
    R                       d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
Z
d dlmZmZ d dlmZmZ d dlmZ d dlmZ dZdd	Zej.                  ddd
       Zej.                  dd       Zd d!dZ	 d 	 	 	 	 	 d"dZej.                  ddd       Zej.                  dd       Zej.                  dd!d       Zd d!dZ	 d 	 	 	 	 	 d#dZd$dZ G d de      Z G d de      Z G d de      Z G d d      Z y)%    )annotationsN)mock)
DEFAULT_CADEFAULT_CERTS)SocketDummyServerTestCaseconsume_socket)ssl_)SSLTransport<   c                 @   t        t        d      r#t        j                  t        j                        }  j	                  t
        d   t
        d          t        t        d      r#t        j                  t        j                        }j                  t               | |fS )NPROTOCOL_TLS_SERVERcertfilekeyfilePROTOCOL_TLS_CLIENT)	hasattrssl
SSLContextr   load_cert_chainr   r   load_verify_locationsr   )server_contextclient_contexts     =platform/gsutil/third_party/urllib3/test/test_ssltransport.pyserver_client_ssl_contextsr      ss    s)*(?(?@""=#<mI>VWs)*(?(?@((4>))    c                     y N binarys    r   sample_requestr    "       r   c                     y r   r   r   s    r   r    r    '   r!   r   c                0    d}| r|S |j                  d      S )NsY   GET http://www.testing.com/ HTTP/1.1
Host: www.testing.com
User-Agent: awesome-test

utf-8decode)r   requests     r   r    r    ,   s$    	  79'.."99r   c                0    | J t        |      }| |k(  sJ y r   )r    )provided_requestr   expected_requests      r   validate_requestr+   6   s*     '''%f-////r   c                     y r   r   r   s    r   sample_responser-   >   r!   r   c                     y r   r   r   s    r   r-   r-   C   r!   r   c                     y r   r   r   s    r   r-   r-   H   r!   r   c                0    d}| r|S |j                  d      S )Ns&   HTTP/1.1 200 OK
Content-Length: 0

r$   r%   )r   responses     r   r-   r-   M   s    >H8;8??7#;;r   c                0    | J t        |      }| |k(  sJ y r   )r-   )provided_responser   expected_responses      r   validate_responser5   R   s*     ((('/ 1111r   c                    | j                  d      }t        |      t        u sJ t        |      dkD  sJ | j                         }t        |      t        u sJ d|v sJ |d   dk7  sJ y )NT)binary_formr   serialNumber )getpeercerttypebyteslendict)
ssl_socketbinary_certcerts      r   validate_peercertrB   Z   s|    ((T(:K%%%{a!!#D:T!!!2%%%r   c                     e Zd ZdZedd       Z	 	 d	 	 	 	 	 ddZej                  j                  e
      dd       Zej                  j                  e
      dd       Zej                  j                  e
      dd       Zej                  j                  e
      dd       Zej                  j                  e
      dd	       Zej                  j                  e
      dd
       Zej                  j                  e
      dd       Zy)SingleTLSLayerTestCasezt
    Uses the SocketDummyServer to validate a single TLS layer can be
    established through the SSLTransport.
    c                2    t               \  | _        | _        y r   r   r   r   clss    r   setup_classz"SingleTLSLayerTestCase.setup_classk       1K1M.C.r   Nc                t     t        j                         d fd}|r|n|} j                  |       y )Nc                6   | j                         d   }	 j                  j                  |d      5 }t        |      }s
	 d d d        y t	        |       |j                  t                      d d d        y # 1 sw Y   y xY w# t        t        f$ r Y y w xY w)Nr   Tserver_side
quit_event)	acceptr   wrap_socketr   r+   sendr-   ConnectionAbortedErrorConnectionResetError)listenersockssockr'   rP   selfvalidates       r   socket_handlerzASingleTLSLayerTestCase.start_dummy_server.<locals>.socket_handlerv   s    ??$Q'D((44Tt4LPU,#-G $ ML %W-JJ01 MLL +,@A s:   B A:B $A:1B :B?B B BBrO   rV   socket.socketreturnNone)	threadingEvent_start_server)rY   handlerrZ   r[   chosen_handlerrP   s   ` `  @r   start_dummy_serverz)SingleTLSLayerTestCase.start_dummy_servero   s4    
 __&
	 %,>jAr   c                   t        j                   t         j                        }t        j                         }|j	                          t        j                  t              5  t        ||       ddd       y# 1 sw Y   yxY w)z=Errors generated from an unconnected socket should bubble up.N)	socketAF_INETr   create_default_contextclosepytestraisesOSErrorr
   )rY   rW   contexts      r   test_start_closed_socketz/SingleTLSLayerTestCase.test_start_closed_socket   sO     }}V^^,,,.

]]7#w' $##s   !A77B c                v   | j                  d       t        j                  | j                  | j                  f      }t        || j                  d      5 }|j                          t        j                  t              5  |j                  d       ddd       ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)z"Socket errors should be bubbled upF)rZ   	localhostserver_hostnames   blaaarghN)re   rg   create_connectionhostportr
   r   rj   rk   rl   rm   rS   )rY   rW   rX   s      r   test_close_after_handshakez1SingleTLSLayerTestCase.test_close_after_handshake   s     	/''DII(>?$%%{
KKMw'

;' (	
 
 ('	
 
s$   *B/ B#B/#B,	(B//B8c                V   | j                          t        j                  | j                  | j                  f      }t        || j                  d      5 }|j                         J |j                  t                      t        |      }t        |       ddd       y# 1 sw Y   yxY w)z0Validates a single TLS layer can be established.rq   rr   N)re   rg   rt   ru   rv   r
   r   versionrS   r    r   r5   rY   rW   rX   r1   s       r   test_wrap_existing_socketz0SingleTLSLayerTestCase.test_wrap_existing_socket   s     	!''DII(>?$%%{
==?...JJ~'(%e,Hh'
 
 
s   ABB(c                   | j                          t        j                  | j                  | j                  f      }t        || j                  d      5 }t        j                  t              5  |j                  dd       d d d        |j                  t                      t        |      }t        |       d d d        y # 1 sw Y   AxY w# 1 sw Y   y xY w)Nrq   rr   rr   )	buffering)re   rg   rt   ru   rv   r
   r   rk   rl   
ValueErrormakefilerS   r    r   r5   rz   s       r   test_unbuffered_text_makefilez4SingleTLSLayerTestCase.test_unbuffered_text_makefile   s    !''DII(>?$%%{
z*sa0 +JJ~'(%e,Hh'
 
 +*
 
s$   C.C7CC	CCc                    d fd} j                  |       t        j                   j                   j                  f      5 }t        | j                  d      }|j                  t                      t        |      }t        |       |j                          |j                  t                      t        |      }t        |       ddd       y# 1 sw Y   yxY w)z
        Validates we can break up the TLS layer
        A full request/response is sent over TLS, and later over plain text.
        c                   | j                         d   5 }j                  j                  |d      5 }t        |      }t	        |       |j                  t                      |j                         5 }t        |      }t	        |       |j                  t                      d d d        d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   y xY wNr   TrM   )rQ   r   rR   r   r+   sendallr-   unwrap)rV   rW   ssl_sockr'   unwrapped_sockrY   s        r   shutdown_handlerzLSingleTLSLayerTestCase.test_unwrap_existing_socket.<locals>.shutdown_handler   s    "1%t/B/B/N/N$ 0O 0(2 )  !23__&.,^<G$W-"**?+<= '0%% '&0 0%%s;   CA C30B<#C+C<CCC	CCrq   rr   Nr\   )re   rg   rt   ru   rv   r
   r   r   r    r   r5   r   )rY   r   rW   rX   r1   s   `    r   test_unwrap_existing_socketz2SingleTLSLayerTestCase.test_unwrap_existing_socket   s    	> 	 01%%tyy$))&<= t':':KXE MM.*+%e,Hh' LLNLL)*%d+Hh' >==s   BCCc                `   | j                          t        j                  | j                  | j                  f      }t        || j                  d      5 }|j                         }t        |      t        u sJ |j                         J |j                         J |j                         }|!t        |      t        u rt        |      dkD  sJ |j                         J t!        |       |j#                  t%                      t'        |      }t)        |       ddd       y# 1 sw Y   yxY w)z)Ensures common ssl attributes are exposedrq   rr   Nr   )re   rg   rt   ru   rv   r
   r   cipherr;   tupleselected_alpn_protocolselected_npn_protocolshared_cipherslistr=   compressionrB   rS   r    r   r5   )rY   rW   rX   r   r   r1   s         r   test_ssl_object_attributesz1SingleTLSLayerTestCase.test_ssl_object_attributes   s    	!''DII(>?$%%{
\\^F<5((( //1999..0888"113N ")^$,^1Dq1H  $$&...e$JJ~'(%e,Hh'/
 
 
s   CD$$D-c                   | j                          t        j                  | j                  | j                  f      }t        || j                  d      5 }|j                         J d}|j                  |       |j                         |k(  sJ |j                  j                         |k(  sJ |j                  t                      t        |      }t        |       ddd       y# 1 sw Y   yxY w)z,Ensures common socket attributes are exposedrq   rr   N
   )re   rg   rt   ru   rv   r
   r   fileno
settimeout
gettimeoutrS   r    r   r5   )rY   rW   rX   test_timeoutr1   s        r   test_socket_object_attributesz4SingleTLSLayerTestCase.test_socket_object_attributes   s     	!''DII(>?$%%{
<<>---L\*##%555<<**,<<<JJ~'(%e,Hh'
 
 
s   B	C&&C/r^   r_   )NT)rc   z-typing.Callable[[socket.socket], None] | NonerZ   boolr^   r_   )__name__
__module____qualname____doc__classmethodrI   re   rk   marktimeoutPER_TEST_TIMEOUTro   rw   r{   r   r   r   r   r   r   r   rD   rD   e   sI   
 N N
 BFB>B B 
	B2 [[)*( +( [[)*
( +
( [[)*( +( [[)*( +( [[)* ( + (D [[)*( +(< [[)*( +(r   rD   c                  F    e Zd ZdZ	 	 	 	 	 	 ddZddZ	 d	 	 	 	 	 	 	 d	dZy)
SocketProxyDummyServerzX
    Simulates a proxy that performs a simple I/O loop on client/server
    socket.
    c                D    || _         || _        t               \  | _        }y r   )destination_server_hostdestination_server_portr   
server_ctx)rY   r   r   _s       r   __init__zSocketProxyDummyServer.__init__  s#     (?$'>$79r   c                4     d fd} j                  |       y)z
        Socket handler for the proxy. Terminates the first TLS layer and tunnels
        any bytes needed for client <-> server communicatin.
        c                J   | j                         d   }j                  j                  |d      5 }t        j                  j
                  j                  f      }j                  ||       |j                          |j                          d d d        y # 1 sw Y   y xY wr   )	rQ   r   rR   rg   rt   r   r   _read_write_looprj   )rV   rW   client_sockupstream_sockrY   s       r   proxy_handlerzASocketProxyDummyServer.start_proxy_handler.<locals>.proxy_handler#  s    ??$Q'D,,Tt,D & 8 81143O3OP! %%k=A##%!!# EDDs   ABB"Nr\   rb   )rY   r   s   ` r   start_proxy_handlerz*SocketProxyDummyServer.start_proxy_handler  s    	$ 	=)r   c                4   ||g}||g}|rtt        j                   |||      \  }}}|ry |D ]M  }	d\  }
}|	|k(  r|}
|}n|}
|}||v s	 |
j                  |      }t        |      dk(  r y |j                  |       O |rsy y # t        j
                  $ r Y  y w xY w)N)NNr   )selectrecvr=   rS   r   SSLEOFError)rY   r   server_sockchunksinputsoutputreadablewritable	exceptionsread_socketwrite_socketbs                r   r   z'SocketProxyDummyServer._read_write_loop/  s     {+{+,2MM&&&,Q)Hh	 ,6)\#"-K#.L"-K#.L  8+',,V4q6Q; #$))!,#  4 ??  	s   B (B  BBN)r   strr   intr^   r_   r   )   )r   r]   r   r]   r   r   r^   r_   )r   r   r   r   r   r   r   r   r   r   r   r     sY    
:'*:EH:	:*, 	'"' #' 	'
 
'r   r   c                  ^    e Zd ZdZedd       Zedd       Zed fd       Zedd       Ze	j                  j                  e      dd       Ze	j                  j                  e      dd       Ze	j                  j                  e      e	j                  j                  dd	d
g      dd              Ze	j                  j#                   ej&                         dk(  d      e	j                  j                  e      dd              Ze	j                  j                  e      dd       Z xZS )TlsInTlsTestCaseaF  
    Creates a TLS in TLS tunnel by chaining a 'SocketProxyDummyServer' and a
    `SocketDummyServerTestCase`.

    Client will first connect to the proxy, who will then proxy any bytes send
    to the destination server. First TLS layer terminates at the proxy, second
    TLS layer terminates at the destination server.
    c                2    t               \  | _        | _        y r   rF   rG   s    r   rI   zTlsInTlsTestCase.setup_classc  rJ   r   c                    t        | j                  | j                        | _        | j                  j	                          y r   )r   ru   rv   proxy_serverr   rG   s    r   start_proxy_serverz#TlsInTlsTestCase.start_proxy_serverg  s-     2#((CHHE,,.r   c                n    t        | d      r| j                  j                          t        | 	          y )Nr   )r   r   teardown_classsuper)rH   	__class__s    r   r   zTlsInTlsTestCase.teardown_classn  s*    3'++- r   c                4     d fd} j                  |       y)z
        Socket handler for the destination_server. Terminates the second TLS
        layer and send a basic HTTP response.
        c                l   | j                         d   }	 j                  j                  |d      5 }t        |      }t	        |       |j                  t                      d d d        |j                          y # 1 sw Y   xY w# t        j                  t        j                  t        f$ r Y y w xY wr   )rQ   r   rR   r   r+   rS   r-   r   r   SSLZeroReturnErrorrm   rj   )rV   rW   rX   r'   rH   s       r   r[   zATlsInTlsTestCase.start_destination_server.<locals>.socket_handler{  s    ??$Q'D''33Dd3Ku,U3G$W-JJ01 L JJL LK OOS%;%;WE s(   B 0A<#B <BB (B32B3Nr\   r   )rH   r[   s   ` r   start_destination_serverz)TlsInTlsTestCase.start_destination_servert  s    		 	.)r   c                   | j                          | j                          t        j                  | j                  j
                  | j                  j                  f      }| j                  j                  |d      5 }t        || j                  d      5 }|j                         J |j                  t                      t        |      }t        |       ddd       ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)zA
        Basic communication over the TLS in TLS tunnel.
        rq   rr   N)r   r   rg   rt   r   ru   rv   r   rR   r
   ry   rS   r    r   r5   )rY   rW   
proxy_sockdestination_sockr1   s        r   test_tls_in_tls_tunnelz'TlsInTlsTestCase.test_tls_in_tls_tunnel  s    
 	%%'!''##T%6%6%;%;<
   ,,+ - 
D//!'//1=== %%n&67)*:;!(+
 
 
 
s%   =C5AC)C5)C2	.C55C>c                   | j                          | j                          t        j                  | j                  j
                  | j                  j                  f      }| j                  j                  |d      5 }t        j                  t        j                        5  t        || j                  d       ddd       ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)zO
        Provides a wrong sni hint to validate an exception is thrown.
        rq   rr   veryverywrongN)r   r   rg   rt   r   ru   rv   r   rR   rk   rl   r   SSLCertVerificationErrorr
   )rY   rW   r   s      r   test_wrong_sni_hintz$TlsInTlsTestCase.test_wrong_sni_hint  s    
 	%%'!''##T%6%6%;%;<
   ,,+ - 
s;;< 3 3_ =
 
 =<
 
s$   =$C!C:CC	CC r~   Nr   c                   | j                          | j                          t        j                  | j                  j
                  | j                  j                  f      }| j                  j                  |d      5 }t        || j                  d      5 }|j                  d|      }|j                  t                      |j                          t        d      }|j                  |      }|J |j!                  d      j#                  d      }t%        |d	       |j'                          ddd       ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)
zT
        Uses makefile with read, write and binary modes without buffering.
        rq   rr   rwbr   Nr$    Fr   )r   r   rg   rt   r   ru   rv   r   rR   r
   r   writer    flush	bytearrayreadintor&   rstripr5   rj   )	rY   r~   rW   r   r   filer1   wrotestr_responses	            r   &test_tls_in_tls_makefile_raw_rw_binaryz7TlsInTlsTestCase.test_tls_in_tls_makefile_raw_rw_binary  s(    	%%'!''##T%6%6%;%;<
   ,,+ - 
D//!'00	B

>+,

$U+h/(((  (w7>>vF!,u=


 
 
 
s%   =EBE /E E		EEWindowsz-Skipping windows due to text makefile support)reasonc                   | j                          | j                          t        j                  | j                  j
                  | j                  j                  f      }| j                  j                  |d      5 }t        || j                  d      5 }|j                  dd      }|j                  dd      }|j                  t        d             |j                          |j                         }t        |      t         u sJ d	|vr%t        |      t         u sJ |j#                  d
d      }t%        |d       ddd       ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)zo
        Creates a separate buffer for reading and writing using text mode and
        utf-8 encoding.
        rq   rr   r}   r$   )encodingwFr   
z
N)r   r   rg   rt   r   ru   rv   r   rR   r
   r   r   r    r   readr;   r   replacer5   )rY   rW   r   r   r   r   r1   s          r    test_tls_in_tls_makefile_rw_textz1TlsInTlsTestCase.test_tls_in_tls_makefile_rw_text  sE    	%%'!''##T%6%6%;%;<
   ,,+ - 
D//!'00w0G(11#1HN%8999;H~,,,x'  >S000'//f=H!(59!
 
 
 
s%   =EB+EEE	EE'c                D   | j                          | j                          t        j                  | j                  j
                  | j                  j                  f      }| j                  j                  |d      5 }t        || j                  d      5 }|j                  t                      t        d      }|j                  |       |j                  d      j                  d      }t!        |d       ddd       ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)	zo
        Valides recv_into and sendall also work as expected. Other tests are
        using recv/send.
        rq   rr   r   r$   r   Fr   N)r   r   rg   rt   r   ru   rv   r   rR   r
   r   r    r   	recv_intor&   r   r5   )rY   rW   r   r   r1   r   s         r   !test_tls_in_tls_recv_into_sendallz2TlsInTlsTestCase.test_tls_in_tls_recv_into_sendall  s     	%%'!''##T%6%6%;%;<
   ,,+ - 
D//! (()9:$U+ **84'w7>>vF!,u=
 
 
 
s%   =DA#D
9D
D	DDr   )r~   z
int | Noner^   r_   )r   r   r   r   r   rI   r   r   r   rk   r   r   r   r   r   parametrizer   skipifplatformsystemr   r   __classcell__)r   s   @r   r   r   Y  s^    N N / / ! !
 * *& [[)*, +,* [[)* +$ [[)*[[[4)4 5 +: [[Y&>   [[)*: +	
:@ [[)*> +>r   r   c                  ,    e Zd ZddZddZddZddZy)TestSSLTransportWithMockc                $   d}t        j                         }t        j                  t        j                        }t        |||d      }|j                  j                  t         j                  t         j                  |       |j                  rJ y )Nexample-domain.comFrs   suppress_ragged_eofsrr   )
r   Mockcreate_autospecr	   r   r
   wrap_bioassert_called_withANYr   rY   rs   rW   rn   ssl_transports        r   test_constructor_paramsz0TestSSLTransportWithMock.test_constructor_params  sx    .yy{&&t7$'?QV
 	++HHdhh 	, 	
 !55555r   c                   d}t        j                         }t        j                  t        j                        }t        |||d      }t        j                  t              5  |j                  d       d d d        t        j                  t              5  |j                  t               d       d d d        t        j                  t              5  |j                  t               d       d d d        t        j                  t              5  |j                  d d       d d d        y # 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   WxY w# 1 sw Y   y xY w)Nr   Fr      )flags)r   r  r  r	   r   r
   rk   rl   r   r   r   r   r   rS   r  s        r   test_various_flags_errorsz2TestSSLTransportWithMock.test_various_flags_errors  s    .yy{&&t7$'?QV
 ]]:&Q' ' ]]:&##IKq#9 ' ]]:&!!)+Q!7 ' ]]:&t1- '& '& '& '& '&s0   "D-D9EE-D69EEEc                   d}t        j                         }t        j                  t        j                        }t        |||d      }t        j                  t              5  |j                  d       d d d        y # 1 sw Y   y xY w)Nr   Fr   x)mode)
r   r  r  r	   r   r
   rk   rl   r   r   r  s        r   test_makefile_wrong_mode_errorz7TestSSLTransportWithMock.test_makefile_wrong_mode_error.  se    .yy{&&t7$'?QV
 ]]:&""", '&&s   "A>>Bc                   d}t        j                         }t        j                  t        j                        }t        |||d      }t         j                  j                  |d      5 }t        j                         |_
        t        j                  t        j                        5  |j                  d       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   Fr   _ssl_io_loopr
  )r   r  r  r	   r   r
   patchobjectr   SSLErrorside_effectrk   rl   _wrap_ssl_read)rY   rs   rW   rn   r  r  s         r   test_wrap_ssl_read_errorz1TestSSLTransportWithMock.test_wrap_ssl_read_error8  s    .yy{&&t7$'?QV
 ZZ}n='*||~L$s||,,,Q/ - >=,, >=s$   )=C&C	8C	C	CCNr   )r   r   r   r  r  r  r  r   r   r   r   r     s    
6.&-
0r   r   )r^   z%tuple[ssl.SSLContext, ssl.SSLContext]).)r   ztyping.Literal[True]r^   r<   )r   ztyping.Literal[False]r^   r   )T)r   r   r^   zbytes | str)r)   r   r   ztyping.Literal[False, True]r^   r_   )r3   zbytes | bytearray | strr   r   r^   r_   )r?   r
   r^   r_   )!
__future__r   r   r   rg   r   r`   typingunittestr   rk   dummyserver.socketserverr   r   dummyserver.testcaser   r   urllib3.utilr	   urllib3.util.ssltransportr
   r   r   overloadr    r+   r-   r5   rB   rD   r   r   r   r   r   r   <module>r!     sB   "    
     > J  2  	*    : HL00)D0	0      < @D2.28<2	2&h(6 h(VF6 FRr>0 r>j40 40r   