cassandra-trunk/src/java/org/apache/cassandra/config/EncryptionOptions.java
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.cassandra.config;

import java.util.Arrays;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.Set;

import javax.annotation.Nullable;

import com.google.common.annotations.VisibleForTesting;
import com.google.common.collect.ImmutableList;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import org.apache.cassandra.locator.IEndpointSnitch;
import org.apache.cassandra.locator.InetAddressAndPort;
import org.apache.cassandra.security.DisableSslContextFactory;
import org.apache.cassandra.security.ISslContextFactory;
import org.apache.cassandra.utils.FBUtilities;

/**
 * This holds various options used for enabling SSL/TLS encryption.
 * Examples of such options are: supported cipher-suites, ssl protocol with version, accepted protocols, end-point
 * verification, require client-auth/cert etc.
 */
public class EncryptionOptions
{
    Logger logger = LoggerFactory.getLogger(EncryptionOptions.class);

    public enum TlsEncryptionPolicy
    {
        UNENCRYPTED("unencrypted"),
        OPTIONAL("optionally encrypted"),
        ENCRYPTED("encrypted");

        private final String description;

        TlsEncryptionPolicy(String description)
        {
            this.description = description;
        }

        public String description()
        {
            return description;
        }
    }

    /*
     * If the ssl_context_factory is configured, most likely it won't use file based keystores and truststores and
     * can choose to completely customize SSL context's creation. Most likely it won't also use keystore_password and
     * truststore_passwords configurations as they are in plaintext format.
     */
    public final ParameterizedClass ssl_context_factory;
    public final String keystore;
    @Nullable
    public final String keystore_password;
    public final String truststore;
    @Nullable
    public final String truststore_password;
    public final List<String> cipher_suites;
    protected String protocol;
    protected List<String> accepted_protocols;
    public final String algorithm;
    public final String store_type;
    public final boolean require_client_auth;
    public final boolean require_endpoint_verification;
    // ServerEncryptionOptions does not use the enabled flag at all instead using the existing
    // internode_encryption option. So we force this private and expose through isEnabled
    // so users of ServerEncryptionOptions can't accidentally use this when they should use isEnabled
    // Long term we need to refactor ClientEncryptionOptions and ServerEncyrptionOptions to be separate
    // classes so we can choose appropriate configuration for each.
    // See CASSANDRA-15262 and CASSANDRA-15146
    protected Boolean enabled;
    protected Boolean optional;

    // Calculated by calling applyConfig() after populating/parsing
    protected Boolean isEnabled;
    protected Boolean isOptional;

    /*
     * We will wait to initialize this until applyConfig() call to make sure we do it only when the caller is ready
     * to use this option instance.
     */
    public transient ISslContextFactory sslContextFactoryInstance;

    public enum ConfigKey
    {
        KEYSTORE("keystore"),
        KEYSTORE_PASSWORD("keystore_password"),
        OUTBOUND_KEYSTORE("outbound_keystore"),
        OUTBOUND_KEYSTORE_PASSWORD("outbound_keystore_password"),
        TRUSTSTORE("truststore"),
        TRUSTSTORE_PASSWORD("truststore_password"),
        CIPHER_SUITES("cipher_suites"),
        PROTOCOL("protocol"),
        ACCEPTED_PROTOCOLS("accepted_protocols"),
        ALGORITHM("algorithm"),
        STORE_TYPE("store_type"),
        REQUIRE_CLIENT_AUTH("require_client_auth"),
        REQUIRE_ENDPOINT_VERIFICATION("require_endpoint_verification"),
        ENABLED("enabled"),
        OPTIONAL("optional");

        final String keyName;

        ConfigKey(String keyName)
        {
            this.keyName=keyName;
        }

        String getKeyName()
        {
            return keyName;
        }

        static Set<String> asSet()
        {
            Set<String> valueSet = new HashSet<>();
            ConfigKey[] values = values();
            for(ConfigKey key: values) {
                valueSet.add(key.getKeyName().toLowerCase());
            }
            return valueSet;
        }
    }

    public EncryptionOptions()
    {
        ssl_context_factory = new ParameterizedClass("org.apache.cassandra.security.DefaultSslContextFactory",
                                                     new HashMap<>());
        keystore = "conf/.keystore";
        keystore_password = null;
        truststore = "conf/.truststore";
        truststore_password = null;
        cipher_suites = null;
        protocol = null;
        accepted_protocols = null;
        algorithm = null;
        store_type = "JKS";
        require_client_auth = false;
        require_endpoint_verification = false;
        enabled = null;
        optional = null;
    }

    public EncryptionOptions(ParameterizedClass ssl_context_factory, String keystore, String keystore_password,
                             String truststore, String truststore_password, List<String> cipher_suites,
                             String protocol, List<String> accepted_protocols, String algorithm, String store_type,
                             boolean require_client_auth, boolean require_endpoint_verification, Boolean enabled,
                             Boolean optional)
    {
        this.ssl_context_factory = ssl_context_factory;
        this.keystore = keystore;
        this.keystore_password = keystore_password;
        this.truststore = truststore;
        this.truststore_password = truststore_password;
        this.cipher_suites = cipher_suites;
        this.protocol = protocol;
        this.accepted_protocols = accepted_protocols;
        this.algorithm = algorithm;
        this.store_type = store_type;
        this.require_client_auth = require_client_auth;
        this.require_endpoint_verification = require_endpoint_verification;
        this.enabled = enabled;
        this.optional = optional;
    }

    public EncryptionOptions(EncryptionOptions options)
    {
        ssl_context_factory = options.ssl_context_factory;
        keystore = options.keystore;
        keystore_password = options.keystore_password;
        truststore = options.truststore;
        truststore_password = options.truststore_password;
        cipher_suites = options.cipher_suites;
        protocol = options.protocol;
        accepted_protocols = options.accepted_protocols;
        algorithm = options.algorithm;
        store_type = options.store_type;
        require_client_auth = options.require_client_auth;
        require_endpoint_verification = options.require_endpoint_verification;
        enabled = options.enabled;
        this.optional = options.optional;
    }

    /* Computes enabled and optional before use. Because the configuration can be loaded
     * through pluggable mechanisms this is the only safe way to make sure that
     * enabled and optional are set correctly.
     *
     * It also initializes the ISslContextFactory's instance
     */
    public EncryptionOptions applyConfig()
    {
        ensureConfigNotApplied();

        initializeSslContextFactory();

        isEnabled = this.enabled != null && enabled;

        if (optional != null)
        {
            isOptional = optional;
        }
        // If someone is asking for an _insecure_ connection and not explicitly telling us to refuse
        // encrypted connections AND they have a keystore file, we assume they would like to be able
        // to transition to encrypted connections in the future.
        else if (sslContextFactoryInstance.hasKeystore())
        {
            isOptional = !isEnabled;
        }
        else
        {
            // Otherwise if there's no keystore, not possible to establish an optional secure connection
            isOptional = false;
        }
        return this;
    }

    /**
     * Prepares the parameterized keys provided in the configuration for {@link ISslContextFactory} to be passed in
     * as the constructor for its implementation.
     *
     * @throws IllegalArgumentException in case any pre-defined key, as per {@link ConfigKey}, for the encryption
     * options is duplicated in the parameterized keys.
     */
    private void prepareSslContextFactoryParameterizedKeys(Map<String,Object> sslContextFactoryParameters)
    {
        if (ssl_context_factory.parameters != null)
        {
            Set<String> configKeys = ConfigKey.asSet();
            for (Map.Entry<String, String> entry : ssl_context_factory.parameters.entrySet())
            {
                if(configKeys.contains(entry.getKey().toLowerCase()))
                {
                    throw new IllegalArgumentException("SslContextFactory "+ssl_context_factory.class_name+" should " +
                                                       "configure '"+entry.getKey()+"' as encryption_options instead of" +
                                                       " parameterized keys");
                }
                sslContextFactoryParameters.put(entry.getKey(),entry.getValue());
            }
        }
    }

    protected void fillSslContextParams(Map<String, Object> sslContextFactoryParameters)
    {
        /*
         * Copy all configs to the Map to pass it on to the ISslContextFactory's implementation
         */
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.KEYSTORE, this.keystore);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.KEYSTORE_PASSWORD, this.keystore_password);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.TRUSTSTORE, this.truststore);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.TRUSTSTORE_PASSWORD, this.truststore_password);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.CIPHER_SUITES, this.cipher_suites);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.PROTOCOL, this.protocol);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.ACCEPTED_PROTOCOLS, this.accepted_protocols);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.ALGORITHM, this.algorithm);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.STORE_TYPE, this.store_type);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.REQUIRE_CLIENT_AUTH, this.require_client_auth);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.REQUIRE_ENDPOINT_VERIFICATION, this.require_endpoint_verification);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.ENABLED, this.enabled);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.OPTIONAL, this.optional);
    }

    private void initializeSslContextFactory()
    {
        Map<String, Object> sslContextFactoryParameters = new HashMap<>();
        prepareSslContextFactoryParameterizedKeys(sslContextFactoryParameters);
        fillSslContextParams(sslContextFactoryParameters);

        if (CassandraRelevantProperties.TEST_JVM_DTEST_DISABLE_SSL.getBoolean())
        {
            sslContextFactoryInstance = new DisableSslContextFactory();
        }
        else
        {
            sslContextFactoryInstance = FBUtilities.newSslContextFactory(ssl_context_factory.class_name,
                                                                         sslContextFactoryParameters);
        }
    }

    protected static void putSslContextFactoryParameter(Map<String, Object> existingParameters, ConfigKey configKey, Object value)
    {
        if (value != null) {
            existingParameters.put(configKey.getKeyName(), value);
        }
    }

    private void ensureConfigApplied()
    {
        if (isEnabled == null || isOptional == null)
            throw new IllegalStateException("EncryptionOptions.applyConfig must be called first");
    }

    private void ensureConfigNotApplied()
    {
        if (isEnabled != null || isOptional != null)
            throw new IllegalStateException("EncryptionOptions cannot be changed after configuration applied");
    }

    /**
     * Indicates if the channel should be encrypted. Client and Server uses different logic to determine this
     *
     * @return if the channel should be encrypted
     */
    public Boolean getEnabled()
    {
        ensureConfigApplied();
        return isEnabled;
    }

    /**
     * Sets if encryption should be enabled for this channel. Note that this should only be called by
     * the configuration parser or tests. It is public only for that purpose, mutating enabled state
     * is probably a bad idea.
     * @param enabled value to set
     */
    public void setEnabled(Boolean enabled)
    {
        ensureConfigNotApplied();
        this.enabled = enabled;
    }

    /**
     * Indicates if the channel may be encrypted (but is not required to be).
     * Explicitly providing a value in the configuration take precedent.
     * If no optional value is set and !isEnabled(), then optional connections are allowed
     * if a keystore exists. Without it, it would be impossible to establish the connections.
     *
     * Return type is Boolean even though it can never be null so that snakeyaml can find it
     * @return if the channel may be encrypted
     */
    public Boolean getOptional()
    {
        ensureConfigApplied();
        return isOptional;
    }

    /**
     * Sets if encryption should be optional for this channel. Note that this should only be called by
     * the configuration parser or tests. It is public only for that purpose, mutating enabled state
     * is probably a bad idea.
     * @param optional value to set
     */
    public void setOptional(Boolean optional)
    {
        ensureConfigNotApplied();
        this.optional = optional;
    }

    /**
     * Sets accepted TLS protocol for this channel. Note that this should only be called by
     * the configuration parser or tests. It is public only for that purpose, mutating protocol state
     * is probably a bad idea.
     * @param protocol value to set
     */
    @VisibleForTesting
    public void setProtocol(String protocol)
    {
        this.protocol = protocol;
    }

    public String getProtocol()
    {
        return protocol;
    }

    /**
     * Sets accepted TLS protocols for this channel. Note that this should only be called by
     * the configuration parser or tests. It is public only for that purpose, mutating protocol state
     * is probably a bad idea. The function casing is required for snakeyaml to find this setter for the protected field.
     * @param accepted_protocols value to set
     */
    public void setAcceptedProtocols(List<String> accepted_protocols)
    {
        this.accepted_protocols = accepted_protocols == null ? null : ImmutableList.copyOf(accepted_protocols);
    }

    public List<String> getAcceptedProtocols()
    {
        return sslContextFactoryInstance == null ? null : sslContextFactoryInstance.getAcceptedProtocols();
    }

    public String[] acceptedProtocolsArray()
    {
        List<String> ap = getAcceptedProtocols();
        return ap == null ?  new String[0] : ap.toArray(new String[0]);
    }

    public TlsEncryptionPolicy tlsEncryptionPolicy()
    {
        if (getOptional())
        {
            return TlsEncryptionPolicy.OPTIONAL;
        }
        else if (getEnabled())
        {
            return TlsEncryptionPolicy.ENCRYPTED;
        }
        else
        {
            return TlsEncryptionPolicy.UNENCRYPTED;
        }
    }

    public EncryptionOptions withSslContextFactory(ParameterizedClass sslContextFactoryClass)
    {
        return new EncryptionOptions(sslContextFactoryClass, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites,protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification,enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withKeyStore(String keystore)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites,protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withKeyStorePassword(String keystore_password)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites,protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withTrustStore(String truststore)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withTrustStorePassword(String truststore_password)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withCipherSuites(List<String> cipher_suites)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withCipherSuites(String ... cipher_suites)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, ImmutableList.copyOf(cipher_suites), protocol,
                                     accepted_protocols, algorithm, store_type, require_client_auth,
                                     require_endpoint_verification, enabled, optional).applyConfig();
    }

    public EncryptionOptions withProtocol(String protocol)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }


    public EncryptionOptions withAcceptedProtocols(List<String> accepted_protocols)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites,protocol, accepted_protocols == null ? null :
                                                                                  ImmutableList.copyOf(accepted_protocols),
                                     algorithm, store_type, require_client_auth, require_endpoint_verification,
                                     enabled, optional).applyConfig();
    }


    public EncryptionOptions withAlgorithm(String algorithm)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withStoreType(String store_type)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withRequireClientAuth(boolean require_client_auth)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withRequireEndpointVerification(boolean require_endpoint_verification)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withEnabled(boolean enabled)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    public EncryptionOptions withOptional(Boolean optional)
    {
        return new EncryptionOptions(ssl_context_factory, keystore, keystore_password, truststore,
                                     truststore_password, cipher_suites, protocol, accepted_protocols, algorithm,
                                     store_type, require_client_auth, require_endpoint_verification, enabled,
                                     optional).applyConfig();
    }

    /**
     * The method is being mainly used to cache SslContexts therefore, we only consider
     * fields that would make a difference when the TrustStore or KeyStore files are updated
     */
    @Override
    public boolean equals(Object o)
    {
        if (o == this)
            return true;
        if (o == null || getClass() != o.getClass())
            return false;

        EncryptionOptions opt = (EncryptionOptions)o;
        return enabled == opt.enabled &&
               optional == opt.optional &&
               require_client_auth == opt.require_client_auth &&
               require_endpoint_verification == opt.require_endpoint_verification &&
               Objects.equals(keystore, opt.keystore) &&
               Objects.equals(keystore_password, opt.keystore_password) &&
               Objects.equals(truststore, opt.truststore) &&
               Objects.equals(truststore_password, opt.truststore_password) &&
               Objects.equals(protocol, opt.protocol) &&
               Objects.equals(accepted_protocols, opt.accepted_protocols) &&
               Objects.equals(algorithm, opt.algorithm) &&
               Objects.equals(store_type, opt.store_type) &&
               Objects.equals(cipher_suites, opt.cipher_suites) &&
               Objects.equals(ssl_context_factory, opt.ssl_context_factory);
    }

    /**
     * The method is being mainly used to cache SslContexts therefore, we only consider
     * fields that would make a difference when the TrustStore or KeyStore files are updated
     */
    @Override
    public int hashCode()
    {
        int result = 0;
        result += 31 * (keystore == null ? 0 : keystore.hashCode());
        result += 31 * (keystore_password == null ? 0 : keystore_password.hashCode());
        result += 31 * (truststore == null ? 0 : truststore.hashCode());
        result += 31 * (truststore_password == null ? 0 : truststore_password.hashCode());
        result += 31 * (protocol == null ? 0 : protocol.hashCode());
        result += 31 * (accepted_protocols == null ? 0 : accepted_protocols.hashCode());
        result += 31 * (algorithm == null ? 0 : algorithm.hashCode());
        result += 31 * (store_type == null ? 0 : store_type.hashCode());
        result += 31 * (enabled == null ? 0 : Boolean.hashCode(enabled));
        result += 31 * (optional == null ? 0 : Boolean.hashCode(optional));
        result += 31 * (cipher_suites == null ? 0 : cipher_suites.hashCode());
        result += 31 * Boolean.hashCode(require_client_auth);
        result += 31 * Boolean.hashCode(require_endpoint_verification);
        result += 31 * (ssl_context_factory == null ? 0 : ssl_context_factory.hashCode());
        return result;
    }

    public static class ServerEncryptionOptions extends EncryptionOptions
    {
        public enum InternodeEncryption
        {
            all, none, dc, rack
        }

        public final InternodeEncryption internode_encryption;
        @Replaces(oldName = "enable_legacy_ssl_storage_port", deprecated = true)
        public final boolean legacy_ssl_storage_port_enabled;
        public final String outbound_keystore;
        @Nullable
        public final String outbound_keystore_password;

        public ServerEncryptionOptions()
        {
            this.internode_encryption = InternodeEncryption.none;
            this.legacy_ssl_storage_port_enabled = false;
            this.outbound_keystore = null;
            this.outbound_keystore_password = null;
        }

        public ServerEncryptionOptions(ParameterizedClass sslContextFactoryClass, String keystore,
                                       String keystore_password,String outbound_keystore,
                                       String outbound_keystore_password, String truststore, String truststore_password,
                                       List<String> cipher_suites, String protocol, List<String> accepted_protocols,
                                       String algorithm, String store_type, boolean require_client_auth,
                                       boolean require_endpoint_verification, Boolean optional,
                                       InternodeEncryption internode_encryption, boolean legacy_ssl_storage_port_enabled)
        {
            super(sslContextFactoryClass, keystore, keystore_password, truststore, truststore_password, cipher_suites,
            protocol, accepted_protocols, algorithm, store_type, require_client_auth, require_endpoint_verification,
            null, optional);
            this.internode_encryption = internode_encryption;
            this.legacy_ssl_storage_port_enabled = legacy_ssl_storage_port_enabled;
            this.outbound_keystore = outbound_keystore;
            this.outbound_keystore_password = outbound_keystore_password;
        }

        public ServerEncryptionOptions(ServerEncryptionOptions options)
        {
            super(options);
            this.internode_encryption = options.internode_encryption;
            this.legacy_ssl_storage_port_enabled = options.legacy_ssl_storage_port_enabled;
            this.outbound_keystore = options.outbound_keystore;
            this.outbound_keystore_password = options.outbound_keystore_password;
        }

        @Override
        protected void fillSslContextParams(Map<String, Object> sslContextFactoryParameters)
        {
            super.fillSslContextParams(sslContextFactoryParameters);
            putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.OUTBOUND_KEYSTORE, this.outbound_keystore);
            putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.OUTBOUND_KEYSTORE_PASSWORD, this.outbound_keystore_password);
        }

        @Override
        public EncryptionOptions applyConfig()
        {
            return applyConfigInternal();
        }

        private ServerEncryptionOptions applyConfigInternal()
        {
            super.applyConfig();

            isEnabled = this.internode_encryption != InternodeEncryption.none;

            if (this.enabled != null && this.enabled && !isEnabled)
            {
                logger.warn("Setting server_encryption_options.enabled has no effect, use internode_encryption");
            }

            if (require_client_auth && (internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc))
            {
                logger.warn("Setting require_client_auth is incompatible with 'rack' and 'dc' internode_encryption values."
                          + " It is possible for an internode connection to pretend to be in the same rack/dc by spoofing"
                          + " its broadcast address in the handshake and bypass authentication. To ensure that mutual TLS"
                          + " authentication is not bypassed, please set internode_encryption to 'all'. Continuing with"
                          + " insecure configuration.");
            }

            // regardless of the optional flag, if the internode encryption is set to rack or dc
            // it must be optional so that unencrypted connections within the rack or dc can be established.
            isOptional = super.isOptional || internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc;

            return this;
        }

        public boolean shouldEncrypt(InetAddressAndPort endpoint)
        {
            IEndpointSnitch snitch = DatabaseDescriptor.getEndpointSnitch();
            switch (internode_encryption)
            {
                case none:
                    return false; // if nothing needs to be encrypted then return immediately.
                case all:
                    break;
                case dc:
                    if (snitch.getDatacenter(endpoint).equals(snitch.getLocalDatacenter()))
                        return false;
                    break;
                case rack:
                    // for rack then check if the DC's are the same.
                    if (snitch.getRack(endpoint).equals(snitch.getLocalRack())
                        && snitch.getDatacenter(endpoint).equals(snitch.getLocalDatacenter()))
                        return false;
                    break;
            }
            return true;
        }

        /**
         * {@link #isOptional} will be set to {@code true} implicitly for {@code internode_encryption}
         * values of "dc" and "all". This method returns the explicit, raw value of {@link #optional}
         * as set by the user (if set at all).
         */
        public boolean isExplicitlyOptional()
        {
            return optional != null && optional;
        }

        public ServerEncryptionOptions withSslContextFactory(ParameterizedClass sslContextFactoryClass)
        {
            return new ServerEncryptionOptions(sslContextFactoryClass, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withKeyStore(String keystore)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withKeyStorePassword(String keystore_password)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withTrustStore(String truststore)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withTrustStorePassword(String truststore_password)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withCipherSuites(List<String> cipher_suites)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withCipherSuites(String... cipher_suites)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, Arrays.asList(cipher_suites), protocol,
                                               accepted_protocols, algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withProtocol(String protocol)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withAcceptedProtocols(List<String> accepted_protocols)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withAlgorithm(String algorithm)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withStoreType(String store_type)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withRequireClientAuth(boolean require_client_auth)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withRequireEndpointVerification(boolean require_endpoint_verification)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withOptional(boolean optional)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withInternodeEncryption(InternodeEncryption internode_encryption)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withLegacySslStoragePort(boolean enable_legacy_ssl_storage_port)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               enable_legacy_ssl_storage_port).applyConfigInternal();
        }

        public ServerEncryptionOptions withOutboundKeystore(String outboundKeystore)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outboundKeystore, outbound_keystore_password, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }

        public ServerEncryptionOptions withOutboundKeystorePassword(String outboundKeystorePassword)
        {
            return new ServerEncryptionOptions(ssl_context_factory, keystore, keystore_password,
                                               outbound_keystore, outboundKeystorePassword, truststore,
                                               truststore_password, cipher_suites, protocol, accepted_protocols,
                                               algorithm, store_type, require_client_auth,
                                               require_endpoint_verification, optional, internode_encryption,
                                               legacy_ssl_storage_port_enabled).applyConfigInternal();
        }
    }
}
