inner_name_ = inner_name == nullptr ? std::string() : inner_name;

    ech_outer_name_ = outer_name == nullptr ? std::string() : outer_name;

    OPENSSL_free(inner_name);

    OPENSSL_free(outer_name);

#endif

  }

  /// Record that OpenSSL requires an identical application-write retry.

  void RecordWriteRetry() { ++write_retry_count_; }

  /// @return protocol version from the most recent completed handshake.

  int negotiated_tls_version() const { return negotiated_tls_version_; }

  /// @return number of connections that completed their handshake.

  std::size_t completed_handshake_count() const { return completed_handshake_count_; }

  /// @return number of completed handshakes that reused a session.

  std::size_t reused_session_count() const { return reused_session_count_; }

  /// @return number of application writes that OpenSSL asked to retry.

  std::size_t write_retry_count() const { return write_retry_count_; }

  /// @return ALPN protocol from the most recent completed handshake.

  const std::string& negotiated_alpn() const { return negotiated_alpn_; }

  /// @return key-exchange group from the most recent completed handshake.

  const std::string& negotiated_group() const { return negotiated_group_; }

  /// @return fixed application protocol this context offers.

  TlsApplicationProtocol protocol() const { return protocol_; }

  /// @return OpenSSL ECH result from the latest completed handshake.

  int ech_status() const { return ech_status_; }

  /// @return latest decrypted inner SNI, if ECH was attempted.

  const std::string& ech_inner_name() const { return ech_inner_name_; }

  /// @return latest public outer SNI, if ECH was attempted.

  const std::string& ech_outer_name() const { return ech_outer_name_; }

 private:

  /// Apply the constructor-selected group policy before any SSL is created.

  /// @return true when the provider accepted the requested policy.

  bool ApplyGroupPolicy() {

    switch (group_policy_) {

      case TlsGroupPolicy::kProviderDefault:

        return true;

      case TlsGroupPolicy::kX25519:

        return SSL_CTX_set1_groups_list(context_, "X25519") == 1;

    }

    return false;

  }

  /// Load a fixed test-only ECH private key and matching public config. This

  /// makes a successful encrypted ClientHello deterministic without DNS or

  /// filesystem state; builds configured without ECH retain the TLS mock.

  bool LoadEchConfig() {

#ifndef OPENSSL_NO_ECH

    BIO* ech_bio = BIO_new_mem_buf(tls_test_credentials::kEchConfigPem, -1);

    OSSL_ECHSTORE* store = OSSL_ECHSTORE_new(nullptr, nullptr);

    if (ech_bio == nullptr || store == nullptr) {

      BIO_free(ech_bio);

      OSSL_ECHSTORE_free(store);

      return false;

    }

    const bool loaded =

        OSSL_ECHSTORE_read_pem(store, ech_bio, OSSL_ECH_NO_RETRY) == 1 && SSL_CTX_set1_echstore(context_, store) == 1;

    BIO_free(ech_bio);

    OSSL_ECHSTORE_free(store);

    return loaded;

#else

    return true;

#endif

  }

  SSL_CTX* context_;

  TlsApplicationProtocol protocol_;

  const TlsGroupPolicy group_policy_;

  std::string negotiated_alpn_;

  std::string negotiated_group_;

  int negotiated_tls_version_;

  std::size_t completed_handshake_count_;

  std::size_t reused_session_count_;

  std::size_t write_retry_count_;

  int ech_status_;

  std::string ech_inner_name_;

  std::string ech_outer_name_;

};

namespace {

/// TLS-aware MockConnection. Application writes are queued before the client

/// starts, then encrypted only after SSL_accept has completed. This preserves

/// MockServer's useful initial_response semantics without ever putting those

/// plaintext bytes onto the TLS wire.

class TlsMockConnection final : public MockConnection {

 public:

  explicit TlsMockConnection(TlsServerContext* context)

      : ssl_(nullptr),

        context_(context),

        pending_offset_(0),

        pending_write_end_(0),

        handshake_complete_(false),

        shutdown_requested_(false),

        write_shutdown_(false),

        failed_(false) {

    OpenSslErrorQueueGuard error_guard;

    SSL_CTX* ssl_context = context_ == nullptr ? nullptr : context_->get();

    ssl_ = ssl_context == nullptr ? nullptr : SSL_new(ssl_context);

    if (ssl_ != nullptr) {

      SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);

      if (SSL_set_fd(ssl_, server_fd()) != 1) {

        SSL_free(ssl_);

        ssl_ = nullptr;

      } else {

        SSL_set_accept_state(ssl_);

      }

    }

  }

  ~TlsMockConnection() override {

    OpenSslErrorQueueGuard error_guard;

    if (ssl_ != nullptr) {

      SSL_free(ssl_);

    }

  }

  /// Require both the socketpair and its OpenSSL wrapper to be usable.

  bool ok() const override { return MockConnection::ok() && ssl_ != nullptr; }

  /// Queue bounded application bytes until the handshake can encrypt them.

  bool WriteAll(const unsigned char* data, std::size_t size) override {

    if (failed_ || (data == nullptr && size != 0) || size > pending_plaintext_.max_size() - pending_plaintext_.size()) {

      return false;

    }

    if (size != 0) {

      pending_plaintext_.append(reinterpret_cast<const char*>(data), size);

    }

    return true;

  }

  /// Advance the handshake, consume encrypted request records, flush queued

  /// response records, and finish a requested close without ever waiting.

  /// @return decrypted/application bytes plus state transitions made this turn.

  std::size_t DrainIncoming() override {

    if (!ok() || failed_) {

      return 0;

    }

    OpenSslErrorQueueGuard error_guard;

    std::size_t progress = 0;

    if (!handshake_complete_) {

      const int state_before = static_cast<int>(SSL_get_state(ssl_));

      const int result = SSL_accept(ssl_);

      // SSL_get_error must be the next OpenSSL call after failed I/O. Even a

      // state query in between would make its use formally unreliable.

      const int error = result == 1 ? SSL_ERROR_NONE : SSL_get_error(ssl_, result);

      const int state_after = static_cast<int>(SSL_get_state(ssl_));

      if (state_after != state_before) {

        ++progress;

      }

      if (result == 1) {

        handshake_complete_ = true;

        if (context_ != nullptr) {

          context_->RecordHandshake(ssl_);

        }

        ++progress;

      } else {

        if (error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE) {

          return progress;

        }

        failed_ = true;

        return progress;

      }

    }

    // A WANT result leaves SSL_write_ex in flight. OpenSSL requires the next

    // I/O operation to retry that exact write, so do not interpose SSL_read_ex

    // merely because the outer driver has yielded back to us.

    if (pending_write_end_ != 0) {

      progress += FlushPendingWrites();

      if (failed_ || pending_write_end_ != 0) {

        return progress;

      }

    }

    unsigned char request[4096];

    while (true) {

      std::size_t received = 0;

      const int result = SSL_read_ex(ssl_, request, sizeof(request), &received);

      if (result == 1 && received != 0) {

        NotifyIncomingData(request, received);

        progress += received;

        continue;

      }

      if (result != 1) {

        const int error = SSL_get_error(ssl_, result);

        if (error == SSL_ERROR_ZERO_RETURN) {

          // The client sent close_notify. TLS requires a reciprocal close_notify

          // before the orderly shutdown completes; protocols such as FTP upload

          // wait for that completion even though the application data is done.

          shutdown_requested_ = true;

        } else if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE) {

          failed_ = true;

        }

      }

      break;

    }

    progress += FlushPendingWrites();

    if (!failed_ && shutdown_requested_ && pending_plaintext_.empty() && !write_shutdown_) {

      const int result = SSL_shutdown(ssl_);

      if (result >= 0) {

        // The first successful call sends close_notify. The fuzzer does not

        // need to wait for the client's reciprocal alert before exposing EOF.

        (void)::shutdown(server_fd(), SHUT_WR);

        write_shutdown_ = true;

        ++progress;

      } else {

        const int error = SSL_get_error(ssl_, result);

        if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE) {

          failed_ = true;

        }

      }

    }

    return progress;

  }

  /// Defer close_notify until every queued plaintext byte has become a record.

  void ShutdownWrite() override {

    // An HTTP/2 proxy connection outlives the scripted origin response inside

    // its CONNECT stream. Half-closing TLS when the last script chunk is

    // queued would make curl observe a dead proxy rather than exercise its

    // own stream/session shutdown and GOAWAY handling.

    if (context_ != nullptr && context_->protocol() == TlsApplicationProtocol::kHttp2) {

      return;

    }

    shutdown_requested_ = true;

    (void)DrainIncoming();

  }

 private:

  /// Flush queued response bytes while preserving any OpenSSL retry boundary.

  /// @return plaintext bytes OpenSSL accepted during this call.

  std::size_t FlushPendingWrites() {

    std::size_t progress = 0;

    while (!failed_ && pending_offset_ < pending_plaintext_.size()) {

      if (pending_write_end_ == 0) {

        // Freeze one write boundary until OpenSSL accepts it. WriteAll may

        // append the next scripted chunk after WANT_READ/WANT_WRITE, but the

        // retry contract permits only pointer relocation—not changed bytes or

        // length—for the outstanding SSL_write_ex call.

        pending_write_end_ = pending_plaintext_.size();

      }

      std::size_t written = 0;

      const int result = SSL_write_ex(ssl_, pending_plaintext_.data() + pending_offset_,

                                      pending_write_end_ - pending_offset_, &written);

      if (result == 1) {

        if (written == 0) {

          failed_ = true;

          break;

        }

        pending_offset_ += written;

        progress += written;

        if (pending_offset_ == pending_write_end_) {

          pending_write_end_ = 0;

        }

        continue;

      }

      const int error = SSL_get_error(ssl_, result);

      if (error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE) {

        if (context_ != nullptr) {

          context_->RecordWriteRetry();

        }

      } else {

        failed_ = true;

      }

      break;

    }

    if (pending_offset_ == pending_plaintext_.size()) {

      pending_plaintext_.clear();

      pending_offset_ = 0;

      pending_write_end_ = 0;

    }

    return progress;

  }

  SSL* ssl_;

  TlsServerContext* context_;

  std::string pending_plaintext_;

  std::size_t pending_offset_;

  /// Exclusive end of a write that OpenSSL may require us to retry exactly.

  std::size_t pending_write_end_;

  bool handshake_complete_;

  bool shutdown_requested_;

  bool write_shutdown_;

  bool failed_;

};

/// Emit one fixed clean-shutdown alert without completing a server handshake.

/// OpenSSL classifies this as SSL_ERROR_ZERO_RETURN with an empty error queue;

/// ignoring scripted response bytes keeps protobuf data out of the TLS record.

class TlsCloseNotifyConnection final : public MockConnection {

 public:

  TlsCloseNotifyConnection() : alert_sent_(false) {}

  bool WriteAll(const unsigned char* /*data*/, std::size_t /*size*/) override { return true; }

  void ShutdownWrite() override {

    if (alert_sent_) {

      return;

    }

    static constexpr unsigned char kCloseNotify[] = {

        0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00,

    };

    alert_sent_ = true;

    (void)MockConnection::WriteAll(kCloseNotify, sizeof(kCloseNotify));

    MockConnection::ShutdownWrite();

  }

 private:

  bool alert_sent_;

};

}  // namespace

/// Construct one reusable TLS context for a protocol-specific peer.

/// @param protocol Fixed ALPN application protocol offered by the server.

/// @param certificate_chain Certificate-chain profile presented to curl.

/// @param group_policy Immutable server key-exchange group policy.

/// @param handshake_profile Closed peer-side handshake terminal.

TlsMockTransport::TlsMockTransport(TlsApplicationProtocol protocol,

                                   curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain,

                                   TlsGroupPolicy group_policy,

                                   curl::fuzzer::proto::TlsHandshakeProfile handshake_profile)

    : group_policy_(group_policy),

      openssl_close_notify_(handshake_profile == curl::fuzzer::proto::TLS_HANDSHAKE_OPENSSL_CLOSE_NOTIFY &&

                            CurlClientUsesOpenSsl()),

      context_(std::make_unique<TlsServerContext>(protocol, certificate_chain, group_policy)) {}

TlsMockTransport::~TlsMockTransport() = default;

/// Install the stable local trust anchor and strict peer verification. Socket

/// callbacks remain owned by the protocol-specific server using this carrier.

/// @param easy Easy handle that will connect to this TLS transport.

void TlsMockTransport::Install(CURL* easy) const {

  struct curl_blob trust_anchor = {const_cast<char*>(tls_test_credentials::kCertificatePem),

                                   sizeof(tls_test_credentials::kCertificatePem) - 1, CURL_BLOB_NOCOPY};

  (void)curl_easy_setopt(easy, CURLOPT_CAINFO_BLOB, &trust_anchor);

  (void)curl_easy_setopt(easy, CURLOPT_SSL_VERIFYPEER, 1L);

  (void)curl_easy_setopt(easy, CURLOPT_SSL_VERIFYHOST, 2L);

}

/// Wrap one socketpair server endpoint in an OpenSSL acceptor.

/// @return A failed connection when context setup was unavailable.

std::unique_ptr<MockConnection> TlsMockTransport::CreateConnection() {

  if (openssl_close_notify_) {

    return std::make_unique<TlsCloseNotifyConnection>();

  }

  return std::make_unique<TlsMockConnection>(context_.get());

}

/// @return Protocol version selected by the most recent handshake, or zero.

int TlsMockTransport::negotiated_tls_version() const {

  return context_ == nullptr ? 0 : context_->negotiated_tls_version();

}

/// @return Number of connections that completed TLS negotiation.

std::size_t TlsMockTransport::completed_handshake_count() const {

  return context_ == nullptr ? 0 : context_->completed_handshake_count();

}

/// @return Number of completed connections that resumed a cached session.

std::size_t TlsMockTransport::reused_session_count() const {

  return context_ == nullptr ? 0 : context_->reused_session_count();

}

/// @return Number of application writes OpenSSL required an exact retry for.

std::size_t TlsMockTransport::write_retry_count() const {

  return context_ == nullptr ? 0 : context_->write_retry_count();

}

/// @return ALPN protocol selected by the most recent handshake.

std::string TlsMockTransport::negotiated_alpn() const {

  return context_ == nullptr ? std::string() : context_->negotiated_alpn();

}

/// @return Immutable key-exchange group policy selected at construction.

TlsGroupPolicy TlsMockTransport::group_policy() const { return group_policy_; }

/// @return Key-exchange group from the most recent completed handshake.

std::string TlsMockTransport::negotiated_group() const {

  return context_ == nullptr ? std::string() : context_->negotiated_group();

}

/// @return OpenSSL's ECH result, or a negative sentinel when unavailable.

int TlsMockTransport::ech_status() const { return context_ == nullptr ? -1 : context_->ech_status(); }

/// @return Decrypted inner SNI recovered by the ECH-capable server.

std::string TlsMockTransport::ech_inner_name() const {

  return context_ == nullptr ? std::string() : context_->ech_inner_name();

}

/// @return Public outer SNI visible before ECH decryption.

std::string TlsMockTransport::ech_outer_name() const {

  return context_ == nullptr ? std::string() : context_->ech_outer_name();

}

/// Build one reusable in-process server context per fuzz iteration.

TlsMockServer::TlsMockServer() : TlsMockServer(curl::fuzzer::proto::TLS_CERTIFICATE_CHAIN_DEFAULT_EC) {}

/// Select one bounded certificate-chain profile for an HTTP/1.1 TLS peer.

/// @param certificate_chain Peer certificate chain presented to curl.

/// @param handshake_profile Closed peer-side handshake terminal.

TlsMockServer::TlsMockServer(curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain,

                             curl::fuzzer::proto::TlsHandshakeProfile handshake_profile)

    : TlsMockServer(TlsApplicationProtocol::kHttp11, certificate_chain, TlsGroupPolicy::kProviderDefault,

                    handshake_profile) {}

/// Construct the shared TLS transport for a protocol-specific derived peer

/// with one fixed ALPN outcome.

/// @param protocol Fixed application protocol the server must negotiate.

/// @param certificate_chain Peer certificate chain presented to curl.

/// @param group_policy Immutable server key-exchange group policy.

/// @param handshake_profile Closed peer-side handshake terminal.

TlsMockServer::TlsMockServer(TlsApplicationProtocol protocol,

                             curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain,

                             TlsGroupPolicy group_policy, curl::fuzzer::proto::TlsHandshakeProfile handshake_profile)

    : transport_(protocol, certificate_chain, group_policy, handshake_profile),

      saw_live_tls_session_(false),

      session_export_attempt_count_(0),

      exported_session_count_(0),

      imported_session_count_(0) {}

/// Release SSL objects before their owning server context. OpenSSL reference

/// counting makes the reverse order legal, but making the ownership order

/// explicit keeps future transport state from acquiring a hidden dependency.

TlsMockServer::~TlsMockServer() { ResetConnections(); }

/// Install common socket callbacks and a stable local trust anchor. Curl copies

/// the blob descriptor during setopt and borrows the inline certificate bytes,

/// whose program lifetime safely exceeds every easy handle. Scenario options run

/// afterwards and can still disable verification or select failing TLS settings.

/// @param easy Easy handle that will connect to this TLS peer.

void TlsMockServer::Install(CURL* easy) {

  MockServer::Install(easy);

  transport_.Install(easy);

}

/// @return true once curl exposed a live TLS backend session during drive.

bool TlsMockServer::saw_live_tls_session() const { return saw_live_tls_session_; }

/// @return number of session representations copied by the export callback

/// out of curl's cache.

std::size_t TlsMockServer::exported_session_count() const { return exported_session_count_; }

/// @return number of copied session representations successfully imported

/// into curl's cache again.

std::size_t TlsMockServer::imported_session_count() const { return imported_session_count_; }

/// @return protocol version selected by the most recent completed handshake,

/// or zero when no connection completed TLS negotiation.

int TlsMockServer::negotiated_tls_version() const { return transport_.negotiated_tls_version(); }

/// @return number of connections that completed TLS negotiation.

std::size_t TlsMockServer::completed_handshake_count() const { return transport_.completed_handshake_count(); }

/// @return number of completed connections that resumed an earlier session.

std::size_t TlsMockServer::reused_session_count() const { return transport_.reused_session_count(); }

/// @return number of application writes OpenSSL required an exact retry for.

std::size_t TlsMockServer::write_retry_count() const { return transport_.write_retry_count(); }

/// @return ALPN protocol selected by the most recent completed handshake.

std::string TlsMockServer::negotiated_alpn() const { return transport_.negotiated_alpn(); }

/// @return Immutable key-exchange group policy selected at construction.

TlsGroupPolicy TlsMockServer::group_policy() const { return transport_.group_policy(); }

/// @return Key-exchange group from the most recent completed handshake.

std::string TlsMockServer::negotiated_group() const { return transport_.negotiated_group(); }

/// @return OpenSSL's ECH status for the most recent completed handshake.

/// Builds without ECH return a negative sentinel.

int TlsMockServer::ech_status() const { return transport_.ech_status(); }

/// @return encrypted inner SNI recovered by the ECH-capable server.

std::string TlsMockServer::ech_inner_name() const { return transport_.ech_inner_name(); }

/// @return public outer SNI visible before ECH decryption.

std::string TlsMockServer::ech_outer_name() const { return transport_.ech_outer_name(); }

/// Wrap one socketpair server endpoint in an OpenSSL acceptor consumed by

/// MockServer.

/// @return a failed connection when context setup was unavailable.

std::unique_ptr<MockConnection> TlsMockServer::CreateConnection() { return transport_.CreateConnection(); }

/// Query while the connection filters are attached. Result-info probes stop

/// after the first live result, and session export has its own fixed attempt

/// bound, so neither recurs throughout every HTTP parser iteration.

/// @param easy Active easy handle whose connection filters remain attached.

void TlsMockServer::ObserveActiveTransfer(CURL* easy) {

  if (!saw_live_tls_session_) {

    long verify_result = 0;

    curl_off_t appconnect_time = 0;

    struct curl_certinfo* certificate_info = nullptr;

    struct curl_tlssessioninfo* tls_session = nullptr;

    (void)curl_easy_getinfo(easy, CURLINFO_SSL_VERIFYRESULT, &verify_result);

    (void)curl_easy_getinfo(easy, CURLINFO_APPCONNECT_TIME_T, &appconnect_time);

    (void)curl_easy_getinfo(easy, CURLINFO_CERTINFO, &certificate_info);

    if (curl_easy_getinfo(easy, CURLINFO_TLS_SSL_PTR, &tls_session) == CURLE_OK && tls_session != nullptr &&

        tls_session->internals != nullptr) {

      saw_live_tls_session_ = true;

    }

  }

  // A TLS 1.3 ticket may arrive after the peer first completes its handshake.

  // Retry only a small fixed number of outer-loop observations, and stop

  // permanently once one copied ticket has made one import attempt.

  const bool completed_live_handshake = transport_.completed_handshake_count() != 0;

#if defined(PROTO_FUZZER_OBSERVE_STATE)

  // Read the owned peer observations once after a real handshake. Signed

  // status values retain their unavailable sentinels; string results are

  // consumed immediately while their temporaries and context are still live.

  static bool observed = false;

  if (completed_live_handshake && !observed) {

    observed = true;

    const volatile bool live = saw_live_tls_session();

    const volatile int status[] = {negotiated_tls_version(), ech_status()};

    const volatile std::size_t counts[] = {

        exported_session_count(),  imported_session_count(), completed_handshake_count(),

        reused_session_count(),    write_retry_count(),      negotiated_alpn().size(),

        negotiated_group().size(), ech_inner_name().size(),  ech_outer_name().size()};

    (void)live;

    (void)status;

    (void)counts;

  }

#endif

  if (!completed_live_handshake || exported_session_count_ != 0 ||

      session_export_attempt_count_ >= kMaxSessionExportAttempts) {

    return;

  }

  ++session_export_attempt_count_;

  ExportedSession exported;

  const CURLcode export_result = curl_easy_ssls_export(easy, &CaptureExportedSession, &exported);

  if (export_result != CURLE_OK || exported.session_data.empty()) {

    return;

  }

  ++exported_session_count_;

  // curl holds the SSL session-cache lock throughout CaptureExportedSession.

  // This deliberately separate call therefore exercises import without

  // recursive API use or retaining any callback-owned pointer.

  if (curl_easy_ssls_import(easy, nullptr, exported.salted_hash.data(), exported.salted_hash.size(),

                            exported.session_data.data(), exported.session_data.size()) == CURLE_OK) {

    ++imported_session_count_;

  }

}

}  // namespace proto_fuzzer