// Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.jrt;

import com.yahoo.security.SslContextBuilder;
import com.yahoo.security.X509CertificateUtils;
import com.yahoo.security.tls.TransportSecurityOptions;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
import java.io.IOException;
import java.io.UncheckedIOException;
import java.nio.channels.SocketChannel;
import java.nio.file.Files;
import java.security.cert.X509Certificate;
import java.util.List;

/**
 * A {@link CryptoSocket} that creates {@link TlsCryptoSocket} instances.
 *
 * @author bjorncs
 */
public class TlsCryptoEngine implements CryptoEngine {

    private final SSLContext sslContext;

    public TlsCryptoEngine(SSLContext sslContext) {
        this.sslContext = sslContext;
    }

    public TlsCryptoEngine(TransportSecurityOptions options) {
        this(createSslContext(options));
    }

    @Override
    public TlsCryptoSocket createCryptoSocket(SocketChannel channel, boolean isServer)  {
        SSLEngine sslEngine = sslContext.createSSLEngine();
        sslEngine.setNeedClientAuth(true);
        sslEngine.setUseClientMode(!isServer);
        return new TlsCryptoSocket(channel, sslEngine);
    }

    private static SSLContext createSslContext(TransportSecurityOptions options) {
        return new SslContextBuilder()
                .withTrustStore(options.getCaCertificatesFile())
                .withKeyStore(options.getPrivateKeyFile(), options.getCertificatesFile())
                .build();
    }
}

@@ -185,56 +185,8 @@
 er;%0A
-import com.yahoo.security.X509CertificateUtils;%0A
 impo
@@ -307,73 +307,8 @@
 ne;%0A
-import java.io.IOException;%0Aimport java.io.UncheckedIOException;%0A
 impo
@@ -359,21 +359,18 @@
 ava.
-nio.file.File
+util.Array
 s;%0Ai
@@ -384,37 +384,47 @@
 ava.
-security.cert.X509Certificate
+util.Collections;%0Aimport java.util.List
 ;%0Aim
@@ -438,20 +438,30 @@
 va.util.
-List
+logging.Logger
 ;%0A%0A/**%0A 
@@ -631,126 +631,452 @@
 ate 
-final SSLContext sslContext;%0A%0A    public TlsCryptoEngine(SSLContext sslContext) %7B%0A        this.sslContext = sslContext
+static final Logger log = Logger.getLogger(TlsCryptoEngine.class.getName());%0A%0A    private final SSLContext sslContext;%0A    private final List%3CString%3E acceptedCiphers;%0A%0A    public TlsCryptoEngine(SSLContext sslContext) %7B%0A        this(sslContext, Collections.emptyList());%0A    %7D%0A%0A    public TlsCryptoEngine(SSLContext sslContext, List%3CString%3E acceptedCiphers) %7B%0A        this.sslContext = sslContext;%0A        this.acceptedCiphers = acceptedCiphers
 ;%0A  
@@ -1181,16 +1181,46 @@
 options)
+, options.getAcceptedCiphers()
 );%0A    %7D
@@ -1397,89 +1397,346 @@
     
-sslEngine.setNeedClientAuth(true);%0A        sslEngine.setUseClientMode(!isServer);
+log.fine(() -%3E String.format(%22Supported ciphers: %25s%22, Arrays.toString(sslEngine.getSupportedCipherSuites())));%0A        sslEngine.setNeedClientAuth(true);%0A        sslEngine.setUseClientMode(!isServer);%0A        if (!acceptedCiphers.isEmpty()) %7B%0A            sslEngine.setEnabledCipherSuites(acceptedCiphers.toArray(new String%5B0%5D));%0A        %7D
 %0A   

Allow configuration of accepted ciphers