def match_hostname(cert, hostname):
if not cert:<EOL><INDENT>raise ValueError("<STR_LIT>"<EOL>"<STR_LIT>"<EOL>"<STR_LIT>")<EOL><DEDENT>try:<EOL><INDENT>host_ip = ipaddress.ip_address(_to_unicode(hostname))<EOL><DEDENT>except ValueError:<EOL><INDENT>host_ip = None<EOL><DEDENT>except UnicodeError:<EOL><INDENT>host_ip = None<EOL><DEDENT>except AttributeError:<EOL><INDENT>if ipaddress is None:<EOL><INDENT>host_ip = None<EOL><DEDENT>else:<EOL><INDENT>raise<EOL><DEDENT><DEDENT>dnsnames = []<EOL>san = cert.get('<STR_LIT>', ())<EOL>for key, value in san:<EOL><INDENT>if key == '<STR_LIT>':<EOL><INDENT>if host_ip is None and _dnsname_match(value, hostname):<EOL><INDENT>return<EOL><DEDENT>dnsnames.append(value)<EOL><DEDENT>elif key == '<STR_LIT>':<EOL><INDENT>if host_ip is not None and _ipaddress_match(value, host_ip):<EOL><INDENT>return<EOL><DEDENT>dnsnames.append(value)<EOL><DEDENT><DEDENT>if not dnsnames:<EOL><INDENT>for sub in cert.get('<STR_LIT>', ()):<EOL><INDENT>for key, value in sub:<EOL><INDENT>if key == '<STR_LIT>':<EOL><INDENT>if _dnsname_match(value, hostname):<EOL><INDENT>return<EOL><DEDENT>dnsnames.append(value)<EOL><DEDENT><DEDENT><DEDENT><DEDENT>if len(dnsnames) > <NUM_LIT:1>:<EOL><INDENT>raise CertificateError("<STR_LIT>"<EOL>"<STR_LIT>"<EOL>% (hostname, '<STR_LIT:U+002CU+0020>'.join(map(repr, dnsnames))))<EOL><DEDENT>elif len(dnsnames) == <NUM_LIT:1>:<EOL><INDENT>raise CertificateError("<STR_LIT>"<EOL>"<STR_LIT>"<EOL>% (hostname, dnsnames[<NUM_LIT:0>]))<EOL><DEDENT>else:<EOL><INDENT>raise CertificateError("<STR_LIT>"<EOL>"<STR_LIT>")<EOL><DEDENT>
Verify that *cert* (in decoded format as returned by
    SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
    rules are followed, but IP addresses are not accepted for *hostname*.

    CertificateError is raised on failure. On success, the function
    returns nothing.