a
    `u!                     @   s  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
mZ zd dlZW n eyj   dZY n0 g dZd  ZzejjZejjZW n ey   e ZZY n0 eduoeeefvZzd dlmZmZ W nN ey&   zd dlmZ d dlmZ W n ey    dZdZY n0 Y n0 es>G dd	 d	eZesVdddZdd ZG dd deZG dd deZdddZ dd Z!e!dd Z"dd Z#dd Z$dS )    N)ResolutionErrorExtractionError)VerifyingHTTPSHandlerfind_ca_bundleis_available
cert_paths
opener_fora  
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r	   )r
   c                   @   s   e Zd ZdS )r	   N)__name__
__module____qualname__ r   r   8/usr/lib/python3/dist-packages/setuptools/ssl_support.pyr	   7   s   r	      c           
      C   s   g }| sdS |  d}|d }|dd }|d}||krLtdt|  |s`|  | kS |dkrt|d n>|d	s|d	r|t| n|t|	d
d |D ]}|t| qt
dd| d tj}	|	|S )zqMatching according to RFC 6125, section 6.4.3

        https://tools.ietf.org/html/rfc6125#section-6.4.3
        F.r   r   N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr	   reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
ZdnhostnameZmax_wildcardsZpatspartsZleftmostZ	remainderZ	wildcardsZfragZpatr   r   r   _dnsname_match=   s,    


r"   c                 C   s   | st dg }| dd}|D ]*\}}|dkr t||r@ dS || q |s| ddD ]6}|D ],\}}|dkrdt||r  dS || qdq\t|dkrtd	|d
tt|f n*t|dkrtd||d f ntddS )a=  Verify that *cert* (in decoded format as returned by
        SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
        rules are followed, but IP addresses are not accepted for *hostname*.

        CertificateError is raised on failure. On success, the function
        returns nothing.
        zempty or no certificateZsubjectAltNamer   ZDNSNZsubjectZ
commonNamer   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)	
ValueErrorgetr"   r   lenr	   r   mapr   )Zcertr    ZdnsnamesZsankeyvaluesubr   r   r   r
   s   s>    


r
   c                   @   s    e Zd ZdZdd Zdd ZdS )r   z=Simple verifying handler: no auth, subclasses, timeouts, etc.c                 C   s   || _ t|  d S N)	ca_bundleHTTPSHandler__init__)selfr+   r   r   r   r-      s    zVerifyingHTTPSHandler.__init__c                    s      fdd|S )Nc                    s   t |  jfi |S r*   )VerifyingHTTPSConnr+   )hostkwr.   r   r   <lambda>       z2VerifyingHTTPSHandler.https_open.<locals>.<lambda>)Zdo_open)r.   Zreqr   r2   r   
https_open   s    
z VerifyingHTTPSHandler.https_openN)r   r   r   __doc__r-   r5   r   r   r   r   r      s   r   c                   @   s    e Zd ZdZdd Zdd ZdS )r/   z@Simple verifying connection: no auth, subclasses, timeouts, etc.c                 K   s   t j| |fi | || _d S r*   )HTTPSConnectionr-   r+   )r.   r0   r+   r1   r   r   r   r-      s    zVerifyingHTTPSConn.__init__c                 C   s   t | j| jft| dd }t| drHt| dd rH|| _|   | j}n| j}tt	drxt	j
| jd}|j||d| _nt	j|t	j| jd| _zt| j | W n, ty   | jt j | j   Y n0 d S )NZsource_address_tunnel_tunnel_hostcreate_default_context)Zcafile)Zserver_hostname)Z	cert_reqsZca_certs)socketZcreate_connectionr0   Zportgetattrhasattrsockr8   r9   sslr:   r+   Zwrap_socketZCERT_REQUIREDr
   Zgetpeercertr	   ZshutdownZ	SHUT_RDWRclose)r.   r>   Zactual_hostctxr   r   r   connect   s(    


zVerifyingHTTPSConn.connectN)r   r   r   r6   r-   rB   r   r   r   r   r/      s   r/   c                 C   s   t jt| pt jS )z@Get a urlopen() replacement that uses ca_bundle for verification)urllibrequestZbuild_openerr   r   open)r+   r   r   r   r      s    r   c                    s   t   fdd}|S )Nc                     s    t  ds | i | _ jS )Nalways_returns)r=   rF   )argskwargsfuncr   r   wrapper   s    
zonce.<locals>.wrapper)	functoolswraps)rJ   rK   r   rI   r   once   s    rN   c                     sX   zdd l } W n ty    Y d S 0 G  fddd| j   }|d |d |jS )Nr   c                       s,   e Zd Z fddZ fddZ  ZS )z"get_win_certfile.<locals>.CertFilec                    s   t  |   t| j d S r*   )superr-   atexitregisterr@   r2   CertFile	__class__r   r   r-      s    z+get_win_certfile.<locals>.CertFile.__init__c                    s*   zt  |   W n ty$   Y n0 d S r*   )rO   r@   OSErrorr2   rR   r   r   r@      s    z(get_win_certfile.<locals>.CertFile.close)r   r   r   r-   r@   __classcell__r   rS   )rT   r   rS      s   rS   ZCAZROOT)wincertstoreImportErrorrS   Zaddstorename)rX   Z	_wincertsr   rW   r   get_win_certfile   s    

r[   c                  C   s$   t tjjt} t p"t| dp"t S )z*Return an existing CA bundle path, or NoneN)filterospathisfiler   r[   next_certifi_where)Zextant_cert_pathsr   r   r   r      s    r   c                
   C   s,   zt d W S  tttfy&   Y n0 d S )NZcertifi)
__import__whererY   r   r   r   r   r   r   ra     s    ra   )r   )N)%r]   r;   rP   r   rL   Zurllib.requestrC   Zhttp.clientZhttpZpkg_resourcesr   r   r?   rY   __all__stripr   r   rD   r,   Zclientr7   AttributeErrorobjectr   r	   r
   Zbackports.ssl_match_hostnamer#   r"   r   r/   r   rN   r[   r   ra   r   r   r   r   <module>   sV   


6*(
	

