U
    ªÃT_-!  ã                   @   s¼  d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm	Z	 d dl
mZmZ zd dlZW n ek
rt   dZY nX dddddgZd	 ¡  ¡ ZzejjZejZW n ek
r¾   e ZZY nX edk	oÒeeefkZzd d
lmZmZ W nR ek
�r:   zd dlmZ d dlmZ W n ek
�r4   dZdZY nX Y nX e�sRG dd„ deƒZe�sjddd„Zdd„ ZG dd„ deƒZG dd„ deƒZd dd„Z dd„ Z!e!dd„ ƒZ"dd„ Z#dd„ Z$dS )!é    N)ÚurllibÚhttp_clientÚmapÚfilter)ÚResolutionErrorÚExtractionErrorÚVerifyingHTTPSHandlerÚfind_ca_bundleÚis_availableÚ
cert_pathsÚ
opener_fora  
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
/usr/local/share/certs/ca-root-nss.crt
/etc/ssl/ca-bundle.pem
)ÚCertificateErrorÚmatch_hostname)r   )r   c                   @   s   e Zd ZdS )r   N)Ú__name__Ú
__module__Ú__qualname__© r   r   ú:/tmp/pip-unpacked-wheel-sr6cxcdi/setuptools/ssl_support.pyr   5   s   r   é   c           
      C   sò   g }| sdS |   d¡}|d }|dd… }| d¡}||krLtdt| ƒ ƒ‚|s`|  ¡ | ¡ kS |dkrt| d¡ n>| d	¡sˆ| d	¡rš| t |¡¡ n| t |¡ 	d
d¡¡ |D ]}| t |¡¡ q¶t 
dd |¡ d tj¡}	|	 |¡S )zqMatching according to RFC 6125, section 6.4.3

        https://tools.ietf.org/html/rfc6125#section-6.4.3
        FÚ.r   r   NÚ*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)ÚsplitÚcountr   ÚreprÚlowerÚappendÚ
startswithÚreÚescapeÚreplaceÚcompileÚjoinÚ
IGNORECASEÚmatch)
ÚdnÚhostnameÚmax_wildcardsÚpatsÚpartsÚleftmostÚ	remainderÚ	wildcardsÚfragÚpatr   r   r   Ú_dnsname_match;   s,    


ÿr.   c                 C   sì   | st dƒ‚g }|  dd¡}|D ]*\}}|dkr t||ƒr@ dS | |¡ q |s”|  dd¡D ]6}|D ],\}}|dkrdt||ƒr†  dS | |¡ qdq\t|ƒdkr¾td	|d
 tt|ƒ¡f ƒ‚n*t|ƒdkràtd||d f ƒ‚ntdƒ‚dS )a=  Verify that *cert* (in decoded format as returned by
        SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
        rules are followed, but IP addresses are not accepted for *hostname*.

        CertificateError is raised on failure. On success, the function
        returns nothing.
        zempty or no certificateÚsubjectAltNamer   ÚDNSNÚsubjectÚ
commonNamer   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)	Ú
ValueErrorÚgetr.   r   Úlenr   r!   r   r   )Úcertr%   ÚdnsnamesÚsanÚkeyÚvalueÚsubr   r   r   r   o   s2    

þ
þr   c                   @   s    e Zd ZdZdd„ Zdd„ ZdS )r   z=Simple verifying handler: no auth, subclasses, timeouts, etc.c                 C   s   || _ t | ¡ d S ©N)Ú	ca_bundleÚHTTPSHandlerÚ__init__)Úselfr=   r   r   r   r?   ›   s    zVerifyingHTTPSHandler.__init__c                    s   ˆ   ‡ fdd„|¡S )Nc                    s   t | ˆ jf|ŽS r<   )ÚVerifyingHTTPSConnr=   )ÚhostÚkw©r@   r   r   Ú<lambda>¡   ó    z2VerifyingHTTPSHandler.https_open.<locals>.<lambda>)Údo_open)r@   Úreqr   rD   r   Ú
https_openŸ   s    
 ÿz VerifyingHTTPSHandler.https_openN)r   r   r   Ú__doc__r?   rI   r   r   r   r   r   ˜   s   c                   @   s    e Zd ZdZdd„ Zdd„ ZdS )rA   z@Simple verifying connection: no auth, subclasses, timeouts, etc.c                 K   s   t j| |f|Ž || _d S r<   )ÚHTTPSConnectionr?   r=   )r@   rB   r=   rC   r   r   r   r?   ¨   s    zVerifyingHTTPSConn.__init__c                 C   sÖ   t  | j| jft| dd ƒ¡}t| dƒrHt| dd ƒrH|| _|  ¡  | j}n| j}tt	dƒrxt	j
| jd�}|j||d�| _nt	j|t	j| jd�| _zt| j ¡ |ƒ W n. tk
rÐ   | j t j¡ | j ¡  ‚ Y nX d S )NÚsource_addressÚ_tunnelÚ_tunnel_hostÚcreate_default_context)Úcafile)Úserver_hostname)Ú	cert_reqsÚca_certs)ÚsocketÚcreate_connectionrB   ÚportÚgetattrÚhasattrÚsockrM   rN   ÚsslrO   r=   Úwrap_socketÚCERT_REQUIREDr   Úgetpeercertr   ÚshutdownÚ	SHUT_RDWRÚclose)r@   rY   Úactual_hostÚctxr   r   r   Úconnect¬   s.    
 
ÿ
  ÿ
zVerifyingHTTPSConn.connectN)r   r   r   rJ   r?   rc   r   r   r   r   rA   ¥   s   rA   c                 C   s   t j t| ptƒ ƒ¡jS )z@Get a urlopen() replacement that uses ca_bundle for verification)r   ÚrequestÚbuild_openerr   r	   Úopen)r=   r   r   r   r   Í   s    ÿc                    s   t  ˆ ¡‡ fdd„ƒ}|S )Nc                     s   t ˆ dƒsˆ | |Žˆ _ˆ jS )NÚalways_returns)rX   rg   )ÚargsÚkwargs©Úfuncr   r   ÚwrapperÖ   s    
zonce.<locals>.wrapper)Ú	functoolsÚwraps)rk   rl   r   rj   r   ÚonceÕ   s    ro   c                     sZ   zdd l } W n tk
r"   Y d S X G ‡ fdd„d| jƒ‰ ˆ ƒ }| d¡ | d¡ |jS )Nr   c                       s,   e Zd Z‡‡ fdd„Z‡‡ fdd„Z‡  ZS )z"get_win_certfile.<locals>.CertFilec                    s   t ˆ | ƒ ¡  t | j¡ d S r<   )Úsuperr?   ÚatexitÚregisterr`   rD   ©ÚCertFileÚ	__class__r   r   r?   æ   s    z+get_win_certfile.<locals>.CertFile.__init__c                    s,   zt ˆ | ƒ ¡  W n tk
r&   Y nX d S r<   )rp   r`   ÚOSErrorrD   rs   r   r   r`   ê   s    z(get_win_certfile.<locals>.CertFile.close)r   r   r   r?   r`   Ú__classcell__r   ©rt   )ru   r   rt   å   s   rt   ÚCAÚROOT)ÚwincertstoreÚImportErrorrt   ZaddstoreÚname)r{   Z	_wincertsr   rx   r   Úget_win_certfileÞ   s    

r~   c                  C   s$   t tjjtƒ} tƒ p"t| dƒp"tƒ S )z*Return an existing CA bundle path, or NoneN)r   ÚosÚpathÚisfiler   r~   ÚnextÚ_certifi_where)Zextant_cert_pathsr   r   r   r	   ö   s    ÿýc                
   C   s.   zt dƒ ¡ W S  tttfk
r(   Y nX d S )NÚcertifi)Ú
__import__Úwherer|   r   r   r   r   r   r   rƒ      s    rƒ   )r   )N)%r   rT   rq   r   rm   Zsetuptools.extern.six.movesr   r   r   r   Úpkg_resourcesr   r   rZ   r|   Ú__all__Ústripr   r   rd   r>   rK   ÚAttributeErrorÚobjectr
   r   r   Zbackports.ssl_match_hostnamer3   r.   r   rA   r   ro   r~   r	   rƒ   r   r   r   r   Ú<module>   sZ   
   þ

4)(
	

