It's looking like I have my idea of .host versus ._tunnel_host swapped. I think things are still buggy, but my interpretation of the bug is wrong or misleading.I gather that after _set_tunnel(), .host is the proxy host and that ._tunnel_host is the original target host.I'll follow up here in a bit when I've better characterised the problem.I think I'm letting urllib2's complicated state stuff confuse me too...