Verify that *cert* (in decoded format as returned by SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125 rules are followed. The function matches IP addresses rather than dNSNames if hostname is a valid ipaddress string. IPv4 addresses are supported on all p
(cert, hostname)
| 374 | |
| 375 | |
| 376 | def match_hostname(cert, hostname): |
| 377 | """Verify that *cert* (in decoded format as returned by |
| 378 | SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125 |
| 379 | rules are followed. |
| 380 | |
| 381 | The function matches IP addresses rather than dNSNames if hostname is a |
| 382 | valid ipaddress string. IPv4 addresses are supported on all platforms. |
| 383 | IPv6 addresses are supported on platforms with IPv6 support (AF_INET6 |
| 384 | and inet_pton). |
| 385 | |
| 386 | CertificateError is raised on failure. On success, the function |
| 387 | returns nothing. |
| 388 | """ |
| 389 | warnings.warn( |
| 390 | "ssl.match_hostname() is deprecated", |
| 391 | category=DeprecationWarning, |
| 392 | stacklevel=2 |
| 393 | ) |
| 394 | if not cert: |
| 395 | raise ValueError("empty or no certificate, match_hostname needs a " |
| 396 | "SSL socket or SSL context with either " |
| 397 | "CERT_OPTIONAL or CERT_REQUIRED") |
| 398 | try: |
| 399 | host_ip = _inet_paton(hostname) |
| 400 | except ValueError: |
| 401 | # Not an IP address (common case) |
| 402 | host_ip = None |
| 403 | dnsnames = [] |
| 404 | san = cert.get('subjectAltName', ()) |
| 405 | for key, value in san: |
| 406 | if key == 'DNS': |
| 407 | if host_ip is None and _dnsname_match(value, hostname): |
| 408 | return |
| 409 | dnsnames.append(value) |
| 410 | elif key == 'IP Address': |
| 411 | if host_ip is not None and _ipaddress_match(value, host_ip): |
| 412 | return |
| 413 | dnsnames.append(value) |
| 414 | if not dnsnames: |
| 415 | # The subject is only checked when there is no dNSName entry |
| 416 | # in subjectAltName |
| 417 | for sub in cert.get('subject', ()): |
| 418 | for key, value in sub: |
| 419 | # XXX according to RFC 2818, the most specific Common Name |
| 420 | # must be used. |
| 421 | if key == 'commonName': |
| 422 | if _dnsname_match(value, hostname): |
| 423 | return |
| 424 | dnsnames.append(value) |
| 425 | if len(dnsnames) > 1: |
| 426 | raise CertificateError("hostname %r " |
| 427 | "doesn't match either of %s" |
| 428 | % (hostname, ', '.join(map(repr, dnsnames)))) |
| 429 | elif len(dnsnames) == 1: |
| 430 | raise CertificateError("hostname %r " |
| 431 | "doesn't match %r" |
| 432 | % (hostname, dnsnames[0])) |
| 433 | else: |
nothing calls this directly
no test coverage detected