�
� fc @ s/ d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z m Z m Z d d l
m Z m Z y d d l
Z
Wn e k
r� d Z
n Xd d d d d g Z d j � j � Z y e j j Z e j Z Wn e k
r� e Z Z n Xe
d k oe e e f k Z y d d
l
m Z m Z WnU e k
r�y$ d d l m Z d d l m Z Wq�e k
r�d Z d Z q�Xn Xe s�d
e f d � � YZ n e s�d d � Z d � Z n d e f d � � YZ d e f d � � YZ d d � Z! d � Z" e" d � � Z# d � Z$ d � Z% d S( i����N( t urllibt http_clientt mapt filter( t ResolutionErrort ExtractionErrort VerifyingHTTPSHandlert find_ca_bundlet is_availablet
cert_pathst
opener_fors
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
( t CertificateErrort match_hostname( R ( R R c B s e Z RS( ( t __name__t
__module__( ( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR 5 s i c
C sR g } | s t S| j d � } | d } | d } | j d � } | | k rg t d t | � � � n | s� | j � | j � k S| d k r� | j d � nY | j d � s� | j d � r� | j t j | � � n" | j t j | � j
d d � � x$ | D] } | j t j | � � q� Wt j d
d j | � d t j
� } | j | � S(
sp Matching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
t .i i t *s, too many wildcards in certificate DNS name: s [^.]+s xn--s \*s [^.]*s \As \.s \Z( t Falset splitt countR t reprt lowert appendt
startswitht ret escapet replacet compilet joint
IGNORECASEt match(
t dnt hostnamet
max_wildcardst patst partst leftmostt remaindert wildcardst fragt pat( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyt _dnsname_match; s*
"
&c C s[ | s t d � � n g } | j d d
� } xC | D]; \ } } | d k r4 t | | � r_ d S| j | � q4 q4 W| s� xc | j d d � D]L } xC | D]; \ } } | d k r� t | | � r� d S| j | � q� q� Wq� Wn t | � d k r t d | d j t t | � � f � � n; t | � d k rKt d
| | d f � � n t d � � d S( s= Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
s empty or no certificatet subjectAltNamet DNSNt subjectt
commonNamei s& hostname %r doesn't match either of %ss , s hostname %r doesn't match %ri s= no appropriate commonName or subjectAltName fields were found( ( ( t
ValueErrort getR) R t lenR R R R ( t certR t dnsnamest sant keyt valuet sub( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR o s. %c B s e Z d Z d � Z d � Z RS( s= Simple verifying handler: no auth, subclasses, timeouts, etc.c C s | | _ t j | � d S( N( t ca_bundlet HTTPSHandlert __init__( t selfR7 ( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR9 � s c s � j � f d � | � S( Nc s t | � j | � S( N( t VerifyingHTTPSConnR7 ( t hostt kw( R: ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyt � t ( t do_open( R: t req( ( R: s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyt
https_open� s ( R
R t __doc__R9 RB ( ( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR � s R; c B s e Z d Z d � Z d � Z RS( s@ Simple verifying connection: no auth, subclasses, timeouts, etc.c K s t j | | | � | | _ d S( N( t HTTPSConnectionR9 R7 ( R: R< R7 R= ( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR9 � s c C s+ t j | j | j f t | d d � � } t | d � rj t | d d � rj | | _ | j � | j } n | j } t t
d � r� t
j d | j � } | j
| d | �| _ n$ t
j
| d t
j d | j �| _ y t | j j � | � Wn4 t k
r&| j j t j � | j j � � n Xd S( Nt source_addresst _tunnelt _tunnel_hostt create_default_contextt cafilet server_hostnamet cert_reqst ca_certs( t sockett create_connectionR< t portt getattrt Nonet hasattrt sockRF RG t sslRH R7 t wrap_sockett
CERT_REQUIREDR t getpeercertR t shutdownt SHUT_RDWRt close( R: RS t actual_hostt ctx( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyt connect� s$ $!
( R
R RC R9 R] ( ( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR; � s c C s" t j j t | p t � � � j S( s@ Get a urlopen() replacement that uses ca_bundle for verification( R t requestt build_openerR R t open( R7 ( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR
� s c s" t j � � � f d � � } | S( Nc s+ t � d � s$ � | | � � _ n � j S( Nt always_returns( RR Ra ( t argst kwargs( t func( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyt wrapper� s ( t functoolst wraps( Rd Re ( ( Rd s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyt once� s c sn y d d l } Wn t k
r$ d SXd | j f � f d � � Y� � � } | j d � | j d � | j S( Ni����t CertFilec s& e Z � f d � Z � f d � Z RS( c s' t � | � j � t j | j � d S( N( t superR9 t atexitt registerRZ ( R: ( Ri ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR9 � s c s/ y t � | � j � Wn t k
r* n Xd S( N( Rj RZ t OSError( R: ( Ri ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyRZ � s
( R
R R9 RZ ( ( Ri ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyRi � s t CAt ROOT( t wincertstoret ImportErrorRQ Ri t addstoret name( Rp t _wincerts( ( Ri s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyt get_win_certfile� s
c C s4 t t j j t � } t � p3 t | d � p3 t � S( s* Return an existing CA bundle path, or NoneN( R t ost patht isfileR Ru t nextRQ t _certifi_where( t extant_cert_paths( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyR � s c C s5 y t d � j � SWn t t t f k
r0 n Xd S( Nt certifi( t
__import__t whereRq R R ( ( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyRz s (& Rv RM Rk R Rf t setuptools.extern.six.movesR R R R t
pkg_resourcesR R RT Rq RQ t __all__t stripR R R^ R8 RD t AttributeErrort objectR R R t backports.ssl_match_hostnameR. R) R R; R
Rh Ru R Rz ( ( ( s: /usr/lib/python2.7/site-packages/setuptools/ssl_support.pyt sP "
4 )
(