X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/46a6199f3a40a24ee145adc390500190b17a6395..f5ab6191a96ce31defe0269b9bc739c6492c1a90:/sdk/python/arvados/api.py

diff --git a/sdk/python/arvados/api.py b/sdk/python/arvados/api.py
index 8294df33f5..5ec5ac2e8a 100644
--- a/sdk/python/arvados/api.py
+++ b/sdk/python/arvados/api.py
@@ -4,6 +4,7 @@ import json
 import logging
 import os
 import re
+import socket
 import types
 
 import apiclient
@@ -60,6 +61,16 @@ def _intercept_http_request(self, uri, **kwargs):
         # previous call did not succeed, so this is slightly
         # risky.
         return self.orig_http_request(uri, **kwargs)
+    except socket.error:
+        # This is the one case where httplib2 doesn't close the
+        # underlying connection first.  Close all open connections,
+        # expecting this object only has the one connection to the API
+        # server.  This is safe because httplib2 reopens connections when
+        # needed.
+        _logger.debug("Retrying API request after socket error", exc_info=True)
+        for conn in self.connections.itervalues():
+            conn.close()
+        return self.orig_http_request(uri, **kwargs)
 
 def _patch_http_request(http, api_token):
     http.arvados_api_token = api_token
@@ -158,11 +169,7 @@ def api(version=None, cache=True, host=None, token=None, insecure=False, **kwarg
             'https://%s/discovery/v1/apis/{api}/{apiVersion}/rest' % (host,))
 
     if 'http' not in kwargs:
-        http_kwargs = {}
-        # Prefer system's CA certificates (if available) over httplib2's.
-        certs_path = '/etc/ssl/certs/ca-certificates.crt'
-        if os.path.exists(certs_path):
-            http_kwargs['ca_certs'] = certs_path
+        http_kwargs = {'ca_certs': util.ca_certs_path()}
         if cache:
             http_kwargs['cache'] = http_cache('discovery')
         if insecure: