3 M(Y "@sddlZddlZddlZddlZddlZddlmZmZmZm Z ddl m Z m Z y ddl Z Wnek rtdZ YnXdddddgZd jjZyejjZejZWnek reZZYnXe dk oeeefkZydd l mZmZWnRek r:ydd lmZdd lmZWnek r4dZdZYnXYnXesRGd ddeZesjdddZddZGdddeZGdddeZd ddZ ddZ!e!ddZ"ddZ#ddZ$dS)!N)urllib http_clientmapfilter)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundle is_available cert_paths opener_fora /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt /usr/share/ssl/certs/ca-bundle.crt /usr/local/share/certs/ca-root.crt /etc/ssl/cert.pem /System/Library/OpenSSL/certs/cert.pem /usr/local/share/certs/ca-root-nss.crt /etc/ssl/ca-bundle.pem )CertificateErrormatch_hostname)r )rc@s eZdZdS)r N)__name__ __module__ __qualname__rrD/private/tmp/pip-build-nl73fm5q/setuptools/setuptools/ssl_support.pyr 5sr c Csg}|s dS|jd}|d}|dd}|jd}||krLtdt||s`|j|jkS|dkrt|jdn>|jd s|jd r|jtj|n|jtj|j d d x|D]}|jtj|qWtj d d j |dtj } | j |S)zpMatching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 F.rrN*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr reprlowerappend startswithreescapereplacecompilejoin IGNORECASEmatch) dnhostname max_wildcardspatspartsleftmost remainder wildcardsfragpatrrr_dnsname_match;s*     r.cCs|s tdg}|jdf}x0|D](\}}|dkr"t||r@dS|j|q"W|sxF|jdfD]6}x0|D](\}}|dkrjt||rdS|j|qjWq`Wt|dkrtd|d jtt|fn*t|dkrtd ||d fntd dS) a=Verify that *cert* (in decoded format as returned by SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125 rules are followed, but IP addresses are not accepted for *hostname*. CertificateError is raised on failure. On success, the function returns nothing. zempty or no certificatesubjectAltNameDNSNsubject commonNamerz&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rrz=no appropriate commonName or subjectAltName fields were found) ValueErrorgetr.rlenr r!rr)certr%dnsnamessankeyvaluesubrrrros.     rc@s eZdZdZddZddZdS)rz=Simple verifying handler: no auth, subclasses, timeouts, etc.cCs||_tj|dS)N) ca_bundle HTTPSHandler__init__)selfr<rrrr>szVerifyingHTTPSHandler.__init__csjfdd|S)Ncst|jf|S)N)VerifyingHTTPSConnr<)hostkw)r?rrsz2VerifyingHTTPSHandler.https_open..)do_open)r?reqr)r?r https_opensz VerifyingHTTPSHandler.https_openN)rrr__doc__r>rFrrrrrsc@s eZdZdZddZddZdS)r@z@Simple verifying connection: no auth, subclasses, timeouts, etc.cKstj||f|||_dS)N)HTTPSConnectionr>r<)r?rAr<rBrrrr>szVerifyingHTTPSConn.__init__c Cstj|j|jft|dd}t|drHt|ddrH||_|j|j}n|j}t j |t j |j d|_yt |jj|Wn.tk r|jjtj|jjYnXdS)Nsource_address_tunnel _tunnel_host) cert_reqsca_certs)socketcreate_connectionrAportgetattrhasattrsockrJrKssl wrap_socket CERT_REQUIREDr<r getpeercertr shutdown SHUT_RDWRclose)r?rS actual_hostrrrconnects zVerifyingHTTPSConn.connectN)rrrrGr>r\rrrrr@sr@cCstjjt|ptjS)z@Get a urlopen() replacement that uses ca_bundle for verification)rrequest build_openerrr open)r<rrrr scstjfdd}|S)Ncstds||_jS)Nalways_returns)rRr`)argskwargs)funcrrwrappers  zonce..wrapper) functoolswraps)rcrdr)rcroncesrgc sXy ddl}Wntk r dSXGfddd|j}|jd|jd|jS)Nrcs,eZdZfddZfddZZS)z"get_win_certfile..CertFilecst|jtj|jdS)N)superr>atexitregisterrZ)r?)CertFile __class__rrr>sz+get_win_certfile..CertFile.__init__c s,yt|jWntk r&YnXdS)N)rhrZOSError)r?)rkrlrrrZsz(get_win_certfile..CertFile.close)rrrr>rZ __classcell__r)rk)rlrrksrkCAROOT) wincertstore ImportErrorrkZaddstorename)rqZ _wincertsr)rkrget_win_certfiles    rtcCs$ttjjt}tp"t|dp"tS)z*Return an existing CA bundle path, or NoneN)rospathisfiler rtnext_certifi_where)Zextant_cert_pathsrrrr s c Cs,y tdjStttfk r&YnXdS)Ncertifi) __import__whererrrrrrrrrys ry)r)N)%rurNrirreZsetuptools.extern.six.movesrrrr pkg_resourcesrrrTrr__all__striprr r]r=rHAttributeErrorobjectr r rZbackports.ssl_match_hostnamer3r.rr@r rgrtr ryrrrrsP      4) #