'use strict';
const common = require('../common');
if (!common.hasCrypto)
  common.skip('missing crypto');

const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');

// This test ensures that `getProtocol` returns the right protocol
// from a TLS connection

const assert = require('assert');
const tls = require('tls');
const fixtures = require('../common/fixtures');
const fips3 = hasFIPS(3);

const clientConfigs = [
  {
    secureProtocol: 'TLSv1_method',
    version: 'TLSv1',
    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
  }, {
    secureProtocol: 'TLSv1_1_method',
    version: 'TLSv1.1',
    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
  }, {
    secureProtocol: 'TLSv1_2_method',
    version: 'TLSv1.2'
  },
];

const serverConfig = {
  // BoringSSL's library default minimum is TLSv1.2, so enable legacy versions
  // explicitly instead of relying on TLS_method's default minimum.
  ...(isBoringSSL ? { minVersion: 'TLSv1' } : { secureProtocol: 'TLS_method' }),
  key: fixtures.readKey('agent2-key.pem'),
  cert: fixtures.readKey('agent2-cert.pem')
};

serverConfig.ciphers = fips3 ?
  'ECDHE-RSA-AES256-GCM-SHA384' : isBoringSSL ? 'RSA' : 'RSA@SECLEVEL=0';

const expectedConnections = fips3 ? 1 : clientConfigs.length;
const server = tls.createServer(serverConfig, common.mustCall(expectedConnections));

if (fips3) {
  server.on('tlsClientError', common.mustCall((err) => {
    assert.ok([
      'ERR_SSL_NO_SUITABLE_DIGEST_ALGORITHM',
      'ERR_SSL_UNEXPECTED_MESSAGE',
    ].includes(err.code), err);
  }, 2));
}

server
.listen(0, common.localhostIPv4, common.mustCall(function() {
  let completed = 0;
  function done() {
    if (++completed === clientConfigs.length)
      server.close();
  }

  for (const v of clientConfigs) {
    const shouldConnect = !fips3 || v.version === 'TLSv1.2';
    const client = tls.connect({
      host: common.localhostIPv4,
      port: server.address().port,
      ciphers: v.ciphers,
      rejectUnauthorized: false,
      secureProtocol: v.secureProtocol
    }, shouldConnect ? common.mustCall(function() {
      assert.strictEqual(this.getProtocol(), v.version);
      this.on('end', common.mustCall());
      this.on('close', common.mustCall(function() {
        assert.strictEqual(this.getProtocol(), null);
        done();
      })).end();
    }) : common.mustNotCall());

    if (!shouldConnect) {
      client.on('error', common.mustCall((err) => assert(err.code)));
      client.on('close', common.mustCall(done));
    }
  }
}));