�
��abc @ s� d Z d d l Z d d l Z y d d l Z Wn e k
rG d Z n Xd Z d e f d � � YZ d d � Z d � Z
d � Z d
� Z d S( sJ The match_hostname() function from Python 3.3.3, essential when using SSL.i����Ns 3.5.0.1t CertificateErrorc B s e Z RS( ( t __name__t
__module__( ( ( sc /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/packages/ssl_match_hostname/_implementation.pyR s i c
C sR g } | s t S| j d � } | d } | d } | j d � } | | k rg t d t | � � � n | s� | j � | j � k S| d k r� | j d � nY | j d � s� | j d � r� | j t j | � � n" | j t j | � j
d d � � x$ | D] } | j t j | � � q� Wt j d
d j | � d t j
� } | j | � S(
sh Matching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
t .i i t *s, too many wildcards in certificate DNS name: s [^.]+s xn--s \*s [^.]*s \As \.s \Z( t Falset splitt countR t reprt lowert appendt
startswitht ret escapet replacet compilet joint
IGNORECASEt match(
t dnt hostnamet
max_wildcardst patst partst leftmostt remaindert wildcardst fragt pat( ( sc /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/packages/ssl_match_hostname/_implementation.pyt _dnsname_match s*
"
&c C s= t | t � r9 t j d k r9 t | d d d d �} n | S( Ni t encodingt asciit errorst strict( i ( t
isinstancet strt syst version_infot unicode( t obj( ( sc /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/packages/ssl_match_hostname/_implementation.pyt _to_unicodeO s c C s% t j t | � j � � } | | k S( s� Exact matching of IP addresses.
RFC 6125 explicitly doesn't define an algorithm for this
(section 1.7.2 - "Out of Scope").
( t ipaddresst
ip_addressR( t rstrip( t ipnamet host_ipt ip( ( sc /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/packages/ssl_match_hostname/_implementation.pyt _ipaddress_matchT s c C s | s t d � � n y t j t | � � } WnU t k
rG d } n? t k
r] d } n) t k
r� t d k r d } q� � n Xg } | j d d � } x� | D]� \ } } | d k r� | d k r� t | | � r� d S| j | � q� | d k r� | d k rt
| | � rd S| j | � q� q� W| s�xc | j d d � D]L } xC | D]; \ } } | d k rQt | | � r|d S| j | � qQqQWqDWn t | � d k r�t d | d
j
t t | � � f � � n; t | � d k rt d | | d f � � n t d
� � d S( s) Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
st empty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDt subjectAltNamet DNSNs
IP Addresst subjectt
commonNamei s& hostname %r doesn't match either of %ss , s hostname %r doesn't match %ri s= no appropriate commonName or subjectAltName fields were found( ( ( t
ValueErrorR) R* R( t Nonet UnicodeErrort AttributeErrort getR R
R/ t lenR R t mapR ( t certR R- t dnsnamest sant keyt valuet sub( ( sc /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/packages/ssl_match_hostname/_implementation.pyt match_hostname` sJ
%(
t __doc__R R$ R) t ImportErrorR5 t __version__R4 R R R( R/ RA ( ( ( sc /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/packages/ssl_match_hostname/_implementation.pyt s
5