ó
.¿”Wc           @   s  d  d l  Z  d  d l Z d  d l Z d  d l Z d  d l m Z m Z m Z d  d l Z d  d l m	 Z	 m
 Z
 y d  d l Z Wn e k
 r— d Z n Xd d d d d g Z d	 j ƒ  j ƒ  Z y e j j Z e j Z Wn e k
 rõ e Z Z n Xe d k	 oe e e f k Z y d  d
 l m Z m Z WnU e k
 r…y$ d  d l m Z d  d l m Z Wq†e k
 rd Z d Z q†Xn Xe s¥d e f d „  ƒ  YZ n  e sÃd d „ Z d „  Z n  d e f d „  ƒ  YZ d e f d „  ƒ  YZ d d „ Z d a  d „  Z! d „  Z" d S(   iÿÿÿÿN(   t   urllibt   http_clientt   map(   t   ResolutionErrort   ExtractionErrort   VerifyingHTTPSHandlert   find_ca_bundlet   is_availablet
   cert_pathst
   opener_forsë   
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
(   t   CertificateErrort   match_hostname(   R
   (   R   R
   c           B   s   e  Z RS(    (   t   __name__t
   __module__(    (    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR
   4   s   i   c   
      C   sR  g  } |  s t  S|  j d ƒ } | d } | d } | j d ƒ } | | k rg t d t |  ƒ ƒ ‚ n  | sƒ |  j ƒ  | j ƒ  k S| d k rŸ | j d ƒ nY | j d ƒ s½ | j d ƒ rÖ | j t j	 | ƒ ƒ n" | j t j	 | ƒ j
 d d	 ƒ ƒ x$ | D] } | j t j	 | ƒ ƒ qÿ Wt j d
 d j | ƒ d t j ƒ }	 |	 j | ƒ S(   sp   Matching according to RFC 6125, section 6.4.3

        http://tools.ietf.org/html/rfc6125#section-6.4.3
        t   .i    i   t   *s,   too many wildcards in certificate DNS name: s   [^.]+s   xn--s   \*s   [^.]*s   \As   \.s   \Z(   t   Falset   splitt   countR
   t   reprt   lowert   appendt
   startswitht   ret   escapet   replacet   compilet   joint
   IGNORECASEt   match(
   t   dnt   hostnamet   max_wildcardst   patst   partst   leftmostt	   remaindert	   wildcardst   fragt   pat(    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyt   _dnsname_match8   s*    

"&c         C   s[  |  s t  d ƒ ‚ n  g  } |  j d d ƒ } xC | D]; \ } } | d k r4 t | | ƒ r_ d S| j | ƒ q4 q4 W| sß xc |  j d d ƒ D]L } xC | D]; \ } } | d k r™ t | | ƒ rÄ d S| j | ƒ q™ q™ WqŒ Wn  t | ƒ d k rt d | d	 j t t | ƒ ƒ f ƒ ‚ n; t | ƒ d k rKt d
 | | d f ƒ ‚ n t d ƒ ‚ d S(   s=  Verify that *cert* (in decoded format as returned by
        SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
        rules are followed, but IP addresses are not accepted for *hostname*.

        CertificateError is raised on failure. On success, the function
        returns nothing.
        s   empty or no certificatet   subjectAltNamet   DNSNt   subjectt
   commonNamei   s&   hostname %r doesn't match either of %ss   , s   hostname %r doesn't match %ri    s=   no appropriate commonName or subjectAltName fields were found(    (    (	   t
   ValueErrort   getR(   R   t   lenR
   R   R   R   (   t   certR   t   dnsnamest   sant   keyt   valuet   sub(    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR   l   s.    %c           B   s    e  Z d  Z d „  Z d „  Z RS(   s=   Simple verifying handler: no auth, subclasses, timeouts, etc.c         C   s   | |  _  t j |  ƒ d  S(   N(   t	   ca_bundlet   HTTPSHandlert   __init__(   t   selfR6   (    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR8   ˜   s    	c            s   ˆ  j  ‡  f d †  | ƒ S(   Nc            s   t  |  ˆ  j |  S(   N(   t   VerifyingHTTPSConnR6   (   t   hostt   kw(   R9   (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyt   <lambda>ž   s    (   t   do_open(   R9   t   req(    (   R9   s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyt
   https_openœ   s    (   R   R   t   __doc__R8   R@   (    (    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR   •   s   	R:   c           B   s    e  Z d  Z d „  Z d „  Z RS(   s@   Simple verifying connection: no auth, subclasses, timeouts, etc.c         K   s    t  j |  | |  | |  _ d  S(   N(   t   HTTPSConnectionR8   R6   (   R9   R;   R6   R<   (    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR8   ¥   s    c         C   sì   t  j |  j |  j f t |  d d  ƒ ƒ } t |  d ƒ rj t |  d d  ƒ rj | |  _ |  j ƒ  |  j	 } n	 |  j } t
 j | d t
 j d |  j ƒ|  _ y t |  j j ƒ  | ƒ Wn4 t k
 rç |  j j t  j ƒ |  j j ƒ  ‚  n Xd  S(   Nt   source_addresst   _tunnelt   _tunnel_hostt	   cert_reqst   ca_certs(   t   sockett   create_connectionR;   t   portt   getattrt   Nonet   hasattrt   sockRD   RE   t   sslt   wrap_sockett   CERT_REQUIREDR6   R   t   getpeercertR
   t   shutdownt	   SHUT_RDWRt   close(   R9   RN   t   actual_host(    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyt   connect©   s    $!	
	(   R   R   RA   R8   RW   (    (    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR:   ¢   s   	c         C   s"   t  j j t |  p t ƒ  ƒ ƒ j S(   s@   Get a urlopen() replacement that uses ca_bundle for verification(   R    t   requestt   build_openerR   R   t   open(   R6   (    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR	   Å   s    	c              sw   t  d  k	 r t  j Sy d d l m ‰  Wn t k
 r; d  SXd ˆ  f ‡  ‡ f d †  ƒ  Y‰ ˆ d d d g ƒ a  t  j S(   Niÿÿÿÿ(   t   CertFilet
   MyCertFilec              s,   e  Z d d ‡  f d  † Z ‡ f d †  Z RS(   c            sL   ˆ  j  |  ƒ x | D] } |  j | ƒ q W|  j | ƒ t j |  j ƒ d  S(   N(   R8   t   addstoret   addcertst   atexitt   registerRU   (   R9   t   storest   certst   store(   R[   (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR8   Û   s
    c            s/   y t  ˆ  |  ƒ j ƒ  Wn t k
 r* n Xd  S(   N(   t   superRU   t   OSError(   R9   (   R\   (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyRU   â   s    (    (    (   R   R   R8   RU   (    (   R[   R\   (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR\   Ù   s   Ra   t   CAt   ROOT(   t	   _wincertsRL   t   namet   wincertstoreR[   t   ImportError(    (    (   R[   R\   s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyt   get_win_certfileÏ   s    c          C   ss   t  j d k r t ƒ  Sx$ t D] }  t  j j |  ƒ r |  Sq Wy t j d d ƒ SWn t t	 t
 f k
 rn d SXd S(   s*   Return an existing CA bundle path, or Nonet   ntt   certifis
   cacert.pemN(   t   osRi   Rl   R   t   patht   isfilet   pkg_resourcest   resource_filenameRk   R   R   RL   (   t	   cert_path(    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyR   ì   s    (#   Ro   RH   R_   R   t   setuptools.extern.six.movesR    R   R   Rr   R   R   RO   Rk   RL   t   __all__t   stripR   R   RX   R7   RB   t   AttributeErrort   objectR   R
   R   t   backports.ssl_match_hostnameR-   R(   R   R:   R	   Rh   Rl   R   (    (    (    s:   /tmp/pip-build-Q3rTTP/setuptools/setuptools/ssl_support.pyt   <module>   sN   
	4)#	