3
;p_?!              "   @   s  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
mZ yd dlZW n ek
rl   dZY nX dddddgZdj j ZyejjZejjZW n ek
r   e ZZY nX edk	oeeefkZyd d	lmZmZ W nR ek
r4   yd d
lmZ d dlmZ W n ek
r.   dZdZY nX Y nX esLG dd deZesddddZdd ZG dd deZG dd deZdddZ dd Z!e!dd Z"dd Z#dd Z$dS )     N)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundleis_available
cert_paths
opener_fora  
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r	   )r
   c               @   s   e Zd ZdS )r	   N)__name__
__module____qualname__ r   r   >/tmp/pip-install-ofl94hr3/setuptools/setuptools/ssl_support.pyr	   7   s   r	      c       
      C   s   g }| sdS | j d}|d }|dd }|jd}||krLtdt|  |s`| j |j kS |dkrt|jd n>|jd	s|jd	r|jtj| n|jtj|j	d
d x|D ]}|jtj| qW tj
ddj| d tj}	|	j|S )zqMatching according to RFC 6125, section 6.4.3

        https://tools.ietf.org/html/rfc6125#section-6.4.3
        F.r   r   N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr	   reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
dnhostnamemax_wildcardspatspartsleftmost	remainder	wildcardsfragpatr   r   r   _dnsname_match=   s*    


r*   c             C   s   | st dg }| jdf }x0|D ](\}}|dkr"t||r@dS |j| q"W |sxF| jdf D ]6}x0|D ](\}}|dkrjt||rdS |j| qjW q`W t|dkrtd|d	jtt|f n*t|dkrtd
||d f ntddS )a=  Verify that *cert* (in decoded format as returned by
        SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
        rules are followed, but IP addresses are not accepted for *hostname*.

        CertificateError is raised on failure. On success, the function
        returns nothing.
        zempty or no certificatesubjectAltNameDNSNsubject
commonNamer   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)	
ValueErrorgetr*   r   lenr	   r   mapr   )certr!   dnsnamessankeyvaluesubr   r   r   r
   s   s4    

r
   c               @   s    e Zd ZdZdd Zdd ZdS )r   z=Simple verifying handler: no auth, subclasses, timeouts, etc.c             C   s   || _ tj|  d S )N)	ca_bundleHTTPSHandler__init__)selfr9   r   r   r   r;      s    zVerifyingHTTPSHandler.__init__c                s    j  fdd|S )Nc                s   t |  jf|S )N)VerifyingHTTPSConnr9   )hostkw)r<   r   r   <lambda>   s    z2VerifyingHTTPSHandler.https_open.<locals>.<lambda>)do_open)r<   reqr   )r<   r   
https_open   s    
z VerifyingHTTPSHandler.https_openN)r   r   r   __doc__r;   rC   r   r   r   r   r      s   c               @   s    e Zd ZdZdd Zdd ZdS )r=   z@Simple verifying connection: no auth, subclasses, timeouts, etc.c             K   s   t j| |f| || _d S )N)HTTPSConnectionr;   r9   )r<   r>   r9   r?   r   r   r   r;      s    zVerifyingHTTPSConn.__init__c             C   s   t j| j| jft| dd }t| drHt| dd rH|| _| j  | j}n| j}tt	drxt	j
| jd}|j||d| _nt	j|t	j| jd| _yt| jj | W n. tk
r   | jjt j | jj   Y nX d S )Nsource_address_tunnel_tunnel_hostcreate_default_context)cafile)server_hostname)	cert_reqsca_certs)socketcreate_connectionr>   portgetattrhasattrsockrG   rH   sslrI   r9   wrap_socketCERT_REQUIREDr
   getpeercertr	   shutdown	SHUT_RDWRclose)r<   rS   actual_hostctxr   r   r   connect   s$    

zVerifyingHTTPSConn.connectN)r   r   r   rD   r;   r]   r   r   r   r   r=      s   r=   c             C   s   t jjt| pt jS )z@Get a urlopen() replacement that uses ca_bundle for verification)urllibrequestbuild_openerr   r   open)r9   r   r   r   r      s    c                s   t j  fdd}|S )Nc                 s   t  ds | | _ jS )Nalways_returns)rR   rb   )argskwargs)funcr   r   wrapper   s    
zonce.<locals>.wrapper)	functoolswraps)re   rf   r   )re   r   once   s    ri   c                 sX   ydd l } W n tk
r    d S X G  fddd| j   }|jd |jd |jS )Nr   c                   s,   e Zd Z fddZ fddZ  ZS )z"get_win_certfile.<locals>.CertFilec                s   t  | j  tj| j d S )N)superr;   atexitregisterrZ   )r<   )CertFile	__class__r   r   r;      s    z+get_win_certfile.<locals>.CertFile.__init__c                s,   yt  | j  W n tk
r&   Y nX d S )N)rj   rZ   OSError)r<   )rm   rn   r   r   rZ      s    z(get_win_certfile.<locals>.CertFile.close)r   r   r   r;   rZ   __classcell__r   )rm   )rn   r   rm      s   rm   CAROOT)wincertstoreImportErrorrm   Zaddstorename)rs   Z	_wincertsr   )rm   r   get_win_certfile   s    

rv   c              C   s$   t tjjt} t p"t| dp"t S )z*Return an existing CA bundle path, or NoneN)filterospathisfiler   rv   next_certifi_where)Zextant_cert_pathsr   r   r   r      s    
c               C   s,   yt dj S  tttfk
r&   Y nX d S )NZcertifi)
__import__wherert   r   r   r   r   r   r   r|     s    r|   )r   )N)%rx   rN   rk   r   rg   urllib.requestr^   http.clienthttppkg_resourcesr   r   rT   rt   __all__stripr   r   r_   r:   clientrE   AttributeErrorobjectr   r	   r
   Zbackports.ssl_match_hostnamer/   r*   r   r=   r   ri   rv   r   r|   r   r   r   r   <module>   sT   



6*(
	
