// Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.jrt;

import com.yahoo.security.KeyStoreBuilder;
import com.yahoo.security.KeyUtils;
import com.yahoo.security.SslContextBuilder;
import com.yahoo.security.X509CertificateBuilder;
import com.yahoo.security.tls.TlsContext;
import com.yahoo.security.tls.authz.PeerAuthorizerTrustManager.Mode;
import com.yahoo.security.tls.authz.PeerAuthorizerTrustManagersFactory;
import com.yahoo.security.tls.policy.AuthorizedPeers;
import com.yahoo.security.tls.policy.HostGlobPattern;
import com.yahoo.security.tls.policy.PeerPolicy;
import com.yahoo.security.tls.policy.RequiredPeerCredential;
import com.yahoo.security.tls.policy.RequiredPeerCredential.Field;
import com.yahoo.security.tls.policy.Role;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
import javax.security.auth.x500.X500Principal;
import java.security.KeyPair;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import java.time.Instant;

import static com.yahoo.security.KeyAlgorithm.RSA;
import static com.yahoo.security.KeyStoreType.PKCS12;
import static com.yahoo.security.SignatureAlgorithm.SHA256_WITH_RSA;
import static com.yahoo.security.X509CertificateBuilder.generateRandomSerialNumber;
import static java.time.Instant.EPOCH;
import static java.time.temporal.ChronoUnit.DAYS;
import static java.util.Collections.singleton;
import static java.util.Collections.singletonList;

/**
 * @author bjorncs
 */
class CryptoUtils {
    static final SSLContext testSslContext = createTestSslContext();

    static TlsContext createTestTlsContext() {
        return new StaticTlsContext(testSslContext);
    }

    // TODO Use EC. Java/JSSE is currently unable to find compatible ciphers when using elliptic curve crypto from BouncyCastle
    static SSLContext createTestSslContext() {
        KeyPair keyPair = KeyUtils.generateKeypair(RSA);

        X509Certificate certificate = X509CertificateBuilder
                .fromKeypair(keyPair, new X500Principal("CN=dummy"), EPOCH, Instant.now().plus(1, DAYS), SHA256_WITH_RSA, generateRandomSerialNumber())
                .build();

        KeyStore trustStore = KeyStoreBuilder.withType(PKCS12)
                .withCertificateEntry("self-signed", certificate)
                .build();


        return new SslContextBuilder()
                .withTrustStore(trustStore)
                .withKeyStore(keyPair.getPrivate(), certificate)
                .withTrustManagerFactory(new PeerAuthorizerTrustManagersFactory(createAuthorizedPeers(), Mode.ENFORCE))
                .build();
    }

    private static AuthorizedPeers createAuthorizedPeers() {
        return new AuthorizedPeers(
                singleton(
                        new PeerPolicy(
                                "dummy-policy",
                                singleton(
                                        new Role("dummy-role")),
                                singletonList(
                                        new RequiredPeerCredential(
                                                Field.CN, new HostGlobPattern("dummy"))))));
    }

    private static class StaticTlsContext implements TlsContext {

        final SSLContext sslContext;

        StaticTlsContext(SSLContext sslContext) {
            this.sslContext = sslContext;
        }

        @Override
        public SSLEngine createSslEngine() {
            return sslContext.createSSLEngine();
        }

    }
}

@@ -169,101 +169,13 @@
 .Key
-StoreBuilder;%0Aimport com.yahoo.security.KeyUtils;%0Aimport com.yahoo.security.SslContextBuilder
+Utils
 ;%0Aim
@@ -218,24 +218,73 @@
 ateBuilder;%0A
+import com.yahoo.security.tls.DefaultTlsContext;%0A
 import com.y
@@ -386,80 +386,8 @@
 de;%0A
-import com.yahoo.security.tls.authz.PeerAuthorizerTrustManagersFactory;%0A
 impo
@@ -715,73 +715,8 @@
 e;%0A%0A
-import javax.net.ssl.SSLContext;%0Aimport javax.net.ssl.SSLEngine;%0A
 impo
@@ -792,39 +792,8 @@
 ir;%0A
-import java.security.KeyStore;%0A
 impo
@@ -913,62 +913,8 @@
 SA;%0A
-import static com.yahoo.security.KeyStoreType.PKCS12;%0A
 impo
@@ -1281,209 +1281,8 @@
  */%0A
-class CryptoUtils %7B%0A    static final SSLContext testSslContext = createTestSslContext();%0A%0A    static TlsContext createTestTlsContext() %7B%0A        return new StaticTlsContext(testSslContext);%0A    %7D%0A%0A    
 // T
@@ -1405,62 +1405,45 @@
 tle%0A
-    static SSLContext createTestSslContext()
+class CryptoUtils
  %7B%0A
+%0A
     
-   
+static final
  Key
@@ -1493,19 +1493,28 @@
 );%0A%0A    
-   
+static final
  X509Cer
@@ -1559,20 +1559,16 @@
 Builder%0A
-    
         
@@ -1711,36 +1711,32 @@
 ())%0A            
- 
-   
 .build();%0A%0A     
@@ -1738,480 +1738,20 @@
     
-    KeyStore trustStore = KeyStoreBuilder.withType(PKCS12)%0A                .withCertificateEntry(%22self-signed%22, certificate)%0A                .build();%0A%0A%0A        return new SslContextBuilder()%0A                .withTrustStore(trustStore)%0A                .withKeyStore(keyPair.getPrivate(), certificate)%0A                .withTrustManagerFactory(new PeerAuthorizerTrustManagersFactory(createAuthorizedPeers(), Mode.ENFORCE))%0A                .build();%0A    %7D%0A%0A    private 
 static
+ final
  Aut
@@ -1767,15 +1767,9 @@
 ers 
-createA
+a
 utho
@@ -1782,27 +1782,10 @@
 eers
-() %7B%0A        return
+ =
  new
@@ -1806,36 +1806,32 @@
 rs(%0A            
- 
-   
 singleton(%0A     
@@ -1817,36 +1817,32 @@
      singleton(%0A
-    
                 
@@ -1889,20 +1889,16 @@
         
-  
-  
 %22dummy-p
@@ -1925,36 +1925,32 @@
                 
-    
 singleton(%0A     
@@ -1976,28 +1976,24 @@
             
-   
- 
 new Role(%22du
@@ -2025,36 +2025,32 @@
                 
-    
 singletonList(%0A 
@@ -2048,20 +2048,16 @@
 onList(%0A
-    
         
@@ -2156,20 +2156,16 @@
         
-    
 Field.CN
@@ -2205,68 +2205,41 @@
 ));%0A
-    %7D%0A%0A    private static class StaticTlsContext implements 
+%0A    static TlsContext createTest
 TlsC
@@ -2248,20 +2248,21 @@
 text
+()
  %7B%0A
-%0A
         
 fina
@@ -2261,268 +2261,152 @@
     
-final SSLContext sslContext;%0A%0A        StaticTlsContext(SSLContext sslContext) %7B%0A            this.sslContext = sslContext;%0A        %7D%0A%0A        @Override%0A        public SSLEngine createSslEngine() %7B%0A            return sslContext.createSSLEngine(
+return new DefaultTlsContext(singletonList(certificate), keyPair.getPrivate(), singletonList(certificate), authorizedPeers, Mode.ENFORCE
 );%0A    
-  
-  %7D%0A%0A    
 %7D
+%0A
 %0A%7D%0A

Use DefaultTlsContext in jrt unit tests