Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cert verify on subjectAltName->"IP Address" not working when doing IPv6 via a proxy #2240

Closed
derekhiggins opened this issue May 21, 2021 · 0 comments · Fixed by #2241
Closed

Comments

@derekhiggins
Copy link
Contributor

Subject

Verifying a https certificate by the subjectAltName->"IP Address" fails when the accessing a server by IPv6 address through a Proxy

in the case where a proxy is used the Host IP used for comparison is wrapped in square brackets

Environment

[derekh@u07 urllib3]$ python
Python 3.6.8 (default, Aug 24 2020, 17:57:11) 
[GCC 8.3.1 20191121 (Red Hat 8.3.1-5)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import platform
>>> import urllib3
>>> 
>>> print("OS", platform.platform())
OS Linux-4.18.0-240.22.1.el8_3.x86_64-x86_64-with-centos-8.3.2011
>>> print("Python", platform.python_version())
Python 3.6.8
>>> print("urllib3", urllib3.__version__)
urllib3 1.24.2

Also reproduced on the master branch
>>> print("urllib3", urllib3.__version__)
urllib3 2.0.0.dev0

Steps to Reproduce

This works (without a proxy)

> conn = urllib3.connection_from_url('https://[fd00:1101::7d50:2883:3df9:68ce]:9999', ca_certs='ca.crt')
> response = conn.request('GET', '/')
> print(response.data)
HELLO

Accessing the same URL via a proxy doesn't

> proxy = urllib3.ProxyManager('http://[fd00:1101::1]:3128', ca_certs='ca.crt')
> conn = proxy.connection_from_url('https://[fd00:1101::7d50:2883:3df9:68ce]:9999')
> try:
>     response = conn.request('GET', '/', retries=0)
> except Exception as e:
>     print(e)
HTTPSConnectionPool(host='fd00:1101::7d50:2883:3df9:68ce', port=9999): Max retries exceeded with url: / (Caused by SSLError(CertificateError("hostname '[fd00:1101::7d50:2883:3df9:68ce]' doesn't match 'FD00:1101:0:0:7D50:2883:3DF9:68CE\\n'",),))

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant