boring-http 1.1.0__tar.gz → 1.2.0__tar.gz

{boring_http-1.1.0 → boring_http-1.2.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.3
 Name: boring-http
-Version: 1.1.0
+Version: 1.2.0
 Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
-Requires-Dist: boring-ssl2
-Requires-Dist: ssl2
+Requires-Dist: boring-ssl2>=1.2.0
+Requires-Dist: ssl2>=1.2.0
 Requires-Python: >=3.14
 Project-URL: Repository, https://github.com/baobien-dev/boring-http
 Description-Content-Type: text/markdown
@@ -39,7 +39,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 
@@ -96,7 +96,7 @@ A single number sets every phase and the total, so the request gives up after th
 ```python
 import asyncio
 
-from boring_http import QUIC_V2, Client, Http3Profile
+from boring_http import Client, Http3Profile, QuicVersion
 
 
 async def main() -> None:
@@ -105,7 +105,7 @@ async def main() -> None:
         second = await client.get("https://pingly.us.kg/api/all")
         print(first.version, second.version)  # h2 h3, the Alt-Svc header taught the client that this origin speaks HTTP/3
 
-    async with Client(versions=("h3",), http3=Http3Profile(quic_version=QUIC_V2)) as client:
+    async with Client(versions=("h3",), http3=Http3Profile(quic_version=QuicVersion.V2)) as client:
         response = await client.get("https://pingly.us.kg/api/all")
         print(response.version, response.json()["http_version"])  # h3 HTTP/3.0
 
@@ -113,7 +113,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-The default is `versions=("h2", "h1")`. With `"h3"` in the list the client switches an origin to QUIC after an `Alt-Svc: h3` header and falls back to TCP when the QUIC route stops answering; `versions=("h3",)` goes straight to QUIC. Retry packets, version negotiation, loss recovery, pacing, flow control, key updates, QPACK with a 64 KiB dynamic table on the decoding side and 0-RTT are handled; connection migration is not. A second connection to an origin resumes the TLS session and sends GET, HEAD and OPTIONS requests before the handshake has finished, under the limits and SETTINGS the server gave last time; other methods wait for the handshake, a 425 answer is retried after it, and a server that declines the early data gets it again under the 1-RTT keys. The transport parameters are Chrome 155's set, in a fresh random order with a GREASE entry, a GREASE version, Chrome's connection options and, on a resumed connection, the round trip time measured last time; `TransportParameters` on the `Http3Profile` changes any of it. The control stream carries SETTINGS with a GREASE entry, a GREASE frame, and a PRIORITY_UPDATE for every request that has a `priority` header, as Chrome sends them.
+The default is `versions=("h2", "h1")`. With `"h3"` in the list the client switches an origin to QUIC after an `Alt-Svc: h3` header and falls back to TCP when the QUIC route stops answering; `versions=("h3",)` goes straight to QUIC. QUIC v1 is the default; `quic_version=QuicVersion.V2` offers v2 through compatible version negotiation (RFC 9368), so the first packet is still v1 and a server that speaks v2, such as aioquic, ngtcp2, haproxy or haskell quic, switches to it, while every other server simply stays on v1. Retry packets, version negotiation, loss recovery, pacing, flow control, key updates, path MTU probing from 1200 up to 1452 bytes with the don't-fragment flag set, QPACK with a 64 KiB dynamic table on the decoding side and 0-RTT are handled; connection migration is not. A second connection to an origin resumes the TLS session and sends GET, HEAD and OPTIONS requests before the handshake has finished, under the limits and SETTINGS the server gave last time; other methods wait for the handshake, a 425 answer is retried after it, and a server that declines the early data gets it again under the 1-RTT keys. The transport parameters are Chrome 155's set, in a fresh random order with a GREASE entry, a GREASE version, Chrome's connection options and, on a resumed connection, the round trip time measured last time; `TransportParameters` on the `Http3Profile` changes any of it. The control stream carries SETTINGS with a GREASE entry, a GREASE frame, and a PRIORITY_UPDATE for every request that has a `priority` header, as Chrome sends them.
 
 ## Proxies
 
@@ -152,7 +152,7 @@ asyncio.run(main())
 ```python
 import asyncio
 
-from boring_http import CHROME, Client
+from boring_http import CHROME_HTTP2, Client
 from ssl2 import (
     JA4,
     CertificateCompressionAlgorithm,
@@ -227,10 +227,10 @@ profile = (
 
 
 async def main() -> None:
-    async with Client(tls=profile, http2=CHROME) as client:
+    async with Client(tls=profile, http2=CHROME_HTTP2) as client:
         report = (await client.get("https://pingly.us.kg/api/all")).json()
         print(report["tls"]["ja4"] == JA4.of(profile).text, report["tls"]["ja4"])  # True t13d1516h2_8daaf6152771_d8a2da3f94cd
-        print(report["http2"]["akamai_fingerprint"] == CHROME.fingerprint.text, report["http2"]["akamai_fingerprint"])  # True 1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p
+        print(report["http2"]["akamai_fingerprint"] == CHROME_HTTP2.fingerprint.text, report["http2"]["akamai_fingerprint"])  # True 1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p
 
 
 asyncio.run(main())
@@ -312,7 +312,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`tls` is a `ssl2.ClientHello`; BoringSSL sends it byte for byte or the client refuses it with the reason. `http2` is an `Http2Profile` with the SETTINGS, WINDOW_UPDATE, priorities and pseudo-header order; `CHROME` is the default. `http3` is an `Http3Profile` with the HTTP/3 SETTINGS, QUIC transport parameters and QUIC version.
+`tls` is a `ssl2.ClientHello`; BoringSSL sends it byte for byte or the client refuses it with the reason. `http2` is an `Http2Profile` with the SETTINGS, WINDOW_UPDATE, priorities and pseudo-header order; `CHROME_HTTP2` is the default. `http3` is an `Http3Profile` with the HTTP/3 SETTINGS, QUIC transport parameters and QUIC version; `CHROME_HTTP3` is the default.
 
 ## WebSocket
 
@@ -363,17 +363,17 @@ Against a Go server (net/http and quic-go) on loopback, so the server is never t
 
 | scenario    | boring-http | boring-http+uvloop |  wreq | curl_cffi | pycurl | httpx | aiohttp | requests |
 | ----------- | ----------: | -----------------: | ----: | --------: | -----: | ----: | ------: | -------: |
-| h1-seq      |        9079 |              13405 | 17190 |      6116 |  28775 |  2171 |   11796 |     3287 |
-| h2-seq      |        5744 |               5931 | 12384 |      4767 |  15384 |  1808 |       - |        - |
-| h3-seq      |        4021 |               4537 |     - |      4595 |  12410 |     - |       - |        - |
-| h1-conc     |        8956 |              12148 | 53500 |      7324 |  31170 |   934 |   23259 |     2361 |
-| h2-conc     |       14846 |              15584 | 48788 |     10683 |  28764 |  2066 |       - |        - |
-| h3-conc     |        6855 |               6901 |     - |     11079 |  29305 |     - |       - |        - |
-| h1-download |         658 |                645 |   689 |       793 |   1019 |   264 |    1117 |      658 |
-| h2-download |         472 |                497 |   426 |       468 |    479 |   123 |       - |        - |
-| h3-download |         105 |                107 |     - |       517 |    492 |     - |       - |        - |
-| h1-upload   |         633 |                687 |  3687 |      2002 |   2124 |   675 |     749 |     2296 |
-| h2-upload   |         447 |                480 |  2309 |      1375 |   1440 |   197 |       - |        - |
-| h3-upload   |          63 |                 67 |     - |       906 |    411 |     - |       - |        - |
+| h1-seq      |       14713 |              14354 | 20116 |      6042 |  29137 |  2248 |   11831 |     3539 |
+| h2-seq      |        7307 |               7359 | 13404 |      5096 |  16023 |  1880 |       - |        - |
+| h3-seq      |        4679 |               4308 |     - |      4725 |  14041 |     - |       - |        - |
+| h1-conc     |       11594 |              12391 | 61212 |      7443 |  33861 |   939 |   24836 |     2438 |
+| h2-conc     |       19234 |              20085 | 41075 |     11354 |  30053 |  2164 |       - |        - |
+| h3-conc     |       10121 |               9788 |     - |     11447 |  29598 |     - |       - |        - |
+| h1-download |         734 |                772 |   823 |       767 |   1229 |   257 |    1081 |      594 |
+| h2-download |         319 |                303 |   443 |       466 |    484 |   120 |       - |        - |
+| h3-download |         199 |                207 |     - |       542 |    491 |     - |       - |        - |
+| h1-upload   |        2513 |               3093 |  3276 |      2106 |   1998 |   694 |     713 |     2376 |
+| h2-upload   |         786 |                839 |  2206 |      1085 |   1323 |   186 |       - |        - |
+| h3-upload   |         132 |                132 |     - |       819 |    434 |     - |       - |        - |
 
 HTTP/1.1 and HTTP/2 are Python framing over BoringSSL records; HTTP/3 is a QUIC stack written in Python with BoringSSL doing the cryptography, which is where the gap to libcurl's HTTP/3 comes from. The same code holds 1000 open clients per protocol, 20000 requests with 256 in flight, parallel multi-megabyte transfers and 5% datagram loss on the QUIC path.

{boring_http-1.1.0 → boring_http-1.2.0}/README.md

@@ -29,7 +29,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 
@@ -86,7 +86,7 @@ A single number sets every phase and the total, so the request gives up after th
 ```python
 import asyncio
 
-from boring_http import QUIC_V2, Client, Http3Profile
+from boring_http import Client, Http3Profile, QuicVersion
 
 
 async def main() -> None:
@@ -95,7 +95,7 @@ async def main() -> None:
         second = await client.get("https://pingly.us.kg/api/all")
         print(first.version, second.version)  # h2 h3, the Alt-Svc header taught the client that this origin speaks HTTP/3
 
-    async with Client(versions=("h3",), http3=Http3Profile(quic_version=QUIC_V2)) as client:
+    async with Client(versions=("h3",), http3=Http3Profile(quic_version=QuicVersion.V2)) as client:
         response = await client.get("https://pingly.us.kg/api/all")
         print(response.version, response.json()["http_version"])  # h3 HTTP/3.0
 
@@ -103,7 +103,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-The default is `versions=("h2", "h1")`. With `"h3"` in the list the client switches an origin to QUIC after an `Alt-Svc: h3` header and falls back to TCP when the QUIC route stops answering; `versions=("h3",)` goes straight to QUIC. Retry packets, version negotiation, loss recovery, pacing, flow control, key updates, QPACK with a 64 KiB dynamic table on the decoding side and 0-RTT are handled; connection migration is not. A second connection to an origin resumes the TLS session and sends GET, HEAD and OPTIONS requests before the handshake has finished, under the limits and SETTINGS the server gave last time; other methods wait for the handshake, a 425 answer is retried after it, and a server that declines the early data gets it again under the 1-RTT keys. The transport parameters are Chrome 155's set, in a fresh random order with a GREASE entry, a GREASE version, Chrome's connection options and, on a resumed connection, the round trip time measured last time; `TransportParameters` on the `Http3Profile` changes any of it. The control stream carries SETTINGS with a GREASE entry, a GREASE frame, and a PRIORITY_UPDATE for every request that has a `priority` header, as Chrome sends them.
+The default is `versions=("h2", "h1")`. With `"h3"` in the list the client switches an origin to QUIC after an `Alt-Svc: h3` header and falls back to TCP when the QUIC route stops answering; `versions=("h3",)` goes straight to QUIC. QUIC v1 is the default; `quic_version=QuicVersion.V2` offers v2 through compatible version negotiation (RFC 9368), so the first packet is still v1 and a server that speaks v2, such as aioquic, ngtcp2, haproxy or haskell quic, switches to it, while every other server simply stays on v1. Retry packets, version negotiation, loss recovery, pacing, flow control, key updates, path MTU probing from 1200 up to 1452 bytes with the don't-fragment flag set, QPACK with a 64 KiB dynamic table on the decoding side and 0-RTT are handled; connection migration is not. A second connection to an origin resumes the TLS session and sends GET, HEAD and OPTIONS requests before the handshake has finished, under the limits and SETTINGS the server gave last time; other methods wait for the handshake, a 425 answer is retried after it, and a server that declines the early data gets it again under the 1-RTT keys. The transport parameters are Chrome 155's set, in a fresh random order with a GREASE entry, a GREASE version, Chrome's connection options and, on a resumed connection, the round trip time measured last time; `TransportParameters` on the `Http3Profile` changes any of it. The control stream carries SETTINGS with a GREASE entry, a GREASE frame, and a PRIORITY_UPDATE for every request that has a `priority` header, as Chrome sends them.
 
 ## Proxies
 
@@ -142,7 +142,7 @@ asyncio.run(main())
 ```python
 import asyncio
 
-from boring_http import CHROME, Client
+from boring_http import CHROME_HTTP2, Client
 from ssl2 import (
     JA4,
     CertificateCompressionAlgorithm,
@@ -217,10 +217,10 @@ profile = (
 
 
 async def main() -> None:
-    async with Client(tls=profile, http2=CHROME) as client:
+    async with Client(tls=profile, http2=CHROME_HTTP2) as client:
         report = (await client.get("https://pingly.us.kg/api/all")).json()
         print(report["tls"]["ja4"] == JA4.of(profile).text, report["tls"]["ja4"])  # True t13d1516h2_8daaf6152771_d8a2da3f94cd
-        print(report["http2"]["akamai_fingerprint"] == CHROME.fingerprint.text, report["http2"]["akamai_fingerprint"])  # True 1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p
+        print(report["http2"]["akamai_fingerprint"] == CHROME_HTTP2.fingerprint.text, report["http2"]["akamai_fingerprint"])  # True 1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p
 
 
 asyncio.run(main())
@@ -302,7 +302,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`tls` is a `ssl2.ClientHello`; BoringSSL sends it byte for byte or the client refuses it with the reason. `http2` is an `Http2Profile` with the SETTINGS, WINDOW_UPDATE, priorities and pseudo-header order; `CHROME` is the default. `http3` is an `Http3Profile` with the HTTP/3 SETTINGS, QUIC transport parameters and QUIC version.
+`tls` is a `ssl2.ClientHello`; BoringSSL sends it byte for byte or the client refuses it with the reason. `http2` is an `Http2Profile` with the SETTINGS, WINDOW_UPDATE, priorities and pseudo-header order; `CHROME_HTTP2` is the default. `http3` is an `Http3Profile` with the HTTP/3 SETTINGS, QUIC transport parameters and QUIC version; `CHROME_HTTP3` is the default.
 
 ## WebSocket
 
@@ -353,17 +353,17 @@ Against a Go server (net/http and quic-go) on loopback, so the server is never t
 
 | scenario    | boring-http | boring-http+uvloop |  wreq | curl_cffi | pycurl | httpx | aiohttp | requests |
 | ----------- | ----------: | -----------------: | ----: | --------: | -----: | ----: | ------: | -------: |
-| h1-seq      |        9079 |              13405 | 17190 |      6116 |  28775 |  2171 |   11796 |     3287 |
-| h2-seq      |        5744 |               5931 | 12384 |      4767 |  15384 |  1808 |       - |        - |
-| h3-seq      |        4021 |               4537 |     - |      4595 |  12410 |     - |       - |        - |
-| h1-conc     |        8956 |              12148 | 53500 |      7324 |  31170 |   934 |   23259 |     2361 |
-| h2-conc     |       14846 |              15584 | 48788 |     10683 |  28764 |  2066 |       - |        - |
-| h3-conc     |        6855 |               6901 |     - |     11079 |  29305 |     - |       - |        - |
-| h1-download |         658 |                645 |   689 |       793 |   1019 |   264 |    1117 |      658 |
-| h2-download |         472 |                497 |   426 |       468 |    479 |   123 |       - |        - |
-| h3-download |         105 |                107 |     - |       517 |    492 |     - |       - |        - |
-| h1-upload   |         633 |                687 |  3687 |      2002 |   2124 |   675 |     749 |     2296 |
-| h2-upload   |         447 |                480 |  2309 |      1375 |   1440 |   197 |       - |        - |
-| h3-upload   |          63 |                 67 |     - |       906 |    411 |     - |       - |        - |
+| h1-seq      |       14713 |              14354 | 20116 |      6042 |  29137 |  2248 |   11831 |     3539 |
+| h2-seq      |        7307 |               7359 | 13404 |      5096 |  16023 |  1880 |       - |        - |
+| h3-seq      |        4679 |               4308 |     - |      4725 |  14041 |     - |       - |        - |
+| h1-conc     |       11594 |              12391 | 61212 |      7443 |  33861 |   939 |   24836 |     2438 |
+| h2-conc     |       19234 |              20085 | 41075 |     11354 |  30053 |  2164 |       - |        - |
+| h3-conc     |       10121 |               9788 |     - |     11447 |  29598 |     - |       - |        - |
+| h1-download |         734 |                772 |   823 |       767 |   1229 |   257 |    1081 |      594 |
+| h2-download |         319 |                303 |   443 |       466 |    484 |   120 |       - |        - |
+| h3-download |         199 |                207 |     - |       542 |    491 |     - |       - |        - |
+| h1-upload   |        2513 |               3093 |  3276 |      2106 |   1998 |   694 |     713 |     2376 |
+| h2-upload   |         786 |                839 |  2206 |      1085 |   1323 |   186 |       - |        - |
+| h3-upload   |         132 |                132 |     - |       819 |    434 |     - |       - |        - |
 
 HTTP/1.1 and HTTP/2 are Python framing over BoringSSL records; HTTP/3 is a QUIC stack written in Python with BoringSSL doing the cryptography, which is where the gap to libcurl's HTTP/3 comes from. The same code holds 1000 open clients per protocol, 20000 requests with 256 in flight, parallel multi-megabyte transfers and 5% datagram loss on the QUIC path.

{boring_http-1.1.0 → boring_http-1.2.0}/pyproject.toml

@@ -1,20 +1,19 @@
 [project]
 name = "boring-http"
-version = "1.1.0"
+version = "1.2.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
-    "boring-ssl2",
-    "ssl2",
+    "boring-ssl2>=1.2.0",
+    "ssl2>=1.2.0",
 ]
 
 [project.urls]
 Repository = "https://github.com/baobien-dev/boring-http"
 
-[build-system]
-requires = ["uv_build>=0.13.0,<0.14.0"]
-build-backend = "uv_build"
+[tool.basedpyright]
+typeCheckingMode = "strict"
 
 [tool.uv.sources.ssl2]
 path = "../ssl2"
@@ -23,3 +22,7 @@ editable = true
 [tool.uv.sources.boring-ssl2]
 path = "../boring-ssl2"
 editable = true
+
+[build-system]
+requires = ["uv_build>=0.13.0,<0.14.0"]
+build-backend = "uv_build"

{boring_http-1.1.0 → boring_http-1.2.0}/pyproject.toml.orig

@@ -1,17 +1,20 @@
 [project]
 name = "boring-http"
-version = "1.1.0"
+version = "1.2.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
-    "boring-ssl2",
-    "ssl2",
+    "boring-ssl2>=1.2.0",
+    "ssl2>=1.2.0",
 ]
 
 [project.urls]
 Repository = "https://github.com/baobien-dev/boring-http"
 
+[tool.basedpyright]
+typeCheckingMode = "strict"
+
 [build-system]
 requires = ["uv_build>=0.13.0,<0.14.0"]
 build-backend = "uv_build"

{boring_http-1.1.0 → boring_http-1.2.0}/src/boring_http/__init__.py

@@ -1,3 +1,5 @@
+from boring_ssl2 import QuicVersion
+
 from boring_http.client import Client
 from boring_http.cookies import Cookie, CookieJar
 from boring_http.errors import (
@@ -5,14 +7,15 @@ from boring_http.errors import (
     HTTPError,
     ProtocolError,
     RemoteDisconnected,
+    RevocationError,
     StreamRefused,
     StreamResetError,
     TimeoutError,
     TooManyRedirects,
     WebSocketClosed,
 )
-from boring_http.http2 import CHROME, Http2Profile
-from boring_http.http3 import Http3Profile
+from boring_http.http2 import CHROME_HTTP2, Http2Profile
+from boring_http.http3 import CHROME_HTTP3, Http3Profile
 from boring_http.message import (
     URL,
     Body,
@@ -23,14 +26,13 @@ from boring_http.message import (
     Response,
 )
 from boring_http.quic.connection import TransportParameters
-from boring_http.quic.packet import QUIC_V1, QUIC_V2
+from boring_http.revocation import Revocation
 from boring_http.timing import Timeout
 from boring_http.websocket import WebSocket
 
 __all__ = (
-    "CHROME",
-    "QUIC_V1",
-    "QUIC_V2",
+    "CHROME_HTTP2",
+    "CHROME_HTTP3",
     "URL",
     "Body",
     "Client",
@@ -44,9 +46,12 @@ __all__ = (
     "Http2Profile",
     "Http3Profile",
     "ProtocolError",
+    "QuicVersion",
     "RemoteDisconnected",
     "Request",
     "Response",
+    "Revocation",
+    "RevocationError",
     "StreamRefused",
     "StreamResetError",
     "Timeout",

{boring_http-1.1.0 → boring_http-1.2.0}/src/boring_http/client.py

@@ -1,12 +1,11 @@
-import asyncio
 import base64
 from collections.abc import AsyncGenerator, AsyncIterable, Mapping, Sequence
 from contextlib import asynccontextmanager
 from dataclasses import replace
 from time import monotonic
-from typing import Final, Self, TypedDict, Unpack, final
+from typing import Self, TypedDict, Unpack
 
-from boring_ssl2 import ClientContext as TLSClientContext
+from boring_ssl2 import ClientContext
 from ssl2 import (
     AsyncTransport,
     ClientHello,
@@ -17,7 +16,7 @@ from ssl2 import (
     ProxyError,
     ProxyScheme,
     SessionCache,
-    StreamTransport,
+    SocketTransport,
     TLSClientConfiguration,
     TLSError,
     TLSStream,
@@ -30,14 +29,14 @@ from boring_http.errors import (
     HTTPError,
     ProtocolError,
     RemoteDisconnected,
+    RevocationError,
     StreamRefused,
     TimeoutError,
     TooManyRedirects,
 )
 from boring_http.http1 import Http1Connection
-from boring_http.http2 import CHROME, Http2Connection, Http2Profile
-from boring_http.http3 import DEFAULT as HTTP3_DEFAULT
-from boring_http.http3 import Http3Connection, Http3Profile
+from boring_http.http2 import CHROME_HTTP2, Http2Connection, Http2Profile
+from boring_http.http3 import CHROME_HTTP3, Http3Connection, Http3Profile
 from boring_http.message import (
     URL,
     Body,
@@ -52,25 +51,25 @@ from boring_http.message import (
 )
 from boring_http.pool import Connection, Pool
 from boring_http.quic.protocol import OriginMemory, QuicClient
+from boring_http.revocation import Revocation, Revocations
 from boring_http.timing import Deadline, Timeout
 from boring_http.websocket import WebSocket
 
-IMPLEMENTED: Final = (HTTPVersion.HTTP_3, HTTPVersion.HTTP_2, HTTPVersion.HTTP_1)
-ALPN: Final = {
+IMPLEMENTED = (HTTPVersion.HTTP_3, HTTPVersion.HTTP_2, HTTPVersion.HTTP_1)
+ALPN = {
     HTTPVersion.HTTP_2: NextProtocol.H2,
     HTTPVersion.HTTP_1: NextProtocol.HTTP1,
 }
-ACCEPTED_ENCODINGS: Final = "gzip, deflate, br, zstd"
-USER_AGENT: Final = "boring-http"
-DEFAULT_TIMEOUT: Final = Timeout()
+ACCEPTED_ENCODINGS = "gzip, deflate, br, zstd"
+USER_AGENT = "boring-http"
+DEFAULT_TIMEOUT = Timeout()
 
 
-@final
 class Unset:
     pass
 
 
-UNSET: Final = Unset()
+UNSET = Unset()
 
 
 class RequestOptions(TypedDict, total=False):
@@ -87,7 +86,6 @@ class RequestOptions(TypedDict, total=False):
     proxy: Proxy | str | None | Unset
 
 
-@final
 class Client:
     def __init__(
         self,
@@ -96,14 +94,15 @@ class Client:
         timeout: float | Timeout | None = DEFAULT_TIMEOUT,
         proxy: Proxy | str | None = None,
         tls: ClientHello | None = None,
-        http2: Http2Profile = CHROME,
-        http3: Http3Profile = HTTP3_DEFAULT,
+        http2: Http2Profile = CHROME_HTTP2,
+        http3: Http3Profile = CHROME_HTTP3,
         versions: Sequence[HTTPVersion | str] = (
             HTTPVersion.HTTP_2,
             HTTPVersion.HTTP_1,
         ),
         trust_store: TrustStore | None = None,
         verify: bool = True,
+        revocation: Revocation = Revocation.SOFT,
         cookies: CookieJar | None = None,
         base_url: str | None = None,
         max_connections: int = 100,
@@ -122,11 +121,12 @@ class Client:
         self._versions = tuple(HTTPVersion(version) for version in versions)
         self._trust_store = trust_store
         self._verify = verify
+        self._revocations = Revocations(revocation, self._fetch_crl)
         self._base_url = base_url
         self._max_redirects = max_redirects
         self._max_message_size = max_message_size
         self._decode = decode
-        self._contexts: dict[tuple[NextProtocol, ...] | None, TLSClientContext] = {}
+        self._contexts: dict[tuple[NextProtocol, ...] | None, ClientContext] = {}
         self._memory: dict[tuple[str, int], OriginMemory] = {}
         self._pool = Pool(self._connect, max_connections, max_connections_per_host)
         self.cookies = CookieJar() if cookies is None else cookies
@@ -230,7 +230,11 @@ class Client:
         if params is not None:
             target = target.with_params(params)
         body = self._body(json, data, content, files)
-        merged = self._headers.merged(Headers(headers))
+        merged = (
+            self._headers.copy()
+            if headers is None
+            else self._headers.merged(Headers(headers))
+        )
         if (
             body is not None
             and body.content_type is not None
@@ -280,7 +284,7 @@ class Client:
                 response.history = tuple(history)
                 if not stream:
                     try:
-                        _ = await response.read()
+                        await response.read()
                     except BaseException:
                         await response.close()
                         raise
@@ -290,7 +294,7 @@ class Client:
                 raise TooManyRedirects(
                     f"more than {self._max_redirects} redirects from {history[0].url if history else request.url}"
                 )
-            _ = await response.read()
+            await response.read()
             history.append(response)
             request = self._redirect(request, response)
 
@@ -350,7 +354,7 @@ class Client:
             )
             self.cookies.store(response.cookies)
             if response.status != 101:
-                _ = await response.read()
+                await response.read()
                 raise ProtocolError(
                     f"websocket handshake answered {response.status} {response.reason}: {response.text[:200]}"
                 )
@@ -410,7 +414,7 @@ class Client:
 
     def _context(
         self, protocols: tuple[NextProtocol, ...] | None = None
-    ) -> TLSClientContext:
+    ) -> ClientContext:
         if protocols not in self._contexts:
             hello = (
                 self._http3.tls
@@ -437,7 +441,7 @@ class Client:
                 if hello is None or hello.offers(ExtensionType.pre_shared_key)
                 else None
             )
-            self._contexts[protocols] = TLSClientContext(
+            self._contexts[protocols] = ClientContext(
                 configuration, session_cache=cache
             )
         return self._contexts[protocols]
@@ -457,6 +461,19 @@ class Client:
             ),
         )
 
+    async def _checked(self, stream: TLSStream, authority: str) -> None:
+        try:
+            await self._revocations.check(stream.buffer.getpeerchain(), authority)
+        except RevocationError:
+            await stream.close()
+            raise
+
+    async def _fetch_crl(self, url: str) -> bytes:
+        async with Client(
+            versions=(HTTPVersion.HTTP_1,), revocation=Revocation.NONE, timeout=10
+        ) as inner:
+            return (await inner.get(url)).body
+
     async def _connect(
         self,
         url: URL,
@@ -477,6 +494,13 @@ class Client:
                     proxy=proxy,
                     memory=memory,
                 )
+                try:
+                    await self._revocations.check(
+                        client.connection.peer_chain, url.authority
+                    )
+                except RevocationError:
+                    client.close()
+                    raise
                 connection = Http3Connection(client, self._http3, memory)
                 await connection.start()
                 return connection
@@ -486,6 +510,7 @@ class Client:
                     url.address,
                     proxy=proxy,
                 )
+                await self._checked(stream, url.authority)
                 if stream.negotiated_protocol() is NextProtocol.H2:
                     connection = Http2Connection(stream, self._http2)
                     await connection.start()
@@ -497,13 +522,13 @@ class Client:
             ):
                 transport: AsyncTransport
                 if proxy.scheme is ProxyScheme.HTTPS:
-                    transport = await TLSStream.connect(
+                    secured = await TLSStream.connect(
                         self._context(), (proxy.host, proxy.port)
                     )
+                    await self._checked(secured, f"{proxy.host}:{proxy.port}")
+                    transport = secured
                 else:
-                    transport = StreamTransport(
-                        *await asyncio.open_connection(proxy.host, proxy.port)
-                    )
+                    transport = await SocketTransport.connect((proxy.host, proxy.port))
                 authorization = None
                 if proxy.credentials is not None:
                     authorization = "Basic " + base64.b64encode(
@@ -512,11 +537,9 @@ class Client:
                 return Http1Connection(
                     transport, absolute_form=True, proxy_authorization=authorization
                 )
-            transport, leftover = await TLSStream.tunnel(
-                self._context(), url.address, proxy
-            )
-            return Http1Connection(transport, leftover=leftover)
-        except ProxyError, ConfigurationError:
+            tunnel = await TLSStream.tunnel(self._context(), url.address, proxy)
+            return Http1Connection(tunnel.transport, leftover=tunnel.leftover)
+        except ProxyError, ConfigurationError, RevocationError:
             raise
         except TLSError as error:
             raise ConnectError(
@@ -537,7 +560,7 @@ class Client:
             except ConnectError, TimeoutError:
                 if quic and self._versions != (HTTPVersion.HTTP_3,):
                     # the learned HTTP/3 route is unreachable, so this origin goes back to TCP
-                    _ = self._alt_svc.pop(request.url.address, None)
+                    self._alt_svc.pop(request.url.address, None)
                     quic = False
                     continue
                 raise

{boring_http-1.1.0 → boring_http-1.2.0}/src/boring_http/codings.py

@@ -1,14 +1,12 @@
 import zlib
 from collections.abc import Callable, Sequence
 from compression import zstd
-from typing import final
 
 from boring_ssl2 import BrotliDecoder
 
 from boring_http.errors import ProtocolError
 
 
-@final
 class ContentDecoder:
     def __init__(self, codings: Sequence[str]) -> None:
         self._codings = tuple(reversed(codings))

{boring_http-1.1.0 → boring_http-1.2.0}/src/boring_http/cookies.py

@@ -2,10 +2,9 @@ import time
 from collections.abc import Iterable, Iterator
 from dataclasses import dataclass
 from email.utils import parsedate_to_datetime
-from typing import Self, final
+from typing import Self
 
 
-@final
 @dataclass(frozen=True, slots=True)
 class Cookie:
     name: str
@@ -86,7 +85,6 @@ class Cookie:
             return None
 
 
-@final
 class CookieJar:
     def __init__(self) -> None:
         self._cookies: dict[tuple[str, str, str], Cookie] = {}
@@ -106,7 +104,7 @@ class CookieJar:
     def set(self, cookie: Cookie) -> None:
         key = (cookie.domain, cookie.path, cookie.name)
         if cookie.expired:
-            _ = self._cookies.pop(key, None)
+            self._cookies.pop(key, None)
         else:
             self._cookies[key] = cookie
 

{boring_http-1.1.0 → boring_http-1.2.0}/src/boring_http/errors.py

@@ -9,6 +9,10 @@ class ConnectError(HTTPError):
     pass
 
 
+class RevocationError(ConnectError):
+    pass
+
+
 class RemoteDisconnected(ConnectError):
     pass