import std.socket : InternetAddress, Socket, TcpSocket, SocketOptionLevel, SocketOption;
import std.exception : enforce, ifThrown;
import std.stdio : writefln, writeln, stderr;
import std.string : toStringz, fromStringz, representation;
import std.format : format;
import deimos.openssl.ssl;
import deimos.openssl.err : ERR_print_errors_fp;
static import cio = core.stdc.stdio;
import hostname : hostnamez;
import sslclient : SSLClient;

void main() {
    ssl_ctx_st* ctx = SSL_CTX_new(TLS_server_method);
    enforce(ctx, "SSL_CTX_new() failed");
    scope (exit)
        SSL_CTX_free(ctx);

    if (!SSL_CTX_use_certificate_file(ctx, "ssl.crt", SSL_FILETYPE_PEM)
            || !SSL_CTX_use_PrivateKey_file(ctx, "ssl.key", SSL_FILETYPE_PEM)) {
        ERR_print_errors_fp(cio.stderr);
        enforce(false, "SSL_CTX_use_certificate_file() failed");
    }

    enum port = 4444;
    scope listener = new TcpSocket;
    listener.blocking = true;
    listener.setOption(SocketOptionLevel.SOCKET, SocketOption.REUSEADDR, 1);
    listener.bind(new InternetAddress(port));
    listener.listen(10);
    writefln!"Listening on %d."(port);
    ubyte[1024] buf;
    ptrdiff_t len;

    while (true) {
        writeln;
        auto client = SSLClient(listener.accept);
        writefln!"Received connection from %s."(client.sock.remoteAddress.toString);

        while (0 < (len = client.recv(buf[]))) {
            if (buf[0 .. len] == "STARTTLS\n") {
                if (!client.accept(ctx).ifThrown(0)) {
                    writeln("Failed to secure socket.");
                    ERR_print_errors_fp(cio.stdout);
                    break;
                }
                client.send(format!"SSL/TLS using %s\n"(SSL_get_cipher(client.ssl)
                        .fromStringz).representation);
            } else {
                client.send(buf[0 .. len]);
            }
        }
    }
    assert(0);
}

import std.socket : Socket;
import std.exception : enforce;
import std.string : toStringz, fromStringz, representation;
import deimos.openssl.ssl : ssl_st, ssl_ctx_st, SSL_new, SSL_set_tlsext_host_name,
    SSL_set_fd, SSL_accept, SSL_connect, SSL_read, SSL_write, SSL_shutdown, SSL_free;
import hostname : hostnamez;

struct SSLClient {
    Socket sock;
    ssl_st* ssl;

    int recv(ubyte[] buf) @trusted {
        assert(buf.ptr !is null);
        assert(buf.length < int.max);
        if (ssl)
            return SSL_read(ssl, cast(void*) buf.ptr, cast(int) buf.length);
        else
            return cast(int) sock.receive(buf);
    }

    int send(const ubyte[] buf) @trusted {
        assert(buf.ptr !is null);
        assert(buf.length < int.max);
        if (ssl)
            return SSL_write(ssl, cast(void*) buf.ptr, cast(int) buf.length);
        else
            return cast(int) sock.send(buf);
    }

    private void ssl_prelude(ssl_ctx_st* ctx) {
        assert(ssl is null);
        enforce(ssl = SSL_new(ctx), "SSL_new() failed");
        enforce(SSL_set_tlsext_host_name(ssl, cast(char*) hostnamez),
                "SSL_set_tlsext_host_name failed");
        enforce(SSL_set_fd(ssl, sock.handle), "SSL_set_fd() failed");
    }

    bool accept(ssl_ctx_st* ctx) {
        ssl_prelude(ctx);
        enforce(SSL_accept(ssl) == 1, "SSL_accept() failed");
        return true;
    }

    bool connect(ssl_ctx_st* ctx) {
        ssl_prelude(ctx);
        enforce(SSL_connect(ssl) == 1, "SSL_connect() failed");
        return true;
    }

    ~this() {
        if (ssl) {
            SSL_shutdown(ssl);
            SSL_free(ssl);
        }
        sock.close;
    }
}