3
LY              "   @   s  d dl Z d dlZd dlZd dlZd dlmZmZmZ d dlZd dlm	Z	m
Z
 yd dlZW n ek
rp   dZY nX dddddgZd	j j ZyejjZejZW n ek
r   e ZZY nX edk	oeeefkZyd d
lmZmZ W nR ek
r6   yd dlmZ d dlmZ W n ek
r0   dZdZY nX Y nX esNG dd deZesfdddZdd ZG dd deZG dd deZdddZdadd Z dd Z!dS )    N)urllibhttp_clientmap)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundleis_available
cert_paths
opener_fora  
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r   )r   c               @   s   e Zd ZdS )r   N)__name__
__module____qualname__ r   r   p/private/var/folders/7d/20zwc49s3kn54d3vgq8bd4640000gn/T/pip-build-an2lx5zf/setuptools/setuptools/ssl_support.pyr   5   s   r      c       
      C   s   g }| sdS | j d}|d }|dd }|jd}||krLtdt|  |s`| j |j kS |dkrt|jd n>|jd	s|jd	r|jtj| n|jtj|j	d
d x|D ]}|jtj| qW tj
ddj| d tj}	|	j|S )zpMatching according to RFC 6125, section 6.4.3

        http://tools.ietf.org/html/rfc6125#section-6.4.3
        F.r   r   N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr   reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
dnhostnamemax_wildcardspatspartsleftmost	remainder	wildcardsfragpatr   r   r   _dnsname_match;   s*    


r-   c             C   s   | st dg }| jdf }x0|D ](\}}|dkr"t||r@dS |j| q"W |sxF| jdf D ]6}x0|D ](\}}|dkrjt||rdS |j| qjW q`W t|dkrtd|d	jtt|f n*t|dkrtd
||d f ntddS )a=  Verify that *cert* (in decoded format as returned by
        SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
        rules are followed, but IP addresses are not accepted for *hostname*.

        CertificateError is raised on failure. On success, the function
        returns nothing.
        zempty or no certificatesubjectAltNameDNSNsubject
commonNamer   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)	
ValueErrorgetr-   r   lenr   r    r   r   )certr$   dnsnamessankeyvaluesubr   r   r   r   o   s.    

r   c               @   s    e Zd ZdZdd Zdd ZdS )r   z=Simple verifying handler: no auth, subclasses, timeouts, etc.c             C   s   || _ tj|  d S )N)	ca_bundleHTTPSHandler__init__)selfr;   r   r   r   r=      s    zVerifyingHTTPSHandler.__init__c                s    j  fdd|S )Nc                s   t |  jf|S )N)VerifyingHTTPSConnr;   )hostkw)r>   r   r   <lambda>   s    z2VerifyingHTTPSHandler.https_open.<locals>.<lambda>)do_open)r>   reqr   )r>   r   
https_open   s    z VerifyingHTTPSHandler.https_openN)r   r   r   __doc__r=   rE   r   r   r   r   r      s   c               @   s    e Zd ZdZdd Zdd ZdS )r?   z@Simple verifying connection: no auth, subclasses, timeouts, etc.c             K   s   t j| |f| || _d S )N)HTTPSConnectionr=   r;   )r>   r@   r;   rA   r   r   r   r=      s    zVerifyingHTTPSConn.__init__c             C   s   t j| j| jft| dd }t| drHt| dd rH|| _| j  | j}n| j}t	j
|t	j| jd| _yt| jj | W n. tk
r   | jjt j | jj   Y nX d S )Nsource_address_tunnel_tunnel_host)	cert_reqsca_certs)socketcreate_connectionr@   portgetattrhasattrsockrI   rJ   sslwrap_socketCERT_REQUIREDr;   r   getpeercertr   shutdown	SHUT_RDWRclose)r>   rR   actual_hostr   r   r   connect   s    
zVerifyingHTTPSConn.connectN)r   r   r   rF   r=   r[   r   r   r   r   r?      s   r?   c             C   s   t jjt| pt jS )z@Get a urlopen() replacement that uses ca_bundle for verification)r   requestbuild_openerr   r   open)r;   r   r   r   r      s    c                  s^   t d k	rt jS yddlm  W n tk
r2   d S X G  fddd ddgda t jS )Nr   )CertFilec                   s0   e Zd Zf f ffdd	Z fddZ  ZS )z$get_win_certfile.<locals>.MyCertFilec                s<    j |  x|D ]}| j| qW | j| tj| j d S )N)r=   ZaddstoreZaddcertsatexitregisterrY   )r>   storescertsstore)r_   r   r   r=      s
    


z-get_win_certfile.<locals>.MyCertFile.__init__c                s,   yt  | j  W n tk
r&   Y nX d S )N)superrY   OSError)r>   )
MyCertFile	__class__r   r   rY      s    z*get_win_certfile.<locals>.MyCertFile.close)r   r   r   r=   rY   __classcell__r   )r_   rg   )rh   r   rg      s   rg   CAROOT)rb   )	_wincertsnameZwincertstorer_   ImportErrorr   r   )r_   rg   r   get_win_certfile   s    ro   c              C   s^   t jdkrt S xtD ]} t jj| r| S qW yddl}|j S  tt	t
fk
rX   dS X dS )z*Return an existing CA bundle path, or Nonentr   N)osrm   ro   r
   pathisfilecertifiwherern   r   r   )Z	cert_pathrt   r   r   r   r      s    

)r   )N)"rq   rM   r`   r   Zsetuptools.extern.six.movesr   r   r   pkg_resourcesr   r   rS   rn   __all__stripr   r
   r\   r<   rG   AttributeErrorobjectr	   r   r   Zbackports.ssl_match_hostnamer2   r-   r   r?   r   rl   ro   r   r   r   r   r   <module>   sN   


4)#
