| Current File : //usr/lib/python3/dist-packages/urllib3/util/__pycache__/ssl_match_hostname.cpython-312.pyc |
�
�g� � � � d Z ddlmZ ddlZddlZddlZddlmZmZ ej rddl m
Z
dZ G d� d e � Z
d
dd
�Zdd �Z d dd �Zy)zHThe match_hostname() function from Python 3.5, essential when using SSL.� )� annotationsN)� IPv4Address� IPv6Address� )�_TYPE_PEER_CERT_RET_DICTz3.5.0.1c � � e Zd Zy)�CertificateErrorN)�__name__�
__module__� __qualname__� � �A/usr/lib/python3/dist-packages/urllib3/util/ssl_match_hostname.pyr r s � �r r c � � g }| sy| j d� }|d }|dd }|j d� }||kD rt dt | � z � �|s*t | j � |j � k( � S |dk( r|j
d� n{|j d � s|j d � r%|j
t j |� � n4|j
t j |� j d
d � � |D ]& }|j
t j |� � �( t j d d
j |� z dz t j � } | j |� S )zhMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
F�.r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)�split�countr �repr�bool�lower�append�
startswith�re�escape�replace�compile�join�
IGNORECASE�match)
�dn�hostname�
max_wildcards�pats�parts�leftmost� remainder� wildcards�frag�pats
r �_dnsname_matchr+ sO � � �D�
��
�H�H�T�N�E��Q�x�H��a�b� �I����s�#�I��=� �
� :�T�"�X� E�
�
�
��B�H�H�J�(�.�.�"2�2�3�3�
�3��
� � �G� � � � �V� $��(;�(;�F�(C�
� � �B�I�I�h�'�(�
� � �B�I�I�h�'�/�/��w�?�@� � %�� � � �B�I�I�d�O�$�%�
�*�*�U�U�Z�Z�� -�-��5�r�}�}�
E�C� �9�9�X� � r c � � t j | j � � }t |j |j k( � S )a� Exact matching of IP addresses.
RFC 9110 section 4.3.5: "A reference identity of IP-ID contains the decoded
bytes of the IP address. An IP version 4 address is 4 octets, and an IP
version 6 address is 16 octets. [...] A reference identity of type IP-ID
matches if the address is identical to an iPAddress value of the
subjectAltName extension of the certificate."
)� ipaddress�
ip_address�rstripr �packed)�ipname�host_ip�ips r �_ipaddress_matchr4 P s2 � �
� � �f�m�m�o� .�B� �� � �W�^�^�+� ,�,r c � � | s t d� � d|v r(t j |d|j d� � }nt j |� }g }| j dd� }|D ]S \ }}|dk( r"|�t ||� r y|j
|� �-|dk( s�3|�t ||� r y|j
|� �U |rK|�I|sG| j dd� D ]2 }|D ]+ \ }}|d k( s� t ||� r y|j
|� �- �4 t |� d
kD r.t d |�d d
j t t |� � ��� �t |� d
k( rt d |�d|d ��� �t d� �# t $ r d}Y ��0w xY w)a) Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIRED�%N�subjectAltNamer
�DNSz
IP Address�subject�
commonNamer z hostname z doesn't match either of z, z doesn't match r z/no appropriate subjectAltName fields were found)
�
ValueErrorr- r. �rfind�getr+ r r4 �lenr r �mapr ) �certr" �hostname_checks_common_namer2 �dnsnames�san�key�value�subs r �match_hostnamerG _ s� � � ��
-�
�
�
� �(�?� �*�*�8�4I�h�n�n�S�6I�+J�K�G� �*�*�8�4�G�
�H�'+�x�x�0@�"�'E�C� � #�
��U� �%�<���>�%��#B�� �O�O�E� "�
�L�
��"�'7��w�'G�� �O�O�E� "�#� #�w��x��8�8�I�r�*� +�C� !�
+�
��U��,�&�%�e�X�6� � �O�O�E�*�
+� +� �8�}�q�� �,4�d�i�i��D�(�@S�6T�
V�
�
�
�X� �!� � ��8�,�o�h�q�k�_� U�V�V� � P�Q�Q��G � ����s �AE2 �2 F� F)r )r! z
typing.Anyr" �strr# �int�returnz typing.Match[str] | None | bool)r1 rH r2 zIPv4Address | IPv6AddressrJ r )F)r@ z _TYPE_PEER_CERT_RET_DICT | Noner" rH rA r rJ �None)�__doc__�
__future__r r- r �typingr r �
TYPE_CHECKING�ssl_r � __version__r; r r+ r4 rG r
r r �<module>rR s� �� N� #� � �
� .� ���.�� � �z� �
9:�5 ��5 � !�5 �25�5 �$�5 �p -�$ ).�@R�
)�@R��@R� "&�@R�
� @Rr