a
hu! @ s d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
m Z z d dl Z W n e
yj dZ Y n0 g dZd ZzejjZejjZW n ey e ZZY n0 e duoeeefvZzd dl mZmZ W nN e
y& z d dlmZ d dlmZ W n e
y dZdZY n0 Y n0 es>G dd d e ZesVd d d Z d
d ZG dd deZ G dd deZ d ddZ dd Z!e!dd Z"dd Z#dd Z$dS ) N)ResolutionErrorExtractionError)VerifyingHTTPSHandlerfind_ca_bundle is_available
cert_paths
opener_fora
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r )r
c @ s e Zd ZdS )r N)__name__
__module__ __qualname__ r r :/usr/lib/python3.9/site-packages/setuptools/ssl_support.pyr 7 s r c
C s g }| s dS | d}|d }|dd }|d}||krLtdt| |s`| | kS |dkrt|d n>|d s|d r|t| n|t| d
d |D ]}|t| qt
d d
| d tj } |
|S )zqMatching according to RFC 6125, section 6.4.3
https://tools.ietf.org/html/rfc6125#section-6.4.3
F.r r N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
ZdnhostnameZ
max_wildcardsZpatspartsZleftmostZ remainderZ wildcardsfragpatr r r _dnsname_match= s,
r$ c C s | s t dg }| dd}|D ]*\}}|dkr t||r@ dS || q |s| ddD ]6}|D ],\}}|dkrdt||r dS || qdq\t|dkrtd |d
tt|f n*t|dkrtd ||d f ntd
dS )a= Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
zempty or no certificateZsubjectAltNamer ZDNSNZsubjectZ
commonNamer z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found)
ValueErrorgetr$ r lenr r mapr )Zcertr ZdnsnamesZsankeyvaluesubr r r r
s s>
r
c @ s e Zd ZdZdd Zdd ZdS )r z=Simple verifying handler: no auth, subclasses, timeouts, etc.c C s || _ t| d S N) ca_bundle HTTPSHandler__init__)selfr- r r r r/ s z VerifyingHTTPSHandler.__init__c s fdd|S )Nc s t | jfi |S r, )VerifyingHTTPSConnr- )hostkwr0 r r z2VerifyingHTTPSHandler.https_open..)Zdo_open)r0 Zreqr r4 r
https_open s
z VerifyingHTTPSHandler.https_openN)r r r
__doc__r/ r7 r r r r r s r c @ s e Zd ZdZdd Zdd ZdS )r1 z@Simple verifying connection: no auth, subclasses, timeouts, etc.c K s t j| |fi | || _d S r, )HTTPSConnectionr/ r- )r0 r2 r- r3 r r r r/ s zVerifyingHTTPSConn.__init__c C s t | j| jft| dd }t| drHt| dd rH|| _| | j}n| j}tt drxt j
| j d}|j ||d| _nt j |t j
| j d| _zt| j | W n, ty | jt j | j Y n0 d S )NZsource_address_tunnel _tunnel_hostcreate_default_context)Zcafile)Zserver_hostname)Z cert_reqsZca_certs)socketZcreate_connectionr2 portgetattrhasattrsockr: r; sslr< r- Z wrap_socketZ
CERT_REQUIREDr
Z getpeercertr ZshutdownZ SHUT_RDWRclose)r0 rA Z actual_hostctxr r r connect s(
zVerifyingHTTPSConn.connectN)r r r
r8 r/ rE r r r r r1 s r1 c C s t jt| pt jS )z@Get a urlopen() replacement that uses ca_bundle for verification)urllibrequestZ build_openerr r open)r- r r r r s r c s t fdd}|S )Nc s t ds | i | _ jS )Nalways_returns)r@ rI )argskwargsfuncr r wrapper s
zonce..wrapper) functoolswraps)rM rN r rL r once s rQ c sX z dd l } W n ty Y d S 0 G fddd| j }|d |d |jS )Nr c s, e Zd Z fddZ fddZ ZS )z"get_win_certfile..CertFilec s t | t| j d S r, )superr/ atexitregisterrC r4 CertFile __class__r r r/ s z+get_win_certfile..CertFile.__init__c s* zt | W n ty$ Y n0 d S r, )rR rC OSErrorr4 rU r r rC s z(get_win_certfile..CertFile.close)r r r
r/ rC
__classcell__r rV )rW r rV s rV ZCAZROOT) wincertstore ImportErrorrV Zaddstorename)r[ Z _wincertsr rZ r get_win_certfile s
r^ c C s$ t tjjt} t p"t| dp"t S )z*Return an existing CA bundle path, or NoneN)filterospathisfiler r^ next_certifi_where)Zextant_cert_pathsr r r r s r c
C s, zt d W S tttfy& Y n0 d S )NZcertifi)
__import__wherer\ r r r r r r rd s rd )r )N)%r` r= rS r rO Zurllib.requestrF Z http.clienthttpZ
pkg_resourcesr r rB r\ __all__stripr r rG r. Zclientr9 AttributeErrorobjectr r r
Z backports.ssl_match_hostnamer% r$ r r1 r rQ r^ r rd r r r r sV
6*(