"""
WARNING: THIS MRE WILL RUN openssl IN A SUBPROCESS AND LEAK THE CERT AND KEY FILES

Strategy: Use SSLObject (not SSLSocket) so the Python-level wrapper can
be GC'd independently of the C-level SSL object. In the SNI callback,
delete the only reference to the SSLObject and force GC. The weakref
in ssl->owner dies, PyWeakref_GetRef returns 0, ssl_socket = NULL,
goto error -> Py_DECREF(NULL) -> crash.
"""
import ssl
import gc
import tempfile
import subprocess

def generate_self_signed_cert():
    """
    Generate a self-signed cert+key for testing.
    WARNING: THIS RUNS openssl IN A SUBPROCESS AND LEAKS THE CERT AND KEY FILES
    """
    certpath = tempfile.mktemp(suffix='.pem')
    keypath = tempfile.mktemp(suffix='.key')
    subprocess.run([
        'openssl', 'req', '-x509', '-newkey', 'rsa:2048',
        '-keyout', keypath, '-out', certpath,
        '-days', '1', '-nodes', '-subj', '/CN=test'
    ], capture_output=True, check=True)
    return certpath, keypath

def sni_callback(sslobj, servername, sslctx):
    pass

certpath, keypath = generate_self_signed_cert()
server_ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
server_ctx.load_cert_chain(certpath, keypath)

server_ctx.set_servername_callback(sni_callback)

# Approach: Use MemoryBIO-based SSLObject (not socket-based SSLSocket)
# to have more control over the object lifecycle.
server_incoming = ssl.MemoryBIO()
server_outgoing = ssl.MemoryBIO()
server_sslobj = server_ctx.wrap_bio(
    server_incoming, server_outgoing, server_side=True
)

client_ctx = ssl.create_default_context()
client_ctx.check_hostname = False
client_ctx.verify_mode = ssl.CERT_NONE

client_incoming = ssl.MemoryBIO()
client_outgoing = ssl.MemoryBIO()
client_sslobj = client_ctx.wrap_bio(
    client_incoming, client_outgoing,
    server_side=False, server_hostname='test'
)

# Get the internal _SSLSocket objects
server_ssl_internal = server_sslobj._sslobj
client_ssl_internal = client_sslobj._sslobj

# The _SSLSocket's "owner" weakref points to the SSLObject.
# If we delete the SSLObject, the weakref dies.
# Try to do the handshake
for i in range(20):
    # Client step
    try:
        client_sslobj.do_handshake()
    except ssl.SSLWantReadError:
        pass

    # Transfer client -> server
    data = client_outgoing.read()
    if data:
        server_incoming.write(data)

    # NOW: before server processes the ClientHello (which triggers SNI),
    # try to kill the server SSLObject so the weakref dies.
    if i == 0 and data:
        # The server hasn't processed ClientHello yet.
        # Delete the SSLObject wrapper — the internal _SSLSocket
        # still exists (we hold server_ssl_internal).
        # The weakref ssl->owner should now be dead.
        del server_sslobj
        gc.collect()
        print(f"server_ssl_internal still alive: {server_ssl_internal is not None}")

        # Now do_handshake on the internal object directly
        # This will trigger the SNI callback with a dead owner weakref
        server_ssl_internal.do_handshake()