Fix backported ssl_match_hostname for http://bugs.python.org/issue17980

1 files changed, 8 insertions, 1 deletions

diff --git a/setuptools/ssl_support.py b/setuptools/ssl_support.py
index 2aec655a..f8a780a9 100644
--- a/setuptools/ssl_support.py
+++ b/setuptools/ssl_support.py
@@ -88,9 +88,16 @@ except ImportError:
     class CertificateError(ValueError):
         pass
 
-    def _dnsname_to_pat(dn):
+    def _dnsname_to_pat(dn, max_wildcards=1):
         pats = []
         for frag in dn.split(r'.'):
+            if frag.count('*') > max_wildcards:
+                # Issue #17980: avoid denials of service by refusing more
+                # than one wildcard per fragment.  A survery of established
+                # policy among SSL implementations showed it to be a
+                # reasonable choice.
+                raise CertificateError(
+                    "too many wildcards in certificate DNS name: " + repr(dn))
             if frag == '*':
                 # When '*' is a fragment by itself, it matches a non-empty dotless
                 # fragment.