File: //usr/local/lib/python3.7/site-packages/urllib3/util/__pycache__/ssl_match_hostname.cpython-37.pyc
B
���g� � @ s� d Z ddlmZ ddlZddlZddlZddlmZmZ ejrJddl m
Z
dZ G dd � d e �Z
d d
d d d
d�dd�Zd ddd�dd�Zd dd ddd�dd�ZdS ) zHThe match_hostname() function from Python 3.5, essential when using SSL.� )� annotationsN)� IPv4Address� IPv6Address� )�_TYPE_PEER_CERT_RET_DICTz3.5.0.1c @ s e Zd ZdS )�CertificateErrorN)�__name__�
__module__� __qualname__� r r �I/usr/local/lib/python3.7/site-packages/urllib3/util/ssl_match_hostname.pyr s r z
typing.Any�str�intz typing.Match[str] | None | bool)�dn�hostname�
max_wildcards�returnc
C s� g }| s dS | � d�}|d }|dd� }|�d�}||krLtdt| � ��|sdt| �� |�� k�S |dkrx|�d� n>|�d �s�|�d �r�|�t� |�� n|�t� |��
d
d �� x |D ]}|�t� |�� q�W t� d d
� |� d tj
�} | �|�S )zhMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
F�.r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)�split�countr �repr�bool�lower�append�
startswith�re�escape�replace�compile�join�
IGNORECASE�match)
r r r �pats�parts�leftmost� remainder� wildcards�frag�patr r r �_dnsname_match s*
r* zIPv4Address | IPv6Addressr )�ipname�host_ipr c C s t �| �� �}t|j|jk�S )a� Exact matching of IP addresses.
RFC 9110 section 4.3.5: "A reference identity of IP-ID contains the decoded
bytes of the IP address. An IP version 4 address is 4 octets, and an IP
version 6 address is 16 octets. [...] A reference identity of type IP-ID
matches if the address is identical to an iPAddress value of the
subjectAltName extension of the certificate."
)� ipaddress�
ip_address�rstripr �packed)r+ r, �ipr r r �_ipaddress_matchP s r2 Fz _TYPE_PEER_CERT_RET_DICT | None�None)�certr �hostname_checks_common_namer c C s� | s t d��y0d|kr0t�|d|�d�� �}n
t�|�}W n t k
rT d}Y nX g }| �dd�}xb|D ]Z\}}|dkr�|dkr�t||�r�dS |�|� ql|dkrl|dk r�t||�r�dS |�|� qlW |�r*|dk�r*|�s*xH| �dd�D ]8}x2|D ]*\}}|d kr�t||��rdS |�|� q�W q�W t|�d
k�rVt d |d �
t t |��f ��n0t|�d
k�r~t d
|�d|d ����nt d��dS )a) Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIRED�%N�subjectAltNamer �DNSz
IP Address�subject�
commonNamer z&hostname %r doesn't match either of %sz, z hostname z doesn't match r z/no appropriate subjectAltName fields were found)
�
ValueErrorr- r. �rfind�getr* r r2 �lenr r �mapr ) r4 r r5 r, �dnsnames�san�key�value�subr r r �match_hostname_ sD
rE )r )F)�__doc__�
__future__r r- r �typingr r �
TYPE_CHECKING�ssl_r � __version__r; r r* r2 rE r r r r �<module> s 7