MRe @ sc d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z d d l m Z y d d l Z Wn e
k
r d Z Yn Xd d d d d g Z d j j
Z e Z Z xp d
d d g f d
d d g f f D]J \ Z Z x; e D]3 Z y e d e e f Wq e
k
r(Yq Xq Wq We d k oLe e e f k Z y d d l m Z m Z WnW e
k
ry$ d d l m Z d d l m Z Wn e
k
rd Z d Z Yn XYn Xe sGd d d e Z n e sd d d Z d d Z n Gd d d e Z Gd d d e Z d d d Z d a d d Z d! d Z! d S)" N)ResolutionErrorExtractionError)urllib2VerifyingHTTPSHandlerfind_ca_bundle is_available
cert_paths
opener_forz
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
HTTPSHandlerr zurllib.requestHTTPSConnectionhttplibz http.clientzfrom %s import %s)CertificateErrormatch_hostname)r
)r c @ s e Z d Z d S)r
N)__name__
__module__ __qualname__ r r 1/tmp/pip-l4uy7dan-build/setuptools/ssl_support.pyr
8 s r
c
C sX g } | s d S| j d } | d } | d d } | j d } | | k rm t d t | n | s | j | j k S| d k r | j d nY | j d s | j d r | j t j | n" | j t j | j d
d x$ | D] } | j t j | qWt j
d d
j | d t j } | j
| S)zpMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
F.r r N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr
reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
dnhostname
max_wildcardspatspartsleftmost remainder wildcardsfragpatr r r _dnsname_match< s*
"
&r. c C s[ | s t d n g } | j d f } xC | D]; \ } } | d k r4 t | | r_ d S| j | q4 q4 W| s xc | j d f D]L } xC | D]; \ } } | d k r t | | r d S| j | q q Wq Wn t | d k r t d | d j t t | f n; t | d k rKt d
| | d f n t d d S)
a= Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
zempty or no certificatesubjectAltNameDNSNsubject
commonNamer z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found)
ValueErrorgetr. r lenr
r! mapr )certr% dnsnamessankeyvaluesubr r r r p s. %r c @ s. e Z d Z d Z d d Z d d Z d S)r z=Simple verifying handler: no auth, subclasses, timeouts, etc.c C s | | _ t j | d S)N) ca_bundler
__init__)selfr= r r r r> s z VerifyingHTTPSHandler.__init__c s j f d d | S)Nc s t | j | S)N)VerifyingHTTPSConnr= )hostkw)r? r r s z2VerifyingHTTPSHandler.https_open..)do_open)r? reqr )r? r
https_open s z VerifyingHTTPSHandler.https_openN)r r r __doc__r> rF r r r r r s c @ s. e Z d Z d Z d d Z d d Z d S)r@ z@Simple verifying connection: no auth, subclasses, timeouts, etc.c K s t j | | | | | _ d S)N)r r> r= )r? rA r= rB r r r r> s zVerifyingHTTPSConn.__init__c C s t j | j | j f t | d d } t | d ra t | d d ra | | _ | j n t j | d t j
d | j | _ y t | j j
| j Wn5 t k
r | j j t j | j j Yn Xd S)Nsource_address_tunnel _tunnel_host cert_reqsca_certs)socketcreate_connectionrA portgetattrhasattrsockrI ssl wrap_socket
CERT_REQUIREDr= r getpeercertr
shutdown SHUT_RDWRclose)r? rR r r r connect s $!
zVerifyingHTTPSConn.connectN)r r r rG r> rZ r r r r r@ s r@ c C s t j t | p t j S)z@Get a urlopen() replacement that uses ca_bundle for verification)r build_openerr r open)r= r r r r s c sx t d k r t j Sy d d l m Wn t k
r? d SYn XG f d d d } | d d d g a t j S)Nr )CertFilec s( e Z d Z f f f d d Z d S)z$get_win_certfile..MyCertFilec sL j | x | D] } | j | q W| j | t j | j d S)N)r> ZaddstoreZaddcertsatexitregisterrY )r? storescertsstore)r] r r r> s
z-get_win_certfile..MyCertFile.__init__N)r r r r> r )r] r r
MyCertFile s rc r` CAROOT) _wincertsnameZ wincertstorer] ImportError)rc r )r] r get_win_certfile s
ri c
C sw t j d k r t Sx$ t D] } t j j | r | Sq Wy t j d d SWn t t t
f k
rr d SYn Xd S)z*Return an existing CA bundle path, or NonentZcertifiz
cacert.pemN) osrg ri r pathisfile
pkg_resourcesresource_filenamerh r r )Z cert_pathr r r r s
)"rk rM r^ r rn r r Zsetuptools.compatr rS rh __all__stripr r objectr
r whatwheremoduleexecr r
r Z backports.ssl_match_hostnamer3 r. r r@ r rf ri r r r r r sV
4)