// Copyright Verizon Media. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.jdisc.http.server.jetty;

import javax.net.ssl.SSLHandshakeException;
import java.util.Optional;
import java.util.function.Predicate;
import java.util.regex.Pattern;

/**
 * Categorizes instances of {@link SSLHandshakeException}
 *
 * @author bjorncs
 */
enum SslHandshakeFailure {
    INCOMPATIBLE_PROTOCOLS(
            MetricDefinitions.SSL_HANDSHAKE_FAILURE_INCOMPATIBLE_PROTOCOLS,
            "(Client requested protocol \\S+? is not enabled or supported in server context" +
                    "|The client supported protocol versions \\[\\S+?\\] are not accepted by server preferences \\[\\S+?\\])"),
    INCOMPATIBLE_CIPHERS(
            MetricDefinitions.SSL_HANDSHAKE_FAILURE_INCOMPATIBLE_CIPHERS,
            "no cipher suites in common"),
    MISSING_CLIENT_CERT(
            MetricDefinitions.SSL_HANDSHAKE_FAILURE_MISSING_CLIENT_CERT,
            "Empty server certificate chain"),
    EXPIRED_CLIENT_CERTIFICATE(
            MetricDefinitions.SSL_HANDSHAKE_FAILURE_EXPIRED_CLIENT_CERT,
            // Note: this pattern will match certificates with too late notBefore as well
            "PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed"),
    INVALID_CLIENT_CERT(
            MetricDefinitions.SSL_HANDSHAKE_FAILURE_INVALID_CLIENT_CERT, // Includes mismatch of client certificate and private key
            "(PKIX path (building|validation) failed: .+)|(Invalid CertificateVerify signature)");

    private final String metricName;
    private final Predicate<String> messageMatcher;

    SslHandshakeFailure(String metricName, String messagePattern) {
        this.metricName = metricName;
        this.messageMatcher = Pattern.compile(messagePattern).asMatchPredicate();
    }

    String metricName() { return metricName; }

    static Optional<SslHandshakeFailure> fromSslHandshakeException(SSLHandshakeException exception) {
        String message = exception.getMessage();
        if (message == null || message.isBlank()) return Optional.empty();
        for (SslHandshakeFailure failure : values()) {
            if (failure.messageMatcher.test(message)) {
                return Optional.of(failure);
            }
        }
        return Optional.empty();
    }
}

@@ -510,16 +510,61 @@
 TOCOLS,%0A
+            %22INCOMPATIBLE_CLIENT_PROTOCOLS%22,%0A
         
@@ -878,16 +878,65 @@
 IPHERS,%0A
+            %22INCOMPATIBLE_CLIENT_CIPHER_SUITES%22,%0A
         
@@ -1060,32 +1060,74 @@
 NG_CLIENT_CERT,%0A
+            %22MISSING_CLIENT_CERTIFICATE%22,%0A
             %22Emp
@@ -1254,32 +1254,74 @@
 ED_CLIENT_CERT,%0A
+            %22EXPIRED_CLIENT_CERTIFICATE%22,%0A
             // N
@@ -1665,16 +1665,58 @@
 ate key%0A
+            %22INVALID_CLIENT_CERTIFICATE%22,%0A
         
@@ -1840,24 +1840,62 @@
 metricName;%0A
+    private final String failureType;%0A
     private 
@@ -1977,16 +1977,36 @@
 ricName,
+ String failureType,
  String 
@@ -2057,24 +2057,64 @@
 metricName;%0A
+        this.failureType = failureType;%0A
         this
@@ -2236,16 +2236,65 @@
 cName; %7D
+%0A    String failureType() %7B return failureType; %7D
 %0A%0A    st

Add 'type' to SslHandshakeFailure