[issue23239] SSL match_hostname does not accept IP Address

Christian Heimes added the comment: Python 2 is out of support. Python 3 can verify IP addresses in certificates correctly. -- resolution: -> out of date stage: needs patch -> resolved status: open -> closed ___ Python tracker

[issue23239] SSL match_hostname does not accept IP Address

Christian Heimes added the comment: #32819 and #32185 have solved the last outstanding bugs with IP address validation and handling. I'm fine with a backport of the feature to 2.7 now. -- assignee: christian.heimes -> versions: -Python 3.5, Python 3.6, Python 3.7

[issue23239] SSL match_hostname does not accept IP Address

Alex Gaynor added the comment: I'd be in favor of backporting this to the 2.x - encouraging reliance on the nonsense behaviour of putting IPAddresses in DNS Names or relying on CN over SAN is bad, and we shouldn't encourage it. -- nosy: +Alex Gaynor

[issue23239] SSL match_hostname does not accept IP Address

j-harbott added the comment: The original issue still exists in py27, is there a chance to get the fix backported? See https://github.com/pyca/cryptography/issues/3943 and https://github.com/shazow/urllib3/issues/1269 for sample issues that arise because we need to work

[issue23239] SSL match_hostname does not accept IP Address

Changes by Christian Heimes : -- components: +SSL ___ Python tracker ___ ___

[issue23239] SSL match_hostname does not accept IP Address

Changes by Christian Heimes : -- assignee: -> christian.heimes priority: normal -> high versions: +Python 3.7 ___ Python tracker ___

[issue23239] SSL match_hostname does not accept IP Address

Changes by R. David Murray : -- stage: commit review -> needs patch ___ Python tracker ___

[issue23239] SSL match_hostname does not accept IP Address

Christian Heimes added the comment: I'm -1 on the patch for a practical reason: The current API is broken and I don't want to have it documented as officially supported. In fact it is not only broken but also incompatible with more modern releases of OpenSSL. Recently OpenSSL got proper

[issue23239] SSL match_hostname does not accept IP Address

Marc Abramowitz added the comment: `ip_certs_comment.patch` is a simple patch that just removes the verbiage about not supporting IP addresses in hostnames, as that restriction was removed by an earlier commit from Antoine. -- ___ Python tracker

[issue23239] SSL match_hostname does not accept IP Address

Marc Abramowitz added the comment: Patch to update the comment to remove "IP addresses are not accepted for *hostname*", because supported for IP addresses was added earlier by @pitrou in https://hg.python.org/cpython/rev/b15a5f239e8a -- nosy: +Marc.Abramowitz Added file:

[issue23239] SSL match_hostname does not accept IP Address

Antoine Pitrou added the comment: ping Sorry. I do not have time currently to tackle this issue. Feel free to submit and/or commit improvements if you feel like it. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23239

[issue23239] SSL match_hostname does not accept IP Address

Christian Heimes added the comment: ping -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23239 ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue23239] SSL match_hostname does not accept IP Address

Christian Heimes added the comment: The patch has a couple of issues 1) match_hostname()'s doc string needs to be updated. It still contains but IP addresses are not accepted for *hostname* 2) The stdlib uses server_hostname for SNI and matching. An IP address in the SNI TLS extension

[issue23239] SSL match_hostname does not accept IP Address

Changes by Antoine Pitrou pit...@free.fr: -- resolution: - fixed stage: patch review - resolved status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23239 ___

[issue23239] SSL match_hostname does not accept IP Address

Roundup Robot added the comment: New changeset b15a5f239e8a by Antoine Pitrou in branch 'default': Issue #23239: ssl.match_hostname() now supports matching of IP addresses. https://hg.python.org/cpython/rev/b15a5f239e8a -- nosy: +python-dev ___

[issue23239] SSL match_hostname does not accept IP Address

Changes by Antoine Pitrou pit...@free.fr: -- keywords: +patch Added file: http://bugs.python.org/file37746/ip_certs.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23239 ___

[issue23239] SSL match_hostname does not accept IP Address

Antoine Pitrou added the comment: Here is a patch. -- stage: needs patch - patch review ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23239 ___

[issue23239] SSL match_hostname does not accept IP Address

Antoine Pitrou added the comment: This is a feature request. Not supporting IP addresses is a documented limitation of the current implementation. -- nosy: +christian.heimes, dstufft ___ Python tracker rep...@bugs.python.org

[issue23239] SSL match_hostname does not accept IP Address

Changes by Antoine Pitrou pit...@free.fr: -- stage: - needs patch type: security - enhancement versions: -Python 2.7, Python 3.4 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23239 ___

[issue23239] SSL match_hostname does not accept IP Address

Changes by STINNER Victor victor.stin...@gmail.com: -- nosy: +alex, pitrou versions: +Python 3.4, Python 3.5 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23239 ___

[issue23239] SSL match_hostname does not accept IP Address

New submission from Ádám Zsigmond: ssl.match_hostname does not accept the ca certificate if the hostname matches the ip address. I am trying to connect to a servert with a cacert by IP address but I get an error message like: '42.42.42.42' hostname does not match 'hostname_in_cacert' The IP

[issue23239] SSL match_hostname does not accept IP Address

Changes by R. David Murray rdmur...@bitdance.com: -- nosy: +r.david.murray ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23239 ___ ___