�
-�c~ � �z � d Z ddlZddlZ ddlZn
# e$ r dZY nw xY wdZ G d� de� � Zd d�Zd� Z d � Z
d
� Z dS ) zJThe match_hostname() function from Python 3.3.3, essential when using SSL.� Nz3.5.0.1c � � e Zd ZdS )�CertificateErrorN)�__name__�
__module__� __qualname__� � �A/usr/lib/python3/dist-packages/urllib3/util/ssl_match_hostname.pyr r s � � � � � ��Dr r � c �l � g }| sdS | � d� � }|d }|dd� }|� d� � }||k r t dt | � � z � � �|s*| � � � |� � � k S |dk r|� d� � n�|� d � � s|� d � � r(|� t j |� � � � n;|� t j |� � � d
d � � � � |D ])}|� t j |� � � � �*t j
d d
� |� � z dz t j � � } | �
|� � S )zhMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
F�.r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)�split�countr �repr�lower�append�
startswith�re�escape�replace�compile�join�
IGNORECASE�match)
�dn�hostname�
max_wildcards�pats�parts�leftmost� remainder� wildcards�frag�pats
r
�_dnsname_matchr& s� � �
�D�
� ��u�
�H�H�T�N�N�E��Q�x�H��a�b�b� �I����s�#�#�I��=� � �
� :�T�"�X�X� E�
�
�
�
� .��x�x�z�z�X�^�^� -� -�-�-�
�3���
� � �G� � � � � � � �V� $� $� A��(;�(;�F�(C�(C� A�
� � �B�I�h�'�'�(�(�(�(�
� � �B�I�h�'�'�/�/��w�?�?�@�@�@� � %� %�� � � �B�I�d�O�O�$�$�$�$�
�*�U�U�Z�Z�� -� -�-��5�r�}�
E�
E�C� �9�9�X� � � r c �t � t | t � � r"t j dk rt | dd�� � } | S )N)� �ascii�strict)�encoding�errors)�
isinstance�str�sys� version_info�unicode)�objs r
� _to_unicoder3 O s: � ��#�s��� >�� 0�4� 7� 7��c�G�H�=�=�=�� �Jr c �t � t j t | � � � � � � � }||k S )z�Exact matching of IP addresses.
RFC 6125 explicitly doesn't define an algorithm for this
(section 1.7.2 - "Out of Scope").
)� ipaddress�
ip_addressr3 �rstrip)�ipname�host_ip�ips r
�_ipaddress_matchr; V s2 � �
� �k�&� 1� 1� 8� 8� :� :� ;� ;�B�
��=�r c � � | st d� � � t j t |� � � � }n/# t t f$ r d}Y nt
$ r t �d}n� Y nw xY wg }| � dd� � }|D ]f\ }}|dk r+|�t ||� � r dS |� |� � �6|dk r*|�t ||� � r dS |� |� � �g|sP| � dd� � D ]9}|D ]4\ }}|dk r)t ||� � r dS |� |� � �5�:t |� � d k r;t d
|�d d � t t |� � � � ��� � �t |� � d k rt d
|�d
|d ��� � �t d� � �)a) Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDN�subjectAltNamer �DNSz
IP Address�subject�
commonNamer z hostname z doesn't match either of z, z doesn't match r z=no appropriate commonName or subjectAltName fields were found)�
ValueErrorr5 r6 r3 � UnicodeError�AttributeError�getr& r r; �lenr r �mapr )�certr r9 �dnsnames�san�key�value�subs r
�match_hostnamerM b sJ � � �
��
-�
�
�
�
��&�{�8�'<�'<�=�=���� �*� %� � � �
���� � � � � � ��G�G� �
�G����� �H�
�(�(�#�R�
(�
(�C�� #� #�
��U� �%�<�<���>�%��#B�#B����� �O�O�E� "� "� "� "�
�L�
�
��"�'7��w�'G�'G�"���� �O�O�E� "� "� "�� �
+� �8�8�I�r�*�*� +� +�C� !�
+�
+�
��U� �,�&�&�%�e�X�6�6� � ���� �O�O�E�*�*�*��
+� �8�}�}�q��� � �,4�H�H�d�i�i��D�(�@S�@S�6T�6T�6T�
V�
�
�
�
�X� � �!� � � � ����8�TU�;�;� W�X�X�X� � K�
�
�
s �!5 �A!�
A!� A!)r ) �__doc__r r/ r5 � ImportError� __version__rA r r& r3 r; rM r r r
�<module>rQ s� �� P� P�
� � � �
�
�
�
� �������� � � ��I�I�I����� � � � � � � �z� � � �3 � 3 � 3 � 3 �l� � � � � �=
� =
� =
� =
� =
s � �� |