3
e~                 @   st   d Z ddlZddlZyddlZW n ek
r8   dZY nX dZG dd deZdddZd	d
 Z	dd Z
dd ZdS )zJThe match_hostname() function from Python 3.3.3, essential when using SSL.    Nz3.5.0.1c               @   s   e Zd ZdS )CertificateErrorN)__name__
__module____qualname__ r   r   c/var/www/html/StaffProfile/staffvenv/lib/python3.6/site-packages/urllib3/util/ssl_match_hostname.pyr      s   r      c       
      C   s   g }| sdS | j d}|d }|dd }|jd}||krLtdt|  |s`| j |j kS |dkrt|jd n>|jd	s|jd	r|jtj| n|jtj|j	d
d x|D ]}|jtj| qW tj
ddj| d tj}	|	j|S )zhMatching according to RFC 6125, section 6.4.3

    http://tools.ietf.org/html/rfc6125#section-6.4.3
    F.r   r   N*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr   reprlowerappend
startswithreescapereplacecompilejoin
IGNORECASEmatch)
dnhostnamemax_wildcardspatspartsleftmost	remainder	wildcardsfragpatr   r   r   _dnsname_match   s*    


r"   c             C   s&   t | tr"tjdk r"t| ddd} | S )N   asciistrict)encodingerrors)r#   )
isinstancestrsysversion_infounicode)objr   r   r   _to_unicodeO   s    r.   c             C   s   t jt| j }||kS )zExact matching of IP addresses.

    RFC 6125 explicitly doesn't define an algorithm for this
    (section 1.7.2 - "Out of Scope").
    )	ipaddress
ip_addressr.   rstrip)ipnamehost_ipipr   r   r   _ipaddress_matchV   s    r5   c             C   s~  | st dytjt|}W n> tt fk
r:   d}Y n$ tk
r\   tdkrVd}n Y nX g }| jdf }xb|D ]Z\}}|dkr|dkrt||rdS |j| qt|dkrt|dk	rt	||rdS |j| qtW |s"xH| jdf D ]8}x2|D ]*\}}|dkrt||rdS |j| qW qW t
|dkrNtd	|d
jtt|f n,t
|dkrrtd||d f ntddS )a)  Verify that *cert* (in decoded format as returned by
    SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
    rules are followed, but IP addresses are not accepted for *hostname*.

    CertificateError is raised on failure. On success, the function
    returns nothing.
    ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDNsubjectAltNameDNSz
IP Addresssubject
commonNamer   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)
ValueErrorr/   r0   r.   UnicodeErrorAttributeErrorgetr"   r   r5   lenr   r   mapr   )certr   r3   dnsnamessankeyvaluesubr   r   r   match_hostnameb   sJ    rF   )r   )__doc__r   r*   r/   ImportError__version__r:   r   r"   r.   r5   rF   r   r   r   r   <module>   s   

6