\ " @ sB d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z m Z m Z d d l
m Z m Z y d d l
Z
Wn e k
r d Z
Yn Xd d d d d g Z d j j Z y e j j Z e j Z Wn e k
r e Z Z Yn Xe
d k oe e e f k Z y d d
l
m Z m Z WnW e k
ry$ d d l m Z d d l m Z Wn e k
rd Z d Z Yn XYn Xe sGd
d d e Z e sd d d Z d d Z Gd d d e Z Gd d d e Z d d d Z d d Z! e! d d Z" d d Z# d d Z$ d S) N)urllib http_clientmapfilter)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundle is_available
cert_paths
opener_fora
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r
)r c @ s e Z d Z d S)r
N)__name__
__module__ __qualname__ r r /ssl_support.pyr
5 s r
c
C sU g } | s d S| j d } | d } | d d } | j d } | | k rj t d t | | s | j | j k S| d k r | j d nY | j d s | j d r | j t j | n" | j t j | j d
d x$ | D] } | j t j | qWt j
d d
j | d t j } | j
| S)zpMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
F.r r N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr
reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
ZdnhostnameZ
max_wildcardsZpatspartsZleftmostZ remainderZ wildcardsZfragpatr r r _dnsname_match; s*
"
&r' c C sO | s t d g } | j d f } x@ | D]8 \ } } | d k r1 t | | r\ d S| j | q1 W| s x] | j d f D]I } x@ | D]8 \ } } | d k r t | | r d S| j | q Wq Wt | d k rt d | d j t t | f n; t | d k r?t d
| | d f n t d d S)
a= Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
zempty or no certificateZsubjectAltNameZDNSNZsubjectZ
commonNamer z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found)
ValueErrorgetr' r lenr
r! r r )Zcertr$ ZdnsnamesZsankeyvaluesubr r r r o s. %r c @ s. e Z d Z d Z d d Z d d Z d S)r z=Simple verifying handler: no auth, subclasses, timeouts, etc.c C s | | _ t j | d S)N) ca_bundle HTTPSHandler__init__)selfr. r r r r0 s z VerifyingHTTPSHandler.__init__c s j f d d | S)Nc s t | j | S)N)VerifyingHTTPSConnr. )hostkw)r1 r r <lambda> s z2VerifyingHTTPSHandler.https_open.<locals>.<lambda>)Zdo_open)r1 Zreqr )r1 r
https_open s z VerifyingHTTPSHandler.https_openN)r r r __doc__r0 r6 r r r r r s c @ s. e Z d Z d Z d d Z d d Z d S)r2 z@Simple verifying connection: no auth, subclasses, timeouts, etc.c K s t j | | | | | _ d S)N)HTTPSConnectionr0 r. )r1 r3 r. r4 r r r r0 s zVerifyingHTTPSConn.__init__c C s t j | j | j f t | d d } t | d rj t | d d rj | | _ | j | j } n | j } t j
| d t j d | j | _ y t
| j j | Wn5 t k
r | j j t j | j j Yn Xd S)Nsource_address_tunnel _tunnel_hostZ cert_reqsZca_certs)socketcreate_connectionr3 portgetattrhasattrsockr: r; sslZ wrap_socketZ
CERT_REQUIREDr. r Z getpeercertr
shutdown SHUT_RDWRclose)r1 rA Z actual_hostr r r connect s $!
zVerifyingHTTPSConn.connectN)r r r r7 r0 rF r r r r r2 s r2 c C s" t j j t | p t j S)z@Get a urlopen() replacement that uses ca_bundle for verification)r requestZ build_openerr r open)r. r r r r s c s% t j f d d } | S)Nc s( t d s! | | _ j S)Nalways_returns)r@ rI )argskwargs)funcr r wrapper s zonce.<locals>.wrapper) functoolswraps)rL rM r )rL r once s !rP c sr y d d l } Wn t k
r( d SYn XG f d d d | j } | j d | j d | j S)Nr c s: e Z d Z f d d Z f d d Z S)z"get_win_certfile.<locals>.CertFilec s' t | j t j | j d S)N)superr0 atexitregisterrE )r1 )CertFile __class__r r r0 s z+get_win_certfile.<locals>.CertFile.__init__c s0 y t | j Wn t k
r+ Yn Xd S)N)rQ rE OSError)r1 )rT rU r r rE s
z(get_win_certfile.<locals>.CertFile.close)r r r r0 rE r )rT )rU r rT s rT ZCAZROOT) wincertstore ImportErrorrT Zaddstorename)rW Z _wincertsr )rT r get_win_certfile s
rZ c C s4 t t j j t } t p3 t | d p3 t S)z*Return an existing CA bundle path, or NoneN)r ospathisfiler rZ next_certifi_where)Zextant_cert_pathsr r r r s c
C s6 y t d j SWn t t t f k
r1 Yn Xd S)NZcertifi)
__import__ZwhererX r r r r r r r_ s r_ )%r[ r< rR r rN Zsetuptools.extern.six.movesr r r r Z
pkg_resourcesr r rB rX __all__stripr r rG r/ r8 AttributeErrorobjectr
r
r Z backports.ssl_match_hostnamer( r' r r2 r rP rZ r r_ r r r r <module> sP "
4 )
#