Index: setuptools-1.1.7/setuptools/ssl_support.py

===================================================================

--- setuptools-1.1.7.orig/setuptools/ssl_support.py

+++ setuptools-1.1.7/setuptools/ssl_support.py

@@ -85,28 +85,69 @@ except ImportError:

 try:

     from ssl import CertificateError, match_hostname

 except ImportError:

+    try:

+        from backports.ssl_match_hostname import CertificateError

+        from backports.ssl_match_hostname import match_hostname

+    except ImportError:

+        CertificateError = None

+        match_hostname = None

+

+if not CertificateError:

     class CertificateError(ValueError):

         pass

-    def _dnsname_to_pat(dn, max_wildcards=1):

+if not match_hostname:

+    def _dnsname_match(dn, hostname, max_wildcards=1):

+        """Matching according to RFC 6125, section 6.4.3

+

+        http://tools.ietf.org/html/rfc6125#section-6.4.3

+        """

         pats = []

-        for frag in dn.split(r'.'):

-            if frag.count('*') > max_wildcards:

-                # Issue #17980: avoid denials of service by refusing more

-                # than one wildcard per fragment.  A survery of established

-                # policy among SSL implementations showed it to be a

-                # reasonable choice.

-                raise CertificateError(

-                    "too many wildcards in certificate DNS name: " + repr(dn))

-            if frag == '*':

-                # When '*' is a fragment by itself, it matches a non-empty dotless

-                # fragment.

-                pats.append('[^.]+')

-            else:

-                # Otherwise, '*' matches any dotless fragment.

-                frag = re.escape(frag)

-                pats.append(frag.replace(r'\*', '[^.]*'))

-        return re.compile(r'\A' + r'\.'.join(pats) + r'\Z', re.IGNORECASE)

+        if not dn:

+            return False

+

+        # Ported from python3-syntax:

+        # leftmost, *remainder = dn.split(r'.')

+        parts = dn.split(r'.')

+        leftmost = parts[0]

+        remainder = parts[1:]

+

+        wildcards = leftmost.count('*')

+        if wildcards > max_wildcards:

+            # Issue #17980: avoid denials of service by refusing more

+            # than one wildcard per fragment.  A survey of established

+            # policy among SSL implementations showed it to be a

+            # reasonable choice.

+            raise CertificateError(

+                "too many wildcards in certificate DNS name: " + repr(dn))

+

+        # speed up common case w/o wildcards

+        if not wildcards:

+            return dn.lower() == hostname.lower()

+

+        # RFC 6125, section 6.4.3, subitem 1.

+        # The client SHOULD NOT attempt to match a presented identifier in which

+        # the wildcard character comprises a label other than the left-most label.

+        if leftmost == '*':

+            # When '*' is a fragment by itself, it matches a non-empty dotless

+            # fragment.

+            pats.append('[^.]+')

+        elif leftmost.startswith('xn--') or hostname.startswith('xn--'):

+            # RFC 6125, section 6.4.3, subitem 3.

+            # The client SHOULD NOT attempt to match a presented identifier

+            # where the wildcard character is embedded within an A-label or

+            # U-label of an internationalized domain name.

+            pats.append(re.escape(leftmost))

+        else:

+            # Otherwise, '*' matches any dotless string, e.g. www*

+            pats.append(re.escape(leftmost).replace(r'\*', '[^.]*'))

+

+        # add the remaining fragments, ignore any wildcards

+        for frag in remainder:

+            pats.append(re.escape(frag))

+

+        pat = re.compile(r'\A' + r'\.'.join(pats) + r'\Z', re.IGNORECASE)

+        return pat.match(hostname)

     def match_hostname(cert, hostname):

         """Verify that *cert* (in decoded format as returned by

@@ -122,7 +163,7 @@ except ImportError:

         san = cert.get('subjectAltName', ())

         for key, value in san:

             if key == 'DNS':

-                if _dnsname_to_pat(value).match(hostname):

+                if _dnsname_match(value, hostname):

                     return

                 dnsnames.append(value)

         if not dnsnames:

@@ -133,7 +174,7 @@ except ImportError:

                     # XXX according to RFC 2818, the most specific Common Name

                     # must be used.

                     if key == 'commonName':

-                        if _dnsname_to_pat(value).match(hostname):

+                        if _dnsname_match(value, hostname):

                             return

                         dnsnames.append(value)

         if len(dnsnames) > 1: