//! mTLS test client

use std::sync::Arc;
use packet_detector::tls_util::LoggingVerifier;
use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
use rustls::version::TLS12;
use rustls::ClientConfig;
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::TcpStream;
use tokio_rustls::TlsConnector;

const CERT: &str = "client_cert.pem";
const KEY: &str = "client_key.pem";

fn load_creds() -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>), Box<dyn std::error::Error>> {
    let cert_pem = std::fs::read_to_string(CERT)?;
    let key_pem = std::fs::read_to_string(KEY)?;
    let certs = rustls_pemfile::certs(&mut cert_pem.as_bytes()).collect::<Result<Vec<_>, _>>()?;
    let key = rustls_pemfile::private_key(&mut key_pem.as_bytes())?.ok_or("No key")?;
    Ok((certs, key))
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    rustls::crypto::ring::default_provider().install_default().ok();

    let host = std::env::args().nth(1).unwrap_or_else(|| "127.0.0.1".into());
    let port: u16 = std::env::args().nth(2).and_then(|s| s.parse().ok()).unwrap_or(8443);

    let (certs, key) = load_creds()?;
    println!("Connecting to {}:{} with client cert", host, port);

    let config = ClientConfig::builder_with_protocol_versions(&[&TLS12])
        .dangerous()
        .with_custom_certificate_verifier(Arc::new(LoggingVerifier))
        .with_client_auth_cert(certs, key)?;

    let stream = TcpStream::connect(format!("{}:{}", host, port)).await?;
    let mut tls = TlsConnector::from(Arc::new(config))
        .connect(ServerName::try_from(host.clone())?, stream).await?;
    println!("TLS handshake complete!");

    let req = format!("GET / HTTP/1.1\r\nHost: {}\r\nConnection: close\r\n\r\n", host);
    tls.write_all(req.as_bytes()).await?;

    let mut resp = Vec::new();
    tls.read_to_end(&mut resp).await?;
    println!("\n{}", String::from_utf8_lossy(&resp));

    Ok(())
}