/*

  * Licensed to the Apache Software Foundation (ASF) under one

  * or more contributor license agreements.  See the NOTICE file

  * distributed with this work for additional information

  * regarding copyright ownership.  The ASF licenses this file

  * to you under the Apache License, Version 2.0 (the

  * "License"); you may not use this file except in compliance

  * with the License.  You may obtain a copy of the License at

  *

  *   http://www.apache.org/licenses/LICENSE-2.0

  *

  * Unless required by applicable law or agreed to in writing,

  * software distributed under the License is distributed on an

  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

  * KIND, either express or implied.  See the License for the

  * specific language governing permissions and limitations

  * under the License.

  */

 package org.apache.myfaces.application.viewstate;

 import java.security.NoSuchAlgorithmException;

 import java.security.NoSuchProviderException;

 import java.security.SecureRandom;

 import java.util.Queue;

 import java.util.concurrent.ConcurrentLinkedQueue;

 import java.util.logging.Level;

 import java.util.logging.Logger;

 /**

  * NOTE: Class taken from tomcat 7 org.apache.catalina.util.SessionIdGenerator

  * and used here as an alternative for server side state token encryption.

  * 

  */

 class SessionIdGenerator

 {

     private static Logger log = Logger.getLogger(SessionIdGenerator.class.getName());

     /**

      * Queue of random number generator objects to be used when creating session

      * identifiers. If the queue is empty when a random number generator is

      * required, a new random number generator object is created. This is

      * designed this way since random number generators use a sync to make them

      * thread-safe and the sync makes using a a single object slow(er).

      */

     private Queue<SecureRandom> randoms =

             new ConcurrentLinkedQueue<SecureRandom>();

     /**

      * The Java class name of the secure random number generator class to be

      * used when generating session identifiers. The random number generator

      * class must be self-seeding and have a zero-argument constructor. If not

      * specified, an instance of {@link SecureRandom} will be generated.

      */

     private String secureRandomClass = null;

     /**

      * The name of the algorithm to use to create instances of

      * {@link SecureRandom} which are used to generate session IDs. If no

      * algorithm is specified, SHA1PRNG is used. To use the platform default

      * (which may be SHA1PRNG), specify the empty string. If an invalid

      * algorithm and/or provider is specified the {@link SecureRandom} instances

      * will be created using the defaults. If that fails, the {@link

      * SecureRandom} instances will be created using platform defaults.

      */

     private String secureRandomAlgorithm = "SHA1PRNG";

     /**

      * The name of the provider to use to create instances of

      * {@link SecureRandom} which are used to generate session IDs. If no

      * algorithm is specified the of SHA1PRNG default is used. If an invalid

      * algorithm and/or provider is specified the {@link SecureRandom} instances

      * will be created using the defaults. If that fails, the {@link

      * SecureRandom} instances will be created using platform defaults.

      */

     private String secureRandomProvider = null;

     /**

      * Node identifier when in a cluster. Defaults to the empty string.

      */

     private String jvmRoute = "";

     /**

      * Number of bytes in a session ID. Defaults to 16.

      */

     private int sessionIdLength = 16;

     /**

      * Specify a non-default @{link {@link SecureRandom} implementation to use.

      *

      * @param secureRandomClass The fully-qualified class name

      */

     public void setSecureRandomClass(String secureRandomClass)

     {

         this.secureRandomClass = secureRandomClass;

     }

     /**

      * Specify a non-default algorithm to use to generate random numbers.

      *

      * @param secureRandomAlgorithm The name of the algorithm

      */

     public void setSecureRandomAlgorithm(String secureRandomAlgorithm)

     {

         this.secureRandomAlgorithm = secureRandomAlgorithm;

     }

     /**

      * Specify a non-default provider to use to generate random numbers.

      *

      * @param secureRandomProvider The name of the provider

      */

     public void setSecureRandomProvider(String secureRandomProvider)

     {

         this.secureRandomProvider = secureRandomProvider;

     }

     /**

      * Specify the node identifier associated with this node which will be

      * included in the generated session ID.

      *

      * @param jvmRoute The node identifier

      */

     public void setJvmRoute(String jvmRoute)

     {

         this.jvmRoute = jvmRoute;

     }

     /**

      * Specify the number of bytes for a session ID

      *

      * @param sessionIdLength Number of bytes

      */

     public void setSessionIdLength(int sessionIdLength)

     {

         this.sessionIdLength = sessionIdLength;

     }

     /**

      * Generate and return a new session identifier.

      */

     public String generateSessionId()

     {

         byte random[] = new byte[16];

         // Render the result as a String of hexadecimal digits

         StringBuilder buffer = new StringBuilder();

         int resultLenBytes = 0;

         while (resultLenBytes < sessionIdLength)

         {

             getRandomBytes(random);

             for (int j = 0;

                     j < random.length && resultLenBytes < sessionIdLength;

                     j++)

             {

                 byte b1 = (byte) ((random[j] & 0xf0) >> 4);

                 byte b2 = (byte) (random[j] & 0x0f);

                 if (b1 < 10)

                 {

                     buffer.append((char) ('0' + b1));

                 }

                 else

                 {

                     buffer.append((char) ('A' + (b1 - 10)));

                 }

                 if (b2 < 10)

                 {

                     buffer.append((char) ('0' + b2));

                 }

                 else

                 {

                     buffer.append((char) ('A' + (b2 - 10)));

                 }

                 resultLenBytes++;

             }

         }

         if (jvmRoute != null && jvmRoute.length() > 0)

         {

             buffer.append('.').append(jvmRoute);

         }

         return buffer.toString();

     }

     public void getRandomBytes(byte bytes[])

     {

         SecureRandom random = randoms.poll();

         if (random == null)

         {

             random = createSecureRandom();

         }

         random.nextBytes(bytes);

         randoms.add(random);

     }

     /**

      * Create a new random number generator instance we should use for

      * generating session identifiers.

      */

     private SecureRandom createSecureRandom()

     {

         SecureRandom result = null;

         long t1 = System.currentTimeMillis();

         if (secureRandomClass != null)

         {

             try

             {

                 // Construct and seed a new random number generator

                 Class<?> clazz = Class.forName(secureRandomClass);

                 result = (SecureRandom) clazz.newInstance();

             }

             catch (Exception e)

             {

                 log.log(Level.SEVERE, "Exception initializing random number generator of class "+ 

                         secureRandomClass + ". Falling back to java.secure.SecureRandom", e);

             }

         }

         if (result == null)

         {

             // No secureRandomClass or creation failed. Use SecureRandom.

             try

             {

                 if (secureRandomProvider != null

                         && secureRandomProvider.length() > 0)

                 {

                     result = SecureRandom.getInstance(secureRandomAlgorithm,

                             secureRandomProvider);

                 }

                 else

                 {

                     if (secureRandomAlgorithm != null

                             && secureRandomAlgorithm.length() > 0)

                     {

                         result = SecureRandom.getInstance(secureRandomAlgorithm);

                     }

                 }

             }

             catch (NoSuchAlgorithmException e)

             {

                 log.log(Level.SEVERE, "Exception initializing random number generator using algorithm: "+

                         secureRandomAlgorithm, e);

             }

             catch (NoSuchProviderException e)

             {

                 log.log(Level.SEVERE, "Exception initializing random number generator using provider: " + 

                         secureRandomProvider, e);

             }

         }

         if (result == null)

         {

             // Invalid provider / algorithm

             try

             {

                 result = SecureRandom.getInstance("SHA1PRNG");

             }

             catch (NoSuchAlgorithmException e)

             {

                 log.log(Level.SEVERE, "Invalid provider / algoritm SHA1PRNG for generate secure random token", e);

             }

         }

         if (result == null)

         {

             // Nothing works - use platform default

             result = new SecureRandom();

         }

         // Force seeding to take place

         result.nextInt();

         long t2 = System.currentTimeMillis();

         if ((t2 - t1) > 100)

         {

             if (log.isLoggable(Level.FINEST))

             {

                 log.info("Creation of SecureRandom instance for session ID generation using ["

                         +result.getAlgorithm()+"] took ["+Long.valueOf(t2 - t1)+"] milliseconds.");

             }

         }

         return result;

     }

 }