U
Qab-! @ s d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm Z d dl
m Z m Z z d dl
Z
W n ek
rt dZ
Y nX dddddgZd ZzejjZejZW n ek
r e ZZY nX e
dk oeeefkZzd d
l
mZmZ W nR ek
r: z d d lmZ d d lmZ W n ek
r4 dZdZY nX Y nX esRG d
d de Zesjd ddZ dd ZG dd deZ G dd deZ d ddZ dd Z!e!dd Z"d d Z#d d Z$dS )! N)urllib http_clientmapfilter)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundle is_available
cert_paths
opener_fora
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r
)r c @ s e Zd ZdS )r
N)__name__
__module__ __qualname__ r r :/usr/lib/python3.8/site-packages/setuptools/ssl_support.pyr
5 s r
c
C s g }| s dS | d}|d }|dd }|d}||krLtdt| |s`| | kS |dkrt|d n>|d s|d r|t| n|t| d
d |D ]}|t| qt
d d
| d tj } |
|S )zqMatching according to RFC 6125, section 6.4.3
https://tools.ietf.org/html/rfc6125#section-6.4.3
F.r r N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr
reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
ZdnhostnameZ
max_wildcardsZpatspartsZleftmostZ remainderZ wildcardsZfragZpatr r r _dnsname_match; s,
r& c C s | s t dg }| dd}|D ]*\}}|dkr t||r@ dS || q |s| ddD ]6}|D ],\}}|dkrdt||r dS || qdq\t|dkrtd |d
tt|f n*t|dkrtd ||d f ntd
dS )a= Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
zempty or no certificateZsubjectAltNamer ZDNSNZsubjectZ
commonNamer z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found)
ValueErrorgetr& r lenr
r! r r )Zcertr$ ZdnsnamesZsankeyvaluesubr r r r o s2
r c @ s e Zd ZdZdd Zdd ZdS )r z=Simple verifying handler: no auth, subclasses, timeouts, etc.c C s || _ t| d S N) ca_bundle HTTPSHandler__init__)selfr. r r r r0 s z VerifyingHTTPSHandler.__init__c s fdd|S )Nc s t | jf|S r- )VerifyingHTTPSConnr. )hostkwr1 r r z2VerifyingHTTPSHandler.https_open..)Zdo_open)r1 Zreqr r5 r
https_open s
z VerifyingHTTPSHandler.https_openN)r r r __doc__r0 r8 r r r r r s c @ s e Zd ZdZdd Zdd ZdS )r2 z@Simple verifying connection: no auth, subclasses, timeouts, etc.c K s t j| |f| || _d S r- )HTTPSConnectionr0 r. )r1 r3 r. r4 r r r r0 s zVerifyingHTTPSConn.__init__c C s t | j| jft| dd }t| drHt| dd rH|| _| | j}n| j}tt drxt j
| j d}|j ||d| _nt j |t j
| j d| _zt| j | W n. tk
r | jt j | j Y nX d S )NZsource_address_tunnel _tunnel_hostcreate_default_context)Zcafile)Zserver_hostname)Z cert_reqsZca_certs)socketZcreate_connectionr3 Zportgetattrhasattrsockr; r< sslr= r. Z wrap_socketZ
CERT_REQUIREDr Z getpeercertr
ZshutdownZ SHUT_RDWRclose)r1 rA Z actual_hostZctxr r r connect s.
zVerifyingHTTPSConn.connectN)r r r r9 r0 rD r r r r r2 s r2 c C s t jt| pt jS )z@Get a urlopen() replacement that uses ca_bundle for verification)r requestZ build_openerr r open)r. r r r r s c s t fdd}|S )Nc s t ds | | _ jS )Nalways_returns)r@ rG )argskwargsfuncr r wrapper s
zonce..wrapper) functoolswraps)rK rL r rJ r once s rO c sZ z dd l } W n tk
r" Y d S X G fddd| j }|d |d |jS )Nr c s, e Zd Z fddZ fddZ ZS )z"get_win_certfile..CertFilec s t | t| j d S r- )superr0 atexitregisterrC r5 CertFile __class__r r r0 s z+get_win_certfile..CertFile.__init__c s, zt | W n tk
r& Y nX d S r- )rP rC OSErrorr5 rS r r rC s z(get_win_certfile..CertFile.close)r r r r0 rC
__classcell__r rT )rU r rT s rT ZCAZROOT) wincertstore ImportErrorrT Zaddstorename)rY Z _wincertsr rX r get_win_certfile s
r\ c C s$ t tjjt} t p"t| dp"t S )z*Return an existing CA bundle path, or NoneN)r ospathisfiler r\ next_certifi_where)Zextant_cert_pathsr r r r s c
C s. zt d W S tttfk
r( Y nX d S )NZcertifi)
__import__whererZ r r r r r r ra s ra )r )N)%r] r> rQ r rM Zsetuptools.extern.six.movesr r r r Z
pkg_resourcesr r rB rZ __all__stripr r rE r/ r: AttributeErrorobjectr
r
r Z backports.ssl_match_hostnamer' r& r r2 r rO r\ r ra r r r r sZ
4)
(