ó
„ÚuVc @ s d Z d d l Z d d l Z y d d l Z Wn e k
rG d Z n Xd Z d e f d „ ƒ YZ d d „ Z d „ Z
d „ Z d
„ Z d S( sJ The match_hostname() function from Python 3.3.3, essential when using SSL.iÿÿÿÿNs 3.5.0.1t CertificateErrorc B s e Z RS( ( t __name__t
__module__( ( ( sI /usr/lib/python2.7/site-packages/backports/ssl_match_hostname/__init__.pyR s i c
C sR g } | s t S| j d ƒ } | d } | d } | j d ƒ } | | k rg t d t | ƒ ƒ ‚ n | sƒ | j ƒ | j ƒ k S| d k rŸ | j d ƒ nY | j d ƒ s½ | j d ƒ rÖ | j t j | ƒ ƒ n" | j t j | ƒ j
d d ƒ ƒ x$ | D] } | j t j | ƒ ƒ qÿ Wt j d
d j | ƒ d t j
ƒ } | j | ƒ S(
sh Matching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
t .i i t *s, too many wildcards in certificate DNS name: s [^.]+s xn--s \*s [^.]*s \As \.s \Z( t Falset splitt countR t reprt lowert appendt
startswitht ret escapet replacet compilet joint
IGNORECASEt match(
t dnt hostnamet
max_wildcardst patst partst leftmostt remaindert wildcardst fragt pat( ( sI /usr/lib/python2.7/site-packages/backports/ssl_match_hostname/__init__.pyt _dnsname_match s*
"
&c C s= t | t ƒ r9 t j d k r9 t | d d d d ƒ} n | S( Ni t encodingt asciit errorst strict( i ( t
isinstancet strt syst version_infot unicode( t obj( ( sI /usr/lib/python2.7/site-packages/backports/ssl_match_hostname/__init__.pyt _to_unicodeL s c C s% t j t | ƒ j ƒ ƒ } | | k S( sˆ Exact matching of IP addresses.
RFC 6125 explicitly doesn't define an algorithm for this
(section 1.7.2 - "Out of Scope").
( t ipaddresst
ip_addressR( t rstrip( t ipnamet host_ipt ip( ( sI /usr/lib/python2.7/site-packages/backports/ssl_match_hostname/__init__.pyt _ipaddress_matchQ s c C s | s t d ƒ ‚ n y t j t | ƒ ƒ } WnU t k
rG d } n? t k
r] d } n) t k
r… t d k r d } q† ‚ n Xg } | j d d ƒ } xŠ | D]‚ \ } } | d k rì | d k rÜ t | | ƒ rÜ d S| j | ƒ q¥ | d k r¥ | d k rt
| | ƒ rd S| j | ƒ q¥ q¥ W| s—xc | j d d ƒ D]L } xC | D]; \ } } | d k rQt | | ƒ r|d S| j | ƒ qQqQWqDWn t | ƒ d k rÔt d | d
j
t t | ƒ ƒ f ƒ ‚ n; t | ƒ d k rt d | | d f ƒ ‚ n t d
ƒ ‚ d S( s) Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
st empty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDt subjectAltNamet DNSNs
IP Addresst subjectt
commonNamei s& hostname %r doesn't match either of %ss , s hostname %r doesn't match %ri s= no appropriate commonName or subjectAltName fields were found( ( ( t
ValueErrorR) R* R( t Nonet UnicodeErrort AttributeErrort getR R
R/ t lenR R t mapR ( t certR R- t dnsnamest sant keyt valuet sub( ( sI /usr/lib/python2.7/site-packages/backports/ssl_match_hostname/__init__.pyt match_hostname] sJ
%(
t __doc__R R$ R) t ImportErrorR5 t __version__R4 R R R( R/ RA ( ( ( sI /usr/lib/python2.7/site-packages/backports/ssl_match_hostname/__init__.pyt <module> s
5