/*
* TLS Server
* (C) 2004-2011,2012,2016 Jack Lloyd
*     2016 Matthias Gierlings
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/internal/tls_server_impl_12.h>

#include <botan/ocsp.h>
#include <botan/tls_magic.h>
#include <botan/tls_messages.h>
#include <botan/tls_server.h>
#include <botan/tls_version.h>
#include <botan/internal/stl_util.h>
#include <botan/internal/tls_handshake_state.h>

namespace Botan::TLS {

class Server_Handshake_State final : public Handshake_State {
   public:
      Server_Handshake_State(std::unique_ptr<Handshake_IO> io, Callbacks& cb) : Handshake_State(std::move(io), cb) {}

      Private_Key* server_rsa_kex_key() { return m_server_rsa_kex_key.get(); }

      void set_server_rsa_kex_key(std::shared_ptr<Private_Key> key) { m_server_rsa_kex_key = std::move(key); }

      bool allow_session_resumption() const { return m_allow_session_resumption; }

      void set_allow_session_resumption(bool allow_session_resumption) {
         m_allow_session_resumption = allow_session_resumption;
      }

      const std::vector<X509_Certificate>& resume_peer_certs() const { return m_resume_peer_certs; }

      void set_resume_certs(const std::vector<X509_Certificate>& certs) { m_resume_peer_certs = certs; }

      void mark_as_resumption() { m_is_a_resumption = true; }

      bool is_a_resumption() const { return m_is_a_resumption; }

   private:
      // Used by the server only, in case of RSA key exchange.
      std::shared_ptr<Private_Key> m_server_rsa_kex_key;

      /*
      * Used by the server to know if resumption should be allowed on
      * a server-initiated renegotiation
      */
      bool m_allow_session_resumption = true;

      bool m_is_a_resumption = false;

      std::vector<X509_Certificate> m_resume_peer_certs;
};

namespace {

std::optional<Session> check_for_resume(const Session_Handle& handle_to_resume,
                                        Session_Manager& session_manager,
                                        Callbacks& cb,
                                        const Policy& policy,
                                        const Client_Hello_12* client_hello) {
   auto session = session_manager.retrieve(handle_to_resume, cb, policy);
   if(!session.has_value()) {
      return std::nullopt;
   }

   // wrong version
   if(client_hello->legacy_version() != session->version()) {
      return std::nullopt;
   }

   // client didn't send original ciphersuite
   if(!value_exists(client_hello->ciphersuites(), session->ciphersuite_code())) {
      return std::nullopt;
   }

   // client sent a different SNI hostname
   if(!client_hello->sni_hostname().empty() && client_hello->sni_hostname() != session->server_info().hostname()) {
      return std::nullopt;
   }

   // Checking extended_master_secret on resume (RFC 7627 section 5.3)
   if(client_hello->supports_extended_master_secret() != session->supports_extended_master_secret()) {
      if(!session->supports_extended_master_secret()) {
         return std::nullopt;  // force new handshake with extended master secret
      } else {
         /*
         Client previously negotiated session with extended master secret,
         but has now attempted to resume without the extension: abort
         */
         throw TLS_Exception(Alert::HandshakeFailure, "Client resumed extended ms session without sending extension");
      }
   }

   // Checking encrypt_then_mac on resume (RFC 7366 section 3.1)
   if(!client_hello->supports_encrypt_then_mac() && session->supports_encrypt_then_mac()) {
      /*
      Client previously negotiated session with Encrypt-then-MAC,
      but has now attempted to resume without the extension: abort
      */
      throw TLS_Exception(Alert::HandshakeFailure, "Client resumed Encrypt-then-MAC session without sending extension");
   }

   return session;
}

/*
* Choose which ciphersuite to use
*/
uint16_t choose_ciphersuite(const Policy& policy,
                            Protocol_Version version,
                            const std::map<std::string, std::vector<X509_Certificate>>& cert_chains,
                            const Client_Hello_12& client_hello) {
   const bool our_choice = policy.server_uses_own_ciphersuite_preferences();
   const std::vector<uint16_t>& client_suites = client_hello.ciphersuites();
   const std::vector<uint16_t> server_suites = policy.ciphersuite_list(version);

   if(server_suites.empty()) {
      throw TLS_Exception(Alert::HandshakeFailure, "Policy forbids us from negotiating any ciphersuite");
   }

   const bool have_shared_ecc_curve =
      (policy.choose_key_exchange_group(client_hello.supported_ecc_curves(), {}) != Group_Params::NONE);

   const bool client_supports_ffdhe_groups = !client_hello.supported_dh_groups().empty();

   const bool have_shared_dh_group =
      (policy.choose_key_exchange_group(client_hello.supported_dh_groups(), {}) != Group_Params::NONE);

   /*
   Walk down one list in preference order
   */
   std::vector<uint16_t> pref_list = server_suites;
   std::vector<uint16_t> other_list = client_suites;

   if(!our_choice) {
      std::swap(pref_list, other_list);
   }

   for(auto suite_id : pref_list) {
      if(!value_exists(other_list, suite_id)) {
         continue;
      }

      const auto suite = Ciphersuite::by_id(suite_id);

      if(!suite.has_value() || !suite->valid()) {
         continue;
      }

      if(have_shared_ecc_curve == false && suite->ecc_ciphersuite()) {
         continue;
      }

      if(suite->kex_method() == Kex_Algo::DH && client_supports_ffdhe_groups && !have_shared_dh_group) {
         continue;
      }

      // For non-anon ciphersuites
      if(suite->signature_used()) {
         const std::string sig_algo = suite->sig_algo();

         // Do we have any certificates for this sig?
         if(!cert_chains.contains(sig_algo)) {
            continue;
         }

         const std::vector<Signature_Scheme> allowed = policy.allowed_signature_schemes();

         std::vector<Signature_Scheme> client_sig_methods = client_hello.signature_schemes();

         /*
         Contrary to the wording of draft-ietf-tls-md5-sha1-deprecate we do
         not enforce that clients do not offer support SHA-1 or MD5
         signatures; we just ignore it.
         */
         bool we_support_some_hash_by_client = false;

         for(Signature_Scheme scheme : client_sig_methods) {
            if(!scheme.is_available()) {
               continue;
            }

            if(scheme.algorithm_name() == suite->sig_algo() &&
               policy.allowed_signature_hash(scheme.hash_function_name())) {
               we_support_some_hash_by_client = true;
            }
         }

         if(we_support_some_hash_by_client == false) {
            throw TLS_Exception(Alert::HandshakeFailure,
                                "Policy does not accept any hash function supported by client");
         }
      }

      return suite_id;
   }

   // RFC 7919 Section 4.
   //   If the [Supported Groups] extension is present
   //   with FFDHE groups, none of the client’s offered groups are acceptable
   //   by the server, and none of the client’s proposed non-FFDHE cipher
   //   suites are acceptable to the server, the server MUST end the
   //   connection with a fatal TLS alert of type insufficient_security(71).
   if(client_supports_ffdhe_groups && !have_shared_dh_group) {
      throw TLS_Exception(Alert::InsufficientSecurity, "Can't agree on a sufficiently strong ciphersuite with client");
   }

   throw TLS_Exception(Alert::HandshakeFailure, "Can't agree on a ciphersuite with client");
}

std::map<std::string, std::vector<X509_Certificate>> get_server_certs(
   std::string_view hostname, const std::vector<Signature_Scheme>& cert_sig_schemes, Credentials_Manager& creds) {
   const char* cert_types[] = {"RSA", "ECDSA", "DSA", nullptr};

   std::map<std::string, std::vector<X509_Certificate>> cert_chains;

   for(size_t i = 0; cert_types[i]; ++i) {
      const std::vector<X509_Certificate> certs = creds.cert_chain_single_type(
         cert_types[i], to_algorithm_identifiers(cert_sig_schemes), "tls-server", std::string(hostname));

      if(!certs.empty()) {
         cert_chains[cert_types[i]] = certs;
      }
   }

   return cert_chains;
}

}  // namespace

Server_Impl_12::Server_Impl_12(const std::shared_ptr<Callbacks>& callbacks,
                               const std::shared_ptr<Session_Manager>& session_manager,
                               const std::shared_ptr<Credentials_Manager>& creds,
                               const std::shared_ptr<const Policy>& policy,
                               const std::shared_ptr<RandomNumberGenerator>& rng,
                               bool is_datagram,
                               size_t io_buf_sz) :
      Channel_Impl_12(callbacks, session_manager, rng, policy, true, is_datagram, io_buf_sz), m_creds(creds) {
   BOTAN_ASSERT_NONNULL(m_creds);
}

Server_Impl_12::Server_Impl_12(const Channel_Impl::Downgrade_Information& downgrade_info) :
      Channel_Impl_12(downgrade_info.callbacks,
                      downgrade_info.session_manager,
                      downgrade_info.rng,
                      downgrade_info.policy,
                      true /* is_server*/,
                      false /* TLS 1.3 does not support DTLS yet */,
                      downgrade_info.io_buffer_size),
      m_creds(downgrade_info.creds) {}

std::unique_ptr<Handshake_State> Server_Impl_12::new_handshake_state(std::unique_ptr<Handshake_IO> io) {
   auto state = std::make_unique<Server_Handshake_State>(std::move(io), callbacks());
   state->set_expected_next(Handshake_Type::ClientHello);
   return state;
}

std::vector<X509_Certificate> Server_Impl_12::get_peer_cert_chain(const Handshake_State& state_base) const {
   const Server_Handshake_State& state = dynamic_cast<const Server_Handshake_State&>(state_base);
   if(!state.resume_peer_certs().empty()) {
      return state.resume_peer_certs();
   }

   if(state.client_certs()) {
      return state.client_certs()->cert_chain();
   }
   return std::vector<X509_Certificate>();
}

/*
* Send a hello request to the client
*/
void Server_Impl_12::initiate_handshake(Handshake_State& state, bool force_full_renegotiation) {
   dynamic_cast<Server_Handshake_State&>(state).set_allow_session_resumption(!force_full_renegotiation);

   Hello_Request hello_req(state.handshake_io());
}

namespace {

Protocol_Version select_version(const TLS::Policy& policy,
                                Protocol_Version client_offer,
                                Protocol_Version active_version,
                                const std::vector<Protocol_Version>& supported_versions) {
   const bool is_datagram = client_offer.is_datagram_protocol();
   const bool initial_handshake = (active_version.valid() == false);

   if(!supported_versions.empty()) {
      if(is_datagram) {
         if(policy.allow_dtls12() && value_exists(supported_versions, Protocol_Version(Protocol_Version::DTLS_V12))) {
            return Protocol_Version::DTLS_V12;
         }
         throw TLS_Exception(Alert::ProtocolVersion, "No shared DTLS version");
      } else {
         if(policy.allow_tls12() && value_exists(supported_versions, Protocol_Version(Protocol_Version::TLS_V12))) {
            return Protocol_Version::TLS_V12;
         }
         throw TLS_Exception(Alert::ProtocolVersion, "No shared TLS version");
      }
   }

   if(!initial_handshake) {
      /*
      * If this is a renegotiation, and the client has offered a
      * later version than what it initially negotiated, negotiate
      * the old version. This matches OpenSSL's behavior. If the
      * client is offering a version earlier than what it initially
      * negotiated, reject as a probable attack.
      */
      if(active_version > client_offer) {
         throw TLS_Exception(
            Alert::ProtocolVersion,
            "Client negotiated " + active_version.to_string() + " then renegotiated with " + client_offer.to_string());
      } else {
         return active_version;
      }
   }

   if(is_datagram) {
      if(policy.allow_dtls12() && client_offer >= Protocol_Version::DTLS_V12) {
         return Protocol_Version::DTLS_V12;
      }
   } else {
      if(policy.allow_tls12() && client_offer >= Protocol_Version::TLS_V12) {
         return Protocol_Version::TLS_V12;
      }
   }

   throw TLS_Exception(Alert::ProtocolVersion,
                       "Client version " + client_offer.to_string() + " is unacceptable by policy");
}
}  // namespace

/*
* Process a Client Hello Message
*/
void Server_Impl_12::process_client_hello_msg(const Handshake_State* active_state,
                                              Server_Handshake_State& pending_state,
                                              const std::vector<uint8_t>& contents,
                                              bool epoch0_restart) {
   BOTAN_ASSERT_IMPLICATION(epoch0_restart, active_state != nullptr, "Can't restart with a dead connection");

   const bool initial_handshake = epoch0_restart || !active_state;

   if(initial_handshake == false && policy().allow_client_initiated_renegotiation() == false) {
      if(policy().abort_connection_on_undesired_renegotiation()) {
         throw TLS_Exception(Alert::NoRenegotiation, "Server policy prohibits renegotiation");
      } else {
         send_warning_alert(Alert::NoRenegotiation);
      }
      return;
   }

   if(!policy().allow_insecure_renegotiation() && !(initial_handshake || secure_renegotiation_supported())) {
      send_warning_alert(Alert::NoRenegotiation);
      return;
   }

   if(pending_state.handshake_io().have_more_data()) {
      throw TLS_Exception(Alert::UnexpectedMessage, "Have data remaining in buffer after ClientHello");
   }

   pending_state.client_hello(new Client_Hello_12(contents));
   const Protocol_Version client_offer = pending_state.client_hello()->legacy_version();
   const bool datagram = client_offer.is_datagram_protocol();

   if(datagram) {
      if(client_offer.major_version() == 0xFF) {
         throw TLS_Exception(Alert::ProtocolVersion, "Client offered DTLS version with major version 0xFF");
      }
   } else {
      if(client_offer.major_version() < 3) {
         throw TLS_Exception(Alert::ProtocolVersion, "Client offered TLS version with major version under 3");
      }
      if(client_offer.major_version() == 3 && client_offer.minor_version() == 0) {
         throw TLS_Exception(Alert::ProtocolVersion, "Client offered SSLv3 which is not supported");
      }
   }

   /*
   * BoGo test suite expects that we will send the hello verify with a record
   * version matching the version that is eventually negotiated. This is wrong
   * but harmless, so go with it. Also doing the version negotiation step first
   * allows to immediately close the connection with an alert if the client has
   * offered a version that we are not going to negotiate anyway, instead of
   * making them first do the cookie exchange and then telling them no.
   *
   * There is no issue with amplification here, since the alert is just 2 bytes.
   */
   const Protocol_Version negotiated_version =
      select_version(policy(),
                     client_offer,
                     active_state ? active_state->version() : Protocol_Version(),
                     pending_state.client_hello()->supported_versions());

   pending_state.set_version(negotiated_version);

   const auto compression_methods = pending_state.client_hello()->compression_methods();
   if(!value_exists(compression_methods, uint8_t(0))) {
      throw TLS_Exception(Alert::IllegalParameter, "Client did not offer NULL compression");
   }

   if(initial_handshake && datagram) {
      SymmetricKey cookie_secret;

      try {
         cookie_secret = m_creds->psk("tls-server", "dtls-cookie-secret", "");
      } catch(...) {}

      if(!cookie_secret.empty()) {
         const std::string client_identity = callbacks().tls_peer_network_identity();
         Hello_Verify_Request verify(pending_state.client_hello()->cookie_input_data(), client_identity, cookie_secret);

         if(pending_state.client_hello()->cookie() != verify.cookie()) {
            if(epoch0_restart) {
               pending_state.handshake_io().send_under_epoch(verify, 0);
            } else {
               pending_state.handshake_io().send(verify);
            }

            pending_state.client_hello(static_cast<Client_Hello_12*>(nullptr));
            pending_state.set_expected_next(Handshake_Type::ClientHello);
            return;
         }
      } else if(epoch0_restart) {
         throw TLS_Exception(Alert::HandshakeFailure, "Reuse of DTLS association requires DTLS cookie secret be set");
      }
   }

   if(epoch0_restart) {
      // If we reached here then we were able to verify the cookie
      reset_active_association_state();
   }

   secure_renegotiation_check(pending_state.client_hello());

   callbacks().tls_examine_extensions(
      pending_state.client_hello()->extensions(), Connection_Side::Client, Handshake_Type::ClientHello);

   const auto session_handle = pending_state.client_hello()->session_handle();

   std::optional<Session> session_info;
   if(pending_state.allow_session_resumption() && session_handle.has_value()) {
      session_info = check_for_resume(
         session_handle.value(), session_manager(), callbacks(), policy(), pending_state.client_hello());
   }

   m_next_protocol = "";
   if(pending_state.client_hello()->supports_alpn()) {
      m_next_protocol = callbacks().tls_server_choose_app_protocol(pending_state.client_hello()->next_protocols());
   }

   if(session_info.has_value()) {
      this->session_resume(pending_state, {session_info.value(), session_handle.value()});
   } else {
      // new session
      this->session_create(pending_state);
   }
}

void Server_Impl_12::process_certificate_msg(Server_Handshake_State& pending_state,
                                             const std::vector<uint8_t>& contents) {
   pending_state.client_certs(new Certificate_12(contents, policy()));

   // CERTIFICATE_REQUIRED would make more sense but BoGo expects handshake failure alert
   if(pending_state.client_certs()->empty() && policy().require_client_certificate_authentication()) {
      throw TLS_Exception(Alert::HandshakeFailure, "Policy requires client send a certificate, but it did not");
   }

   pending_state.set_expected_next(Handshake_Type::ClientKeyExchange);
}

void Server_Impl_12::process_client_key_exchange_msg(Server_Handshake_State& pending_state,
                                                     const std::vector<uint8_t>& contents) {
   if(pending_state.received_handshake_msg(Handshake_Type::Certificate) && !pending_state.client_certs()->empty()) {
      pending_state.set_expected_next(Handshake_Type::CertificateVerify);
   } else {
      pending_state.set_expected_next(Handshake_Type::HandshakeCCS);
   }

   pending_state.client_kex(
      new Client_Key_Exchange(contents, pending_state, pending_state.server_rsa_kex_key(), *m_creds, policy(), rng()));

   pending_state.compute_session_keys();
   if(policy().allow_ssl_key_log_file()) {
      // draft-thomson-tls-keylogfile-00 Section 3.2
      //    An implementation of TLS 1.2 (and also earlier versions) use
      //    the label "CLIENT_RANDOM" to identify the "master" secret for
      //    the connection.
      callbacks().tls_ssl_key_log_data(
         "CLIENT_RANDOM", pending_state.client_hello()->random(), pending_state.session_keys().master_secret());
   }
}

void Server_Impl_12::process_change_cipher_spec_msg(Server_Handshake_State& pending_state) {
   pending_state.set_expected_next(Handshake_Type::Finished);
   change_cipher_spec_reader(Connection_Side::Server);
}

void Server_Impl_12::process_certificate_verify_msg(Server_Handshake_State& pending_state,
                                                    Handshake_Type type,
                                                    const std::vector<uint8_t>& contents) {
   pending_state.client_verify(new Certificate_Verify_12(contents));

   const std::vector<X509_Certificate>& client_certs = pending_state.client_certs()->cert_chain();

   if(client_certs.empty()) {
      throw TLS_Exception(Alert::DecodeError, "No client certificate sent");
   }

   if(!client_certs[0].allowed_usage(Key_Constraints::DigitalSignature)) {
      throw TLS_Exception(Alert::BadCertificate, "Client certificate does not support signing");
   }

   const bool sig_valid = pending_state.client_verify()->verify(client_certs[0], pending_state, policy());

   pending_state.hash().update(pending_state.handshake_io().format(contents, type));

   /*
   * Using DECRYPT_ERROR looks weird here, but per RFC 4346 is for
   * "A handshake cryptographic operation failed, including being
   * unable to correctly verify a signature, ..."
   */
   if(!sig_valid) {
      throw TLS_Exception(Alert::DecryptError, "Client cert verify failed");
   }

   try {
      const std::string sni_hostname = pending_state.client_hello()->sni_hostname();
      auto trusted_CAs = m_creds->trusted_certificate_authorities("tls-server", sni_hostname);

      callbacks().tls_verify_cert_chain(client_certs,
                                        {},  // ocsp
                                        trusted_CAs,
                                        Usage_Type::TLS_CLIENT_AUTH,
                                        sni_hostname,
                                        policy());
   } catch(std::exception& e) {
      throw TLS_Exception(Alert::BadCertificate, e.what());
   }

   pending_state.set_expected_next(Handshake_Type::HandshakeCCS);
}

void Server_Impl_12::process_finished_msg(Server_Handshake_State& pending_state,
                                          Handshake_Type type,
                                          const std::vector<uint8_t>& contents) {
   pending_state.set_expected_next(Handshake_Type::None);

   if(pending_state.handshake_io().have_more_data()) {
      throw TLS_Exception(Alert::UnexpectedMessage, "Have data remaining in buffer after Finished");
   }

   pending_state.client_finished(new Finished_12(contents));

   if(!pending_state.client_finished()->verify(pending_state, Connection_Side::Client)) {
      throw TLS_Exception(Alert::DecryptError, "Finished message didn't verify");
   }

   if(!pending_state.server_finished()) {
      // already sent finished if resuming, so this is a new session

      pending_state.hash().update(pending_state.handshake_io().format(contents, type));

      Session session_info(pending_state.session_keys().master_secret(),
                           pending_state.server_hello()->legacy_version(),
                           pending_state.server_hello()->ciphersuite(),
                           Connection_Side::Server,
                           pending_state.server_hello()->supports_extended_master_secret(),
                           pending_state.server_hello()->supports_encrypt_then_mac(),
                           get_peer_cert_chain(pending_state),
                           Server_Information(pending_state.client_hello()->sni_hostname()),
                           pending_state.server_hello()->srtp_profile(),
                           callbacks().tls_current_timestamp());

      // Give the application a chance for a final veto before fully
      // establishing the connection.
      callbacks().tls_session_established([&, this] {
         Session_Summary summary(session_info, pending_state.is_a_resumption(), external_psk_identity());
         summary.set_session_id(pending_state.server_hello()->session_id());
         return summary;
      }());

      if(callbacks().tls_should_persist_resumption_information(session_info)) {
         auto handle = session_manager().establish(session_info,
                                                   pending_state.server_hello()->session_id(),
                                                   !pending_state.server_hello()->supports_session_ticket());

         if(pending_state.server_hello()->supports_session_ticket() && handle.has_value() && handle->is_ticket()) {
            pending_state.new_session_ticket(new New_Session_Ticket_12(pending_state.handshake_io(),
                                                                       pending_state.hash(),
                                                                       handle->ticket().value(),
                                                                       policy().session_ticket_lifetime()));
         }
      }

      if(!pending_state.new_session_ticket() && pending_state.server_hello()->supports_session_ticket()) {
         pending_state.new_session_ticket(
            new New_Session_Ticket_12(pending_state.handshake_io(), pending_state.hash()));
      }

      pending_state.handshake_io().send(Change_Cipher_Spec());

      change_cipher_spec_writer(Connection_Side::Server);

      pending_state.server_finished(
         new Finished_12(pending_state.handshake_io(), pending_state, Connection_Side::Server));
   }

   activate_session();
}

/*
* Process a handshake message
*/
void Server_Impl_12::process_handshake_msg(const Handshake_State* active_state,
                                           Handshake_State& state_base,
                                           Handshake_Type type,
                                           const std::vector<uint8_t>& contents,
                                           bool epoch0_restart) {
   Server_Handshake_State& state = dynamic_cast<Server_Handshake_State&>(state_base);
   state.confirm_transition_to(type);

   /*
   * The change cipher spec message isn't technically a handshake
   * message so it's not included in the hash. The finished and
   * certificate verify messages are verified based on the current
   * state of the hash *before* this message so we delay adding them
   * to the hash computation until we've processed them below.
   */
   if(type != Handshake_Type::HandshakeCCS && type != Handshake_Type::Finished &&
      type != Handshake_Type::CertificateVerify) {
      state.hash().update(state.handshake_io().format(contents, type));
   }

   switch(type) {
      case Handshake_Type::ClientHello:
         return this->process_client_hello_msg(active_state, state, contents, epoch0_restart);

      case Handshake_Type::Certificate:
         return this->process_certificate_msg(state, contents);

      case Handshake_Type::ClientKeyExchange:
         return this->process_client_key_exchange_msg(state, contents);

      case Handshake_Type::CertificateVerify:
         return this->process_certificate_verify_msg(state, type, contents);

      case Handshake_Type::HandshakeCCS:
         return this->process_change_cipher_spec_msg(state);

      case Handshake_Type::Finished:
         return this->process_finished_msg(state, type, contents);

      default:
         throw Unexpected_Message("Unknown handshake message received");
   }
}

void Server_Impl_12::session_resume(Server_Handshake_State& pending_state, const Session_with_Handle& session) {
   // Only offer a resuming client a new ticket if they didn't send one this time,
   // ie, resumed via server-side resumption. TODO: also send one if expiring soon?

   const bool offer_new_session_ticket = pending_state.client_hello()->supports_session_ticket() &&
                                         pending_state.client_hello()->session_ticket().empty() &&
                                         session_manager().emits_session_tickets();

   pending_state.server_hello(new Server_Hello_12(pending_state.handshake_io(),
                                                  pending_state.hash(),
                                                  policy(),
                                                  callbacks(),
                                                  rng(),
                                                  secure_renegotiation_data_for_server_hello(),
                                                  *pending_state.client_hello(),
                                                  session.session,
                                                  offer_new_session_ticket,
                                                  m_next_protocol));

   secure_renegotiation_check(pending_state.server_hello());

   pending_state.mark_as_resumption();
   pending_state.compute_session_keys(session.session.master_secret());
   if(policy().allow_ssl_key_log_file()) {
      // draft-thomson-tls-keylogfile-00 Section 3.2
      //    An implementation of TLS 1.2 (and also earlier versions) use
      //    the label "CLIENT_RANDOM" to identify the "master" secret for
      //    the connection.
      callbacks().tls_ssl_key_log_data(
         "CLIENT_RANDOM", pending_state.client_hello()->random(), pending_state.session_keys().master_secret());
   }
   pending_state.set_resume_certs(session.session.peer_certs());

   // Give the application a chance for a final veto before fully
   // establishing the connection.
   callbacks().tls_session_established([&, this] {
      Session_Summary summary(session.session, pending_state.is_a_resumption(), external_psk_identity());
      summary.set_session_id(pending_state.server_hello()->session_id());
      if(auto ticket = session.handle.ticket()) {
         summary.set_session_ticket(std::move(ticket.value()));
      }
      return summary;
   }());

   auto new_handle = [&, this]() -> std::optional<Session_Handle> {
      if(!callbacks().tls_should_persist_resumption_information(session.session)) {
         session_manager().remove(session.handle);
         return std::nullopt;
      } else {
         return session_manager().establish(session.session, session.handle.id());
      }
   }();

   if(pending_state.server_hello()->supports_session_ticket()) {
      if(new_handle.has_value() && new_handle->is_ticket()) {
         pending_state.new_session_ticket(new New_Session_Ticket_12(pending_state.handshake_io(),
                                                                    pending_state.hash(),
                                                                    new_handle->ticket().value(),
                                                                    policy().session_ticket_lifetime()));
      } else {
         pending_state.new_session_ticket(
            new New_Session_Ticket_12(pending_state.handshake_io(), pending_state.hash()));
      }
   }

   pending_state.handshake_io().send(Change_Cipher_Spec());

   change_cipher_spec_writer(Connection_Side::Server);

   pending_state.server_finished(new Finished_12(pending_state.handshake_io(), pending_state, Connection_Side::Server));
   pending_state.set_expected_next(Handshake_Type::HandshakeCCS);
}

void Server_Impl_12::session_create(Server_Handshake_State& pending_state) {
   std::map<std::string, std::vector<X509_Certificate>> cert_chains;

   const std::string sni_hostname = pending_state.client_hello()->sni_hostname();

   // RFC 8446 1.3
   //    The "signature_algorithms_cert" extension allows a client to indicate
   //    which signature algorithms it can validate in X.509 certificates.
   //
   // RFC 8446 4.2.3
   //     TLS 1.2 implementations SHOULD also process this extension.
   const auto cert_signature_schemes = pending_state.client_hello()->certificate_signature_schemes();
   cert_chains = get_server_certs(sni_hostname, cert_signature_schemes, *m_creds);

   if(!sni_hostname.empty() && cert_chains.empty()) {
      cert_chains = get_server_certs("", cert_signature_schemes, *m_creds);

      /*
      * Only send the unrecognized_name alert if we couldn't
      * find any certs for the requested name but did find at
      * least one cert to use in general. That avoids sending an
      * unrecognized_name when a server is configured for purely
      * anonymous/PSK operation.
      */
      if(!cert_chains.empty()) {
         send_warning_alert(Alert::UnrecognizedName);
      }
   }

   const uint16_t ciphersuite =
      choose_ciphersuite(policy(), pending_state.version(), cert_chains, *pending_state.client_hello());

   Server_Hello_12::Settings srv_settings(Session_ID(make_hello_random(rng(), callbacks(), policy())),
                                          pending_state.version(),
                                          ciphersuite,
                                          session_manager().emits_session_tickets());

   pending_state.server_hello(new Server_Hello_12(pending_state.handshake_io(),
                                                  pending_state.hash(),
                                                  policy(),
                                                  callbacks(),
                                                  rng(),
                                                  secure_renegotiation_data_for_server_hello(),
                                                  *pending_state.client_hello(),
                                                  srv_settings,
                                                  m_next_protocol));

   secure_renegotiation_check(pending_state.server_hello());

   const Ciphersuite& pending_suite = pending_state.ciphersuite();

   std::shared_ptr<Private_Key> private_key;

   if(pending_suite.signature_used() || pending_suite.kex_method() == Kex_Algo::STATIC_RSA) {
      const std::string algo_used = pending_suite.signature_used() ? pending_suite.sig_algo() : "RSA";

      BOTAN_ASSERT(!cert_chains[algo_used].empty(), "Attempting to send empty certificate chain");

      pending_state.server_certs(
         new Certificate_12(pending_state.handshake_io(), pending_state.hash(), cert_chains[algo_used]));

      if(pending_state.client_hello()->supports_cert_status_message() && pending_state.is_a_resumption() == false) {
         auto* csr = pending_state.client_hello()->extensions().get<Certificate_Status_Request>();
         // csr is non-null if client_hello()->supports_cert_status_message()
         BOTAN_ASSERT_NOMSG(csr != nullptr);
         const auto resp_bytes = callbacks().tls_provide_cert_status(cert_chains[algo_used], *csr);
         if(!resp_bytes.empty()) {
            pending_state.server_cert_status(
               new Certificate_Status(pending_state.handshake_io(), pending_state.hash(), resp_bytes));
         }
      }

      private_key = m_creds->private_key_for(pending_state.server_certs()->cert_chain()[0], "tls-server", sni_hostname);

      if(!private_key) {
         throw Internal_Error("No private key located for associated server cert");
      }
   }

   if(pending_suite.kex_method() == Kex_Algo::STATIC_RSA) {
      pending_state.set_server_rsa_kex_key(private_key);
   } else {
      pending_state.server_kex(new Server_Key_Exchange(
         pending_state.handshake_io(), pending_state, policy(), *m_creds, rng(), private_key.get()));
   }

   auto trusted_CAs = m_creds->trusted_certificate_authorities("tls-server", sni_hostname);

   std::vector<X509_DN> client_auth_CAs;

   for(auto* store : trusted_CAs) {
      auto subjects = store->all_subjects();
      client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end());
   }

   const bool request_cert = (client_auth_CAs.empty() == false) || policy().request_client_certificate_authentication();

   if(request_cert && pending_state.ciphersuite().signature_used()) {
      pending_state.cert_req(
         new Certificate_Request_12(pending_state.handshake_io(), pending_state.hash(), policy(), client_auth_CAs));

      /*
      SSLv3 allowed clients to skip the Certificate message entirely
      if they wanted. In TLS v1.0 and later clients must send a
      (possibly empty) Certificate message
      */
      pending_state.set_expected_next(Handshake_Type::Certificate);
   } else {
      pending_state.set_expected_next(Handshake_Type::ClientKeyExchange);
   }

   pending_state.server_hello_done(new Server_Hello_Done(pending_state.handshake_io(), pending_state.hash()));
}
}  // namespace Botan::TLS