"""Test that TLS is properly hardened on all HTTPS sites."""

import socket
import ssl

import pytest

HOST = "www.hantim.net"


def test_tls13_works():
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    ctx.load_default_certs()
    ctx.minimum_version = ssl.TLSVersion.TLSv1_3
    ctx.maximum_version = ssl.TLSVersion.TLSv1_3
    with ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST) as s:
        assert s.version() == "TLSv1.3"


def test_tls12_works():
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    ctx.load_default_certs()
    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
    ctx.maximum_version = ssl.TLSVersion.TLSv1_2
    with ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST) as s:
        assert s.version() == "TLSv1.2"


@pytest.mark.filterwarnings("ignore::DeprecationWarning")
def test_tls11_rejected():
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    ctx.minimum_version = ssl.TLSVersion.TLSv1_1
    ctx.maximum_version = ssl.TLSVersion.TLSv1_1
    with pytest.raises((ssl.SSLError, OSError)):
        ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST)