{"action":"created","issue":{"url":"https://api.github.com/repos/shazow/urllib3/issues/981","repository_url":"https://api.github.com/repos/shazow/urllib3","labels_url":"https://api.github.com/repos/shazow/urllib3/issues/981/labels{/name}","comments_url":"https://api.github.com/repos/shazow/urllib3/issues/981/comments","events_url":"https://api.github.com/repos/shazow/urllib3/issues/981/events","html_url":"https://github.com/shazow/urllib3/issues/981","id":178193327,"number":981,"title":"InvalidCodepoint exception with wildcard certificate name ? [Wildcard/CN=*.]","user":{"login":"spazm","id":92896,"avatar_url":"https://avatars.githubusercontent.com/u/92896?v=3","gravatar_id":"","url":"https://api.github.com/users/spazm","html_url":"https://github.com/spazm","followers_url":"https://api.github.com/users/spazm/followers","following_url":"https://api.github.com/users/spazm/following{/other_user}","gists_url":"https://api.github.com/users/spazm/gists{/gist_id}","starred_url":"https://api.github.com/users/spazm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spazm/subscriptions","organizations_url":"https://api.github.com/users/spazm/orgs","repos_url":"https://api.github.com/users/spazm/repos","events_url":"https://api.github.com/users/spazm/events{/privacy}","received_events_url":"https://api.github.com/users/spazm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-20T22:08:14Z","updated_at":"2016-09-20T22:13:36Z","closed_at":null,"body":"# Error\r\n\r\n```\r\nelasticsearch.exceptions.ConnectionError: ConnectionError(Codepoint U+002A at position 1 of u'*' not allowed) caused by: InvalidCodepoint(Codepoint U+002A at position 1 of u'*' not allowed)\r\n```\r\n\r\n# Overview\r\n\r\nI'm seeing an `InvalidCodepoint` exception connecting to my elasticsearch server via ssl after upgrading to urllib3==1.17.  This worked correctly with urllib3=1.16.  \r\n\r\nWhat can I do to help debug this issue?  Can I turn up logging? ~~Is this a problem with how elasticsearch is calling urllib3?~~  I've simplified with a direct urllib3 example.\r\n\r\n## Lemma 1.\r\n\r\nIn 1.17 urllib3 switched to using idna.\r\n\r\n## Lemma 2\r\n\r\nThe host has a wildcard certificate valid for `*.prod.example.com` \r\n\r\n## Hypothesis\r\n\r\nI assume the wildcard certificate is somehow related to the `u'*'` in the invalid code point error provided from idna.\r\n\r\n# Reproduction Steps\r\n\r\n## Failing elasticsearch script\r\n\r\nurllib3_test.py:\r\n```\r\n#!/usr/bin/env python\r\n\r\nimport certifi\r\nfrom elasticsearch import Elasticsearch\r\nimport urllib3.contrib.pyopenssl\r\n\r\nurllib3.contrib.pyopenssl.inject_into_urllib3()\r\n\r\nhost = u\"rdb-test-andrew-01.prod.example.com\"\r\nes_client=Elasticsearch(host,\r\n                        use_ssl=True,\r\n                        verify_certs=True,\r\n                        ca_certs=certifi.where())\r\nes_client.info()\r\n```\r\n\r\n## Recreate environment\r\n\r\n```\r\nvirtualenv env-test && . env-test/bin/activate\r\npip install elasticsearch==2.4.0 urllib3==1.17 certifi==2016.8.31 \r\npip install urllib3[secure]\r\n\r\n$ ./urllib3_test.py\r\nTraceback (most recent call last):\r\n  File \"./urllib3_test.py\", line 14, in <module>\r\n    es_client.info()\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/elasticsearch/client/utils.py\", line 69, in _wrapped\r\n    return func(*args, params=params, **kwargs)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/elasticsearch/client/__init__.py\", line 220, in info\r\n    return self.transport.perform_request('GET', '/', params=params)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/elasticsearch/transport.py\", line 327, in perform_request\r\n    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/elasticsearch/connection/http_urllib3.py\", line 105, in perform_request\r\n    raise ConnectionError('N/A', str(e), e)\r\nelasticsearch.exceptions.ConnectionError: ConnectionError(Codepoint U+002A at position 1 of u'*' not allowed) caused by: InvalidCodepoint(Codepoint U+002A at position 1 of u'*' not allowed)\r\n```\r\n\r\n## Installed versions:\r\n\r\npip freeze\r\n\r\n```\r\nargparse==1.2.1\r\ncertifi==2016.08.31\r\ncffi==1.8.3\r\ncryptography==1.5\r\ndistribute==0.6.24\r\nelasticsearch==2.4.0\r\nenum34==1.1.6\r\nidna==2.1\r\nipaddress==1.0.17\r\npyOpenSSL==16.1.0\r\npyasn1==0.1.9\r\npycparser==2.14\r\nsix==1.10.0\r\nurllib3==1.17\r\nwsgiref==0.1.2\r\n```\r\n\r\n# Working example in urllib3==1.16\r\n\r\n```\r\n% pip install urllib3==1.16\r\n% pip install pyopenssl ndg-httpsclient pyasn1\r\n\r\n% ./urllib3_test.py\r\n# success! no error\r\n\r\n% pip freeze\r\nargparse==1.2.1\r\ncertifi==2016.08.31\r\ncffi==1.8.3\r\ncryptography==1.5\r\ndistribute==0.6.24\r\nelasticsearch==2.4.0\r\nenum34==1.1.6\r\nidna==2.1\r\nipaddress==1.0.17\r\nndg-httpsclient==0.4.2\r\npyOpenSSL==16.1.0\r\npyasn1==0.1.9\r\npycparser==2.14\r\nsix==1.10.0\r\nurllib3==1.16\r\nwsgiref==0.1.2\r\n```\r\n\r\n# Simplified test\r\n\r\n```\r\n#!/usr/bin/env python\r\n\r\nimport certifi\r\nimport urllib3\r\nimport urllib3.contrib.pyopenssl\r\n\r\nurllib3.contrib.pyopenssl.inject_into_urllib3()\r\n\r\nurl = u\"https://rdb-test-andrew-01.prod.example.com:9200\"\r\nconnection_pool = urllib3.PoolManager(\r\n        cert_reqs='CERT_REQUIRED',\r\n        ca_certs=certifi.where())\r\nresp = connection_pool.request('GET', url)\r\nprint resp.data\r\n```\r\n\r\n```\r\n  File \"./urllib3_test_direct.py\", line 13, in <module>\r\n    resp = connection_pool.request('GET', url)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/request.py\", line 66, in request\r\n    **urlopen_kw)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/request.py\", line 87, in request_encode_url\r\n    return self.urlopen(method, url, **extra_kw)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/poolmanager.py\", line 244, in urlopen\r\n    response = conn.urlopen(method, u.request_uri, **kw)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/connectionpool.py\", line 594, in urlopen\r\n    chunked=chunked)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/connectionpool.py\", line 350, in _make_request\r\n    self._validate_conn(conn)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/connectionpool.py\", line 833, in _validate_conn\r\n    conn.connect()\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/connection.py\", line 324, in connect\r\n    cert = self.sock.getpeercert()\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py\", line 312, in getpeercert\r\n    'subjectAltName': get_subj_alt_name(x509)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py\", line 185, in get_subj_alt_name\r\n    for name in ext.get_values_for_type(x509.DNSName)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py\", line 141, in _dnsname_to_stdlib\r\n    name = idna.encode(name)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/idna/core.py\", line 355, in encode\r\n    result.append(alabel(label))\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/idna/core.py\", line 276, in alabel\r\n    check_label(label)\r\n  File \"/mnt/my-candidates/env-test/local/lib/python2.7/site-packages/idna/core.py\", line 253, in check_label\r\n    raise InvalidCodepoint('Codepoint {0} at position {1} of {2} not allowed'.format(_unot(cp_value), pos+1, repr(label)))\r\nidna.core.InvalidCodepoint: Codepoint U+002A at position 1 of u'*' not allowed\r\n```\r\n\r\n## Certificate Info\r\n\r\n```\r\n---\r\nCertificate chain\r\n 0 s:/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.prod.ziprecruiter.com\r\n   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA\r\n 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA\r\n   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority\r\n 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority\r\n   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root\r\n```\r\n\r\n```\r\nsubject=/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.prod.example.com\r\nissuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA\r\n```\r\n\r\n# ObNote\r\n\r\nreplaced our real commercial domain name with example.com.  "},"comment":{"url":"https://api.github.com/repos/shazow/urllib3/issues/comments/248451017","html_url":"https://github.com/shazow/urllib3/issues/981#issuecomment-248451017","issue_url":"https://api.github.com/repos/shazow/urllib3/issues/981","id":248451017,"user":{"login":"nateprewitt","id":5271761,"avatar_url":"https://avatars.githubusercontent.com/u/5271761?v=3","gravatar_id":"","url":"https://api.github.com/users/nateprewitt","html_url":"https://github.com/nateprewitt","followers_url":"https://api.github.com/users/nateprewitt/followers","following_url":"https://api.github.com/users/nateprewitt/following{/other_user}","gists_url":"https://api.github.com/users/nateprewitt/gists{/gist_id}","starred_url":"https://api.github.com/users/nateprewitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nateprewitt/subscriptions","organizations_url":"https://api.github.com/users/nateprewitt/orgs","repos_url":"https://api.github.com/users/nateprewitt/repos","events_url":"https://api.github.com/users/nateprewitt/events{/privacy}","received_events_url":"https://api.github.com/users/nateprewitt/received_events","type":"User","site_admin":false},"created_at":"2016-09-20T22:13:35Z","updated_at":"2016-09-20T22:13:35Z","body":"Hey @spazm, I believe this may be related to #979 which has been addressed in master with #980. If you have a moment could you run your codebase with the current master branch and see if this solves the issue?"}}
{"actor":{"display_login":"nateprewitt"}}