Bug 1303156

Summary:	pki.client.PKIConnection should ignore env vars such as http_proxy
Product:	Red Hat Enterprise Linux 7	Reporter:	Matthew Harmsen <mharmsen>
Component:	pki-core	Assignee:	Christian Heimes <cheimes>
Status:	CLOSED ERRATA	QA Contact:	Asha Akkiangady <aakkiang>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.3	CC:	arubin, ssidhaye
Target Milestone:	rc
Target Release:	7.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	pki-core-10.3.1-1.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-04 05:22:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Matthew Harmsen 2016-01-29 17:33:13 UTC

PKIConnection uses python-requests to handle HTTP connections to the server. requests inspects env vars such as http_proxy and https_proxy for HTTP proxy server location, REQUESTS_CA_BUNDLE and CURL_CA_BUNDLE to override the trust store location as well as ~/.netrc for authentication. This can cause hard to debug issues such as installation failures. See https://fedorahosted.org/freeipa/ticket/5555 for background.

The feature can be disabled easily: https://requests.readthedocs.org/en/latest/api/?highlight=trust_env#requests.Session.trust_env

I propose to have it disabled by default. It's a one line fix (two with comment, three if we want a flag in PKIConnection.__init__()).

Comment 1 Matthew Harmsen 2016-01-29 17:34:21 UTC

This issue has been fixed in PKI TRAC Ticket #1733.

Comment 2 Mike McCune 2016-03-28 22:25:24 UTC

This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions

Comment 4 Sumedh Sidhaye 2016-08-10 10:46:21 UTC

Tested it by setting HTTP_PROXY / HTTPS_PROXY variable before running pkispawn.

pkispawn succeeds with no errors. Hence marking it as verified.

Tested with the following build:

pki-base.noarch          10.3.3-5.el7                                     
pki-base-java.noarch     10.3.3-5.el7                                     
pki-ca.noarch            10.3.3-5.el7                                     
pki-console.noarch       10.3.3-1.el7pki                                  
pki-core-debuginfo.x86_6410.3.3-5.el7pki                                  
pki-javadoc.noarch       10.3.3-5.el7                                     
pki-kra.noarch           10.3.3-5.el7                                     
pki-ocsp.noarch          10.3.3-5.el7pki                                  
pki-server.noarch        10.3.3-5.el7                                     
pki-symkey.x86_64        10.3.3-5.el7                                     
pki-tks.noarch           10.3.3-5.el7pki                                  
pki-tools.x86_64         10.3.3-5.el7                                     
pki-tps.x86_64           10.3.3-5.el7pki

Comment 6 errata-xmlrpc 2016-11-04 05:22:45 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2396.html