package okhttp3

import javax.net.ssl.SSLSocket
import javax.net.ssl.SSLSocketFactory
import okhttp3.FallbackTestClientSocketFactory.Companion.TLS_FALLBACK_SCSV

/**
 * An SSLSocketFactory that delegates calls. Sockets created by the delegate are wrapped with ones
 * that will not accept the [TLS_FALLBACK_SCSV] cipher, thus bypassing server-side fallback
 * checks on platforms that support it. Unfortunately this wrapping will disable any

    expectedCipherSuites.add(CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA.javaName)
    if (listOf<String>(*socket.supportedCipherSuites).contains("TLS_FALLBACK_SCSV")) {
      expectedCipherSuites.add("TLS_FALLBACK_SCSV")
    }
    assertThat(socket.enabledCipherSuites)
      .containsExactly(*expectedCipherSuites.toTypedArray())
  }

  @Test
  fun tls_explicitCiphers() {

    socket.supportedCipherSuites = arrayOf("TLS_A", "TLS_FALLBACK_SCSV")
    socket.enabledCipherSuites = arrayOf("TLS_A")
    val connectionSpec =
      ConnectionSpec.Builder(true)
        .tlsVersions(TlsVersion.TLS_1_0)
        .cipherSuites("TLS_A")
        .build()
    applyConnectionSpec(connectionSpec, socket, true)
    assertArrayEquals(
      arrayOf("TLS_A", "TLS_FALLBACK_SCSV"),
      socket.enabledCipherSuites,
    )

pkg crypto/rsa, type PSSOptions struct, Hash crypto.Hash

# CL 157090043 crypto/tls: support TLS_FALLBACK_SCSV as a server., Adam Langley <******@****.***>
pkg crypto/tls, const TLS_FALLBACK_SCSV = 22016
pkg crypto/tls, const TLS_FALLBACK_SCSV uint16

# CL 107400043 crypto/tls: Added dynamic alternative to NameToCertificate map for SNI, Percy Wegmann <******@****.***>

    @JvmField val TLS_EMPTY_RENEGOTIATION_INFO_SCSV = init("TLS_EMPTY_RENEGOTIATION_INFO_SCSV", 0x00ff)

    @JvmField val TLS_FALLBACK_SCSV = init("TLS_FALLBACK_SCSV", 0x5600)

    @JvmField val TLS_ECDH_ECDSA_WITH_NULL_SHA = init("TLS_ECDH_ECDSA_WITH_NULL_SHA", 0xc001)

    @JvmField val TLS_ECDH_ECDSA_WITH_RC4_128_SHA = init("TLS_ECDH_ECDSA_WITH_RC4_128_SHA", 0xc002)

    // cipher is added to signal that a protocol fallback has taken place.
    val supportedCipherSuites = sslSocket.supportedCipherSuites
    val indexOfFallbackScsv =
      supportedCipherSuites.indexOf(
        "TLS_FALLBACK_SCSV",
        CipherSuite.ORDER_BY_NAME,
      )
    if (isFallback && indexOfFallbackScsv != -1) {
      cipherSuitesIntersection =
        cipherSuitesIntersection.concat(

    platform.assumeNotConscrypt()
    val tlsFallbackScsv = "TLS_FALLBACK_SCSV"
    val supportedCiphers = listOf(*handshakeCertificates.sslSocketFactory().supportedCipherSuites)
    if (!supportedCiphers.contains(tlsFallbackScsv)) {
      // This only works if the client socket supports TLS_FALLBACK_SCSV.
      return
    }
    server.useHttps(handshakeCertificates.sslSocketFactory())

    introduction to this new API.

 *  New: APIs to iterate and selectively clear the response cache.
 *  New: Support for SOCKS proxies.
 *  New: Support for `TLS_FALLBACK_SCSV`.
 *  New: Update HTTP/2 support to `h2-16` and `hpack-10`.
 *  New: APIs to prevent retrying non-idempotent requests.
 *  Fix: Drop NPN support. Going forward we support ALPN only.

	public static final field TLS_ECDH_anon_WITH_RC4_128_SHA Lokhttp3/CipherSuite;
	public static final field TLS_EMPTY_RENEGOTIATION_INFO_SCSV Lokhttp3/CipherSuite;
	public static final field TLS_FALLBACK_SCSV Lokhttp3/CipherSuite;
	public static final field TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 Lokhttp3/CipherSuite;
	public static final field TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA Lokhttp3/CipherSuite;

    server.protocolNegotiationEnabled = true
    server.protocols = client.protocols
  }

  /**
   * Used during tests that involve TLS connection fallback attempts. OkHttp includes the
   * TLS_FALLBACK_SCSV cipher on fallback connections. See [FallbackTestClientSocketFactory]
   * for details.
   */