3
vh,! " @ s d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm Z d dl
m Z m Z y d dl
Z
W n ek
rt dZ
Y nX dddddgZd j j ZyejjZejZW n ek
r e ZZY nX e
dk oeeefkZyd d
l
mZmZ W nR ek
r: y d d lmZ d d lmZ W n ek
r4 dZdZY nX Y nX esRG d
d de Zesjd ddZ dd ZG dd deZ G dd deZ d ddZ dd Z!e!dd Z"d d Z#d d Z$dS )! N)urllib http_clientmapfilter)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundle is_available
cert_paths
opener_fora
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r
)r c @ s e Zd ZdS )r
N)__name__
__module__ __qualname__ r r !/usr/lib/python3.6/ssl_support.pyr
5 s r
c
C s g }| s dS | j d}|d }|dd }|jd}||krLtdt| |s`| j |j kS |dkrt|jd n>|jd s|jd r|jtj| n|jtj|j d
d x |D ]}|jtj| qW tj
d d
j | d tj } | j
|S )zpMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
F.r r N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr
reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
ZdnhostnameZ
max_wildcardsZpatspartsZleftmostZ remainderZ wildcardsZfragZpatr r r _dnsname_match; s*
r& c C s | s t dg }| jdf }x0|D ](\}}|dkr"t||r@dS |j| q"W |sxF| jdf D ]6}x0|D ](\}}|dkrjt||rdS |j| qjW q`W t|dkrtd|d jtt|f n*t|dkrtd
||d f ntd dS )
a= Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
zempty or no certificateZsubjectAltNameZDNSNZsubjectZ
commonNamer z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found)
ValueErrorgetr& r lenr
r! r r )Zcertr$ ZdnsnamesZsankeyvaluesubr r r r o s.
r c @ s e Zd ZdZdd Zdd ZdS )r z=Simple verifying handler: no auth, subclasses, timeouts, etc.c C s || _ tj| d S )N) ca_bundle HTTPSHandler__init__)selfr- r r r r/ s z VerifyingHTTPSHandler.__init__c s j fdd|S )Nc s t | jf|S )N)VerifyingHTTPSConnr- )hostkw)r0 r r s z2VerifyingHTTPSHandler.https_open..)Zdo_open)r0 Zreqr )r0 r
https_open s z VerifyingHTTPSHandler.https_openN)r r r __doc__r/ r5 r r r r r s c @ s e Zd ZdZdd Zdd ZdS )r1 z@Simple verifying connection: no auth, subclasses, timeouts, etc.c K s t j| |f| || _d S )N)HTTPSConnectionr/ r- )r0 r2 r- r3 r r r r/ s zVerifyingHTTPSConn.__init__c C s t j| j| jft| dd }t| drHt| dd rH|| _| j | j}n| j}tt drxt j
| j d}|j ||d| _nt j |t j
| j d| _yt| jj | W n. tk
r | jjt j | jj Y nX d S )NZsource_address_tunnel _tunnel_hostcreate_default_context)Zcafile)Zserver_hostname)Z cert_reqsZca_certs)socketZcreate_connectionr2 Zportgetattrhasattrsockr8 r9 sslr: r- Z wrap_socketZ
CERT_REQUIREDr Z getpeercertr
ZshutdownZ SHUT_RDWRclose)r0 r> Z actual_hostZctxr r r connect s$
zVerifyingHTTPSConn.connectN)r r r r6 r/ rA r r r r r1 s r1 c C s t jjt| pt jS )z@Get a urlopen() replacement that uses ca_bundle for verification)r requestZ build_openerr r open)r- r r r r s c s t j fdd}|S )Nc s t ds | | _ jS )Nalways_returns)r= rD )argskwargs)funcr r wrapper s
zonce..wrapper) functoolswraps)rG rH r )rG r once s rK c sX y dd l } W n tk
r d S X G fddd| j }|jd |jd |jS )Nr c s, e Zd Z fddZ fddZ ZS )z"get_win_certfile..CertFilec s t | j tj| j d S )N)superr/ atexitregisterr@ )r0 )CertFile __class__r r r/ s z+get_win_certfile..CertFile.__init__c s, yt | j W n tk
r& Y nX d S )N)rL r@ OSError)r0 )rO rP r r r@ s z(get_win_certfile..CertFile.close)r r r r/ r@
__classcell__r )rO )rP r rO s rO ZCAZROOT) wincertstore ImportErrorrO Zaddstorename)rS Z _wincertsr )rO r get_win_certfile s
rV c C s$ t tjjt} t p"t| dp"t S )z*Return an existing CA bundle path, or NoneN)r ospathisfiler rV next_certifi_where)Zextant_cert_pathsr r r r s
c
C s, y t dj S tttfk
r& Y nX d S )NZcertifi)
__import__whererT r r r r r r r[ s r[ )r )N)%rW r; rM r rI Zsetuptools.extern.six.movesr r r r Z
pkg_resourcesr r r? rT __all__stripr r rB r. r7 AttributeErrorobjectr
r
r Z backports.ssl_match_hostnamer' r& r r1 r rK rV r r[ r r r r sP
4)
(