Re " @ sB d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z m Z m Z d d l
m Z m Z y d d l
Z
Wn e k
r d Z
Yn Xd d d d d g Z d j j Z y e j j Z e j Z Wn e k
r e Z Z Yn Xe
d k oe e e f k Z y d d
l
m Z m Z WnW e k
ry$ d d l m Z d d l m Z Wn e k
rd Z d Z Yn XYn Xe sGd
d d e Z e sd d d Z d d Z Gd d d e Z Gd d d e Z d d d Z d d Z! e! d d Z" d d Z# d d Z$ d S) N)urllib http_clientmapfilter)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundle is_available
cert_paths
opener_fora
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r
)r c @ s e Z d Z d S)r
N)__name__
__module__ __qualname__ r r /builddir/build/BUILDROOT/alt-python35-setuptools-36.3.0-4.el8.x86_64/opt/alt/python35/lib/python3.5/site-packages/setuptools/ssl_support.pyr
5 s r
c
C sU g } | s d S| j d } | d } | d d } | j d } | | k rj t d t | | s | j | j k S| d k r | j d nY | j d s | j d r | j t j | n" | j t j | j d
d x$ | D] } | j t j | qWt j
d d
j | d t j } | j
| S)zpMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
F.r r N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr
reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
dnhostname
max_wildcardspatspartsleftmost remainder wildcardsfragpatr r r _dnsname_match; s*
"
&r. c C sO | s t d g } | j d f } x@ | D]8 \ } } | d k r1 t | | r\ d S| j | q1 W| s x] | j d f D]I } x@ | D]8 \ } } | d k r t | | r d S| j | q Wq Wt | d k rt d | d j t t | f n; t | d k r?t d
| | d f n t d d S)
a= Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
zempty or no certificatesubjectAltNameDNSNsubject
commonNamer z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found)
ValueErrorgetr. r lenr
r! r r )certr% dnsnamessankeyvaluesubr r r r o s. %r c @ s. e Z d Z d Z d d Z d d Z d S)r z=Simple verifying handler: no auth, subclasses, timeouts, etc.c C s | | _ t j | d S)N) ca_bundle HTTPSHandler__init__)selfr< r r r r> s z VerifyingHTTPSHandler.__init__c s j f d d | S)Nc s t | j | S)N)VerifyingHTTPSConnr< )hostkw)r? r r s z2VerifyingHTTPSHandler.https_open..)do_open)r? reqr )r? r
https_open s z VerifyingHTTPSHandler.https_openN)r r r __doc__r> rF r r r r r s c @ s. e Z d Z d Z d d Z d d Z d S)r@ z@Simple verifying connection: no auth, subclasses, timeouts, etc.c K s t j | | | | | _ d S)N)HTTPSConnectionr> r< )r? rA r< rB r r r r> s zVerifyingHTTPSConn.__init__c C s t j | j | j f t | d d } t | d rj t | d d rj | | _ | j | j } n | j } t j
| d t j d | j | _ y t
| j j | Wn5 t k
r | j j t j | j j Yn Xd S)Nsource_address_tunnel _tunnel_host cert_reqsca_certs)socketcreate_connectionrA portgetattrhasattrsockrJ rK ssl wrap_socket
CERT_REQUIREDr< r getpeercertr
shutdown SHUT_RDWRclose)r? rS actual_hostr r r connect s $!
zVerifyingHTTPSConn.connectN)r r r rG r> r\ r r r r r@ s r@ c C s" t j j t | p t j S)z@Get a urlopen() replacement that uses ca_bundle for verification)r request build_openerr r open)r< r r r r s c s% t j f d d } | S)Nc s( t d s! | | _ j S)Nalways_returns)rR r` )argskwargs)funcr r wrapper s zonce..wrapper) functoolswraps)rc rd r )rc r once s !rg c sr y d d l } Wn t k
r( d SYn XG f d d d | j } | j d | j d | j S)Nr c s: e Z d Z f d d Z f d d Z S)z"get_win_certfile..CertFilec s' t | j t j | j d S)N)superr> atexitregisterrZ )r? )CertFile __class__r r r> s z+get_win_certfile..CertFile.__init__c s0 y t | j Wn t k
r+ Yn Xd S)N)rh rZ OSError)r? )rk rl r r rZ s
z(get_win_certfile..CertFile.close)r r r r> rZ r )rk )rl r rk s rk CAROOT) wincertstore ImportErrorrk Zaddstorename)rp Z _wincertsr )rk r get_win_certfile s
rs c C s4 t t j j t } t p3 t | d p3 t S)z*Return an existing CA bundle path, or NoneN)r ospathisfiler rs next_certifi_where)Zextant_cert_pathsr r r r s c
C s6 y t d j SWn t t t f k
r1 Yn Xd S)Ncertifi)
__import__whererq r r r r r r rx s rx )%rt rN ri r re Zsetuptools.extern.six.movesr r r r
pkg_resourcesr r rT rq __all__stripr r r] r= rH AttributeErrorobjectr
r
r Z backports.ssl_match_hostnamer3 r. r r@ r rg rs r rx r r r r sP "
4 )
#