package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"math/big"
	"net"
	"net/http"
	"time"
)

func generateCert() ([]tls.Certificate, error) {
	rootKey, err := rsa.GenerateKey(rand.Reader, 4096)
	if err != nil {
		return nil, fmt.Errorf("failed to generate rsa key: %v", err)
	}
	serial, err := rand.Int(rand.Reader, big.NewInt(1<<62))
	if err != nil {
		return nil, fmt.Errorf("failed to generate serial: %v", err)
	}
	rootTemplate := &x509.Certificate{
		SerialNumber: serial,
		NotBefore:    time.Now().Add(-time.Hour),
		NotAfter:     time.Now().Add(time.Hour * 24 * 365 * 10),
		KeyUsage:     x509.KeyUsageContentCommitment | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		ExtKeyUsage: []x509.ExtKeyUsage{
			x509.ExtKeyUsageClientAuth,
			x509.ExtKeyUsageServerAuth,
		},
		BasicConstraintsValid: true,
		IPAddresses:           []net.IP{net.IPv4(127, 0, 0, 1)},
	}
	rootDER, err := x509.CreateCertificate(rand.Reader, rootTemplate, rootTemplate, &rootKey.PublicKey, rootKey)
	if err != nil {
		return nil, fmt.Errorf("failed to create certificate: %v", err)
	}
	return []tls.Certificate{
		{
			Certificate: [][]byte{rootDER},
			PrivateKey:  rootKey,
		},
	}, nil
}

func main() {
	tlsCertificates, err := generateCert()
	if err != nil {
		panic(err)
	}
	server := http.Server{
		Addr: "127.0.0.1:8081",
		TLSConfig: &tls.Config{
			Certificates: tlsCertificates,
		},
		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Write([]byte("success"))
		}),
	}
	server.TLSConfig.WrapSession = func(cs tls.ConnectionState, ss *tls.SessionState) ([]byte, error) {
		// it works for <=16371 bytes
		return make([]byte, 16372), nil
	}
	server.TLSConfig.UnwrapSession = func(identity []byte, cs tls.ConnectionState) (*tls.SessionState, error) {
		return nil, fmt.Errorf("UnwrapSession not implemented")
	}
	fmt.Printf("listening...\n")
	server.ListenAndServeTLS("", "")
}