# coding=utf-8

from __future__ import absolute_import, print_function

import doctest

import os

def check(a, b):

    if a != b:

        print((a, b))

def cert(cn):

    return {'subject': ((('commonName', cn),),)}

from mercurial import (

    sslutil,

)

_verifycert = sslutil._verifycert

# Test non-wildcard certificates

check(_verifycert(cert('example.com'), 'example.com'),

      None)

check(_verifycert(cert('example.com'), 'www.example.com'),

check(_verifycert(cert('www.example.com'), 'example.com'),

# Test wildcard certificates

check(_verifycert(cert('*.example.com'), 'www.example.com'),

      None)

check(_verifycert(cert('*.example.com'), 'example.com'),

check(_verifycert(cert('*.example.com'), 'w.w.example.com'),

# Test subjectAltName

san_cert = {'subject': ((('commonName', 'example.com'),),),

            'subjectAltName': (('DNS', '*.example.net'),

                               ('DNS', 'example.net'))}

check(_verifycert(san_cert, 'example.net'),

      None)

check(_verifycert(san_cert, 'foo.example.net'),

      None)

# no fallback to subject commonName when subjectAltName has DNS

check(_verifycert(san_cert, 'example.com'),

# fallback to subject commonName when no DNS in subjectAltName

san_cert = {'subject': ((('commonName', 'example.com'),),),

            'subjectAltName': (('IP Address', '8.8.8.8'),)}

check(_verifycert(san_cert, 'example.com'), None)

# Avoid some pitfalls

check(_verifycert(cert('*.foo'), 'foo'),

check(_verifycert(cert('*o'), 'foo'), None)

check(_verifycert({'subject': ()},

                  'example.com'),

check(_verifycert(None, 'example.com'),

# Unicode (IDN) certname isn't supported

check(_verifycert(cert(u'\u4f8b.jp'), 'example.jp'),

# The following tests are from CPython's test_ssl.py.

check(_verifycert(cert('example.com'), 'example.com'), None)

check(_verifycert(cert('example.com'), 'ExAmple.cOm'), None)

check(_verifycert(cert('example.com'), 'www.example.com'),

check(_verifycert(cert('example.com'), '.example.com'),

check(_verifycert(cert('example.com'), 'example.org'),

check(_verifycert(cert('example.com'), 'exampleXcom'),

check(_verifycert(cert('*.a.com'), 'foo.a.com'), None)

check(_verifycert(cert('*.a.com'), 'bar.foo.a.com'),

check(_verifycert(cert('*.a.com'), 'a.com'),

check(_verifycert(cert('*.a.com'), 'Xa.com'),

check(_verifycert(cert('*.a.com'), '.a.com'),

# only match one left-most wildcard

check(_verifycert(cert('f*.com'), 'foo.com'), None)

check(_verifycert(cert('f*.com'), 'f.com'), None)

check(_verifycert(cert('f*.com'), 'bar.com'),

check(_verifycert(cert('f*.com'), 'foo.a.com'),

check(_verifycert(cert('f*.com'), 'bar.foo.com'),

# NULL bytes are bad, CVE-2013-4073

check(_verifycert(cert('null.python.org\x00example.org'),

                  'null.python.org\x00example.org'), None)

check(_verifycert(cert('null.python.org\x00example.org'),

                  'example.org'),

check(_verifycert(cert('null.python.org\x00example.org'),

                  'null.python.org'),

# error cases with wildcards

check(_verifycert(cert('*.*.a.com'), 'bar.foo.a.com'),

check(_verifycert(cert('*.*.a.com'), 'a.com'),

check(_verifycert(cert('*.*.a.com'), 'Xa.com'),

check(_verifycert(cert('*.*.a.com'), '.a.com'),

check(_verifycert(cert('a.*.com'), 'a.foo.com'),

check(_verifycert(cert('a.*.com'), 'a..com'),

check(_verifycert(cert('a.*.com'), 'a.com'),

# wildcard doesn't match IDNA prefix 'xn--'

idna = u'püthon.python.org'.encode('idna').decode('ascii')

check(_verifycert(cert(idna), idna), None)

check(_verifycert(cert('x*.python.org'), idna),

check(_verifycert(cert('xn--p*.python.org'), idna),

# wildcard in first fragment and  IDNA A-labels in sequent fragments

# are supported.

idna = u'www*.pythön.org'.encode('idna').decode('ascii')

check(_verifycert(cert(idna),

                  u'www.pythön.org'.encode('idna').decode('ascii')),

      None)

check(_verifycert(cert(idna),

                  u'www1.pythön.org'.encode('idna').decode('ascii')),

      None)

check(_verifycert(cert(idna),

                  u'ftp.pythön.org'.encode('idna').decode('ascii')),

check(_verifycert(cert(idna),

                  u'pythön.org'.encode('idna').decode('ascii')),

c = {

    'notAfter': 'Jun 26 21:41:46 2011 GMT',

    'subject': (((u'commonName', u'linuxfrz.org'),),),

    'subjectAltName': (

        ('DNS', 'linuxfr.org'),

        ('DNS', 'linuxfr.com'),

        ('othername', '<unsupported>'),

    )

}

check(_verifycert(c, 'linuxfr.org'), None)

check(_verifycert(c, 'linuxfr.com'), None)

# Not a "DNS" entry

check(_verifycert(c, '<unsupported>'),

# When there is a subjectAltName, commonName isn't used

check(_verifycert(c, 'linuxfrz.org'),

# A pristine real-world example

c = {

    'notAfter': 'Dec 18 23:59:59 2011 GMT',

    'subject': (

        ((u'countryName', u'US'),),

        ((u'stateOrProvinceName', u'California'),),

        ((u'localityName', u'Mountain View'),),

        ((u'organizationName', u'Google Inc'),),

        ((u'commonName', u'mail.google.com'),),

    ),

}

check(_verifycert(c, 'mail.google.com'), None)

# Only commonName is considered

# Neither commonName nor subjectAltName

c = {

    'notAfter': 'Dec 18 23:59:59 2011 GMT',

    'subject': (

        ((u'countryName', u'US'),),

        ((u'stateOrProvinceName', u'California'),),

        ((u'localityName', u'Mountain View'),),

        ((u'organizationName', u'Google Inc'),),

    ),

}

check(_verifycert(c, 'mail.google.com'),

# No DNS entry in subjectAltName but a commonName

c = {

    'notAfter': 'Dec 18 23:59:59 2099 GMT',

    'subject': (

        ((u'countryName', u'US'),),

        ((u'stateOrProvinceName', u'California'),),

        ((u'localityName', u'Mountain View'),),

        ((u'commonName', u'mail.google.com'),),

    ),

    'subjectAltName': (('othername', 'blabla'),),

}

check(_verifycert(c, 'mail.google.com'), None)

# No DNS entry subjectAltName and no commonName

c = {

    'notAfter': 'Dec 18 23:59:59 2099 GMT',

    'subject': (

        ((u'countryName', u'US'),),

        ((u'stateOrProvinceName', u'California'),),

        ((u'localityName', u'Mountain View'),),

        ((u'organizationName', u'Google Inc'),),

    ),

    'subjectAltName': (('othername', 'blabla'),),

}

check(_verifycert(c, 'google.com'),

# Empty cert / no cert

# avoid denials of service by refusing more than one

# wildcard per fragment.

check(_verifycert({'subject': (((u'commonName', u'a*b.com'),),)},

                  'axxb.com'), None)

check(_verifycert({'subject': (((u'commonName', u'a*b.co*'),),)},

check(_verifycert({'subject': (((u'commonName', u'a*b*.com'),),)},

                  'axxbxxc.com'),

def test_url():

    """

    >>> from mercurial import error, pycompat

    >>> from mercurial.util import forcebytestr, url

    This tests for edge cases in url.URL's parsing algorithm. Most of

    these aren't useful for documentation purposes, so they aren't

    part of the class's doc tests.

    Query strings and fragments:

    <url scheme: 'http', host: 'host', path: 'a', query: 'b', fragment: 'c'>

    <url scheme: 'http', host: 'host', path: 'a'>

    <url scheme: 'http', host: 'host', path: 'a', fragment: 'b#c'>

    <url scheme: 'http', host: 'host', path: 'a', fragment: 'b?c'>

    <url scheme: 'http', host: 'host', path: '', query: 'a', fragment: 'b'>

    <url scheme: 'http', host: 'host', path: '?a', fragment: 'b'>

    <url scheme: 'http', host: 'host', path: '', query: 'a#b'>

    <url scheme: 'http', host: 'host', path: '?a#b'>

    IPv6 addresses:

    <url scheme: 'ldap', host: '[2001:db8::7]', path: 'c=GB',

         query: 'objectClass?one'>

    <url scheme: 'ldap', user: 'joe', passwd: 'xxx', host: '[2001:db8::7]',

         port: '80', path: 'c=GB', query: 'objectClass?one'>

    Missing scheme, host, etc.:

    <url path: '://192.0.2.16:80/'>

    <url scheme: 'https', host: 'mercurial-scm.org'>

    <url path: '/foo'>

    <url scheme: 'bundle', path: '/foo'>

    <url path: 'a?b', fragment: 'c'>

    <url scheme: 'http', host: 'x.com', query: 'arg=/foo'>

    <url scheme: 'http', user: 'joe', passwd: 'xxx', path: 'foo'>

    Just a scheme and a path:

    <url scheme: 'mailto', path: 'John.Doe@example.com'>

    <url path: 'a:b:c:d'>

    <url scheme: 'aa', path: 'bb:cc:dd'>

    SSH examples:

    <url scheme: 'ssh', user: 'joe', host: 'host', path: '/home/joe'>

    <url scheme: 'ssh', user: 'joe', passwd: 'xxx', host: 'host', path: 'src'>

    <url scheme: 'ssh', user: 'joe', passwd: 'xxx', host: 'host'>

    <url scheme: 'ssh', user: 'joe', host: 'host'>

    <url scheme: 'ssh', host: 'host'>

    <url scheme: 'ssh'>

    <url scheme: 'ssh'>

    Non-numeric port:

    <url scheme: 'http', host: 'example.com', port: 'dd'>

    <url scheme: 'ssh', user: 'joe', passwd: 'xxx', host: 'host', port: 'ssh',

         path: 'foo'>

    Bad authentication credentials:

    <url scheme: 'http', user: 'joe@joeville', passwd: '123@4:',

         host: 'host', path: 'a', query: 'b', fragment: 'c'>

    <url scheme: 'http', host: '!*', fragment: '?/@!*#?/:@host/a?b#c'>

    <url scheme: 'http', host: '!*', fragment: '?@!*#?:@host/a?b#c'>

    <url scheme: 'http', user: '!*@', passwd: '!*@', host: 'host',

         path: 'a', query: 'b', fragment: 'c'>

    File paths:

    <url path: 'a/b/c/d.g.f'>

    <url path: '/x///z/y/'>

    <url path: '/foo:bar'>

    <url path: '\\\\foo:bar'>

    <url path: './foo:bar'>

    Non-localhost file URL:

    >>> try:

    ...   u = url(b'file://mercurial-scm.org/foo')

    ... except error.Abort as e:

    ...   forcebytestr(e)

    'file:// URLs can only refer to localhost'

    Empty URL:

    >>> u

    <url path: ''>

    >>> str(u)

    ''

    Empty path with query string:

    'http://foo/?bar'

    Invalid path:

    >>> str(u)

    'http://foo/bar'

    >>> u

    <url scheme: 'file', path: '/foo/bar/baz'>

    >>> str(u)

    'file:///foo/bar/baz'

    '/foo/bar/baz'

    >>> u

    <url scheme: 'file', path: '/foo/bar/baz'>

    >>> str(u)

    'file:///foo/bar/baz'

    '/foo/bar/baz'

    >>> u

    <url scheme: 'file', path: 'f:oo/bar/baz'>

    >>> str(u)

    'file:///f:oo/bar/baz'