Bug 1329395 - urllib3 PoolManager does not pool connections based on SSL configuration
Summary: urllib3 PoolManager does not pool connections based on SSL configuration
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: python-urllib3
Version: 7.3
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Iryna Shcherbina
QA Contact: Lukáš Zachar
: 1394919 (view as bug list)
Depends On:
Blocks: Red Hat1356060 Engineering1380359 Engineering1393868
TreeView+ depends on / blocked
Reported: 2016-04-21 19:51 UTC by Jeremy Cline
Modified: 2017-08-01 16:18 UTC (History)
14 users (show)

Fixed In Version: python-urllib3-1.10.2-3.el7
Doc Type: No Doc Update
Doc Text:
Clone Of:
Last Closed: 2017-08-01 16:18:18 UTC
Target Upstream Version:

Attachments (Terms of Use)
Proposed patch (18.35 KB, patch)
2016-04-21 19:51 UTC, Jeremy Cline
no flags Details | Diff
test_urllib3.py (3.89 KB, text/plain)
2017-01-18 17:01 UTC, Iryna Shcherbina
no flags Details

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:1884 0 normal SHIPPED_LIVE python-urllib3 bug fix update 2017-08-01 17:53:59 UTC

Description Jeremy Cline 2016-04-21 19:51:31 UTC
Created attachment 1149549 [details]
Proposed patch

Description of problem:
Note this also affects RHEL 6 and I've filed the same bug against it: https://bugzilla.redhat.com/show_bug.cgi?id=1329382

If a user of urllib3 modifies the ``connection_pool_kw`` dictionary on the ``urllib3.poolmanager.PoolManager`` class to change the SSL configuration (client certificate and key, CA certificate bundle, SSL version, and whether or not the server's certificate must be valid), the ``PoolManager`` instance will not consider these new configurations when providing a pooled connection for a request.

This results in existing connections that are not configured as the user expects to be used rather than new connections being created. This causes issues like https://github.com/kennethreitz/requests/issues/2863. 

Version-Release number of selected component (if applicable):
All versions equal to or below urllib3 version 1.15.z

How reproducible:
Easily and reliably reproducible.

Steps to Reproduce:
1. See attached Python script - this script attempts to reconfigure the CA bundle used by urllib3. It deletes the old CA file so that if the PoolManager uses the old one, it gets a "No such file or directory error". Doing `python test_urllib3.py` on a version of urllib3 affected by this bug will produce a traceback. 

Actual results:
Old SSL configurations are used.

Expected results:
New SSL configurations are used.

Additional info:
The patch for this bug has been accepted upstream, but is not yet in a released version: https://github.com/shazow/urllib3/pull/830

This is an issue Satellite 6 suffers from.

Comment 5 Charalampos Stratakis 2016-11-15 10:06:59 UTC
*** Bug 1394919 has been marked as a duplicate of this bug. ***

Comment 7 Iryna Shcherbina 2017-01-18 17:01:40 UTC
Created attachment 1242221 [details]

The script mentioned in Steps to Reproduce.

Obtained from the RHEL 6 bug.

Comment 11 errata-xmlrpc 2017-08-01 16:18:18 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.