
    R                       S SK Jr  S SKrS SKrS SKrS SKrS SKrS SKrS SKJ	r	  S SK
r
S SKJrJr  S SKJrJr  S SKJr  S SKJr  SrSS	 jr\R.                  SSS
 jj5       r\R.                  SS j5       rS S!S jjr S      S"S jjr\R.                  SSS jj5       r\R.                  SS j5       r\R.                  SS!S jj5       rS S!S jjr S      S#S jjrS$S jr " S S\5      r " S S\5      r " S S\5      r " S S5      r g)%    )annotationsN)mock)
DEFAULT_CADEFAULT_CERTS)SocketDummyServerTestCaseconsume_socket)ssl_)SSLTransport<   c                 V   [        [        S5      (       a$  [        R                  " [        R                  5      n W R	                  [
        S   [
        S   5        [        [        S5      (       a$  [        R                  " [        R                  5      nWR                  [        5        X4$ )NPROTOCOL_TLS_SERVERcertfilekeyfilePROTOCOL_TLS_CLIENT)	hasattrssl
SSLContextr   load_cert_chainr   r   load_verify_locationsr   )server_contextclient_contexts     =platform/gsutil/third_party/urllib3/test/test_ssltransport.pyserver_client_ssl_contextsr      sw    s)**(?(?@""=#<mI>VWs)**(?(?@((4))    c                    g N binarys    r   sample_requestr    "       r   c                    g r   r   r   s    r   r    r    '   r!   r   c                :    SnU (       a  U$ UR                  S5      $ )NsY   GET http://www.testing.com/ HTTP/1.1
Host: www.testing.com
User-Agent: awesome-test

utf-8decode)r   requests     r   r    r    ,   s$    	  79'.."99r   c                2    U c   e[        U5      nX:X  d   eg r   )r    )provided_requestr   expected_requests      r   validate_requestr+   6   s'     '''%f-///r   c                    g r   r   r   s    r   sample_responser-   >   r!   r   c                    g r   r   r   s    r   r-   r-   C   r!   r   c                    g r   r   r   s    r   r-   r-   H   r!   r   c                :    SnU (       a  U$ UR                  S5      $ )Ns&   HTTP/1.1 200 OK
Content-Length: 0

r$   r%   )r   responses     r   r-   r-   M   s    >H8;8??7#;;r   c                2    U c   e[        U5      nX:X  d   eg r   )r-   )provided_responser   expected_responses      r   validate_responser5   R   s'     ((('/111r   c                    U R                  SS9n[        U5      [        L d   e[        U5      S:  d   eU R                  5       n[        U5      [        L d   eSU;   d   eUS   S:w  d   eg )NT)binary_formr   serialNumber )getpeercerttypebyteslendict)
ssl_socketbinary_certcerts      r   validate_peercertrB   Z   s|    ((T(:K%%%{a!!#D:T!!!2%%%r   c                  2   \ rS rSrSr\SS j5       r  S     SS jjr\R                  R                  \5      SS j5       r\R                  R                  \5      SS j5       r\R                  R                  \5      SS j5       r\R                  R                  \5      SS	 j5       r\R                  R                  \5      SS
 j5       r\R                  R                  \5      SS j5       r\R                  R                  \5      SS j5       rSrg)SingleTLSLayerTestCasee   zh
Uses the SocketDummyServer to validate a single TLS layer can be
established through the SSLTransport.
c                2    [        5       u  U l        U l        g r   r   r   r   clss    r   setup_class"SingleTLSLayerTestCase.setup_classk       1K1M.C.r   Nc                ~   ^ ^^ [         R                  " 5       mSUU U4S jjnU(       a  UOUnT R                  UTS9  g )Nc                @  > U R                  5       S   n TR                  R                  USS9 n[        UTS9nT(       d
   S S S 5        g [	        U5        UR                  [        5       5        S S S 5        g ! , (       d  f       g = f! [        [        4 a     g f = f)Nr   Tserver_side
quit_event)	acceptr   wrap_socketr   r+   sendr-   ConnectionAbortedErrorConnectionResetError)listenersockssockr'   rR   selfvalidates       r   socket_handlerASingleTLSLayerTestCase.start_dummy_server.<locals>.socket_handlerv   s    ??$Q'D((44Tt4LPU,#-G $ ML %W-JJ01 MLL +,@A s:   B
 A9B
 $A90B
 9
BB
 B
 
BBrQ   rX   socket.socketreturnNone)	threadingEvent_start_server)r[   handlerr\   r]   chosen_handlerrR   s   ` `  @r   start_dummy_server)SingleTLSLayerTestCase.start_dummy_servero   s9    
 __&
	 	 %,>jAr   c                   [         R                   " [         R                  5      n[        R                  " 5       nUR	                  5         [
        R                  " [        5         [        X5        SSS5        g! , (       d  f       g= f)z=Errors generated from an unconnected socket should bubble up.N)	socketAF_INETr   create_default_contextclosepytestraisesOSErrorr
   )r[   rY   contexts      r   test_start_closed_socket/SingleTLSLayerTestCase.test_start_closed_socket   sM     }}V^^,,,.

]]7#' $##s   $A99
Bc                   U R                  SS9  [        R                  " U R                  U R                  45      n[        XR                  SS9 nUR                  5         [        R                  " [        5         UR                  S5        SSS5        SSS5        g! , (       d  f       N= f! , (       d  f       g= f)z"Socket errors should be bubbled upF)r\   	localhostserver_hostnames   blaaarghN)rh   rk   create_connectionhostportr
   r   rn   ro   rp   rq   rU   )r[   rY   rZ   s      r   test_close_after_handshake1SingleTLSLayerTestCase.test_close_after_handshake   s     	/''DII(>?%%{
KKMw'

;' (	
 
 ('	
 
s$   +B/;BB/
B,	(B//
B=c                \   U R                  5         [        R                  " U R                  U R                  45      n[        XR                  SS9 nUR                  5       c   eUR                  [        5       5        [        U5      n[        U5        SSS5        g! , (       d  f       g= f)z0Validates a single TLS layer can be established.rv   rw   N)rh   rk   ry   rz   r{   r
   r   versionrU   r    r   r5   r[   rY   rZ   r1   s       r   test_wrap_existing_socket0SingleTLSLayerTestCase.test_wrap_existing_socket   s     	!''DII(>?%%{
==?...JJ~'(%e,Hh'
 
 
s   AB
B+c                   U R                  5         [        R                  " U R                  U R                  45      n[        XR                  SS9 n[        R                  " [        5         UR                  SSS9  S S S 5        UR                  [        5       5        [        U5      n[        U5        S S S 5        g ! , (       d  f       NF= f! , (       d  f       g = f)Nrv   rw   rr   )	buffering)rh   rk   ry   rz   r{   r
   r   ro   rp   
ValueErrormakefilerU   r    r   r5   r   s       r   test_unbuffered_text_makefile4SingleTLSLayerTestCase.test_unbuffered_text_makefile   s    !''DII(>?%%{
z*sa0 +JJ~'(%e,Hh'
 
 +*
 
s$   C,B==7C=
C	C
Cc                  ^  SU 4S jjnT R                  U5        [        R                  " T R                  T R                  45       n[        UT R                  SS9nUR                  [        5       5        [        U5      n[        U5        UR                  5         UR                  [        5       5        [        U5      n[        U5        SSS5        g! , (       d  f       g= f)zn
Validates we can break up the TLS layer
A full request/response is sent over TLS, and later over plain text.
c                  > U R                  5       S    nTR                  R                  USS9 n[        U5      n[	        U5        UR                  [        5       5        UR                  5        n[        U5      n[	        U5        UR                  [        5       5        S S S 5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       N(= f! , (       d  f       g = fNr   TrO   )rS   r   rT   r   r+   sendallr-   unwrap)rX   rY   ssl_sockr'   unwrapped_sockr[   s        r   shutdown_handlerLSingleTLSLayerTestCase.test_unwrap_existing_socket.<locals>.shutdown_handler   s    "1%t/B/B/N/N$ 0O 0(2 )  !23__&.,^<G$W-"**?+<= '0%% '&0 0%%s;   CA C
00B9 C
(C9
CC


C	C
C)rv   rw   Nr_   )rh   rk   ry   rz   r{   r
   r   r   r    r   r5   r   )r[   r   rY   rZ   r1   s   `    r   test_unwrap_existing_socket2SingleTLSLayerTestCase.test_unwrap_existing_socket   s    	> 	 01%%tyy$))&<= t':':KXE MM.*+%e,Hh' LLNLL)*%d+Hh' >==s   BC
C"c                r   U R                  5         [        R                  " U R                  U R                  45      n[        XR                  SS9 nUR                  5       n[        U5      [        L d   eUR                  5       b   eUR                  5       b   eUR                  5       nUb#  [        U5      [        L a  [        U5      S:  d   eUR                  5       b   e[!        U5        UR#                  [%        5       5        ['        U5      n[)        U5        SSS5        g! , (       d  f       g= f)z)Ensures common ssl attributes are exposedrv   rw   Nr   )rh   rk   ry   rz   r{   r
   r   cipherr;   tupleselected_alpn_protocolselected_npn_protocolshared_cipherslistr=   compressionrB   rU   r    r   r5   )r[   rY   rZ   r   r   r1   s         r   test_ssl_object_attributes1SingleTLSLayerTestCase.test_ssl_object_attributes   s    	!''DII(>?%%{
\\^F<5((( //1999..0888"113N ")^$,^1Dq1H  $$&...e$JJ~'(%e,Hh'/
 
 
s   CD((
D6c                   U R                  5         [        R                  " U R                  U R                  45      n[        XR                  SS9 nUR                  5       c   eSnUR                  U5        UR                  5       U:X  d   eUR                  R                  5       U:X  d   eUR                  [        5       5        [        U5      n[        U5        SSS5        g! , (       d  f       g= f)z,Ensures common socket attributes are exposedrv   rw   N
   )rh   rk   ry   rz   r{   r
   r   fileno
settimeout
gettimeoutrU   r    r   r5   )r[   rY   rZ   test_timeoutr1   s        r   test_socket_object_attributes4SingleTLSLayerTestCase.test_socket_object_attributes   s     	!''DII(>?%%{
<<>---L\*##%555<<**,<<<JJ~'(%e,Hh'
 
 
s   BC&&
C4r   ra   rb   )NT)rf   z-typing.Callable[[socket.socket], None] | Noner\   boolra   rb   )__name__
__module____qualname____firstlineno____doc__classmethodrJ   rh   ro   marktimeoutPER_TEST_TIMEOUTrs   r|   r   r   r   r   r   __static_attributes__r   r   r   rD   rD   e   sI   
 N N
 BFB>B B 
	B2 [[)*( +( [[)*
( +
( [[)*( +( [[)*( +( [[)* ( + (D [[)*( +(< [[)*( +(r   rD   c                  V    \ rS rSrSr      SS jrS	S jr S
       SS jjrSrg)SocketProxyDummyServeri  zL
Simulates a proxy that performs a simple I/O loop on client/server
socket.
c                @    Xl         X l        [        5       u  U l        ng r   )destination_server_hostdestination_server_portr   
server_ctx)r[   r   r   _s       r   __init__SocketProxyDummyServer.__init__  s     (?$'>$79r   c                8   ^  SU 4S jjnT R                  U5        g)z
Socket handler for the proxy. Terminates the first TLS layer and tunnels
any bytes needed for client <-> server communicatin.
c                N  > U R                  5       S   nTR                  R                  USS9 n[        R                  " TR
                  TR                  45      nTR                  X#5        UR                  5         UR                  5         S S S 5        g ! , (       d  f       g = fr   )	rS   r   rT   rk   ry   r   r   _read_write_looprn   )rX   rY   client_sockupstream_sockr[   s       r   proxy_handlerASocketProxyDummyServer.start_proxy_handler.<locals>.proxy_handler#  s    ??$Q'D,,Tt,D & 8 81143O3OP! %%kA##%!!# EDDs   AB
B$Nr_   re   )r[   r   s   ` r   start_proxy_handler*SocketProxyDummyServer.start_proxy_handler  s    	$ 	=)r   c                X   X/nX/nU(       a  [         R                   " XEU5      u  pgnU(       a  g U HP  n	Su  pX:X  a  Un
UnOUn
UnX;   d  M   U
R                  U5      n[        U5      S:X  a    g UR                  U5        MR     U(       a  M  g g ! [        R
                   a       g f = f)N)NNr   )selectrecvr=   rU   r   SSLEOFError)r[   r   server_sockchunksinputsoutputreadablewritable	exceptionsread_socketwrite_socketbs                r   r   'SocketProxyDummyServer._read_write_loop/  s     ++,2MM&&,Q)H	 ,6)#"-K#.L"-K#.L  +',,V4q6Q; #$))!,#  f4 ??  	s    B1BB)(B))r   r   r   N)r   strr   intra   rb   r   )   )r   r`   r   r`   r   r   ra   rb   )	r   r   r   r   r   r   r   r   r   r   r   r   r   r     s^    
:'*:EH:	:*, 	'"' #' 	'
 
' 'r   r   c                  t  ^  \ rS rSrSr\SS j5       r\SS j5       r\SU 4S jj5       r\SS j5       r	\
R                  R                  \5      SS j5       r\
R                  R                  \5      SS j5       r\
R                  R                  \5      \
R                  R!                  S	S
S/5      SS j5       5       r\
R                  R%                  \R(                  " 5       S:H  SS9\
R                  R                  \5      SS j5       5       r\
R                  R                  \5      SS j5       rSrU =r$ )TlsInTlsTestCaseiY  a.  
Creates a TLS in TLS tunnel by chaining a 'SocketProxyDummyServer' and a
`SocketDummyServerTestCase`.

Client will first connect to the proxy, who will then proxy any bytes send
to the destination server. First TLS layer terminates at the proxy, second
TLS layer terminates at the destination server.
c                2    [        5       u  U l        U l        g r   rG   rH   s    r   rJ   TlsInTlsTestCase.setup_classc  rL   r   c                    [        U R                  U R                  5      U l        U R                  R	                  5         g r   )r   rz   r{   proxy_serverr   rH   s    r   start_proxy_server#TlsInTlsTestCase.start_proxy_serverg  s-     2#((CHHE,,.r   c                x   > [        U S5      (       a  U R                  R                  5         [        TU ]	  5         g )Nr   )r   r   teardown_classsuper)rI   	__class__s    r   r   TlsInTlsTestCase.teardown_classn  s-    3''++- r   c                8   ^  SU 4S jjnT R                  U5        g)zl
Socket handler for the destination_server. Terminates the second TLS
layer and send a basic HTTP response.
c                r  > U R                  5       S   n TR                  R                  USS9 n[        U5      n[	        U5        UR                  [        5       5        S S S 5        UR                  5         g ! , (       d  f       N= f! [        R                  [        R                  [        4 a     g f = fr   )rS   r   rT   r   r+   rU   r-   r   r   SSLZeroReturnErrorrq   rn   )rX   rY   rZ   r'   rI   s       r   r]   ATlsInTlsTestCase.start_destination_server.<locals>.socket_handler{  s    ??$Q'D''33Dd3Ku,U3G$W-JJ01 L JJL LK OOS%;%;WE s.   B
 0A9 B
 9
BB
 B
 
)B65B6Nr_   r   )rI   r]   s   ` r   start_destination_server)TlsInTlsTestCase.start_destination_servert  s    		 	.)r   c                   U R                  5         U R                  5         [        R                  " U R                  R
                  U R                  R                  45      nU R                  R                  USS9 n[        X R                  SS9 nUR                  5       c   eUR                  [        5       5        [        U5      n[        U5        SSS5        SSS5        g! , (       d  f       N= f! , (       d  f       g= f)z1
Basic communication over the TLS in TLS tunnel.
rv   rw   N)r   r   rk   ry   r   rz   r{   r   rT   r
   r   rU   r    r   r5   )r[   rY   
proxy_sockdestination_sockr1   s        r   test_tls_in_tls_tunnel'TlsInTlsTestCase.test_tls_in_tls_tunnel  s    
 	%%'!''##T%6%6%;%;<
   ,,+ - 
//!'//1=== %%n&67)*:;!(+
 
 
 
s%   ;C5AC$C5$
C2	.C55
Dc                   U R                  5         U R                  5         [        R                  " U R                  R
                  U R                  R                  45      nU R                  R                  USS9 n[        R                  " [        R                  5         [        X R                  SS9  SSS5        SSS5        g! , (       d  f       N= f! , (       d  f       g= f)z?
Provides a wrong sni hint to validate an exception is thrown.
rv   rw   veryverywrongN)r   r   rk   ry   r   rz   r{   r   rT   ro   rp   r   SSLCertVerificationErrorr
   )r[   rY   r   s      r   test_wrong_sni_hint$TlsInTlsTestCase.test_wrong_sni_hint  s    
 	%%'!''##T%6%6%;%;<
   ,,+ - 
s;;< 3 3_ =
 
 =<
 
s$   ;%C C5C
C	C
C%r   Nr   c                   U R                  5         U R                  5         [        R                  " U R                  R
                  U R                  R                  45      nU R                  R                  USS9 n[        X0R                  SS9 nUR                  SU5      nUR                  [        5       5        UR                  5         [        S5      nUR                  U5      nUc   eUR!                  S5      R#                  S5      n[%        USS	9  UR'                  5         SSS5        SSS5        g! , (       d  f       N= f! , (       d  f       g= f)
zD
Uses makefile with read, write and binary modes without buffering.
rv   rw   rwbr   Nr$    Fr   )r   r   rk   ry   r   rz   r{   r   rT   r
   r   writer    flush	bytearrayreadintor&   rstripr5   rn   )	r[   r   rY   r   r   filer1   wrotestr_responses	            r   &test_tls_in_tls_makefile_raw_rw_binary7TlsInTlsTestCase.test_tls_in_tls_makefile_raw_rw_binary  s&    	%%'!''##T%6%6%;%;<
   ,,+ - 
//!'00	B

>+,

$U+h/(((  (w7>>vF!,u=


 
 
 
s%   ;E	BD8'E	8
E	E		
EWindowsz-Skipping windows due to text makefile support)reasonc                   U R                  5         U R                  5         [        R                  " U R                  R
                  U R                  R                  45      nU R                  R                  USS9 n[        X R                  SS9 nUR                  SSS9nUR                  SSS9nUR                  [        SS95        UR                  5         UR                  5       n[        U5      [         L d   eS	U;  a&  [        U5      [         L d   eUR#                  S
S5      n[%        USS9  SSS5        SSS5        g! , (       d  f       N= f! , (       d  f       g= f)zW
Creates a separate buffer for reading and writing using text mode and
utf-8 encoding.
rv   rw   r   r$   )encodingwFr   
z
N)r   r   rk   ry   r   rz   r{   r   rT   r
   r   r   r    r   readr;   r   replacer5   )r[   rY   r   r   r
  r   r1   s          r    test_tls_in_tls_makefile_rw_text1TlsInTlsTestCase.test_tls_in_tls_makefile_rw_text  sC    	%%'!''##T%6%6%;%;<
   ,,+ - 
//!'00w0G(11#1HN%8999;H~,,,x'  >S000'//f=H!(59!
 
 
 
s%   ;EB#E3E
E	E
E#c                F   U R                  5         U R                  5         [        R                  " U R                  R
                  U R                  R                  45      nU R                  R                  USS9 n[        X R                  SS9 nUR                  [        5       5        [        S5      nUR                  U5        UR                  S5      R                  S5      n[!        USS9  SSS5        SSS5        g! , (       d  f       N= f! , (       d  f       g= f)	zW
Valides recv_into and sendall also work as expected. Other tests are
using recv/send.
rv   rw   r   r$   r   Fr   N)r   r   rk   ry   r   rz   r{   r   rT   r
   r   r    r   	recv_intor&   r   r5   )r[   rY   r   r   r1   r   s         r   !test_tls_in_tls_recv_into_sendall2TlsInTlsTestCase.test_tls_in_tls_recv_into_sendall  s     	%%'!''##T%6%6%;%;<
   ,,+ - 
//! (()9:$U+ **84'w7>>vF!,u=
 
 
 
s%   ;DA D0D
D	D
D r   r   )r   z
int | Nonera   rb   )r   r   r   r   r   r   rJ   r   r   r   ro   r   r   r   r   r   parametrizer  skipifplatformsystemr  r  r   __classcell__)r   s   @r   r   r   Y  s\    N N / / ! !
 * *& [[)*, +,* [[)* +$ [[)*[[[4)4 5 +: [[Y&>   [[)*: +	
:@ [[)*> +>r   r   c                  <    \ rS rSrSS jrSS jrSS jrSS jrSrg)	TestSSLTransportWithMocki  c                $   Sn[         R                  " 5       n[         R                  " [        R                  5      n[        X#USS9nUR                  R                  [         R                  [         R                  US9  UR                  (       a   eg )Nexample-domain.comFrx   suppress_ragged_eofsrw   )
r   Mockcreate_autospecr	   r   r
   wrap_bioassert_called_withANYr  r[   rx   rY   rr   ssl_transports        r   test_constructor_params0TestSSLTransportWithMock.test_constructor_params  sv    .yy{&&t7$?QV
 	++HHdhh 	, 	
 !55555r   c                   Sn[         R                  " 5       n[         R                  " [        R                  5      n[        X#USS9n[        R                  " [        5         UR                  SS9  S S S 5        [        R                  " [        5         UR                  [        5       SS9  S S S 5        [        R                  " [        5         UR                  [        5       SS9  S S S 5        [        R                  " [        5         UR                  S SS9  S S S 5        g ! , (       d  f       N= f! , (       d  f       N= f! , (       d  f       Nd= f! , (       d  f       g = f)Nr  Fr     )flags)r   r  r  r	   r   r
   ro   rp   r   r   r  r   r   rU   r"  s        r   test_various_flags_errors2TestSSLTransportWithMock.test_various_flags_errors  s    .yy{&&t7$?QV
 ]]:&Q' ' ]]:&##IKq#9 ' ]]:&!!)+Q!7 ' ]]:&t1- '& '& '& '& '&s0   !D#D4E	E#
D14
E
E
E$c                   Sn[         R                  " 5       n[         R                  " [        R                  5      n[        X#USS9n[        R                  " [        5         UR                  SS9  S S S 5        g ! , (       d  f       g = f)Nr  Fr  x)mode)
r   r  r  r	   r   r
   ro   rp   r   r   r"  s        r   test_makefile_wrong_mode_error7TestSSLTransportWithMock.test_makefile_wrong_mode_error.  sc    .yy{&&t7$?QV
 ]]:&""", '&&s   !A::
Bc                   Sn[         R                  " 5       n[         R                  " [        R                  5      n[        X#USS9n[         R                  R                  US5       n[        R                  " 5       Ul
        [        R                  " [        R                  5         UR                  S5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  Fr  _ssl_io_loopr'  )r   r  r  r	   r   r
   patchobjectr   SSLErrorside_effectro   rp   _wrap_ssl_read)r[   rx   rY   rr   r#  r1  s         r   test_wrap_ssl_read_error1TestSSLTransportWithMock.test_wrap_ssl_read_error8  s    .yy{&&t7$?QV
 ZZ}n='*||~L$s||,,,Q/ - >=,, >=s$   '?C&C	8C	
C	C
C(r   Nr   )	r   r   r   r   r$  r)  r.  r7  r   r   r   r   r  r    s    
6.&-
0r   r  )ra   z%tuple[ssl.SSLContext, ssl.SSLContext]).)r   ztyping.Literal[True]ra   r<   )r   ztyping.Literal[False]ra   r   )T)r   r   ra   zbytes | str)r)   r   r   ztyping.Literal[False, True]ra   rb   )r3   zbytes | bytearray | strr   r   ra   rb   )r?   r
   ra   rb   )!
__future__r   r  r   rk   r   rc   typingunittestr   ro   dummyserver.socketserverr   r   dummyserver.testcaser   r   urllib3.utilr	   urllib3.util.ssltransportr
   r   r   overloadr    r+   r-   r5   rB   rD   r   r   r  r   r   r   <module>rA     sB   "    
     > J  2  	*    : HL00)D0	0      < @D2.28<2	2&h(6 h(VF6 FRr>0 r>j40 40r   