3
yYði,!  ã            "   @   s¼  d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm	Z	 d dl
mZmZ yd dlZW n ek
rt   dZY nX dddddgZd	jƒ jƒ ZyejjZejZW n ek
r¾   e ZZY nX edk	oÒeeefkZyd d
lmZmZ W nR ek
�r:   yd dlmZ d dlmZ W n ek
�r4   dZdZY nX Y nX e�sRG dd„ deƒZe�sjddd„Zdd„ ZG dd„ deƒZG dd„ deƒZd dd„Z dd„ Z!e!dd„ ƒZ"dd„ Z#dd„ Z$dS )!é    N)ÚurllibÚhttp_clientÚmapÚfilter)ÚResolutionErrorÚExtractionErrorÚVerifyingHTTPSHandlerÚfind_ca_bundleÚis_availableÚ
cert_pathsÚ
opener_fora  
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)ÚCertificateErrorÚmatch_hostname)r   )r   c               @   s   e Zd ZdS )r   N)Ú__name__Ú
__module__Ú__qualname__© r   r   ú</tmp/pip-build-ue6tjl93/setuptools/setuptools/ssl_support.pyr   5   s   r   é   c       
      C   sö   g }| sdS | j dƒ}|d }|dd… }|jdƒ}||krLtdt| ƒ ƒ‚|s`| jƒ |jƒ kS |dkrt|jdƒ n>|jd	ƒsˆ|jd	ƒrš|jtj|ƒƒ n|jtj|ƒj	d
dƒƒ x|D ]}|jtj|ƒƒ q¸W tj
ddj|ƒ d tjƒ}	|	j|ƒS )zpMatching according to RFC 6125, section 6.4.3

        http://tools.ietf.org/html/rfc6125#section-6.4.3
        FÚ.r   r   NÚ*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)ÚsplitÚcountr   ÚreprÚlowerÚappendÚ
startswithÚreÚescapeÚreplaceÚcompileÚjoinÚ
IGNORECASEÚmatch)
ÚdnÚhostnameÚmax_wildcardsÚpatsÚpartsÚleftmostÚ	remainderÚ	wildcardsÚfragÚpatr   r   r   Ú_dnsname_match;   s*    


r.   c             C   sò   | st dƒ‚g }| jdf ƒ}x0|D ](\}}|dkr"t||ƒr@dS |j|ƒ q"W |sšxF| jdf ƒD ]6}x0|D ](\}}|dkrjt||ƒrˆdS |j|ƒ qjW q`W t|ƒdkrÄtd|d	jtt|ƒƒf ƒ‚n*t|ƒdkrætd
||d f ƒ‚ntdƒ‚dS )a=  Verify that *cert* (in decoded format as returned by
        SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
        rules are followed, but IP addresses are not accepted for *hostname*.

        CertificateError is raised on failure. On success, the function
        returns nothing.
        zempty or no certificateÚsubjectAltNameÚDNSNÚsubjectÚ
commonNamer   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)	Ú
ValueErrorÚgetr.   r   Úlenr   r!   r   r   )Úcertr%   ÚdnsnamesÚsanÚkeyÚvalueÚsubr   r   r   r   o   s.    

r   c               @   s    e Zd ZdZdd„ Zdd„ ZdS )r   z=Simple verifying handler: no auth, subclasses, timeouts, etc.c             C   s   || _ tj| ƒ d S )N)Ú	ca_bundleÚHTTPSHandlerÚ__init__)Úselfr<   r   r   r   r>   ›   s    zVerifyingHTTPSHandler.__init__c                s   ˆ j ‡ fdd„|ƒS )Nc                s   t | ˆ jf|ŽS )N)ÚVerifyingHTTPSConnr<   )ÚhostÚkw)r?   r   r   Ú<lambda>¡   s    z2VerifyingHTTPSHandler.https_open.<locals>.<lambda>)Údo_open)r?   Úreqr   )r?   r   Ú
https_openŸ   s    z VerifyingHTTPSHandler.https_openN)r   r   r   Ú__doc__r>   rF   r   r   r   r   r   ˜   s   c               @   s    e Zd ZdZdd„ Zdd„ ZdS )r@   z@Simple verifying connection: no auth, subclasses, timeouts, etc.c             K   s   t j| |f|Ž || _d S )N)ÚHTTPSConnectionr>   r<   )r?   rA   r<   rB   r   r   r   r>   ¨   s    zVerifyingHTTPSConn.__init__c             C   sÖ   t j| j| jft| dd ƒƒ}t| dƒrHt| dd ƒrH|| _| jƒ  | j}n| j}tt	dƒrxt	j
| jd�}|j||d�| _nt	j|t	j| jd�| _yt| jjƒ |ƒ W n. tk
rÐ   | jjt jƒ | jjƒ  ‚ Y nX d S )NÚsource_addressÚ_tunnelÚ_tunnel_hostÚcreate_default_context)Úcafile)Úserver_hostname)Ú	cert_reqsÚca_certs)ÚsocketÚcreate_connectionrA   ÚportÚgetattrÚhasattrÚsockrJ   rK   ÚsslrL   r<   Úwrap_socketÚCERT_REQUIREDr   Úgetpeercertr   ÚshutdownÚ	SHUT_RDWRÚclose)r?   rV   Úactual_hostÚctxr   r   r   Úconnect¬   s$    

zVerifyingHTTPSConn.connectN)r   r   r   rG   r>   r`   r   r   r   r   r@   ¥   s   r@   c             C   s   t jjt| ptƒ ƒƒjS )z@Get a urlopen() replacement that uses ca_bundle for verification)r   ÚrequestÚbuild_openerr   r	   Úopen)r<   r   r   r   r   Í   s    c                s   t jˆ ƒ‡ fdd„ƒ}|S )Nc                 s   t ˆ dƒsˆ | |Žˆ _ˆ jS )NÚalways_returns)rU   rd   )ÚargsÚkwargs)Úfuncr   r   ÚwrapperÖ   s    
zonce.<locals>.wrapper)Ú	functoolsÚwraps)rg   rh   r   )rg   r   ÚonceÕ   s    rk   c                 sX   ydd l } W n tk
r    d S X G ‡ fdd„d| jƒ‰ ˆ ƒ }|jdƒ |jdƒ |jS )Nr   c                   s,   e Zd Z‡‡ fdd„Z‡‡ fdd„Z‡  ZS )z"get_win_certfile.<locals>.CertFilec                s   t ˆ | ƒjƒ  tj| jƒ d S )N)Úsuperr>   ÚatexitÚregisterr]   )r?   )ÚCertFileÚ	__class__r   r   r>   æ   s    z+get_win_certfile.<locals>.CertFile.__init__c                s,   yt ˆ | ƒjƒ  W n tk
r&   Y nX d S )N)rl   r]   ÚOSError)r?   )ro   rp   r   r   r]   ê   s    z(get_win_certfile.<locals>.CertFile.close)r   r   r   r>   r]   Ú__classcell__r   )ro   )rp   r   ro   å   s   ro   ÚCAÚROOT)ÚwincertstoreÚImportErrorro   ZaddstoreÚname)ru   Z	_wincertsr   )ro   r   Úget_win_certfileÞ   s    

rx   c              C   s$   t tjjtƒ} tƒ p"t| dƒp"tƒ S )z*Return an existing CA bundle path, or NoneN)r   ÚosÚpathÚisfiler   rx   ÚnextÚ_certifi_where)Zextant_cert_pathsr   r   r   r	   ö   s    
c               C   s,   yt dƒjƒ S  tttfk
r&   Y nX d S )NÚcertifi)Ú
__import__Úwhererv   r   r   r   r   r   r   r}      s    r}   )r   )N)%ry   rQ   rm   r   ri   Zsetuptools.extern.six.movesr   r   r   r   Úpkg_resourcesr   r   rW   rv   Ú__all__Ústripr   r   ra   r=   rH   ÚAttributeErrorÚobjectr
   r   r   Zbackports.ssl_match_hostnamer3   r.   r   r@   r   rk   rx   r	   r}   r   r   r   r   Ú<module>   sP   


4)(
	
