/*
    * Licensed to the Apache Software Foundation (ASF) under one or more
    * contributor license agreements.  See the NOTICE file distributed with
    * this work for additional information regarding copyright ownership.
    * The ASF licenses this file to You under the Apache License, Version 2.0
    * (the "License"); you may not use this file except in compliance with
    * the License.  You may obtain a copy of the License at
    *
    *      https://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.apache.commons.net.ftp;
  
  import java.io.BufferedReader;
  import java.io.BufferedWriter;
  import java.io.IOException;
  import java.io.InputStreamReader;
  import java.io.OutputStreamWriter;
  import java.net.Inet6Address;
  import java.net.InetAddress;
  import java.net.InetSocketAddress;
  import java.net.ServerSocket;
  import java.net.Socket;
  import java.util.Base64;
  
  import javax.net.ssl.HostnameVerifier;
  import javax.net.ssl.KeyManager;
  import javax.net.ssl.SSLContext;
  import javax.net.ssl.SSLException;
  import javax.net.ssl.SSLHandshakeException;
  import javax.net.ssl.SSLSocket;
  import javax.net.ssl.SSLSocketFactory;
  import javax.net.ssl.TrustManager;
  
  import org.apache.commons.io.IOUtils;
  import org.apache.commons.net.util.SSLContextUtils;
  import org.apache.commons.net.util.SSLSocketUtils;
  import org.apache.commons.net.util.TrustManagerUtils;
  
  /**
   * FTP over SSL processing. If desired, the JVM property -Djavax.net.debug=all can be used to see wire-level SSL details.
   *
   * Warning: the hostname is not verified against the certificate by default, use {@link #setHostnameVerifier(HostnameVerifier)} or
   * {@link #setEndpointCheckingEnabled(boolean)} (on Java 1.7+) to enable verification. Verification is only performed on client mode connections.
   *
   * @since 2.0
   */
  public class FTPSClient extends FTPClient {
  
  // From http://www.iana.org/assignments/port-numbers
  
  //    ftps-data   989/tcp    ftp protocol, data, over TLS/SSL
  //    ftps-data   989/udp    ftp protocol, data, over TLS/SSL
  //    ftps        990/tcp    ftp protocol, control, over TLS/SSL
  //    ftps        990/udp    ftp protocol, control, over TLS/SSL
  
      /** Default FTPS data port. */
      public static final int DEFAULT_FTPS_DATA_PORT = 989;
  
      /** Default FTPS port. */
      public static final int DEFAULT_FTPS_PORT = 990;
  
      /** The value that I can set in PROT command (C = Clear, P = Protected) */
      private static final String[] PROT_COMMAND_VALUE = { "C", "E", "S", "P" };
  
      /** Default PROT Command */
      private static final String DEFAULT_PROT = "C";
  
      /** Default secure socket protocol name, i.e. TLS */
      private static final String DEFAULT_PROTOCOL = "TLS";
  
      /** The AUTH (Authentication/Security Mechanism) command. */
      private static final String CMD_AUTH = "AUTH";
  
      /** The ADAT (Authentication/Security Data) command. */
      private static final String CMD_ADAT = "ADAT";
  
      /** The PROT (Data Channel Protection Level) command. */
      private static final String CMD_PROT = "PROT";
  
      /** The PBSZ (Protection Buffer Size) command. */
      private static final String CMD_PBSZ = "PBSZ";
  
      /** The MIC (Integrity Protected Command) command. */
      private static final String CMD_MIC = "MIC";
  
      /** The CONF (Confidentiality Protected Command) command. */
      private static final String CMD_CONF = "CONF";
  
      /** The ENC (Privacy Protected Command) command. */
      private static final String CMD_ENC = "ENC";
  
      /** The CCC (Clear Command Channel) command. */
     private static final String CMD_CCC = "CCC";
 
     /** @deprecated - not used - may be removed in a future release */
     @Deprecated
     public static String KEYSTORE_ALGORITHM;
 
     /** @deprecated - not used - may be removed in a future release */
     @Deprecated
     public static String TRUSTSTORE_ALGORITHM;
 
     /** @deprecated - not used - may be removed in a future release */
     @Deprecated
     public static String PROVIDER;
 
     /** @deprecated - not used - may be removed in a future release */
     @Deprecated
     public static String STORE_TYPE;
 
     /** The security mode. (True - Implicit Mode / False - Explicit Mode) */
     private final boolean isImplicit;
 
     /** The secure socket protocol to be used, e.g. SSL/TLS. */
     private final String protocol;
 
     /** The AUTH Command value */
     private String auth = DEFAULT_PROTOCOL;
 
     /** The context object. */
     private SSLContext context;
 
     /** The socket object. */
     private Socket plainSocket;
 
     /** Controls whether a new SSL session may be established by this socket. Default true. */
     private boolean isCreation = true;
 
     /** The use client mode flag. */
     private boolean isClientMode = true;
 
     /** The need client auth flag. */
     private boolean isNeedClientAuth;
 
     /** The want client auth flag. */
     private boolean isWantClientAuth;
 
     /** The cipher suites */
     private String[] suites;
 
     /** The protocol versions */
     private String[] protocols;
 
     /**
      * The FTPS {@link TrustManager} implementation, default validate only {@link TrustManagerUtils#getValidateServerCertificateTrustManager()}.
      */
     private TrustManager trustManager = TrustManagerUtils.getValidateServerCertificateTrustManager();
 
     /** The {@link KeyManager}, default null (i.e. use system default). */
     private KeyManager keyManager;
 
     /** The {@link HostnameVerifier} to use post-TLS, default null (i.e. no verification). */
     private HostnameVerifier hostnameVerifier;
 
     /** Use Java 1.7+ HTTPS Endpoint Identification Algorithm. */
     private boolean tlsEndpointChecking;
 
     /**
      * Constructor for FTPSClient, calls {@link #FTPSClient(String, boolean)}.
      *
      * Sets protocol to {@link #DEFAULT_PROTOCOL} - i.e. TLS - and security mode to explicit (isImplicit = false)
      */
     public FTPSClient() {
         this(DEFAULT_PROTOCOL, false);
     }
 
     /**
      * Constructor for FTPSClient, using {@link #DEFAULT_PROTOCOL} - i.e. TLS Calls {@link #FTPSClient(String, boolean)}
      *
      * @param isImplicit The security mode (Implicit/Explicit).
      */
     public FTPSClient(final boolean isImplicit) {
         this(DEFAULT_PROTOCOL, isImplicit);
     }
 
     /**
      * Constructor for FTPSClient, using {@link #DEFAULT_PROTOCOL} - i.e. TLS The default TrustManager is set from
      * {@link TrustManagerUtils#getValidateServerCertificateTrustManager()}
      *
      * @param isImplicit The security mode(Implicit/Explicit).
      * @param context    A pre-configured SSL Context
      */
     public FTPSClient(final boolean isImplicit, final SSLContext context) {
         this(DEFAULT_PROTOCOL, isImplicit);
         this.context = context;
     }
 
     /**
      * Constructor for FTPSClient, using {@link #DEFAULT_PROTOCOL} - i.e. TLS and isImplicit {@code false} Calls {@link #FTPSClient(boolean, SSLContext)}
      *
      * @param context A pre-configured SSL Context
      */
     public FTPSClient(final SSLContext context) {
         this(false, context);
     }
 
     /**
      * Constructor for FTPSClient, using explicit mode, calls {@link #FTPSClient(String, boolean)}.
      *
      * @param protocol the protocol to use
      */
     public FTPSClient(final String protocol) {
         this(protocol, false);
     }
 
     /**
      * Constructor for FTPSClient allowing specification of protocol and security mode. If isImplicit is true, the port is set to {@link #DEFAULT_FTPS_PORT}
      * i.e. 990. The default TrustManager is set from {@link TrustManagerUtils#getValidateServerCertificateTrustManager()}
      *
      * @param protocol   the protocol
      * @param isImplicit The security mode(Implicit/Explicit).
      */
     public FTPSClient(final String protocol, final boolean isImplicit) {
         this.protocol = protocol;
         this.isImplicit = isImplicit;
         if (isImplicit) {
             setDefaultPort(DEFAULT_FTPS_PORT);
         }
     }
 
     /**
      * Because there are so many connect() methods, the _connectAction_() method is provided as a means of performing some action immediately after establishing
      * a connection, rather than reimplementing all the connect() methods.
      *
      * @throws IOException If there is any problem with establishing the connection.
      * @see org.apache.commons.net.SocketClient#_connectAction_()
      */
     @Override
     protected void _connectAction_() throws IOException {
         // Implicit mode.
         if (isImplicit) {
             applySocketAttributes();
             sslNegotiation();
         }
         super._connectAction_();
         // Explicit mode.
         if (!isImplicit) {
             execAUTH();
             sslNegotiation();
         }
     }
 
     /**
      * Returns a socket of the data connection. Wrapped as an {@link SSLSocket}, which carries out handshake processing.
      *
      * @param command The int representation of the FTP command to send.
      * @param arg     The arguments to the FTP command. If this parameter is set to null, then the command is sent with no arguments.
      * @return corresponding to the established data connection. Null is returned if an FTP protocol error is reported at any point during the establishment and
      *         initialization of the connection.
      * @throws IOException If there is any problem with the connection.
      * @see FTPClient#_openDataConnection_(int, String)
      * @deprecated (3.3) Use {@link FTPClient#_openDataConnection_(FTPCmd, String)} instead
      */
     @Override
     // Strictly speaking this is not needed, but it works round a Clirr bug
     // So rather than invoke the parent code, we do it here
     @Deprecated
     protected Socket _openDataConnection_(final int command, final String arg) throws IOException {
         return _openDataConnection_(FTPCommand.getCommand(command), arg);
     }
 
     /**
      * Returns a socket of the data connection. Wrapped as an {@link SSLSocket}, which carries out handshake processing.
      *
      * @param command The textual representation of the FTP command to send.
      * @param arg     The arguments to the FTP command. If this parameter is set to null, then the command is sent with no arguments.
      * @return corresponding to the established data connection. Null is returned if an FTP protocol error is reported at any point during the establishment and
      *         initialization of the connection.
      * @throws IOException If there is any problem with the connection.
      * @see FTPClient#_openDataConnection_(int, String)
      * @since 3.2
      */
     @Override
     protected Socket _openDataConnection_(final String command, final String arg) throws IOException {
         final Socket socket = openDataSecureConnection(command, arg);
         _prepareDataSocket_(socket);
         if (socket instanceof SSLSocket) {
             final SSLSocket sslSocket = (SSLSocket) socket;
 
             sslSocket.setUseClientMode(isClientMode);
             sslSocket.setEnableSessionCreation(isCreation);
 
             // server mode
             if (!isClientMode) {
                 sslSocket.setNeedClientAuth(isNeedClientAuth);
                 sslSocket.setWantClientAuth(isWantClientAuth);
             }
             if (suites != null) {
                 sslSocket.setEnabledCipherSuites(suites);
             }
             if (protocols != null) {
                 sslSocket.setEnabledProtocols(protocols);
             }
             sslSocket.startHandshake();
         }
 
         return socket;
     }
 
     /**
      * Performs any custom initialization for a newly created SSLSocket (before the SSL handshake happens). Called by {@link #_openDataConnection_(int, String)}
      * immediately after creating the socket. The default implementation is a no-op
      *
      * @param socket the socket to set up
      * @throws IOException on error
      * @since 3.1
      */
     protected void _prepareDataSocket_(final Socket socket) throws IOException {
     }
 
     /**
      * Check the value that can be set in PROT Command value.
      *
      * @param prot Data Channel Protection Level.
      * @return True - A set point is right / False - A set point is not right
      */
     private boolean checkPROTValue(final String prot) {
         for (final String element : PROT_COMMAND_VALUE) {
             if (element.equals(prot)) {
                 return true;
             }
         }
         return false;
     }
 
     /**
      * Closes sockets.
      *
      * @param socket    main socket for proxy if enabled.
      * @param sslSocket SSL socket.
      * @throws IOException closing sockets is not successful.
      */
     private void closeSockets(final Socket socket, final Socket sslSocket) throws IOException {
         IOUtils.close(socket, sslSocket);
     }
 
     /**
      * Create SSL socket from plain socket.
      *
      * @param socket
      * @return SSL Socket
      * @throws IOException
      */
     private SSLSocket createSSLSocket(final Socket socket) throws IOException {
         if (socket != null) {
             final SSLSocketFactory f = context.getSocketFactory();
             return (SSLSocket) f.createSocket(socket, _hostname_, socket.getPort(), false);
         }
         return null;
     }
 
     /**
      * Closes the connection to the FTP server and restores connection parameters to the default values.
      * <p>
      * Calls {@code setSocketFactory(null)} and {@code setServerSocketFactory(null)} to reset the factories that may have been changed during the session, e.g.
      * by {@link #execPROT(String)}
      *
      * @throws IOException If an error occurs while disconnecting.
      * @since 3.0
      */
     @Override
     public void disconnect() throws IOException {
         super.disconnect();
         IOUtils.close(plainSocket);
         setSocketFactory(null);
         setServerSocketFactory(null);
     }
 
     /**
      * Sends the ADAT command with the specified authentication data.
      *
      * @param data The data to send with the command.
      * @return server reply.
      * @throws IOException If an I/O error occurs while sending the command.
      * @since 3.0
      */
     public int execADAT(final byte[] data) throws IOException {
         if (data != null) {
             return sendCommand(CMD_ADAT, Base64.getEncoder().encodeToString(data));
         }
         return sendCommand(CMD_ADAT);
     }
 
     /**
      * Sends the AUTH command.
      *
      * @throws SSLException If the server reply code equals neither "234" nor "334".
      * @throws IOException  If an I/O error occurs while either sending the command.
      */
     protected void execAUTH() throws SSLException, IOException {
         final int replyCode = sendCommand(CMD_AUTH, auth);
         if (FTPReply.SECURITY_MECHANISM_IS_OK == replyCode) {
             // replyCode = 334
             // I carry out an ADAT command.
         } else if (FTPReply.SECURITY_DATA_EXCHANGE_COMPLETE != replyCode) {
             throw new SSLException(getReplyString());
         }
     }
 
     /**
      * Sends the AUTH command with the specified mechanism.
      *
      * @param mechanism The mechanism name to send with the command.
      * @return server reply.
      * @throws IOException If an I/O error occurs while sending the command.
      * @since 3.0
      */
     public int execAUTH(final String mechanism) throws IOException {
         return sendCommand(CMD_AUTH, mechanism);
     }
 
     /**
      * Sends the CCC command to the server. The CCC (Clear Command Channel) command causes the underlying {@link SSLSocket} instance to be assigned to a plain
      * {@link Socket} instances
      *
      * @return server reply.
      * @throws IOException If an I/O error occurs while sending the command.
      * @since 3.0
      */
     public int execCCC() throws IOException {
 
 // This will be performed by sendCommand(String, String)
 //        if (FTPReply.isPositiveCompletion(repCode)) {
 //            _socket_.close();
 //            _socket_ = plainSocket;
 //            _controlInput_ = new BufferedReader(
 //                new InputStreamReader(
 //                    _socket_.getInputStream(), getControlEncoding()));
 //            _controlOutput_ = new BufferedWriter(
 //                new OutputStreamWriter(
 //                    _socket_.getOutputStream(), getControlEncoding()));
 //        }
         return sendCommand(CMD_CCC);
     }
 
     /**
      * Sends the CONF command with the specified data.
      *
      * @param data The data to send with the command.
      * @return server reply.
      * @throws IOException If an I/O error occurs while sending the command.
      * @since 3.0
      */
     public int execCONF(final byte[] data) throws IOException {
         if (data != null) {
             return sendCommand(CMD_CONF, Base64.getEncoder().encodeToString(data));
         }
         return sendCommand(CMD_CONF, ""); // perhaps "=" or just sendCommand(String)?
     }
 
     /**
      * Sends the ENC command with the specified data.
      *
      * @param data The data to send with the command.
      * @return server reply.
      * @throws IOException If an I/O error occurs while sending the command.
      * @since 3.0
      */
     public int execENC(final byte[] data) throws IOException {
         if (data != null) {
             return sendCommand(CMD_ENC, Base64.getEncoder().encodeToString(data));
         }
         return sendCommand(CMD_ENC, ""); // perhaps "=" or just sendCommand(String)?
     }
 
     /**
      * Sends the MIC command with the specified data.
      *
      * @param data The data to send with the command.
      * @return server reply.
      * @throws IOException If an I/O error occurs while sending the command.
      * @since 3.0
      */
     public int execMIC(final byte[] data) throws IOException {
         if (data != null) {
             return sendCommand(CMD_MIC, Base64.getEncoder().encodeToString(data));
         }
         return sendCommand(CMD_MIC, ""); // perhaps "=" or just sendCommand(String)?
     }
 
     /**
      * PBSZ command. pbsz value: 0 to (2^32)-1 decimal integer.
      *
      * @param pbsz Protection Buffer Size.
      * @throws SSLException If the server reply code does not equal "200".
      * @throws IOException  If an I/O error occurs while sending the command.
      * @see #parsePBSZ(long)
      */
     public void execPBSZ(final long pbsz) throws SSLException, IOException {
         if (pbsz < 0 || 4294967295L < pbsz) { // 32-bit unsigned number
             throw new IllegalArgumentException();
         }
         final int status = sendCommand(CMD_PBSZ, String.valueOf(pbsz));
         if (FTPReply.COMMAND_OK != status) {
             throw new SSLException(getReplyString());
         }
     }
 
     /**
      * PROT command.
      * <ul>
      * <li>C - Clear</li>
      * <li>S - Safe(SSL protocol only)</li>
      * <li>E - Confidential(SSL protocol only)</li>
      * <li>P - Private</li>
      * </ul>
      * <strong>N.B.</strong> the method calls {@link #setSocketFactory(javax.net.SocketFactory)} and
      * {@link #setServerSocketFactory(javax.net.ServerSocketFactory)}
      *
      * @param prot Data Channel Protection Level, if {@code null}, use {@link #DEFAULT_PROT}.
      * @throws SSLException If the server reply code does not equal {@code 200}.
      * @throws IOException  If an I/O error occurs while sending the command.
      */
     public void execPROT(String prot) throws SSLException, IOException {
         if (prot == null) {
             prot = DEFAULT_PROT;
         }
         if (!checkPROTValue(prot)) {
             throw new IllegalArgumentException();
         }
         if (FTPReply.COMMAND_OK != sendCommand(CMD_PROT, prot)) {
             throw new SSLException(getReplyString());
         }
         if (DEFAULT_PROT.equals(prot)) {
             setSocketFactory(null);
             setServerSocketFactory(null);
         } else {
             setSocketFactory(new FTPSSocketFactory(context));
             setServerSocketFactory(new FTPSServerSocketFactory(context));
             initSslContext();
         }
     }
 
     /**
      * Extract the data from a reply with a prefix, e.g. PBSZ=1234 => 1234
      *
      * @param prefix the prefix to find
      * @param reply  where to find the prefix
      * @return the remainder of the string after the prefix, or null if the prefix was not present.
      */
     private String extractPrefixedData(final String prefix, final String reply) {
         final int idx = reply.indexOf(prefix);
         if (idx == -1) {
             return null;
         }
         // Cannot use trim before substring as leading space would affect the offset.
         return reply.substring(idx + prefix.length()).trim();
     }
 
     /**
      * Gets AUTH command use value.
      *
      * @return AUTH command use value.
      */
     public String getAuthValue() {
         return auth;
     }
 
     /**
      * Gets the names of the cipher suites which could be enabled for use on this connection. When the underlying {@link Socket} is not an {@link SSLSocket}
      * instance, returns null.
      *
      * @return An array of cipher suite names, or {@code null}
      */
     public String[] getEnabledCipherSuites() {
         if (_socket_ instanceof SSLSocket) {
             return ((SSLSocket) _socket_).getEnabledCipherSuites();
         }
         return null;
     }
 
     /**
      * Gets the names of the protocol versions which are currently enabled for use on this connection. When the underlying {@link Socket} is not an
      * {@link SSLSocket} instance, returns null.
      *
      * @return An array of protocols, or {@code null}
      */
     public String[] getEnabledProtocols() {
         if (_socket_ instanceof SSLSocket) {
             return ((SSLSocket) _socket_).getEnabledProtocols();
         }
         return null;
     }
 
     /**
      * Gets true if new SSL sessions may be established by this socket. When the underlying {@link Socket} instance is not SSL-enabled (i.e. an instance of
      * {@link SSLSocket} with {@link SSLSocket}{@link #getEnableSessionCreation()}) enabled, this returns False.
      *
      * @return true - Indicates that sessions may be created; this is the default. false - indicates that an existing session must be resumed.
      */
     public boolean getEnableSessionCreation() {
         if (_socket_ instanceof SSLSocket) {
             return ((SSLSocket) _socket_).getEnableSessionCreation();
         }
         return false;
     }
 
     /**
      * Gets the currently configured {@link HostnameVerifier}. The verifier is only used on client mode connections.
      *
      * @return A HostnameVerifier instance.
      * @since 3.4
      */
     public HostnameVerifier getHostnameVerifier() {
         return hostnameVerifier;
     }
 
     /**
      * Gets the {@link KeyManager} instance.
      *
      * @return The {@link KeyManager} instance
      */
     private KeyManager getKeyManager() {
         return keyManager;
     }
 
     /**
      * Gets true if the socket will require client authentication. When the underlying {@link Socket} is not an {@link SSLSocket} instance, returns false.
      *
      * @return true - If the server mode socket should request that the client authenticate itself.
      */
     public boolean getNeedClientAuth() {
         if (_socket_ instanceof SSLSocket) {
             return ((SSLSocket) _socket_).getNeedClientAuth();
         }
         return false;
     }
 
     /**
      * Gets the secure socket protocol to be used, e.g. SSL/TLS.
      *
      * @return the protocol
      * @since 3.11.0
      */
     protected String getProtocol() {
         return protocol;
     }
 
     /**
      * Gets the protocol versions. The {@link #getEnabledProtocols()} method gets the value from the socket while
      * this method gets its value from this instance's config.
      *
      * @return a clone of the protocols, may be null
      * @since 3.11.0
      */
     protected String[] getProtocols() {
         return protocols == null ? null : protocols.clone();
     }
 
     /**
      * Gets the cipher suites. The {@link #getEnabledCipherSuites()} method gets the value from the socket while
      * this method gets its value from this instance's config.
      *
      * @return a clone of the suites, may be null
      * @since 3.11.0
      */
     protected String[] getSuites() {
         return suites == null ? null : suites.clone();
     }
 
     /**
      * Gets the currently configured {@link TrustManager}.
      *
      * @return A TrustManager instance.
      */
     public TrustManager getTrustManager() {
         return trustManager;
     }
 
     /**
      * Gets whether the socket is set to use client mode in its first handshake. When the underlying {@link Socket} is not an {@link SSLSocket} instance,
      * returns false.
      *
      * @return true - If the socket should start its first handshake in "client" mode.
      */
     public boolean getUseClientMode() {
         if (_socket_ instanceof SSLSocket) {
             return ((SSLSocket) _socket_).getUseClientMode();
         }
         return false;
     }
 
     /**
      * Gets whether the socket will request client authentication. When the underlying {@link Socket} is not an {@link SSLSocket} instance, returns false.
      *
      * @return true - If the server mode socket should request that the client authenticate itself.
      */
     public boolean getWantClientAuth() {
         if (_socket_ instanceof SSLSocket) {
             return ((SSLSocket) _socket_).getWantClientAuth();
         }
         return false;
     }
 
     /**
      * Performs a lazy init of the SSL context
      *
      * @throws IOException
      */
     private void initSslContext() throws IOException {
         if (context == null) {
             context = SSLContextUtils.createSSLContext(protocol, getKeyManager(), getTrustManager());
         }
     }
 
     /**
      * Tests the use client mode flag. The {@link #getUseClientMode()} method gets the value from the socket while
      * this method gets its value from this instance's config.
      *
      * @return True If the socket should start its first handshake in "client" mode.
      * @since 3.11.0
      */
     protected boolean isClientMode() {
         return isClientMode;
     }
 
     /**
      * Tests whether a new SSL session may be established by this socket. Default true
      *
      * @return True if session may be established
      * @since 3.11.0
      */
     protected boolean isCreation() {
         return isCreation;
     }
 
     /**
      * Tests whether or not endpoint identification using the HTTPS algorithm on Java 1.7+ is enabled. The default behavior is for this to be disabled.
      *
      * This check is only performed on client mode connections.
      *
      * @return True if enabled, false if not.
      * @since 3.4
      */
     public boolean isEndpointCheckingEnabled() {
         return tlsEndpointChecking;
     }
 
     /**
      * Tests the security mode. (True - Implicit Mode / False - Explicit Mode).
      *
      * @return True if enabled, false if not.
      * @since 3.11.0
      */
     protected boolean isImplicit() {
         return isImplicit;
     }
 
     /**
      * Tests the need client auth flag. The {@link #getNeedClientAuth()} method gets the value from the socket while
      * this method gets its value from this instance's config.
      *
      * @return True if enabled, false if not.
      * @since 3.11.0
      */
     protected boolean isNeedClientAuth() {
         return isNeedClientAuth;
     }
 
     /**
      * Tests the want client auth flag. The {@link #getWantClientAuth()} method gets the value from the socket while
      * this method gets its value from this instance's config.
      *
      * @return True if enabled, false if not.
      * @since 3.11.0
      */
     protected boolean isWantClientAuth() {
         return isWantClientAuth;
     }
 
     /**
      * Establishes a data connection with the FTP server, returning a Socket for the connection if successful. If a restart offset has been set with
      * {@link #setRestartOffset(long)}, a REST command is issued to the server with the offset as an argument before establishing the data connection. Active
      * mode connections also cause a local PORT command to be issued.
      *
      * @param command The text representation of the FTP command to send.
      * @param arg     The arguments to the FTP command. If this parameter is set to null, then the command is sent with no argument.
      * @return A Socket corresponding to the established data connection. Null is returned if an FTP protocol error is reported at any point during the
      *         establishment and initialization of the connection.
      * @throws IOException If an I/O error occurs while either sending a command to the server or receiving a reply from the server.
      * @since 3.1
      */
     private Socket openDataSecureConnection(final String command, final String arg) throws IOException {
         if (getDataConnectionMode() != ACTIVE_LOCAL_DATA_CONNECTION_MODE && getDataConnectionMode() != PASSIVE_LOCAL_DATA_CONNECTION_MODE) {
             return null;
         }
 
         final boolean isInet6Address = getRemoteAddress() instanceof Inet6Address;
 
         final Socket socket;
         Socket sslSocket = null;
         final int soTimeoutMillis = DurationUtils.toMillisInt(getDataTimeout());
         if (getDataConnectionMode() == ACTIVE_LOCAL_DATA_CONNECTION_MODE) {
             // if no activePortRange was set (correctly) -> getActivePort() = 0
             // -> new ServerSocket(0) -> bind to any free local port
             try (ServerSocket server = _serverSocketFactory_.createServerSocket(getActivePort(), 1, getHostAddress())) {
                 // Try EPRT only if remote server is over IPv6, if not use PORT,
                 // because EPRT has no advantage over PORT on IPv4.
                 // It could even have the disadvantage,
                 // that EPRT will make the data connection fail, because
                 // today's intelligent NAT Firewalls are able to
                 // substitute IP addresses in the PORT command,
                 // but might not be able to recognize the EPRT command.
                 if (isInet6Address) {
                     if (!FTPReply.isPositiveCompletion(eprt(getReportHostAddress(), server.getLocalPort()))) {
                         return null;
                     }
                 } else if (!FTPReply.isPositiveCompletion(port(getReportHostAddress(), server.getLocalPort()))) {
                     return null;
                 }
 
                 if (getRestartOffset() > 0 && !restart(getRestartOffset()) || !FTPReply.isPositivePreliminary(sendCommand(command, arg))) {
                     return null;
                 }
 
                 // For now, let's just use the data timeout value for waiting for
                 // the data connection. It may be desirable to let this be a
                 // separately configurable value. In any case, we really want
                 // to allow preventing the accept from blocking indefinitely.
                 if (soTimeoutMillis >= 0) {
                     server.setSoTimeout(soTimeoutMillis);
                 }
                 socket = server.accept();
 
                 // Ensure the timeout is set before any commands are issued on the new socket
                 if (soTimeoutMillis >= 0) {
                     socket.setSoTimeout(soTimeoutMillis);
                 }
                 if (getReceiveDataSocketBufferSize() > 0) {
                     socket.setReceiveBufferSize(getReceiveDataSocketBufferSize());
                 }
                 if (getSendDataSocketBufferSize() > 0) {
                     socket.setSendBufferSize(getSendDataSocketBufferSize());
                 }
             }
         } else { // We must be in PASSIVE_LOCAL_DATA_CONNECTION_MODE
 
             // Try EPSV command first on IPv6 - and IPv4 if enabled.
             // When using IPv4 with NAT it has the advantage
             // to work with more rare configurations.
             // E.g. if FTP server has a static PASV address (external network)
             // and the client is coming from another internal network.
             // In that case the data connection after PASV command would fail,
             // while EPSV would make the client succeed by taking just the port.
             final boolean attemptEPSV = isUseEPSVwithIPv4() || isInet6Address;
             if (attemptEPSV && epsv() == FTPReply.ENTERING_EPSV_MODE) {
                 _parseExtendedPassiveModeReply(_replyLines.get(0));
             } else {
                 // If EPSV failed on IPV4, revert to PASV
                 if (isInet6Address || pasv() != FTPReply.ENTERING_PASSIVE_MODE) {
                     return null;
                 }
                 _parsePassiveModeReply(_replyLines.get(0));
             }
 
             if (getProxy() != null) {
                 socket = new Socket(getProxy());
             } else {
                 socket = _socketFactory_.createSocket();
             }
 
             if (getReceiveDataSocketBufferSize() > 0) {
                 socket.setReceiveBufferSize(getReceiveDataSocketBufferSize());
             }
             if (getSendDataSocketBufferSize() > 0) {
                 socket.setSendBufferSize(getSendDataSocketBufferSize());
             }
             if (getPassiveLocalIPAddress() != null) {
                 socket.bind(new InetSocketAddress(getPassiveLocalIPAddress(), 0));
             }
 
             // For now, let's just use the data timeout value for waiting for
             // the data connection. It may be desirable to let this be a
             // separately configurable value. In any case, we really want
             // to allow preventing the accept from blocking indefinitely.
             if (soTimeoutMillis >= 0) {
                 socket.setSoTimeout(soTimeoutMillis);
             }
 
             socket.connect(new InetSocketAddress(getPassiveHost(), getPassivePort()), connectTimeout);
 
             if (getProxy() != null) {
                 sslSocket = context.getSocketFactory().createSocket(socket, getPassiveHost(), getPassivePort(), true);
             }
 
             if (getRestartOffset() > 0 && !restart(getRestartOffset()) || !FTPReply.isPositivePreliminary(sendCommand(command, arg))) {
                 closeSockets(socket, sslSocket);
                 return null;
             }
         }
 
         if (isRemoteVerificationEnabled() && !verifyRemote(socket)) {
             // Grab the host before we close the socket to avoid NET-663
             final InetAddress socketHost = socket.getInetAddress();
 
             closeSockets(socket, sslSocket);
 
             throw new IOException(
                     "Host attempting data connection " + socketHost.getHostAddress() + " is not same as server " + getRemoteAddress().getHostAddress());
         }
 
         return getProxy() != null ? sslSocket : socket;
     }
 
     /**
      * Parses the given ADAT response line and base64-decodes the data.
      *
      * @param reply The ADAT reply to parse.
      * @return the data in the reply, base64-decoded.
      * @since 3.0
      */
     public byte[] parseADATReply(final String reply) {
         if (reply == null) {
             return null;
         }
         return Base64.getDecoder().decode(extractPrefixedData("ADAT=", reply));
     }
 
     /**
      * PBSZ command. pbsz value: 0 to (2^32)-1 decimal integer. Issues the command and parses the response to return the negotiated value.
      *
      * @param pbsz Protection Buffer Size.
      * @throws SSLException If the server reply code does not equal "200".
      * @throws IOException  If an I/O error occurs while sending the command.
      * @return the negotiated value.
      * @see #execPBSZ(long)
      * @since 3.0
      */
     public long parsePBSZ(final long pbsz) throws SSLException, IOException {
         execPBSZ(pbsz);
         long minvalue = pbsz;
         final String remainder = extractPrefixedData("PBSZ=", getReplyString());
         if (remainder != null) {
             final long replysz = Long.parseLong(remainder);
             if (replysz < minvalue) {
                 minvalue = replysz;
             }
         }
         return minvalue;
     }
 
     // DEPRECATED - for API compatibility only - DO NOT USE
 
     /**
      * Send an FTP command. A successful CCC (Clear Command Channel) command causes the underlying {@link SSLSocket} instance to be assigned to a plain
      * {@link Socket}
      *
      * @param command The FTP command.
      * @return server reply.
      * @throws IOException  If an I/O error occurs while sending the command.
      * @throws SSLException if a CCC command fails
      * @see org.apache.commons.net.ftp.FTP#sendCommand(String)
      */
     // Would like to remove this method, but that will break any existing clients that are using CCC
     @Override
     public int sendCommand(final String command, final String args) throws IOException {
         final int repCode = super.sendCommand(command, args);
         /* If CCC is issued, restore socket i/o streams to unsecured versions */
         if (CMD_CCC.equals(command)) {
             if (FTPReply.COMMAND_OK != repCode) {
                 throw new SSLException(getReplyString());
             }
             _socket_.close();
             _socket_ = plainSocket;
             _controlInput_ = new BufferedReader(new InputStreamReader(_socket_.getInputStream(), getControlEncoding()));
             _controlOutput_ = new BufferedWriter(new OutputStreamWriter(_socket_.getOutputStream(), getControlEncoding()));
         }
         return repCode;
     }
 
     /**
      * Sets AUTH command use value. This processing is done before connected processing.
      *
      * @param auth AUTH command use value.
      */
     public void setAuthValue(final String auth) {
         this.auth = auth;
     }
 
     /**
      * Sets which particular cipher suites are enabled for use on this connection. Called before server negotiation.
      *
      * @param cipherSuites The cipher suites.
      */
     public void setEnabledCipherSuites(final String[] cipherSuites) {
         suites = cipherSuites.clone();
     }
 
     /**
      * Sets which particular protocol versions are enabled for use on this connection. I perform setting before a server negotiation.
      *
      * @param protocolVersions The protocol versions.
      */
     public void setEnabledProtocols(final String[] protocolVersions) {
         protocols = protocolVersions.clone();
     }
 
     /**
      * Sets whether a new SSL session may be established by this socket.
      *
      * @param isCreation The established socket flag.
      */
     public void setEnabledSessionCreation(final boolean isCreation) {
         this.isCreation = isCreation;
     }
 
     /**
      * Sets automatic endpoint identification checking using the HTTPS algorithm is supported on Java 1.7+. The default behavior is for this to be disabled.
      *
      * This check is only performed on client mode connections.
      *
      * @param enable Enable automatic endpoint identification checking using the HTTPS algorithm on Java 1.7+.
      * @since 3.4
      */
     public void setEndpointCheckingEnabled(final boolean enable) {
         tlsEndpointChecking = enable;
     }
 
     /**
      * Sets to override the default {@link HostnameVerifier} to use. The verifier is only used on client mode connections.
      *
      * @param newHostnameVerifier The HostnameVerifier implementation to set or {@code null} to disable.
      * @since 3.4
      */
     public void setHostnameVerifier(final HostnameVerifier newHostnameVerifier) {
         hostnameVerifier = newHostnameVerifier;
     }
 
     /**
      * Sets a {@link KeyManager} to use
      *
      * @param keyManager The KeyManager implementation to set.
      * @see org.apache.commons.net.util.KeyManagerUtils
      */
     public void setKeyManager(final KeyManager keyManager) {
         this.keyManager = keyManager;
     }
 
     /**
      * Sets the socket to require client authentication.
      *
      * @param isNeedClientAuth The need client auth flag.
      */
     public void setNeedClientAuth(final boolean isNeedClientAuth) {
         this.isNeedClientAuth = isNeedClientAuth;
     }
 
     /**
      * Sets to override the default {@link TrustManager} to use; if set to {@code null}, the default TrustManager from the JVM will be used.
      *
      * @param trustManager The TrustManager implementation to set, may be {@code null}
      * @see org.apache.commons.net.util.TrustManagerUtils
      */
     public void setTrustManager(final TrustManager trustManager) {
         this.trustManager = trustManager;
     }
 
     /**
      * Sets the socket to use client (or server) mode in its first handshake.
      *
      * @param isClientMode The use client mode flag.
      */
     public void setUseClientMode(final boolean isClientMode) {
         this.isClientMode = isClientMode;
     }
 
     /**
      * Sets the socket to request client authentication, but only if such a request is appropriate to the cipher suite negotiated.
      *
      * @param isWantClientAuth The want client auth flag.
      */
     public void setWantClientAuth(final boolean isWantClientAuth) {
         this.isWantClientAuth = isWantClientAuth;
     }
 
     /**
      * SSL/TLS negotiation. Acquires an SSL socket of a control connection and carries out handshake processing.
      *
      * @throws IOException If server negotiation fails
      */
     protected void sslNegotiation() throws IOException {
         plainSocket = _socket_;
         initSslContext();
         final SSLSocket socket = createSSLSocket(_socket_);
         socket.setEnableSessionCreation(isCreation);
         socket.setUseClientMode(isClientMode);
 
         // client mode
         if (isClientMode) {
             if (tlsEndpointChecking) {
                 SSLSocketUtils.enableEndpointNameVerification(socket);
             }
         } else { // server mode
             socket.setNeedClientAuth(isNeedClientAuth);
             socket.setWantClientAuth(isWantClientAuth);
         }
 
         if (protocols != null) {
             socket.setEnabledProtocols(protocols);
         }
         if (suites != null) {
             socket.setEnabledCipherSuites(suites);
         }
         socket.startHandshake();
 
         // TODO the following setup appears to duplicate that in the super class methods
         _socket_ = socket;
         _controlInput_ = new BufferedReader(new InputStreamReader(socket.getInputStream(), getControlEncoding()));
         _controlOutput_ = new BufferedWriter(new OutputStreamWriter(socket.getOutputStream(), getControlEncoding()));
 
         if (isClientMode && hostnameVerifier != null && !hostnameVerifier.verify(_hostname_, socket.getSession())) {
             throw new SSLHandshakeException("Hostname doesn't match certificate");
         }
     }
 }