/*
    * Copyright 2014 The Netty Project
    *
    * The Netty Project licenses this file to you under the Apache License,
    * version 2.0 (the "License"); you may not use this file except in compliance
    * with the License. You may obtain a copy of the License at:
    *
    *   https://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
   * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
   * License for the specific language governing permissions and limitations
   * under the License.
   */
  
  package io.netty.handler.proxy;
  
  import io.netty.channel.ChannelHandlerContext;
  import io.netty.channel.ChannelPipeline;
  import io.netty.handler.codec.socksx.v5.DefaultSocks5InitialRequest;
  import io.netty.handler.codec.socksx.v5.DefaultSocks5CommandRequest;
  import io.netty.handler.codec.socksx.v5.DefaultSocks5PasswordAuthRequest;
  import io.netty.handler.codec.socksx.v5.Socks5AddressType;
  import io.netty.handler.codec.socksx.v5.Socks5AuthMethod;
  import io.netty.handler.codec.socksx.v5.Socks5InitialRequest;
  import io.netty.handler.codec.socksx.v5.Socks5InitialResponse;
  import io.netty.handler.codec.socksx.v5.Socks5InitialResponseDecoder;
  import io.netty.handler.codec.socksx.v5.Socks5ClientEncoder;
  import io.netty.handler.codec.socksx.v5.Socks5CommandResponse;
  import io.netty.handler.codec.socksx.v5.Socks5CommandResponseDecoder;
  import io.netty.handler.codec.socksx.v5.Socks5CommandStatus;
  import io.netty.handler.codec.socksx.v5.Socks5CommandType;
  import io.netty.handler.codec.socksx.v5.Socks5PasswordAuthResponse;
  import io.netty.handler.codec.socksx.v5.Socks5PasswordAuthResponseDecoder;
  import io.netty.handler.codec.socksx.v5.Socks5PasswordAuthStatus;
  import io.netty.util.NetUtil;
  import io.netty.util.internal.StringUtil;
  
  import java.net.InetSocketAddress;
  import java.net.SocketAddress;
  import java.util.Arrays;
  import java.util.Collections;
  
  public final class Socks5ProxyHandler extends ProxyHandler {
  
      private static final String PROTOCOL = "socks5";
      private static final String AUTH_PASSWORD = "password";
  
      private static final Socks5InitialRequest INIT_REQUEST_NO_AUTH =
              new DefaultSocks5InitialRequest(Collections.singletonList(Socks5AuthMethod.NO_AUTH));
  
      private static final Socks5InitialRequest INIT_REQUEST_PASSWORD =
              new DefaultSocks5InitialRequest(Arrays.asList(Socks5AuthMethod.NO_AUTH, Socks5AuthMethod.PASSWORD));
  
      private final String username;
      private final String password;
  
      private String decoderName;
      private String encoderName;
  
      public Socks5ProxyHandler(SocketAddress proxyAddress) {
          this(proxyAddress, null, null);
      }
  
      public Socks5ProxyHandler(SocketAddress proxyAddress, String username, String password) {
          super(proxyAddress);
          if (username != null && username.isEmpty()) {
              username = null;
          }
          if (password != null && password.isEmpty()) {
              password = null;
          }
          this.username = username;
          this.password = password;
      }
  
      @Override
      public String protocol() {
          return PROTOCOL;
      }
  
      @Override
      public String authScheme() {
          return socksAuthMethod() == Socks5AuthMethod.PASSWORD? AUTH_PASSWORD : AUTH_NONE;
      }
  
      public String username() {
          return username;
      }
  
      public String password() {
          return password;
      }
  
      @Override
      protected void addCodec(ChannelHandlerContext ctx) throws Exception {
          ChannelPipeline p = ctx.pipeline();
          String name = ctx.name();
 
         Socks5InitialResponseDecoder decoder = new Socks5InitialResponseDecoder();
         p.addBefore(name, null, decoder);
 
         decoderName = p.context(decoder).name();
         encoderName = decoderName + ".encoder";
 
         p.addBefore(name, encoderName, Socks5ClientEncoder.DEFAULT);
     }
 
     @Override
     protected void removeEncoder(ChannelHandlerContext ctx) throws Exception {
         ctx.pipeline().remove(encoderName);
     }
 
     @Override
     protected void removeDecoder(ChannelHandlerContext ctx) throws Exception {
         ChannelPipeline p = ctx.pipeline();
         if (p.context(decoderName) != null) {
             p.remove(decoderName);
         }
     }
 
     @Override
     protected Object newInitialMessage(ChannelHandlerContext ctx) throws Exception {
         return socksAuthMethod() == Socks5AuthMethod.PASSWORD? INIT_REQUEST_PASSWORD : INIT_REQUEST_NO_AUTH;
     }
 
     @Override
     protected boolean handleResponse(ChannelHandlerContext ctx, Object response) throws Exception {
         if (response instanceof Socks5InitialResponse) {
             Socks5InitialResponse res = (Socks5InitialResponse) response;
             Socks5AuthMethod authMethod = socksAuthMethod();
 
             if (res.authMethod() != Socks5AuthMethod.NO_AUTH && res.authMethod() != authMethod) {
                 // Server did not allow unauthenticated access nor accept the requested authentication scheme.
                 throw new ProxyConnectException(exceptionMessage("unexpected authMethod: " + res.authMethod()));
             }
 
             if (authMethod == Socks5AuthMethod.NO_AUTH) {
                 sendConnectCommand(ctx);
             } else if (authMethod == Socks5AuthMethod.PASSWORD) {
                 // In case of password authentication, send an authentication request.
                 ctx.pipeline().replace(decoderName, decoderName, new Socks5PasswordAuthResponseDecoder());
                 sendToProxyServer(new DefaultSocks5PasswordAuthRequest(
                         username != null? username : "", password != null? password : ""));
             } else {
                 // Should never reach here.
                 throw new Error();
             }
 
             return false;
         }
 
         if (response instanceof Socks5PasswordAuthResponse) {
             // Received an authentication response from the server.
             Socks5PasswordAuthResponse res = (Socks5PasswordAuthResponse) response;
             if (res.status() != Socks5PasswordAuthStatus.SUCCESS) {
                 throw new ProxyConnectException(exceptionMessage("authStatus: " + res.status()));
             }
 
             sendConnectCommand(ctx);
             return false;
         }
 
         // This should be the last message from the server.
         Socks5CommandResponse res = (Socks5CommandResponse) response;
         if (res.status() != Socks5CommandStatus.SUCCESS) {
             throw new ProxyConnectException(exceptionMessage("status: " + res.status()));
         }
 
         return true;
     }
 
     private Socks5AuthMethod socksAuthMethod() {
         Socks5AuthMethod authMethod;
         if (username == null && password == null) {
             authMethod = Socks5AuthMethod.NO_AUTH;
         } else {
             authMethod = Socks5AuthMethod.PASSWORD;
         }
         return authMethod;
     }
 
     private void sendConnectCommand(ChannelHandlerContext ctx) throws Exception {
         InetSocketAddress raddr = destinationAddress();
         Socks5AddressType addrType;
         String rhost;
         if (raddr.isUnresolved()) {
             addrType = Socks5AddressType.DOMAIN;
             rhost = raddr.getHostString();
         } else {
             rhost = raddr.getAddress().getHostAddress();
             if (NetUtil.isValidIpV4Address(rhost)) {
                 addrType = Socks5AddressType.IPv4;
             } else if (NetUtil.isValidIpV6Address(rhost)) {
                 addrType = Socks5AddressType.IPv6;
             } else {
                 throw new ProxyConnectException(
                         exceptionMessage("unknown address type: " + StringUtil.simpleClassName(rhost)));
             }
         }
 
         ctx.pipeline().replace(decoderName, decoderName, new Socks5CommandResponseDecoder());
         sendToProxyServer(new DefaultSocks5CommandRequest(Socks5CommandType.CONNECT, addrType, rhost, raddr.getPort()));
     }
 }