Repository: urllib3/urllib3

Issue:
keylog_filename triggering error when SSLKEYLOGFILE is not set
### Subject

Requests are failing with the error:

```
urllib3.exceptions.ProtocolError: ('Connection aborted.', FileNotFoundError(2, 'No such file or directory'))
```

The line that raises this exception is the following (at the bottom of the stacktrace):

```
File "/Users/basta/.local/share/virtualenvs/venv-OmZ6DiXY/lib/python3.8/site-packages/urllib3/util/ssl_.py", line 302, in create_urllib3_context
    context.keylog_filename = os.environ.get("SSLKEYLOGFILE")
```

Editing this file to print `os.environ.get("SSLKEYLOGFILE")` shows that this is empty.

This issue started happening after upgrading from Python 3.7 to 3.8.

### Environment

This issue is happening for me on macOS Catalina 10.15.2.

```python
import platform
import urllib3

print("OS", platform.platform())
print("Python", platform.python_version())
print("urllib3", urllib3.__version__)
```

returns

```
>>> import platform
>>> import urllib3
>>>
>>> print("OS", platform.platform())
OS macOS-10.15.2-x86_64-i386-64bit
>>> print("Python", platform.python_version())
Python 3.8.5
>>> print("urllib3", urllib3.__version__)
urllib3 1.25.10
```

### Steps to Reproduce

This issue is always reproducible when making any requests using the `stripe-python` library. I don't have access to other machines to try to reproduce it elsewhere. However, it does not occur in my production environment (Linux) on the same Python version (3.8).

### Expected Behavior

I would expect this line to no-op rather than raising. Replacing `if hasattr(context, "keylog_filename"):` with `if hasattr(context, "keylog_filename") and os.environ.get("SSLKEYLOGFILE"):` in `ssl_.py` eliminates the issue.

### Actual Behavior

The noted exception is raised.



Discussion:
Thanks for opening this, this looks like a bug. We'll get a fix in and make a 1.25.11 release.

Would you be willing to provide a patch and test case? If not no problem. 
@sethmlarson I'm happy to put up my little patch as a PR. I'm not so sure how to test it, though, since the problem only seems to occur on my one machine running macOS (and I can't possibly be the only person using Stripe's SDK on python 3.8!).

If the fix alone is enough, I can have that up soon. You're welcome to use it as a guide or take it over or whatever. 

Resolving patch:
diff --git a/src/urllib3/util/ssl_.py b/src/urllib3/util/ssl_.py
--- a/src/urllib3/util/ssl_.py
+++ b/src/urllib3/util/ssl_.py
@@ -314,9 +314,11 @@ def create_urllib3_context(
         context.check_hostname = False
 
     # Enable logging of TLS session keys via defacto standard environment variable
-    # 'SSLKEYLOGFILE', if the feature is available (Python 3.8+).
+    # 'SSLKEYLOGFILE', if the feature is available (Python 3.8+). Skip empty values.
     if hasattr(context, "keylog_filename"):
-        context.keylog_filename = os.environ.get("SSLKEYLOGFILE")
+        sslkeylogfile = os.environ.get("SSLKEYLOGFILE")
+        if sslkeylogfile:
+            context.keylog_filename = sslkeylogfile
 
     return context
 


Test patch:
diff --git a/test/with_dummyserver/test_https.py b/test/with_dummyserver/test_https.py
--- a/test/with_dummyserver/test_https.py
+++ b/test/with_dummyserver/test_https.py
@@ -719,6 +719,18 @@ def test_sslkeylogfile(self, tmpdir, monkeypatch):
                 keylog_file
             )
 
+    @pytest.mark.parametrize("sslkeylogfile", [None, ""])
+    def test_sslkeylogfile_empty(self, monkeypatch, sslkeylogfile):
+        # Assert that an HTTPS connection doesn't error out when given
+        # no SSLKEYLOGFILE or an empty value (ie 'SSLKEYLOGFILE=')
+        if sslkeylogfile is not None:
+            monkeypatch.setenv("SSLKEYLOGFILE", sslkeylogfile)
+        else:
+            monkeypatch.delenv("SSLKEYLOGFILE", raising=False)
+        with HTTPSConnectionPool(self.host, self.port, ca_certs=DEFAULT_CA) as pool:
+            r = pool.request("GET", "/")
+            assert r.status == 200, r.data
+
     def test_alpn_default(self):
         """Default ALPN protocols are sent by default."""
         if not has_alpn() or not has_alpn(ssl.SSLContext):