diff -Nru backports.ssl-match-hostname-3.4.0.2/backports/__init__.py backports.ssl-match-hostname-3.5.0.1/backports/__init__.py --- backports.ssl-match-hostname-3.4.0.2/backports/__init__.py 1970-01-01 00:00:00.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/backports/__init__.py 2015-12-19 22:30:28.000000000 +0000 @@ -0,0 +1,3 @@ +# This is a Python "namespace package" http://www.python.org/dev/peps/pep-0382/ +from pkgutil import extend_path +__path__ = extend_path(__path__, __name__) diff -Nru backports.ssl-match-hostname-3.4.0.2/backports/ssl_match_hostname/__init__.py backports.ssl-match-hostname-3.5.0.1/backports/ssl_match_hostname/__init__.py --- backports.ssl-match-hostname-3.4.0.2/backports/ssl_match_hostname/__init__.py 1970-01-01 00:00:00.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/backports/ssl_match_hostname/__init__.py 2015-12-19 22:30:28.000000000 +0000 @@ -0,0 +1,154 @@ +"""The match_hostname() function from Python 3.3.3, essential when using SSL.""" + +import re +import sys + +# ipaddress has been backported to 2.6+ in pypi. If it is installed on the +# system, use it to handle IPAddress ServerAltnames (this was added in +# python-3.5) otherwise only do DNS matching. This allows +# backports.ssl_match_hostname to continue to be used all the way back to +# python-2.4. +try: + import ipaddress +except ImportError: + ipaddress = None + +__version__ = '3.5.0.1' + + +class CertificateError(ValueError): + pass + + +def _dnsname_match(dn, hostname, max_wildcards=1): + """Matching according to RFC 6125, section 6.4.3 + + http://tools.ietf.org/html/rfc6125#section-6.4.3 + """ + pats = [] + if not dn: + return False + + # Ported from python3-syntax: + # leftmost, *remainder = dn.split(r'.') + parts = dn.split(r'.') + leftmost = parts[0] + remainder = parts[1:] + + wildcards = leftmost.count('*') + if wildcards > max_wildcards: + # Issue #17980: avoid denials of service by refusing more + # than one wildcard per fragment. A survey of established + # policy among SSL implementations showed it to be a + # reasonable choice. + raise CertificateError( + "too many wildcards in certificate DNS name: " + repr(dn)) + + # speed up common case w/o wildcards + if not wildcards: + return dn.lower() == hostname.lower() + + # RFC 6125, section 6.4.3, subitem 1. + # The client SHOULD NOT attempt to match a presented identifier in which + # the wildcard character comprises a label other than the left-most label. + if leftmost == '*': + # When '*' is a fragment by itself, it matches a non-empty dotless + # fragment. + pats.append('[^.]+') + elif leftmost.startswith('xn--') or hostname.startswith('xn--'): + # RFC 6125, section 6.4.3, subitem 3. + # The client SHOULD NOT attempt to match a presented identifier + # where the wildcard character is embedded within an A-label or + # U-label of an internationalized domain name. + pats.append(re.escape(leftmost)) + else: + # Otherwise, '*' matches any dotless string, e.g. www* + pats.append(re.escape(leftmost).replace(r'\*', '[^.]*')) + + # add the remaining fragments, ignore any wildcards + for frag in remainder: + pats.append(re.escape(frag)) + + pat = re.compile(r'\A' + r'\.'.join(pats) + r'\Z', re.IGNORECASE) + return pat.match(hostname) + + +def _to_unicode(obj): + if isinstance(obj, str) and sys.version_info < (3,): + obj = unicode(obj, encoding='ascii', errors='strict') + return obj + +def _ipaddress_match(ipname, host_ip): + """Exact matching of IP addresses. + + RFC 6125 explicitly doesn't define an algorithm for this + (section 1.7.2 - "Out of Scope"). + """ + # OpenSSL may add a trailing newline to a subjectAltName's IP address + # Divergence from upstream: ipaddress can't handle byte str + ip = ipaddress.ip_address(_to_unicode(ipname).rstrip()) + return ip == host_ip + + +def match_hostname(cert, hostname): + """Verify that *cert* (in decoded format as returned by + SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125 + rules are followed, but IP addresses are not accepted for *hostname*. + + CertificateError is raised on failure. On success, the function + returns nothing. + """ + if not cert: + raise ValueError("empty or no certificate, match_hostname needs a " + "SSL socket or SSL context with either " + "CERT_OPTIONAL or CERT_REQUIRED") + try: + # Divergence from upstream: ipaddress can't handle byte str + host_ip = ipaddress.ip_address(_to_unicode(hostname)) + except ValueError: + # Not an IP address (common case) + host_ip = None + except UnicodeError: + # Divergence from upstream: Have to deal with ipaddress not taking + # byte strings. addresses should be all ascii, so we consider it not + # an ipaddress in this case + host_ip = None + except AttributeError: + # Divergence from upstream: Make ipaddress library optional + if ipaddress is None: + host_ip = None + else: + raise + dnsnames = [] + san = cert.get('subjectAltName', ()) + for key, value in san: + if key == 'DNS': + if host_ip is None and _dnsname_match(value, hostname): + return + dnsnames.append(value) + elif key == 'IP Address': + if host_ip is not None and _ipaddress_match(value, host_ip): + return + dnsnames.append(value) + if not dnsnames: + # The subject is only checked when there is no dNSName entry + # in subjectAltName + for sub in cert.get('subject', ()): + for key, value in sub: + # XXX according to RFC 2818, the most specific Common Name + # must be used. + if key == 'commonName': + if _dnsname_match(value, hostname): + return + dnsnames.append(value) + if len(dnsnames) > 1: + raise CertificateError("hostname %r " + "doesn't match either of %s" + % (hostname, ', '.join(map(repr, dnsnames)))) + elif len(dnsnames) == 1: + raise CertificateError("hostname %r " + "doesn't match %r" + % (hostname, dnsnames[0])) + else: + raise CertificateError("no appropriate commonName or " + "subjectAltName fields were found") diff -Nru backports.ssl-match-hostname-3.4.0.2/backports/ssl_match_hostname/LICENSE.txt backports.ssl-match-hostname-3.5.0.1/backports/ssl_match_hostname/LICENSE.txt --- backports.ssl-match-hostname-3.4.0.2/backports/ssl_match_hostname/LICENSE.txt 1970-01-01 00:00:00.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/backports/ssl_match_hostname/LICENSE.txt 2015-12-19 22:30:28.000000000 +0000 @@ -0,0 +1,51 @@ +Python License (Python-2.0) + +Python License, Version 2 (Python-2.0) + +PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2 +-------------------------------------------- + +1. This LICENSE AGREEMENT is between the Python Software Foundation +("PSF"), and the Individual or Organization ("Licensee") accessing and +otherwise using this software ("Python") in source or binary form and +its associated documentation. + +2. Subject to the terms and conditions of this License Agreement, PSF +hereby grants Licensee a nonexclusive, royalty-free, world-wide +license to reproduce, analyze, test, perform and/or display publicly, +prepare derivative works, distribute, and otherwise use Python +alone or in any derivative version, provided, however, that PSF's +License Agreement and PSF's notice of copyright, i.e., "Copyright (c) +2001-2013 Python Software Foundation; All Rights Reserved" are retained in +Python alone or in any derivative version prepared by Licensee. + +3. In the event Licensee prepares a derivative work that is based on +or incorporates Python or any part thereof, and wants to make +the derivative work available to others as provided herein, then +Licensee hereby agrees to include in any such work a brief summary of +the changes made to Python. + +4. PSF is making Python available to Licensee on an "AS IS" +basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR +IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND +DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS +FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT +INFRINGE ANY THIRD PARTY RIGHTS. + +5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON +FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS +A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON, +OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. + +6. This License Agreement will automatically terminate upon a material +breach of its terms and conditions. + +7. Nothing in this License Agreement shall be deemed to create any +relationship of agency, partnership, or joint venture between PSF and +Licensee. This License Agreement does not grant permission to use PSF +trademarks or trade name in a trademark sense to endorse or promote +products or services of Licensee, or any third party. + +8. By copying, installing or otherwise using Python, Licensee +agrees to be bound by the terms and conditions of this License +Agreement. diff -Nru backports.ssl-match-hostname-3.4.0.2/backports/ssl_match_hostname/README.txt backports.ssl-match-hostname-3.5.0.1/backports/ssl_match_hostname/README.txt --- backports.ssl-match-hostname-3.4.0.2/backports/ssl_match_hostname/README.txt 1970-01-01 00:00:00.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/backports/ssl_match_hostname/README.txt 2015-12-19 22:30:28.000000000 +0000 @@ -0,0 +1,69 @@ + +The ssl.match_hostname() function from Python 3.5 +================================================= + +The Secure Sockets Layer is only actually *secure* +if you check the hostname in the certificate returned +by the server to which you are connecting, +and verify that it matches to hostname +that you are trying to reach. + +But the matching logic, defined in `RFC2818`_, +can be a bit tricky to implement on your own. +So the ``ssl`` package in the Standard Library of Python 3.2 +and greater now includes a ``match_hostname()`` function +for performing this check instead of requiring every application +to implement the check separately. + +This backport brings ``match_hostname()`` to users +of earlier versions of Python. +Simply make this distribution a dependency of your package, +and then use it like this:: + + from backports.ssl_match_hostname import match_hostname, CertificateError + [...] + sslsock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_SSLv23, + cert_reqs=ssl.CERT_REQUIRED, ca_certs=...) + try: + match_hostname(sslsock.getpeercert(), hostname) + except CertificateError, ce: + ... + +Brandon Craig Rhodes is merely the packager of this distribution; +the actual code inside comes from Python 3.5 with small changes for +portability. + + +Requirements +------------ + +* If you want to verify hosts match with certificates via ServerAltname + IPAddress fields, you need to install the `ipaddress module`_. + backports.ssl_match_hostname will continue to work without ipaddress but + will only be able to handle ServerAltName DNSName fields, not IPAddress. + System packagers (Linux distributions, et al) are encouraged to add + this as a hard dependency in their packages. + +* If you need to use this on Python versions earlier than 2.6 you will need to + install the `ssl module`_. From Python 2.6 upwards ``ssl`` is included in + the Python Standard Library so you do not need to install it separately. + +.. _`ipaddress module`:: https://pypi.python.org/pypi/ipaddress +.. _`ssl module`:: https://pypi.python.org/pypi/ssl + +History +------- + +* This function was introduced in python-3.2 +* It was updated for python-3.4a1 for a CVE + (backports-ssl_match_hostname-3.4.0.1) +* It was updated from RFC2818 to RFC 6125 compliance in order to fix another + security flaw for python-3.3.3 and python-3.4a5 + (backports-ssl_match_hostname-3.4.0.2) +* It was updated in python-3.5 to handle IPAddresses in ServerAltName fields + (something that backports.ssl_match_hostname will do if you also install the + ipaddress library from pypi). + + +.. _RFC2818: http://tools.ietf.org/html/rfc2818.html + diff -Nru backports.ssl-match-hostname-3.4.0.2/debian/changelog backports.ssl-match-hostname-3.5.0.1/debian/changelog --- backports.ssl-match-hostname-3.4.0.2/debian/changelog 2014-05-11 11:37:11.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/debian/changelog 2017-02-02 13:20:06.000000000 +0000 @@ -1,3 +1,21 @@ +backports.ssl-match-hostname (3.5.0.1-1~cloud0) xenial-ocata; urgency=medium + + * New upstream release for the Ubuntu Cloud Archive. + + -- Openstack Ubuntu Testing Bot Thu, 02 Feb 2017 13:20:06 +0000 + +backports.ssl-match-hostname (3.5.0.1-1) unstable; urgency=medium + + [ Nicolas Dandrimont ] + * New upstream release. + * Update short description to match version. + + [ Julien Puydt ] + * Fixed file conflicts with other python-backports-* packages. + * Pushed standards-version up. + + -- Nicolas Dandrimont Thu, 21 Jul 2016 17:36:44 +0200 + backports.ssl-match-hostname (3.4.0.2-1) unstable; urgency=medium * Initial release. (Closes: #747481) diff -Nru backports.ssl-match-hostname-3.4.0.2/debian/clean backports.ssl-match-hostname-3.5.0.1/debian/clean --- backports.ssl-match-hostname-3.4.0.2/debian/clean 2014-05-09 15:30:03.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/debian/clean 2016-07-21 15:23:43.000000000 +0000 @@ -1 +1 @@ -src/backports/ssl_match_hostname/LICENSE.txt +backports/__init__.py diff -Nru backports.ssl-match-hostname-3.4.0.2/debian/control backports.ssl-match-hostname-3.5.0.1/debian/control --- backports.ssl-match-hostname-3.4.0.2/debian/control 2014-05-09 08:33:30.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/debian/control 2016-07-21 15:29:09.000000000 +0000 @@ -7,14 +7,16 @@ dh-python, python-all, python-setuptools -Standards-Version: 3.9.5 +Standards-Version: 3.9.8 X-Python-Version: >= 2.4 +Vcs-Git: https://anonscm.debian.org/git/python-modules/packages/backports.ssl-match-hostname.git +Vcs-Browser: https://anonscm.debian.org/git/python-modules/packages/backports.ssl-match-hostname.git Homepage: https://bitbucket.org/brandon/backports.ssl_match_hostname Package: python-backports.ssl-match-hostname Architecture: all Depends: ${misc:Depends}, ${python:Depends} -Description: Backport of the Python 3.2 SSL hostname checking function +Description: Backport of the Python 3.5 SSL hostname checking function The Secure Sockets layer is only actually secure if you check the hostname in the certificate returned by the server to which you are connecting, and verify that it matches to hostname that you are trying diff -Nru backports.ssl-match-hostname-3.4.0.2/debian/docs backports.ssl-match-hostname-3.5.0.1/debian/docs --- backports.ssl-match-hostname-3.4.0.2/debian/docs 2014-05-11 11:34:59.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/debian/docs 2016-07-21 15:20:33.000000000 +0000 @@ -1 +1 @@ -README.txt +backports/ssl_match_hostname/README.txt diff -Nru backports.ssl-match-hostname-3.4.0.2/debian/.git-dpm backports.ssl-match-hostname-3.5.0.1/debian/.git-dpm --- backports.ssl-match-hostname-3.4.0.2/debian/.git-dpm 1970-01-01 00:00:00.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/debian/.git-dpm 2016-07-21 15:14:31.000000000 +0000 @@ -0,0 +1,11 @@ +# see git-dpm(1) from git-dpm package +3878686f6abd42d46f67cf42b268f3ba9871caff +3878686f6abd42d46f67cf42b268f3ba9871caff +3878686f6abd42d46f67cf42b268f3ba9871caff +3878686f6abd42d46f67cf42b268f3ba9871caff +backports.ssl-match-hostname_3.5.0.1.orig.tar.gz +0567c136707a5f53b95aa793b79cc8d5c61d8e22 +5605 +debianTag="debian/%e%v" +patchedTag="patched/%e%v" +upstreamTag="upstream/%e%u" diff -Nru backports.ssl-match-hostname-3.4.0.2/debian/rules backports.ssl-match-hostname-3.5.0.1/debian/rules --- backports.ssl-match-hostname-3.4.0.2/debian/rules 2014-05-11 11:33:53.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/debian/rules 2016-07-21 15:21:38.000000000 +0000 @@ -2,10 +2,9 @@ %: dh $@ --with python2 --buildsystem=pybuild -override_dh_auto_build: - mv $(CURDIR)/src/backports/ssl_match_hostname/README.txt $(CURDIR)/ - dh_auto_build +override_dh_auto_install: + dh_auto_install + find $(CURDIR)/debian/python-backports.ssl-match-hostname/ -name README.txt -delete -override_dh_auto_clean: - dh_auto_clean - if [ -f $(CURDIR)/README.txt ]; then mv $(CURDIR)/README.txt $(CURDIR)/src/backports/ssl_match_hostname/; fi +override_dh_python2: + dh_python2 --namespace backports diff -Nru backports.ssl-match-hostname-3.4.0.2/debian/watch backports.ssl-match-hostname-3.5.0.1/debian/watch --- backports.ssl-match-hostname-3.4.0.2/debian/watch 2014-05-09 15:25:31.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/debian/watch 2016-07-21 15:14:31.000000000 +0000 @@ -1,3 +1,3 @@ version=3 - -opts="pgpsigurlmangle=s/$/.asc/" https://pypi.python.org/packages/source/b/backports.ssl_match_hostname/backports.ssl_match_hostname-(.*).tar.gz +opts=uversionmangle=s/(rc|a|b|c)/~$1/,pgpsigurlmangle=s/$/.asc/ \ +https://pypi.debian.net/backports.ssl_match_hostname/backports.ssl_match_hostname-(.+)\.(?:zip|tgz|tbz|txz|(?:tar\.(?:gz|bz2|xz))) diff -Nru backports.ssl-match-hostname-3.4.0.2/MANIFEST.in backports.ssl-match-hostname-3.5.0.1/MANIFEST.in --- backports.ssl-match-hostname-3.4.0.2/MANIFEST.in 2013-10-27 19:21:12.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/MANIFEST.in 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -recursive-include src * diff -Nru backports.ssl-match-hostname-3.4.0.2/PKG-INFO backports.ssl-match-hostname-3.5.0.1/PKG-INFO --- backports.ssl-match-hostname-3.4.0.2/PKG-INFO 2013-10-27 19:24:03.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/PKG-INFO 2015-12-19 22:33:16.000000000 +0000 @@ -1,13 +1,16 @@ Metadata-Version: 1.1 Name: backports.ssl_match_hostname -Version: 3.4.0.2 -Summary: The ssl.match_hostname() function from Python 3.4 +Version: 3.5.0.1 +Summary: The ssl.match_hostname() function from Python 3.5 Home-page: http://bitbucket.org/brandon/backports.ssl_match_hostname -Author: Brandon Craig Rhodes -Author-email: brandon@rhodesmill.org -License: UNKNOWN +Author: Toshio Kuratomi +Author-email: toshio@fedoraproject.org +License: Python Software Foundation License Description: - The Secure Sockets layer is only actually *secure* + The ssl.match_hostname() function from Python 3.5 + ================================================= + + The Secure Sockets Layer is only actually *secure* if you check the hostname in the certificate returned by the server to which you are connecting, and verify that it matches to hostname @@ -26,31 +29,48 @@ and then use it like this:: from backports.ssl_match_hostname import match_hostname, CertificateError - ... - sslsock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_SSLv3, + [...] + sslsock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_SSLv23, cert_reqs=ssl.CERT_REQUIRED, ca_certs=...) try: match_hostname(sslsock.getpeercert(), hostname) except CertificateError, ce: ... - Note that the ``ssl`` module is only included in the Standard Library - for Python 2.6 and later; - users of Python 2.5 or earlier versions - will also need to install the ``ssl`` distribution - from the Python Package Index to use code like that shown above. - Brandon Craig Rhodes is merely the packager of this distribution; - the actual code inside comes verbatim from Python 3.4. + the actual code inside comes from Python 3.5 with small changes for + portability. + + + Requirements + ------------ + + * If you want to verify hosts match with certificates via ServerAltname + IPAddress fields, you need to install the `ipaddress module`_. + backports.ssl_match_hostname will continue to work without ipaddress but + will only be able to handle ServerAltName DNSName fields, not IPAddress. + System packagers (Linux distributions, et al) are encouraged to add + this as a hard dependency in their packages. + + * If you need to use this on Python versions earlier than 2.6 you will need to + install the `ssl module`_. From Python 2.6 upwards ``ssl`` is included in + the Python Standard Library so you do not need to install it separately. + + .. _`ipaddress module`:: https://pypi.python.org/pypi/ipaddress + .. _`ssl module`:: https://pypi.python.org/pypi/ssl History ------- + * This function was introduced in python-3.2 * It was updated for python-3.4a1 for a CVE (backports-ssl_match_hostname-3.4.0.1) * It was updated from RFC2818 to RFC 6125 compliance in order to fix another security flaw for python-3.3.3 and python-3.4a5 (backports-ssl_match_hostname-3.4.0.2) + * It was updated in python-3.5 to handle IPAddresses in ServerAltName fields + (something that backports.ssl_match_hostname will do if you also install the + ipaddress library from pypi). .. _RFC2818: http://tools.ietf.org/html/rfc2818.html diff -Nru backports.ssl-match-hostname-3.4.0.2/setup.cfg backports.ssl-match-hostname-3.5.0.1/setup.cfg --- backports.ssl-match-hostname-3.4.0.2/setup.cfg 2013-10-27 19:24:03.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/setup.cfg 1970-01-01 00:00:00.000000000 +0000 @@ -1,5 +0,0 @@ -[egg_info] -tag_build = -tag_date = 0 -tag_svn_revision = 0 - diff -Nru backports.ssl-match-hostname-3.4.0.2/setup.py backports.ssl-match-hostname-3.5.0.1/setup.py --- backports.ssl-match-hostname-3.4.0.2/setup.py 2013-10-27 19:23:51.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/setup.py 2015-12-19 22:30:28.000000000 +0000 @@ -1,22 +1,34 @@ # -*- coding: utf-8 -*- -# This setup.py was generated automatically by Pyron. -# For details, see http://pypi.python.org/pypi/pyron/ -from setuptools import setup, find_packages +import os +from distutils.core import setup -setup( - name = 'backports.ssl_match_hostname', - version = '3.4.0.2', - description = 'The ssl.match_hostname() function from Python 3.4', - long_description = '\nThe Secure Sockets layer is only actually *secure*\nif you check the hostname in the certificate returned\nby the server to which you are connecting,\nand verify that it matches to hostname\nthat you are trying to reach.\n\nBut the matching logic, defined in `RFC2818`_,\ncan be a bit tricky to implement on your own.\nSo the ``ssl`` package in the Standard Library of Python 3.2\nand greater now includes a ``match_hostname()`` function\nfor performing this check instead of requiring every application\nto implement the check separately.\n\nThis backport brings ``match_hostname()`` to users\nof earlier versions of Python.\nSimply make this distribution a dependency of your package,\nand then use it like this::\n\n from backports.ssl_match_hostname import match_hostname, CertificateError\n ...\n sslsock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_SSLv3,\n cert_reqs=ssl.CERT_REQUIRED, ca_certs=...)\n try:\n match_hostname(sslsock.getpeercert(), hostname)\n except CertificateError, ce:\n ...\n\nNote that the ``ssl`` module is only included in the Standard Library\nfor Python 2.6 and later;\nusers of Python 2.5 or earlier versions\nwill also need to install the ``ssl`` distribution\nfrom the Python Package Index to use code like that shown above.\n\nBrandon Craig Rhodes is merely the packager of this distribution;\nthe actual code inside comes verbatim from Python 3.4.\n\nHistory\n-------\n* This function was introduced in python-3.2\n* It was updated for python-3.4a1 for a CVE \n (backports-ssl_match_hostname-3.4.0.1)\n* It was updated from RFC2818 to RFC 6125 compliance in order to fix another\n security flaw for python-3.3.3 and python-3.4a5\n (backports-ssl_match_hostname-3.4.0.2)\n\n\n.. _RFC2818: http://tools.ietf.org/html/rfc2818.html\n\n', - author = 'Brandon Craig Rhodes', - author_email = 'brandon@rhodesmill.org', - url = 'http://bitbucket.org/brandon/backports.ssl_match_hostname', - classifiers = ['Development Status :: 5 - Production/Stable', 'License :: OSI Approved :: Python Software Foundation License', 'Programming Language :: Python :: 2.4', 'Programming Language :: Python :: 2.5', 'Programming Language :: Python :: 2.6', 'Programming Language :: Python :: 2.7', 'Programming Language :: Python :: 3', 'Programming Language :: Python :: 3.0', 'Programming Language :: Python :: 3.1', 'Topic :: Security :: Cryptography'], +long_description = open(os.path.join( + os.path.dirname(__file__), 'backports', 'ssl_match_hostname', 'README.txt', + )).read() - package_dir = {'': 'src'}, - packages = find_packages('src'), - include_package_data = True, - install_requires = [], - entry_points = '', +setup( + name='backports.ssl_match_hostname', + version='3.5.0.1', + description='The ssl.match_hostname() function from Python 3.5', + long_description=long_description, + author='Brandon Rhodes', + author_email='brandon@rhodesmill.org', + maintainer='Toshio Kuratomi', + maintainer_email='toshio@fedoraproject.org', + url='http://bitbucket.org/brandon/backports.ssl_match_hostname', + license='Python Software Foundation License', + classifiers=[ + 'Development Status :: 5 - Production/Stable', + 'License :: OSI Approved :: Python Software Foundation License', + 'Programming Language :: Python :: 2.4', + 'Programming Language :: Python :: 2.5', + 'Programming Language :: Python :: 2.6', + 'Programming Language :: Python :: 2.7', + 'Programming Language :: Python :: 3', + 'Programming Language :: Python :: 3.0', + 'Programming Language :: Python :: 3.1', + 'Topic :: Security :: Cryptography', + ], + packages=['backports', 'backports.ssl_match_hostname'], ) diff -Nru backports.ssl-match-hostname-3.4.0.2/src/backports/__init__.py backports.ssl-match-hostname-3.5.0.1/src/backports/__init__.py --- backports.ssl-match-hostname-3.4.0.2/src/backports/__init__.py 2013-10-27 19:21:12.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/src/backports/__init__.py 1970-01-01 00:00:00.000000000 +0000 @@ -1,3 +0,0 @@ -# This is a Python "namespace package" http://www.python.org/dev/peps/pep-0382/ -from pkgutil import extend_path -__path__ = extend_path(__path__, __name__) diff -Nru backports.ssl-match-hostname-3.4.0.2/src/backports/ssl_match_hostname/__init__.py backports.ssl-match-hostname-3.5.0.1/src/backports/ssl_match_hostname/__init__.py --- backports.ssl-match-hostname-3.4.0.2/src/backports/ssl_match_hostname/__init__.py 2013-10-27 19:21:12.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/src/backports/ssl_match_hostname/__init__.py 1970-01-01 00:00:00.000000000 +0000 @@ -1,102 +0,0 @@ -"""The match_hostname() function from Python 3.3.3, essential when using SSL.""" - -import re - -__version__ = '3.4.0.2' - -class CertificateError(ValueError): - pass - - -def _dnsname_match(dn, hostname, max_wildcards=1): - """Matching according to RFC 6125, section 6.4.3 - - http://tools.ietf.org/html/rfc6125#section-6.4.3 - """ - pats = [] - if not dn: - return False - - # Ported from python3-syntax: - # leftmost, *remainder = dn.split(r'.') - parts = dn.split(r'.') - leftmost = parts[0] - remainder = parts[1:] - - wildcards = leftmost.count('*') - if wildcards > max_wildcards: - # Issue #17980: avoid denials of service by refusing more - # than one wildcard per fragment. A survey of established - # policy among SSL implementations showed it to be a - # reasonable choice. - raise CertificateError( - "too many wildcards in certificate DNS name: " + repr(dn)) - - # speed up common case w/o wildcards - if not wildcards: - return dn.lower() == hostname.lower() - - # RFC 6125, section 6.4.3, subitem 1. - # The client SHOULD NOT attempt to match a presented identifier in which - # the wildcard character comprises a label other than the left-most label. - if leftmost == '*': - # When '*' is a fragment by itself, it matches a non-empty dotless - # fragment. - pats.append('[^.]+') - elif leftmost.startswith('xn--') or hostname.startswith('xn--'): - # RFC 6125, section 6.4.3, subitem 3. - # The client SHOULD NOT attempt to match a presented identifier - # where the wildcard character is embedded within an A-label or - # U-label of an internationalized domain name. - pats.append(re.escape(leftmost)) - else: - # Otherwise, '*' matches any dotless string, e.g. www* - pats.append(re.escape(leftmost).replace(r'\*', '[^.]*')) - - # add the remaining fragments, ignore any wildcards - for frag in remainder: - pats.append(re.escape(frag)) - - pat = re.compile(r'\A' + r'\.'.join(pats) + r'\Z', re.IGNORECASE) - return pat.match(hostname) - - -def match_hostname(cert, hostname): - """Verify that *cert* (in decoded format as returned by - SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125 - rules are followed, but IP addresses are not accepted for *hostname*. - - CertificateError is raised on failure. On success, the function - returns nothing. - """ - if not cert: - raise ValueError("empty or no certificate") - dnsnames = [] - san = cert.get('subjectAltName', ()) - for key, value in san: - if key == 'DNS': - if _dnsname_match(value, hostname): - return - dnsnames.append(value) - if not dnsnames: - # The subject is only checked when there is no dNSName entry - # in subjectAltName - for sub in cert.get('subject', ()): - for key, value in sub: - # XXX according to RFC 2818, the most specific Common Name - # must be used. - if key == 'commonName': - if _dnsname_match(value, hostname): - return - dnsnames.append(value) - if len(dnsnames) > 1: - raise CertificateError("hostname %r " - "doesn't match either of %s" - % (hostname, ', '.join(map(repr, dnsnames)))) - elif len(dnsnames) == 1: - raise CertificateError("hostname %r " - "doesn't match %r" - % (hostname, dnsnames[0])) - else: - raise CertificateError("no appropriate commonName or " - "subjectAltName fields were found") diff -Nru backports.ssl-match-hostname-3.4.0.2/src/backports/ssl_match_hostname/LICENSE.txt backports.ssl-match-hostname-3.5.0.1/src/backports/ssl_match_hostname/LICENSE.txt --- backports.ssl-match-hostname-3.4.0.2/src/backports/ssl_match_hostname/LICENSE.txt 2013-10-27 19:21:12.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/src/backports/ssl_match_hostname/LICENSE.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,51 +0,0 @@ -Python License (Python-2.0) - -Python License, Version 2 (Python-2.0) - -PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2 --------------------------------------------- - -1. This LICENSE AGREEMENT is between the Python Software Foundation -("PSF"), and the Individual or Organization ("Licensee") accessing and -otherwise using this software ("Python") in source or binary form and -its associated documentation. - -2. Subject to the terms and conditions of this License Agreement, PSF -hereby grants Licensee a nonexclusive, royalty-free, world-wide -license to reproduce, analyze, test, perform and/or display publicly, -prepare derivative works, distribute, and otherwise use Python -alone or in any derivative version, provided, however, that PSF's -License Agreement and PSF's notice of copyright, i.e., "Copyright (c) -2001-2013 Python Software Foundation; All Rights Reserved" are retained in -Python alone or in any derivative version prepared by Licensee. - -3. In the event Licensee prepares a derivative work that is based on -or incorporates Python or any part thereof, and wants to make -the derivative work available to others as provided herein, then -Licensee hereby agrees to include in any such work a brief summary of -the changes made to Python. - -4. PSF is making Python available to Licensee on an "AS IS" -basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR -IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND -DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS -FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT -INFRINGE ANY THIRD PARTY RIGHTS. - -5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON -FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS -A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON, -OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. - -6. This License Agreement will automatically terminate upon a material -breach of its terms and conditions. - -7. Nothing in this License Agreement shall be deemed to create any -relationship of agency, partnership, or joint venture between PSF and -Licensee. This License Agreement does not grant permission to use PSF -trademarks or trade name in a trademark sense to endorse or promote -products or services of Licensee, or any third party. - -8. By copying, installing or otherwise using Python, Licensee -agrees to be bound by the terms and conditions of this License -Agreement. diff -Nru backports.ssl-match-hostname-3.4.0.2/src/backports/ssl_match_hostname/README.txt backports.ssl-match-hostname-3.5.0.1/src/backports/ssl_match_hostname/README.txt --- backports.ssl-match-hostname-3.4.0.2/src/backports/ssl_match_hostname/README.txt 2013-10-27 19:21:12.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/src/backports/ssl_match_hostname/README.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,52 +0,0 @@ - -The ssl.match_hostname() function from Python 3.4 -================================================= - -The Secure Sockets layer is only actually *secure* -if you check the hostname in the certificate returned -by the server to which you are connecting, -and verify that it matches to hostname -that you are trying to reach. - -But the matching logic, defined in `RFC2818`_, -can be a bit tricky to implement on your own. -So the ``ssl`` package in the Standard Library of Python 3.2 -and greater now includes a ``match_hostname()`` function -for performing this check instead of requiring every application -to implement the check separately. - -This backport brings ``match_hostname()`` to users -of earlier versions of Python. -Simply make this distribution a dependency of your package, -and then use it like this:: - - from backports.ssl_match_hostname import match_hostname, CertificateError - ... - sslsock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_SSLv3, - cert_reqs=ssl.CERT_REQUIRED, ca_certs=...) - try: - match_hostname(sslsock.getpeercert(), hostname) - except CertificateError, ce: - ... - -Note that the ``ssl`` module is only included in the Standard Library -for Python 2.6 and later; -users of Python 2.5 or earlier versions -will also need to install the ``ssl`` distribution -from the Python Package Index to use code like that shown above. - -Brandon Craig Rhodes is merely the packager of this distribution; -the actual code inside comes verbatim from Python 3.4. - -History -------- -* This function was introduced in python-3.2 -* It was updated for python-3.4a1 for a CVE - (backports-ssl_match_hostname-3.4.0.1) -* It was updated from RFC2818 to RFC 6125 compliance in order to fix another - security flaw for python-3.3.3 and python-3.4a5 - (backports-ssl_match_hostname-3.4.0.2) - - -.. _RFC2818: http://tools.ietf.org/html/rfc2818.html - diff -Nru backports.ssl-match-hostname-3.4.0.2/src/backports.ssl_match_hostname.egg-info/dependency_links.txt backports.ssl-match-hostname-3.5.0.1/src/backports.ssl_match_hostname.egg-info/dependency_links.txt --- backports.ssl-match-hostname-3.4.0.2/src/backports.ssl_match_hostname.egg-info/dependency_links.txt 2013-10-27 19:24:03.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/src/backports.ssl_match_hostname.egg-info/dependency_links.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ - diff -Nru backports.ssl-match-hostname-3.4.0.2/src/backports.ssl_match_hostname.egg-info/PKG-INFO backports.ssl-match-hostname-3.5.0.1/src/backports.ssl_match_hostname.egg-info/PKG-INFO --- backports.ssl-match-hostname-3.4.0.2/src/backports.ssl_match_hostname.egg-info/PKG-INFO 2013-10-27 19:24:03.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/src/backports.ssl_match_hostname.egg-info/PKG-INFO 1970-01-01 00:00:00.000000000 +0000 @@ -1,69 +0,0 @@ -Metadata-Version: 1.1 -Name: backports.ssl-match-hostname -Version: 3.4.0.2 -Summary: The ssl.match_hostname() function from Python 3.4 -Home-page: http://bitbucket.org/brandon/backports.ssl_match_hostname -Author: Brandon Craig Rhodes -Author-email: brandon@rhodesmill.org -License: UNKNOWN -Description: - The Secure Sockets layer is only actually *secure* - if you check the hostname in the certificate returned - by the server to which you are connecting, - and verify that it matches to hostname - that you are trying to reach. - - But the matching logic, defined in `RFC2818`_, - can be a bit tricky to implement on your own. - So the ``ssl`` package in the Standard Library of Python 3.2 - and greater now includes a ``match_hostname()`` function - for performing this check instead of requiring every application - to implement the check separately. - - This backport brings ``match_hostname()`` to users - of earlier versions of Python. - Simply make this distribution a dependency of your package, - and then use it like this:: - - from backports.ssl_match_hostname import match_hostname, CertificateError - ... - sslsock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_SSLv3, - cert_reqs=ssl.CERT_REQUIRED, ca_certs=...) - try: - match_hostname(sslsock.getpeercert(), hostname) - except CertificateError, ce: - ... - - Note that the ``ssl`` module is only included in the Standard Library - for Python 2.6 and later; - users of Python 2.5 or earlier versions - will also need to install the ``ssl`` distribution - from the Python Package Index to use code like that shown above. - - Brandon Craig Rhodes is merely the packager of this distribution; - the actual code inside comes verbatim from Python 3.4. - - History - ------- - * This function was introduced in python-3.2 - * It was updated for python-3.4a1 for a CVE - (backports-ssl_match_hostname-3.4.0.1) - * It was updated from RFC2818 to RFC 6125 compliance in order to fix another - security flaw for python-3.3.3 and python-3.4a5 - (backports-ssl_match_hostname-3.4.0.2) - - - .. _RFC2818: http://tools.ietf.org/html/rfc2818.html - - -Platform: UNKNOWN -Classifier: Development Status :: 5 - Production/Stable -Classifier: License :: OSI Approved :: Python Software Foundation License -Classifier: Programming Language :: Python :: 2.4 -Classifier: Programming Language :: Python :: 2.5 -Classifier: Programming Language :: Python :: 2.6 -Classifier: Programming Language :: Python :: 2.7 -Classifier: Programming Language :: Python :: 3 -Classifier: Programming Language :: Python :: 3.0 -Classifier: Programming Language :: Python :: 3.1 -Classifier: Topic :: Security :: Cryptography diff -Nru backports.ssl-match-hostname-3.4.0.2/src/backports.ssl_match_hostname.egg-info/SOURCES.txt backports.ssl-match-hostname-3.5.0.1/src/backports.ssl_match_hostname.egg-info/SOURCES.txt --- backports.ssl-match-hostname-3.4.0.2/src/backports.ssl_match_hostname.egg-info/SOURCES.txt 2013-10-27 19:24:03.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/src/backports.ssl_match_hostname.egg-info/SOURCES.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,10 +0,0 @@ -MANIFEST.in -setup.py -src/backports/__init__.py -src/backports.ssl_match_hostname.egg-info/PKG-INFO -src/backports.ssl_match_hostname.egg-info/SOURCES.txt -src/backports.ssl_match_hostname.egg-info/dependency_links.txt -src/backports.ssl_match_hostname.egg-info/top_level.txt -src/backports/ssl_match_hostname/LICENSE.txt -src/backports/ssl_match_hostname/README.txt -src/backports/ssl_match_hostname/__init__.py \ No newline at end of file diff -Nru backports.ssl-match-hostname-3.4.0.2/src/backports.ssl_match_hostname.egg-info/top_level.txt backports.ssl-match-hostname-3.5.0.1/src/backports.ssl_match_hostname.egg-info/top_level.txt --- backports.ssl-match-hostname-3.4.0.2/src/backports.ssl_match_hostname.egg-info/top_level.txt 2013-10-27 19:24:03.000000000 +0000 +++ backports.ssl-match-hostname-3.5.0.1/src/backports.ssl_match_hostname.egg-info/top_level.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -backports