intermediate changes

ref:25a63ccc20e5607b77f6958c1b50aca29743afeb

9 files changed, 35 insertions, 32 deletions

diff --git a/contrib/python/urllib3/.dist-info/METADATA b/contrib/python/urllib3/.dist-info/METADATA
index 20ceebfa65..885ce4476a 100644
--- a/contrib/python/urllib3/.dist-info/METADATA
+++ b/contrib/python/urllib3/.dist-info/METADATA
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: urllib3
-Version: 1.26.8
+Version: 1.26.9
 Summary: HTTP library with thread-safe connection pooling, file post, and more.
 Home-page: https://urllib3.readthedocs.io/
 Author: Andrey Petrov
@@ -34,7 +34,9 @@ Requires-Python: >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, <4
 Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Provides-Extra: brotli
-Requires-Dist: brotlipy (>=0.6.0) ; extra == 'brotli'
+Requires-Dist: brotlicffi (>=0.8.0) ; ((os_name != "nt" or python_version >= "3") and platform_python_implementation != "CPython") and extra == 'brotli'
+Requires-Dist: brotli (>=1.0.9) ; ((os_name != "nt" or python_version >= "3") and platform_python_implementation == "CPython") and extra == 'brotli'
+Requires-Dist: brotlipy (>=0.6.0) ; (os_name == "nt" and python_version < "3") and extra == 'brotli'
 Provides-Extra: secure
 Requires-Dist: pyOpenSSL (>=0.14) ; extra == 'secure'
 Requires-Dist: cryptography (>=1.3.4) ; extra == 'secure'
@@ -82,7 +84,7 @@ urllib3 can be installed with `pip <https://pip.pypa.io>`_::
 Alternatively, you can grab the latest source code from `GitHub <https://github.com/urllib3/urllib3>`_::
 
     $ git clone git://github.com/urllib3/urllib3.git
-    $ python setup.py install
+    $ pip install .
 
 
 Documentation
@@ -151,10 +153,21 @@ For Enterprise
 Changes
 =======
 
+1.26.9 (2022-03-16)
+-------------------
+
+* Changed ``urllib3[brotli]`` extra to favor installing Brotli libraries that are still
+  receiving updates like ``brotli`` and ``brotlicffi`` instead of ``brotlipy``.
+  This change does not impact behavior of urllib3, only which dependencies are installed.
+* Fixed a socket leaking when ``HTTPSConnection.connect()`` raises an exception.
+* Fixed ``server_hostname`` being forwarded from ``PoolManager`` to ``HTTPConnectionPool``
+  when requesting an HTTP URL. Should only be forwarded when requesting an HTTPS URL.
+
+
 1.26.8 (2022-01-07)
 -------------------
 
-* Added extra message to``urllib3.exceptions.ProxyError`` when urllib3 detects that
+* Added extra message to ``urllib3.exceptions.ProxyError`` when urllib3 detects that
   a proxy is configured to use HTTPS but the proxy itself appears to only use HTTP.
 * Added a mention of the size of the connection pool when discarding a connection due to the pool being full.
 * Added explicit support for Python 3.11.
diff --git a/contrib/python/urllib3/README.rst b/contrib/python/urllib3/README.rst
index 75b33750b6..9f4cd507fd 100644
--- a/contrib/python/urllib3/README.rst
+++ b/contrib/python/urllib3/README.rst
@@ -52,7 +52,7 @@ urllib3 can be installed with `pip <https://pip.pypa.io>`_::
 Alternatively, you can grab the latest source code from `GitHub <https://github.com/urllib3/urllib3>`_::
 
     $ git clone git://github.com/urllib3/urllib3.git
-    $ python setup.py install
+    $ pip install .
 
 
 Documentation
diff --git a/contrib/python/urllib3/patches/01-arcadia.patch b/contrib/python/urllib3/patches/01-arcadia.patch
index 22d4aaf235..29a3958613 100644
--- a/contrib/python/urllib3/patches/01-arcadia.patch
+++ b/contrib/python/urllib3/patches/01-arcadia.patch
@@ -10,15 +10,3 @@
          self.ca_cert_dir = ca_cert_dir and os.path.expanduser(ca_cert_dir)
          self.ca_cert_data = ca_cert_data
  
---- contrib/python/urllib3/urllib3/response.py	(index)
-+++ contrib/python/urllib3/urllib3/response.py	(working tree)
-@@ -9,7 +9,8 @@ from socket import timeout as SocketTimeout
- 
- try:
-     import brotli
--except ImportError:
-+    brotli.error
-+except (ImportError, Exception):
-     brotli = None
- 
- from ._collections import HTTPHeaderDict
diff --git a/contrib/python/urllib3/urllib3/_version.py b/contrib/python/urllib3/urllib3/_version.py
index fa8979d73e..d905b69755 100644
--- a/contrib/python/urllib3/urllib3/_version.py
+++ b/contrib/python/urllib3/urllib3/_version.py
@@ -1,2 +1,2 @@
 # This file is protected via CODEOWNERS
-__version__ = "1.26.8"
+__version__ = "1.26.9"
diff --git a/contrib/python/urllib3/urllib3/connection.py b/contrib/python/urllib3/urllib3/connection.py
index 625f966749..b98a86f448 100644
--- a/contrib/python/urllib3/urllib3/connection.py
+++ b/contrib/python/urllib3/urllib3/connection.py
@@ -356,17 +356,15 @@ class HTTPSConnection(HTTPConnection):
 
     def connect(self):
         # Add certificate verification
-        conn = self._new_conn()
+        self.sock = conn = self._new_conn()
         hostname = self.host
         tls_in_tls = False
 
         if self._is_using_tunnel():
             if self.tls_in_tls_required:
-                conn = self._connect_tls_proxy(hostname, conn)
+                self.sock = conn = self._connect_tls_proxy(hostname, conn)
                 tls_in_tls = True
 
-            self.sock = conn
-
             # Calls self._set_hostport(), so self.host is
             # self._tunnel_host below.
             self._tunnel()
diff --git a/contrib/python/urllib3/urllib3/poolmanager.py b/contrib/python/urllib3/urllib3/poolmanager.py
index 3a31a285bf..ca4ec34118 100644
--- a/contrib/python/urllib3/urllib3/poolmanager.py
+++ b/contrib/python/urllib3/urllib3/poolmanager.py
@@ -34,6 +34,7 @@ SSL_KEYWORDS = (
     "ca_cert_dir",
     "ssl_context",
     "key_password",
+    "server_hostname",
 )
 
 # All known keyword arguments that could be provided to the pool manager, its
diff --git a/contrib/python/urllib3/urllib3/response.py b/contrib/python/urllib3/urllib3/response.py
index f66f14e2de..fdb50ddb2f 100644
--- a/contrib/python/urllib3/urllib3/response.py
+++ b/contrib/python/urllib3/urllib3/response.py
@@ -8,9 +8,11 @@ from socket import error as SocketError
 from socket import timeout as SocketTimeout
 
 try:
-    import brotli
-    brotli.error
-except (ImportError, Exception):
+    try:
+        import brotlicffi as brotli
+    except ImportError:
+        import brotli
+except ImportError:
     brotli = None
 
 from ._collections import HTTPHeaderDict
diff --git a/contrib/python/urllib3/urllib3/util/request.py b/contrib/python/urllib3/urllib3/util/request.py
index 25103383ec..b574b081e9 100644
--- a/contrib/python/urllib3/urllib3/util/request.py
+++ b/contrib/python/urllib3/urllib3/util/request.py
@@ -14,7 +14,10 @@ SKIPPABLE_HEADERS = frozenset(["accept-encoding", "host", "user-agent"])
 
 ACCEPT_ENCODING = "gzip,deflate"
 try:
-    import brotli as _unused_module_brotli  # noqa: F401
+    try:
+        import brotlicffi as _unused_module_brotli  # noqa: F401
+    except ImportError:
+        import brotli as _unused_module_brotli  # noqa: F401
 except ImportError:
     pass
 else:
diff --git a/contrib/python/urllib3/urllib3/util/ssl_match_hostname.py b/contrib/python/urllib3/urllib3/util/ssl_match_hostname.py
index a4b4a569cb..1dd950c489 100644
--- a/contrib/python/urllib3/urllib3/util/ssl_match_hostname.py
+++ b/contrib/python/urllib3/urllib3/util/ssl_match_hostname.py
@@ -112,11 +112,9 @@ def match_hostname(cert, hostname):
     try:
         # Divergence from upstream: ipaddress can't handle byte str
         host_ip = ipaddress.ip_address(_to_unicode(hostname))
-    except ValueError:
-        # Not an IP address (common case)
-        host_ip = None
-    except UnicodeError:
-        # Divergence from upstream: Have to deal with ipaddress not taking
+    except (UnicodeError, ValueError):
+        # ValueError: Not an IP address (common case)
+        # UnicodeError: Divergence from upstream: Have to deal with ipaddress not taking
         # byte strings.  addresses should be all ascii, so we consider it not
         # an ipaddress in this case
         host_ip = None
@@ -124,7 +122,7 @@ def match_hostname(cert, hostname):
         # Divergence from upstream: Make ipaddress library optional
         if ipaddress is None:
             host_ip = None
-        else:
+        else:  # Defensive
             raise
     dnsnames = []
     san = cert.get("subjectAltName", ())