B
    Y\-!                 @   s  d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm	Z	 d dl
mZmZ yd dlZW n ek
rt   dZY nX dddddgZd	  ZyejjZejZW n ek
r   e ZZY nX edk	oeeefkZyd d
lmZmZ W nR ek
r:   yd dlmZ d dlmZ W n ek
r4   dZdZY nX Y nX esRG dd deZesjdddZdd ZG dd deZG dd deZd ddZ dd Z!e!dd Z"dd Z#dd Z$dS )!    N)urllibhttp_clientmapfilter)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundleis_available
cert_paths
opener_fora  
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r   )r   c               @   s   e Zd ZdS )r   N)__name__
__module____qualname__ r   r   5lib/python3.7/site-packages/setuptools/ssl_support.pyr   5   s   r      c       
      C   s   g }| sdS |  d}|d }|dd }|d}||krLtdt|  |s`|  | kS |dkrt|d n>|d	s|d	r|t| n|t|	d
d x|D ]}|t| qW t
dd| d tj}	|	|S )zqMatching according to RFC 6125, section 6.4.3

        https://tools.ietf.org/html/rfc6125#section-6.4.3
        F.r   r   N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr   reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
ZdnhostnameZmax_wildcardsZpatspartsZleftmostZ	remainderZ	wildcardsZfragZpatr   r   r   _dnsname_match;   s*    


r&   c             C   s   | st dg }| dd}x0|D ](\}}|dkr"t||r@dS || q"W |sxF| ddD ]6}x0|D ](\}}|dkrjt||rdS || qjW q`W t|dkrtd	|d
tt|f n*t|dkrtd||d f ntddS )a=  Verify that *cert* (in decoded format as returned by
        SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
        rules are followed, but IP addresses are not accepted for *hostname*.

        CertificateError is raised on failure. On success, the function
        returns nothing.
        zempty or no certificateZsubjectAltNamer   ZDNSNZsubjectZ
commonNamer   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)	
ValueErrorgetr&   r   lenr   r!   r   r   )Zcertr$   ZdnsnamesZsankeyvaluesubr   r   r   r   o   s.    

r   c               @   s    e Zd ZdZdd Zdd ZdS )r   z=Simple verifying handler: no auth, subclasses, timeouts, etc.c             C   s   || _ t|  d S )N)	ca_bundleHTTPSHandler__init__)selfr-   r   r   r   r/      s    zVerifyingHTTPSHandler.__init__c                s      fdd|S )Nc                s   t |  jf|S )N)VerifyingHTTPSConnr-   )hostkw)r0   r   r   <lambda>   s    z2VerifyingHTTPSHandler.https_open.<locals>.<lambda>)Zdo_open)r0   Zreqr   )r0   r   
https_open   s    z VerifyingHTTPSHandler.https_openN)r   r   r   __doc__r/   r5   r   r   r   r   r      s   c               @   s    e Zd ZdZdd Zdd ZdS )r1   z@Simple verifying connection: no auth, subclasses, timeouts, etc.c             K   s   t j| |f| || _d S )N)HTTPSConnectionr/   r-   )r0   r2   r-   r3   r   r   r   r/      s    zVerifyingHTTPSConn.__init__c             C   s   t | j| jft| dd }t| drHt| dd rH|| _|   | j}n| j}tt	drxt	j
| jd}|j||d| _nt	j|t	j| jd| _yt| j | W n. tk
r   | jt j | j   Y nX d S )NZsource_address_tunnel_tunnel_hostcreate_default_context)Zcafile)Zserver_hostname)Z	cert_reqsZca_certs)socketZcreate_connectionr2   Zportgetattrhasattrsockr8   r9   sslr:   r-   Zwrap_socketZCERT_REQUIREDr   Zgetpeercertr   ZshutdownZ	SHUT_RDWRclose)r0   r>   Zactual_hostZctxr   r   r   connect   s$    

zVerifyingHTTPSConn.connectN)r   r   r   r6   r/   rA   r   r   r   r   r1      s   r1   c             C   s   t jt| pt jS )z@Get a urlopen() replacement that uses ca_bundle for verification)r   requestZbuild_openerr   r	   open)r-   r   r   r   r      s    c                s   t   fdd}|S )Nc                 s   t  ds | | _ jS )Nalways_returns)r=   rD   )argskwargs)funcr   r   wrapper   s    
zonce.<locals>.wrapper)	functoolswraps)rG   rH   r   )rG   r   once   s    rK   c                 sX   ydd l } W n tk
r    d S X G  fddd| j   }|d |d |jS )Nr   c                   s,   e Zd Z fddZ fddZ  ZS )z"get_win_certfile.<locals>.CertFilec                s   t  |   t| j d S )N)superr/   atexitregisterr@   )r0   )CertFile	__class__r   r   r/      s    z+get_win_certfile.<locals>.CertFile.__init__c                s,   yt  |   W n tk
r&   Y nX d S )N)rL   r@   OSError)r0   )rO   rP   r   r   r@      s    z(get_win_certfile.<locals>.CertFile.close)r   r   r   r/   r@   __classcell__r   )rO   )rP   r   rO      s   rO   ZCAZROOT)wincertstoreImportErrorrO   Zaddstorename)rS   Z	_wincertsr   )rO   r   get_win_certfile   s    

rV   c              C   s$   t tjjt} t p"t| dp"t S )z*Return an existing CA bundle path, or NoneN)r   ospathisfiler   rV   next_certifi_where)Zextant_cert_pathsr   r   r   r	      s    
c            
   C   s,   yt d S  tttfk
r&   Y nX d S )NZcertifi)
__import__whererT   r   r   r   r   r   r   r[      s    r[   )r   )N)%rW   r;   rM   r   rI   Zsetuptools.extern.six.movesr   r   r   r   Zpkg_resourcesr   r   r?   rT   __all__stripr   r   rB   r.   r7   AttributeErrorobjectr
   r   r   Zbackports.ssl_match_hostnamer'   r&   r   r1   r   rK   rV   r	   r[   r   r   r   r   <module>   sP   


4)(
	
