Merge lp:~matsubara/ubuntu/trusty/python-urllib3/bug-1412545 into lp:ubuntu/trusty/python-urllib3

[Diogo Matsubara]

This is an attempt to backport the fix for bug LP #1412545.
The issue in the trusty version is that when users are behind a proxy and the
connection is dropped, the library stops using the proxy. The fix has been
committed on 1c30a1f3 python-urllib3 upstream code and released on 1.8.3.

[Robie Basak (racb)]

Assuming the patch works, the packaging changes look good.

A few minor corrections:

Please use 1.7.1-1ubuntu0.1 as the version number from an SRU (taken from https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging, which is recommended from https://wiki.ubuntu.com/StableReleaseUpdates#Procedure).

Please can you add dep3 headers to the quilt patch? Described at http://dep.debian.net/deps/dep3/, these make it easier for other developers to track where the patch came from and what its current status is. I'm sorry if I failed to mention this in our Hangout.

Finally, please can you check step 3 in https://wiki.ubuntu.com/StableReleaseUpdates#Procedure? The SRU team will need this to process the upload, so we don't upload until all steps before step 5 are complete. As you backported the patch you're probably the best person to assess the potential for regressions and pass this information on the SRU team.

Thanks!

review: Needs Fixing

[lp:~matsubara/ubuntu/trusty/python-urllib3/bug-1412545]

13. By Diogo Matsubara on 2015-01-27

review comments: fix package versioning, add dep3 headers to patch

[Diogo Matsubara (matsubara)]

Hi Robie,

thanks for the review!

> Assuming the patch works, the packaging changes look good.
>
> A few minor corrections:
>
> Please use 1.7.1-1ubuntu0.1 as the version number from an SRU (taken from
> https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging,
> which is recommended from
> https://wiki.ubuntu.com/StableReleaseUpdates#Procedure).

Done.

>
> Please can you add dep3 headers to the quilt patch? Described at
> http://dep.debian.net/deps/dep3/, these make it easier for other developers to
> track where the patch came from and what its current status is. I'm sorry if I
> failed to mention this in our Hangout.

You did mention, I forgot to update it but have done so now.

>
> Finally, please can you check step 3 in
> https://wiki.ubuntu.com/StableReleaseUpdates#Procedure? The SRU team will need
> this to process the upload, so we don't upload until all steps before step 5
> are complete. As you backported the patch you're probably the best person to
> assess the potential for regressions and pass this information on the SRU
> team.

Done.

[lp:~matsubara/ubuntu/trusty/python-urllib3/bug-1412545]

14. By Diogo Matsubara on 2015-01-28

review comments: fix dep3 headers

=== modified file 'debian/changelog'
--- debian/changelog	2014-02-23 13:53:23 +0000
+++ debian/changelog	2015-01-28 15:47:21 +0000
@@ -1,3 +1,11 @@
+python-urllib3 (1.7.1-1ubuntu0.1) UNRELEASED; urgency=medium
+
+  * debian/patches/05_backport_proxy_fix.patch: Backport upstream fix 1c30a1f3
+    from 1.8.3 release. Fixes the issue when a dropped connection makes
+    further connections ignore the proxy. (LP: #1412545)
+
+ -- Diogo Matsubara <[e-mail]>  Mon, 26 Jan 2015 12:02:13 -0200
+
 python-urllib3 (1.7.1-1build1) trusty; urgency=medium
 
   * Rebuild to drop files installed into /usr/share/pyshared.
 
=== added file 'debian/patches/05_backport_proxy_fix.patch'
--- debian/patches/05_backport_proxy_fix.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/05_backport_proxy_fix.patch	2015-01-28 15:47:21 +0000
@@ -0,0 +1,66 @@
+Description: Backport upstream fix to deal with dropped connections that
+ ignore proxy settings.
+Origin: backport, https://github.com/shazow/urllib3/commit/1c30a1f3a4af9591f480a338f75221bdf5ca48da
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/python-urllib3/+bug/1412545
+
+Index: trusty/urllib3/connectionpool.py
+===================================================================
+--- trusty.orig/urllib3/connectionpool.py	2015-01-26 11:59:47.871036000 -0200
++++ trusty/urllib3/connectionpool.py	2015-01-26 12:01:56.137278695 -0200
+@@ -122,6 +122,7 @@
+             # Calls self._set_hostport(), so self.host is
+             # self._tunnel_host below.
+             self._tunnel()
++            self.auto_open = 0
+ 
+         # Wrap socket using verification with the root certs in
+         # trusted_root_certs
+@@ -260,10 +261,18 @@
+         if not six.PY3:  # Python 2
+             extra_params['strict'] = self.strict
+ 
+-        return HTTPConnection(host=self.host, port=self.port,
++        conn = HTTPConnection(host=self.host, port=self.port,
+                               timeout=self.timeout.connect_timeout,
+                               **extra_params)
+ 
++        # Backport fix LP #1412545
++        if getattr(conn, '_tunnel_host', None):
++            # TODO: Fix tunnel so it doesn't depend on self.sock state.
++            conn._tunnel()
++            # Mark this connection as not reusable
++            conn.auto_open = 0
++
++        return conn
+ 
+     def _get_conn(self, timeout=None):
+         """
+@@ -295,6 +304,12 @@
+         if conn and is_connection_dropped(conn):
+             log.info("Resetting dropped connection: %s" % self.host)
+             conn.close()
++            if getattr(conn, 'auto_open', 1) == 0:
++                # This is a proxied connection that has been mutated by
++                # httplib._tunnel() and cannot be reused (since it would
++                # attempt to bypass the proxy)
++                conn = None
++
+ 
+         return conn or self._new_conn()
+ 
+Index: trusty/urllib3/util.py
+===================================================================
+--- trusty.orig/urllib3/util.py	2015-01-26 11:59:47.871036000 -0200
++++ trusty/urllib3/util.py	2015-01-26 12:01:56.141278695 -0200
+@@ -479,8 +479,10 @@
+     let the platform handle connection recycling transparently for us.
+     """
+     sock = getattr(conn, 'sock', False)
+-    if not sock: # Platform-specific: AppEngine
++    if sock is False: # Platform-specific: AppEngine
+         return False
++    if sock is None:  # Connection already closed (such as by httplib).
++        return True
+ 
+     if not poll:
+         if not select: # Platform-specific: AppEngine
 
=== modified file 'debian/patches/series'
--- debian/patches/series	2013-10-17 13:28:10 +0000
+++ debian/patches/series	2015-01-28 15:47:21 +0000
@@ -2,3 +2,4 @@
 02_require-cert-verification.patch
 03_no-setuptools.patch
 04_relax_nosetests_options.patch
+05_backport_proxy_fix.patch