
|_               "   @   sB  d  d l  Z  d  d l Z d  d l Z d  d l Z d  d l Z d  d l m Z m Z m Z m	 Z	 d  d l
 m Z m Z y d  d l Z Wn e k
 r d Z Yn Xd d d d d g Z d	 j   j   Z y e j j Z e j Z Wn e k
 r e Z Z Yn Xe d k	 oe e e f k Z y d  d
 l m Z m Z WnW e k
 ry$ d  d l m Z d  d l m Z Wn e k
 rd Z d Z Yn XYn Xe sGd d   d e  Z e sd d d  Z d d   Z Gd d   d e  Z Gd d   d e  Z d d d  Z  d d   Z! e! d d    Z" d d   Z# d d   Z$ d S)    N)urllibhttp_clientmapfilter)ResolutionErrorExtractionErrorVerifyingHTTPSHandlerfind_ca_bundleis_available
cert_paths
opener_fora  
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)CertificateErrormatch_hostname)r   )r   c               @   s   e  Z d  Z d S)r   N)__name__
__module____qualname__ r   r   </tmp/pip-build-3_sjtvrs/setuptools/setuptools/ssl_support.pyr   5   s   r      c       
      C   sU  g  } |  s d S|  j  d  } | d } | d d  } | j d  } | | k rj t d t |     | s |  j   | j   k S| d k r | j d  nY | j d	  s | j d	  r | j t j |   n" | j t j |  j	 d
 d   x$ | D] } | j t j |   qWt j
 d d j |  d t j  }	 |	 j |  S)zpMatching according to RFC 6125, section 6.4.3

        http://tools.ietf.org/html/rfc6125#section-6.4.3
        F.r   r   N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr   reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
dnhostnamemax_wildcardspatspartsleftmost	remainder	wildcardsfragpatr   r   r   _dnsname_match;   s*    
"&r.   c             C   sO  |  s t  d   g  } |  j d f   } x@ | D]8 \ } } | d k r1 t | |  r\ d S| j |  q1 W| s x] |  j d f   D]I } x@ | D]8 \ } } | d k r t | |  r d S| j |  q Wq Wt |  d k rt d | d	 j t t |   f   n; t |  d k r?t d
 | | d f   n t d   d S)a=  Verify that *cert* (in decoded format as returned by
        SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
        rules are followed, but IP addresses are not accepted for *hostname*.

        CertificateError is raised on failure. On success, the function
        returns nothing.
        zempty or no certificatesubjectAltNameDNSNsubject
commonNamer   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)	
ValueErrorgetr.   r   lenr   r!   r   r   )certr%   dnsnamessankeyvaluesubr   r   r   r   o   s.    %r   c               @   s.   e  Z d  Z d Z d d   Z d d   Z d S)r   z=Simple verifying handler: no auth, subclasses, timeouts, etc.c             C   s   | |  _  t j |   d  S)N)	ca_bundleHTTPSHandler__init__)selfr<   r   r   r   r>      s    	zVerifyingHTTPSHandler.__init__c                s     j    f d d   |  S)Nc                s   t  |    j |  S)N)VerifyingHTTPSConnr<   )hostkw)r?   r   r   <lambda>   s    z2VerifyingHTTPSHandler.https_open.<locals>.<lambda>)do_open)r?   reqr   )r?   r   
https_open   s    z VerifyingHTTPSHandler.https_openN)r   r   r   __doc__r>   rF   r   r   r   r   r      s   c               @   s.   e  Z d  Z d Z d d   Z d d   Z d S)r@   z@Simple verifying connection: no auth, subclasses, timeouts, etc.c             K   s    t  j |  | |  | |  _ d  S)N)HTTPSConnectionr>   r<   )r?   rA   r<   rB   r   r   r   r>      s    zVerifyingHTTPSConn.__init__c             C   s   t  j |  j |  j f t |  d d    } t |  d  rj t |  d d   rj | |  _ |  j   |  j } n	 |  j } t	 j
 | d t	 j d |  j |  _ y t |  j j   |  Wn5 t k
 r |  j j t  j  |  j j     Yn Xd  S)Nsource_address_tunnel_tunnel_host	cert_reqsca_certs)socketcreate_connectionrA   portgetattrhasattrsockrJ   rK   sslwrap_socketCERT_REQUIREDr<   r   getpeercertr   shutdown	SHUT_RDWRclose)r?   rS   actual_hostr   r   r   connect   s    $!	
	zVerifyingHTTPSConn.connectN)r   r   r   rG   r>   r\   r   r   r   r   r@      s   r@   c             C   s"   t  j j t |  p t     j S)z@Get a urlopen() replacement that uses ca_bundle for verification)r   requestbuild_openerr   r	   open)r<   r   r   r   r      s    	c                s%   t  j      f d d    } | S)Nc                 s(   t    d  s!   |  |     _   j S)Nalways_returns)rR   r`   )argskwargs)funcr   r   wrapper   s    zonce.<locals>.wrapper)	functoolswraps)rc   rd   r   )rc   r   once   s    !rg   c                 sr   y d d  l  }  Wn t k
 r( d  SYn XG  f d d   d |  j        } | j d  | j d  | j S)Nr   c                   s:   e  Z d  Z    f d d   Z    f d d   Z   S)z"get_win_certfile.<locals>.CertFilec                s'   t    |   j   t j |  j  d  S)N)superr>   atexitregisterrZ   )r?   )CertFile	__class__r   r   r>      s    z+get_win_certfile.<locals>.CertFile.__init__c                s0   y t    |   j   Wn t k
 r+ Yn Xd  S)N)rh   rZ   OSError)r?   )rk   rl   r   r   rZ      s    z(get_win_certfile.<locals>.CertFile.close)r   r   r   r>   rZ   r   )rk   )rl   r   rk      s   rk   CAROOT)wincertstoreImportErrorrk   Zaddstorename)rp   Z	_wincertsr   )rk   r   get_win_certfile   s    		rs   c              C   s4   t  t j j t  }  t   p3 t |  d  p3 t   S)z*Return an existing CA bundle path, or NoneN)r   ospathisfiler   rs   next_certifi_where)Zextant_cert_pathsr   r   r   r	      s    	c               C   s6   y t  d  j   SWn t t t f k
 r1 Yn Xd  S)NZcertifi)
__import__whererq   r   r   r   r   r   r   rx      s    rx   )%rt   rN   ri   r   re   Zsetuptools.extern.six.movesr   r   r   r   pkg_resourcesr   r   rT   rq   __all__stripr   r   r]   r=   rH   AttributeErrorobjectr
   r   r   Zbackports.ssl_match_hostnamer3   r.   r   r@   r   rg   rs   r	   rx   r   r   r   r   <module>   sP   "	4)#	
