Bug 1450213

Created attachment 1278018 [details]
Test script to demonstrate bug

Description of problem:

I believe the python-urllib3 rpm that is in the EL7 repo is an old version, and it has a bug with regards to HTTPS connections. The bug is that the python urllib3 library's connectionpool.py module defaults the variable ca_certs, where it looks for the CA certs, to /etc/ssl/certs/ca-certificates.crt, which isn't the default for RHEL-based distributions, I believe. So if I try to connect to, say, https://www.google.com without specifying a cert, it will throw an SSLError. This is not the case with the version of urllib3 in PyPI, where you'll only get a warning, and no error. The difference is that in the latter, the default for ca_certs is None, so not specifying a location will not cause the python code to fail. Given that the error appears in the EL package and not in the PyPI one, I'm assuming the latter is older.

I've put more details on how I reproduced the error below.


Version-Release number of selected component (if applicable):
1.10.2-2

How reproducible:
100%

Steps to Reproduce:
1. yum install python-urllib3
2. Run python script testscript.py, that simply tries to connect to https://www.google.com without specifying a ca cert bundle.

Actual results:
Here is the error I get:

Traceback (most recent call last):
File "testscript.py", line 4, in <module>
r = http.request('GET', 'https://www.google.com')
File "/usr/lib/python2.7/site-packages/urllib3/request.py", line 68, in request
**urlopen_kw)
File "/usr/lib/python2.7/site-packages/urllib3/request.py", line 81, in request_encode_url
return self.urlopen(method, url, **urlopen_kw)
File "/usr/lib/python2.7/site-packages/urllib3/poolmanager.py", line 161, in urlopen
response = conn.urlopen(method, u.request_uri, **kw)
File "/usr/lib/python2.7/site-packages/urllib3/connectionpool.py", line 544, in urlopen
body=body, headers=headers)
File "/usr/lib/python2.7/site-packages/urllib3/connectionpool.py", line 341, in _make_request
self._validate_conn(conn)
File "/usr/lib/python2.7/site-packages/urllib3/connectionpool.py", line 762, in _validate_conn
conn.connect()
File "/usr/lib/python2.7/site-packages/urllib3/connection.py", line 238, in connect
ssl_version=resolved_ssl_version)
File "/usr/lib/python2.7/site-packages/urllib3/util/ssl_.py", line 246, in ssl_wrap_socket
raise SSLError(e)
urllib3.exceptions.SSLError: [Errno 2] No such file or directory 


Expected results:
In the PyPI version I installed with pip, I got the following warning, but no error:

/usr/lib/python2.7/site-packages/urllib3/connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)
200
Success 


Additional info:
I've attached my test script to this bug report.