Bring back the ssl_match_hostname source and hackery

Python 3 has ssl_match_hostname as a file, but Python 2 symlinks the
directory and upgrading is troublesome. Rather than dealing with an
upgrade scriptlet, just bring back the old rm -rf stuff and wait for
Python 2 to die.

Unbundle-ssl_match_hostname-backport.patch

@@ -1,207 +0,0 @@
-From ee3425b5bfba3262c3485265c3aaaf99169e11d0 Mon Sep 17 00:00:00 2001
-From: Jeremy Cline <jcline@redhat.com>
-Date: Mon, 29 Oct 2018 16:07:52 -0400
-Subject: [PATCH] Unbundle ssl_match_hostname backport
-
-Fedora has shipped 3.5+ for a long time and we depend on backports of
-Python 2.
-
-Signed-off-by: Jeremy Cline <jcline@redhat.com>
----
- .../packages/ssl_match_hostname/__init__.py   |  14 +-
- .../ssl_match_hostname/_implementation.py     | 156 ------------------
- 2 files changed, 3 insertions(+), 167 deletions(-)
- delete mode 100644 src/urllib3/packages/ssl_match_hostname/_implementation.py
-
-diff --git a/src/urllib3/packages/ssl_match_hostname/__init__.py b/src/urllib3/packages/ssl_match_hostname/__init__.py
-index d6594eb..6bd8fb9 100644
---- a/src/urllib3/packages/ssl_match_hostname/__init__.py
-+++ b/src/urllib3/packages/ssl_match_hostname/__init__.py
-@@ -1,19 +1,11 @@
- import sys
- 
- try:
--    # Our match_hostname function is the same as 3.5's, so we only want to
--    # import the match_hostname function if it's at least that good.
--    if sys.version_info < (3, 5):
--        raise ImportError("Fallback to vendored code")
--
-+    # Python 3.5+
-     from ssl import CertificateError, match_hostname
- except ImportError:
--    try:
--        # Backport of the function from a pypi module
--        from backports.ssl_match_hostname import CertificateError, match_hostname
--    except ImportError:
--        # Our vendored copy
--        from ._implementation import CertificateError, match_hostname
-+    # Python 2
-+    from backports.ssl_match_hostname import CertificateError, match_hostname
- 
- # Not needed, but documenting what we provide.
- __all__ = ('CertificateError', 'match_hostname')
-diff --git a/src/urllib3/packages/ssl_match_hostname/_implementation.py b/src/urllib3/packages/ssl_match_hostname/_implementation.py
-deleted file mode 100644
-index d6e66c0..0000000
---- a/src/urllib3/packages/ssl_match_hostname/_implementation.py
-+++ /dev/null
-@@ -1,156 +0,0 @@
--"""The match_hostname() function from Python 3.3.3, essential when using SSL."""
--
--# Note: This file is under the PSF license as the code comes from the python
--# stdlib.   http://docs.python.org/3/license.html
--
--import re
--import sys
--
--# ipaddress has been backported to 2.6+ in pypi.  If it is installed on the
--# system, use it to handle IPAddress ServerAltnames (this was added in
--# python-3.5) otherwise only do DNS matching.  This allows
--# backports.ssl_match_hostname to continue to be used in Python 2.7.
--try:
--    import ipaddress
--except ImportError:
--    ipaddress = None
--
--__version__ = '3.5.0.1'
--
--
--class CertificateError(ValueError):
--    pass
--
--
--def _dnsname_match(dn, hostname, max_wildcards=1):
--    """Matching according to RFC 6125, section 6.4.3
--
--    http://tools.ietf.org/html/rfc6125#section-6.4.3
--    """
--    pats = []
--    if not dn:
--        return False
--
--    # Ported from python3-syntax:
--    # leftmost, *remainder = dn.split(r'.')
--    parts = dn.split(r'.')
--    leftmost = parts[0]
--    remainder = parts[1:]
--
--    wildcards = leftmost.count('*')
--    if wildcards > max_wildcards:
--        # Issue #17980: avoid denials of service by refusing more
--        # than one wildcard per fragment.  A survey of established
--        # policy among SSL implementations showed it to be a
--        # reasonable choice.
--        raise CertificateError(
--            "too many wildcards in certificate DNS name: " + repr(dn))
--
--    # speed up common case w/o wildcards
--    if not wildcards:
--        return dn.lower() == hostname.lower()
--
--    # RFC 6125, section 6.4.3, subitem 1.
--    # The client SHOULD NOT attempt to match a presented identifier in which
--    # the wildcard character comprises a label other than the left-most label.
--    if leftmost == '*':
--        # When '*' is a fragment by itself, it matches a non-empty dotless
--        # fragment.
--        pats.append('[^.]+')
--    elif leftmost.startswith('xn--') or hostname.startswith('xn--'):
--        # RFC 6125, section 6.4.3, subitem 3.
--        # The client SHOULD NOT attempt to match a presented identifier
--        # where the wildcard character is embedded within an A-label or
--        # U-label of an internationalized domain name.
--        pats.append(re.escape(leftmost))
--    else:
--        # Otherwise, '*' matches any dotless string, e.g. www*
--        pats.append(re.escape(leftmost).replace(r'\*', '[^.]*'))
--
--    # add the remaining fragments, ignore any wildcards
--    for frag in remainder:
--        pats.append(re.escape(frag))
--
--    pat = re.compile(r'\A' + r'\.'.join(pats) + r'\Z', re.IGNORECASE)
--    return pat.match(hostname)
--
--
--def _to_unicode(obj):
--    if isinstance(obj, str) and sys.version_info < (3,):
--        obj = unicode(obj, encoding='ascii', errors='strict')
--    return obj
--
--def _ipaddress_match(ipname, host_ip):
--    """Exact matching of IP addresses.
--
--    RFC 6125 explicitly doesn't define an algorithm for this
--    (section 1.7.2 - "Out of Scope").
--    """
--    # OpenSSL may add a trailing newline to a subjectAltName's IP address
--    # Divergence from upstream: ipaddress can't handle byte str
--    ip = ipaddress.ip_address(_to_unicode(ipname).rstrip())
--    return ip == host_ip
--
--
--def match_hostname(cert, hostname):
--    """Verify that *cert* (in decoded format as returned by
--    SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
--    rules are followed, but IP addresses are not accepted for *hostname*.
--
--    CertificateError is raised on failure. On success, the function
--    returns nothing.
--    """
--    if not cert:
--        raise ValueError("empty or no certificate, match_hostname needs a "
--                         "SSL socket or SSL context with either "
--                         "CERT_OPTIONAL or CERT_REQUIRED")
--    try:
--        # Divergence from upstream: ipaddress can't handle byte str
--        host_ip = ipaddress.ip_address(_to_unicode(hostname))
--    except ValueError:
--        # Not an IP address (common case)
--        host_ip = None
--    except UnicodeError:
--        # Divergence from upstream: Have to deal with ipaddress not taking
--        # byte strings.  addresses should be all ascii, so we consider it not
--        # an ipaddress in this case
--        host_ip = None
--    except AttributeError:
--        # Divergence from upstream: Make ipaddress library optional
--        if ipaddress is None:
--            host_ip = None
--        else:
--            raise
--    dnsnames = []
--    san = cert.get('subjectAltName', ())
--    for key, value in san:
--        if key == 'DNS':
--            if host_ip is None and _dnsname_match(value, hostname):
--                return
--            dnsnames.append(value)
--        elif key == 'IP Address':
--            if host_ip is not None and _ipaddress_match(value, host_ip):
--                return
--            dnsnames.append(value)
--    if not dnsnames:
--        # The subject is only checked when there is no dNSName entry
--        # in subjectAltName
--        for sub in cert.get('subject', ()):
--            for key, value in sub:
--                # XXX according to RFC 2818, the most specific Common Name
--                # must be used.
--                if key == 'commonName':
--                    if _dnsname_match(value, hostname):
--                        return
--                    dnsnames.append(value)
--    if len(dnsnames) > 1:
--        raise CertificateError("hostname %r "
--            "doesn't match either of %s"
--            % (hostname, ', '.join(map(repr, dnsnames))))
--    elif len(dnsnames) == 1:
--        raise CertificateError("hostname %r "
--            "doesn't match %r"
--            % (hostname, dnsnames[0]))
--    else:
--        raise CertificateError("no appropriate commonName or "
--            "subjectAltName fields were found")
--- 
-2.19.1
-

python-urllib3.spec

@@ -5,14 +5,14 @@
 
 Name:           python-%{srcname}
 Version:        1.24.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Python HTTP library with thread-safe connection pooling and file post
 
 License:        MIT
 URL:            https://github.com/urllib3/urllib3
 Source0:        %{url}/archive/%{version}/%{srcname}-%{version}.tar.gz
 # Unbundle ssl_match_hostname since we depend on it
-Patch0:         Unbundle-ssl_match_hostname-backport.patch
+Source1:        ssl_match_hostname_py3.py
 BuildArch:      noarch
 
 %description
@@ -96,17 +96,22 @@ rm -f test/test_no_ssl.py
 
 # Unbundle the Python 2 build
 rm -rf %{buildroot}/%{python2_sitelib}/urllib3/packages/six.py*
+rm -rf %{buildroot}/%{python2_sitelib}/urllib3/packages/ssl_match_hostname/
 
 mkdir -p %{buildroot}/%{python2_sitelib}/urllib3/packages/
 ln -s %{python2_sitelib}/six.py %{buildroot}/%{python2_sitelib}/urllib3/packages/six.py
 ln -s %{python2_sitelib}/six.pyc %{buildroot}/%{python2_sitelib}/urllib3/packages/six.pyc
 ln -s %{python2_sitelib}/six.pyo %{buildroot}/%{python2_sitelib}/urllib3/packages/six.pyo
+ln -s %{python2_sitelib}/backports/ssl_match_hostname \
+      %{buildroot}/%{python2_sitelib}/urllib3/packages/ssl_match_hostname
 
 # Unbundle the Python 3 build
 rm -rf %{buildroot}/%{python3_sitelib}/urllib3/packages/six.py*
 rm -rf %{buildroot}/%{python3_sitelib}/urllib3/packages/__pycache__/six*
+rm -rf %{buildroot}/%{python3_sitelib}/urllib3/packages/ssl_match_hostname/
 
 mkdir -p %{buildroot}/%{python3_sitelib}/urllib3/packages/
+cp -a %{SOURCE1} %{buildroot}/%{python3_sitelib}/urllib3/packages/ssl_match_hostname.py
 ln -s %{python3_sitelib}/six.py %{buildroot}/%{python3_sitelib}/urllib3/packages/six.py
 ln -s %{python3_sitelib}/__pycache__/six.cpython-%{python3_version_nodots}.opt-1.pyc \
       %{buildroot}/%{python3_sitelib}/urllib3/packages/__pycache__/
@@ -138,6 +143,9 @@ popd
 
 
 %changelog
+* Tue Nov 13 2018 Jeremy Cline <jeremy@jcline.org> - 1.24.1-2
+- Adjust unbundling of ssl_match_hostname
+
 * Mon Oct 29 2018 Jeremy Cline <jeremy@jcline.org> - 1.24.1-1
 - Update to v1.24.1