ERROR: Ensure that urllib3 can validate SANs with IP addresses in them.

[mrobbetts]

I get this error when trying to build urllib3-1.20

(This is in connection with NixOS/nixpkgs#22616)

======================================================================
ERROR: Ensure that urllib3 can validate SANs with IP addresses in them.
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/tmp/nix-build-python2.7-urllib3-1.20.drv-0/urllib3-1.20/test/with_dummyserver/test_https.py", line 508, in test_can_validate_ip_san
    r = https_pool.request('GET', '/')
  File "/tmp/nix-build-python2.7-urllib3-1.20.drv-0/urllib3-1.20/urllib3/request.py", line 66, in request
    **urlopen_kw)
  File "/tmp/nix-build-python2.7-urllib3-1.20.drv-0/urllib3-1.20/urllib3/request.py", line 87, in request_encode_url
    return self.urlopen(method, url, **extra_kw)
  File "/tmp/nix-build-python2.7-urllib3-1.20.drv-0/urllib3-1.20/urllib3/connectionpool.py", line 630, in urlopen
    raise SSLError(e)
SSLError: hostname '127.0.0.1' doesn't match either of 'localhost', '127.0.0.1'
-------------------- >> begin captured logging << --------------------
urllib3.connectionpool: DEBUG: Starting new HTTPS connection (1): 127.0.0.1
urllib3.connection: ERROR: Certificate did not match expected hostname: 127.0.0.1. Certificate: {'subjectAltName': (('email', 'root@localhost'), ('DNS', 'localhost'), ('IP Address', '127.0.0.1')), 'notBefore': u'Dec 22 07:58:40 2011 GMT', 'serialNumber': u'01', 'notAfter': 'Dec 18 07:58:40 2021 GMT', 'version': 3L, 'subject': ((('countryName', u'FI'),), (('stateOrProvinceName', u'dummy'),), (('localityName', u'dummy'),), (('organizationName', u'dummy'),), (('organizationalUnitName', u'dummy'),), (('commonName', u'localhost'),)), 'issuer': ((('countryName', u'FI'),), (('stateOrProvinceName', u'dummy'),), (('localityName', u'dummy'),), (('organizationName', u'dummy'),), (('organizationalUnitName', u'dummy'),), (('commonName', u'SnakeOil'),), (('emailAddress', u'dummy@test.local'),))}
--------------------- >> end captured logging << ---------------------

Is this user error? I can't really understand the error:
SSLError: hostname '127.0.0.1' doesn't match either of 'localhost', '127.0.0.1' (!)

[Lukasa]

This definitely is not user error: it's a dependency problem. =) urllib3 can only validate IP addresses with SANs in them on platforms where the ipaddress module is present: either in third-party code, or in the standard library.

In the short term I'd suggest that the easiest way to fix this is to make the ipaddress backport module a required dependency of urllib3. This is the most secure way to deploy urllib3 in any case, so it's highly recommended.

More generally, we should probably skip this test on platforms where the ipaddress module has not been installed.

[mrobbetts]

Great, thanks for that. I would likely have never figured that out :)

Adding ipaddress fixes it for me