Using nfqueue on Linux as a novel, webserver-agnostic HTTP authenticator

This may not be relevant, but I am bringing it up just-in-case. Many years ago, I ran into the issue of Python's requests library not being able to give me actual information about the connection - which caused a lot of blockages/issues in troubleshooting. I eventually realized the cause of our problems were domains that had multiple DNS records, and we had no way to determine what IP address we connected to (our issue) OR what their SSL Certificate was (another group's issue that was essentially the same as ours, and we eventually needed).

The underlying reason for this, was the manner in which requests utilizes urllib3, and that urllib3 closes the socket connection without logging any info or offering hooks to capture data. Suggested "workarounds" all involved a second connection, which is not guaranteed to be similar to the first. We eventually found a workaround technique for persisting IP data, but could not persist the SSL Certificate data without a fork or monkeypatch. urllib3 and requests are open to a new debug object, but no one involved had enough time to fully spec this out and get enough consensus to generate a PR that would be accepted.

Anyways, my suggestion is to check the fnfqueue source to see if they are closing something or just not persisting some variable or connection. There might also be an opportunity for a new hook.

6 Likes