boring-http 2.0.0__tar.gz → 2.0.2__tar.gz

{boring_http-2.0.0 → boring_http-2.0.2}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.3
 Name: boring-http
-Version: 2.0.0
+Version: 2.0.2
 Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
 Requires-Dist: boring-ssl2>=1.2.0
-Requires-Dist: ssl2>=1.2.0
+Requires-Dist: ssl2>=2.0.1
 Requires-Python: >=3.14
 Project-URL: Repository, https://github.com/baobien-dev/boring-http
 Description-Content-Type: text/markdown
@@ -98,7 +98,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
+A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `connect` covers opening a connection, the proxy, TCP and the TLS or QUIC handshake included, `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
 
 ## HTTP/3
 
@@ -152,7 +152,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-The default is `versions=("h2", "h1")`. With `"h3"` in the list the client switches an origin to QUIC after an `Alt-Svc: h3` header and falls back to TCP when the QUIC route stops answering; `versions=("h3",)` goes straight to QUIC. QUIC v1 is the default; `quic_version=QuicVersion.V2` offers v2 through compatible version negotiation (RFC 9368), so the first packet is still v1 and a server that speaks v2, such as aioquic, ngtcp2, haproxy or haskell quic, switches to it, while every other server simply stays on v1. Retry packets, version negotiation, loss recovery, pacing, flow control, key updates, path MTU probing from 1200 up to 1452 bytes with the don't-fragment flag set, QPACK with the dynamic table the SETTINGS allow on the decoding side and 0-RTT are handled; connection migration is not. A second connection to an origin resumes the TLS session and sends GET, HEAD and OPTIONS requests before the handshake has finished, under the limits and SETTINGS the server gave last time; other methods wait for the handshake, a 425 answer is retried after it, and a server that declines the early data gets it again under the 1-RTT keys. `TransportParameters` sends the parameters in `order`, in that order; `grease=True` adds a GREASE entry, `grease_version=True` a GREASE version, `shuffle=True` a fresh random order on every connection, and `INITIAL_ROUND_TRIP_TIME` in `order` sends the round trip time measured last time on a resumed connection. The control stream carries the SETTINGS of the `Http3Settings`, a GREASE entry and a GREASE frame with `grease=True`, and a PRIORITY_UPDATE for every request that has a `priority` header.
+The default is `versions=("h2", "h1")`. With `"h3"` in the list the client switches an origin to QUIC after an `Alt-Svc: h3` header and falls back to TCP when the QUIC route stops answering; `versions=("h3",)` goes straight to QUIC. QUIC v1 is the default; `quic_version=QuicVersion.V2` offers v2 through compatible version negotiation (RFC 9368), so the first packet is still v1 and a server that speaks v2, such as aioquic, ngtcp2, haproxy or haskell quic, switches to it, while every other server simply stays on v1; v2 needs `Parameter.VERSION_INFORMATION` in `order`. Retry packets, version negotiation, loss recovery, pacing, flow control, key updates, path MTU probing from 1200 up to 1452 bytes with the don't-fragment flag set, QPACK with the dynamic table the SETTINGS allow on the decoding side and 0-RTT are handled; connection migration is not. A second connection to an origin resumes the TLS session and sends GET, HEAD and OPTIONS requests before the handshake has finished, under the limits and SETTINGS the server gave last time; other methods wait for the handshake, a 425 answer is retried after it, and a server that declines the early data gets it again under the 1-RTT keys. `TransportParameters` sends the parameters in `order`, in that order, and refuses a value the peer would never see: one that differs from the RFC's absent value, or a GREASE version, connection options or round trip time, with its parameter missing from `order`. `max_idle_timeout=0` sets no idle timeout. `grease=True` adds a GREASE entry, `grease_version=True` a GREASE version, `shuffle=True` a fresh random order on every connection, and `INITIAL_ROUND_TRIP_TIME` in `order` sends `initial_round_trip_time`, or else the round trip time measured on the last connection to that origin. The control stream carries the SETTINGS of the `Http3Settings`, a GREASE entry and a GREASE frame with `grease=True`, and a PRIORITY_UPDATE for every request that has a `priority` header.
 
 ## Proxies
 
@@ -425,7 +425,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`tls` is a `ssl2.ClientHello`; BoringSSL sends it byte for byte or the client refuses it with the reason. `http2` is an `Http2Settings` with the SETTINGS, WINDOW_UPDATE, priorities and pseudo-header order. `http3` is an `Http3Settings` with the HTTP/3 SETTINGS, pseudo-header order, QUIC transport parameters and QUIC version. Neither has a default: `h2` in `versions` or in the ClientHello needs `http2`, and `h3` in `versions` needs `http3`.
+`tls` is a `ssl2.ClientHello`; BoringSSL sends it byte for byte or the client refuses it with the reason. `http2` is an `Http2Settings` with the SETTINGS, WINDOW_UPDATE, priorities and pseudo-header order. `http3` is an `Http3Settings` with the HTTP/3 SETTINGS, pseudo-header order, QUIC transport parameters and QUIC version. Neither has a default: `h2` in the ALPN offered over TCP, which is the ClientHello's when `tls` is given and that of `versions` otherwise, needs `http2`, and `h3` in `versions` needs `http3`. A connection that must be HTTP/1.1, such as the TLS hop to an `https` proxy or a WebSocket fallback, offers only `http/1.1` and drops the ALPS extension.
 
 ## WebSocket
 
@@ -453,7 +453,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen.
+Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen. The `total` of `timeout` covers the handshake only; afterwards `read` and `write` still limit each wait, so `Timeout(read=None)` lets `receive()` wait through any silence.
 
 ## uvloop
 

{boring_http-2.0.0 → boring_http-2.0.2}/README.md

@@ -88,7 +88,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
+A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `connect` covers opening a connection, the proxy, TCP and the TLS or QUIC handshake included, `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
 
 ## HTTP/3
 
@@ -142,7 +142,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-The default is `versions=("h2", "h1")`. With `"h3"` in the list the client switches an origin to QUIC after an `Alt-Svc: h3` header and falls back to TCP when the QUIC route stops answering; `versions=("h3",)` goes straight to QUIC. QUIC v1 is the default; `quic_version=QuicVersion.V2` offers v2 through compatible version negotiation (RFC 9368), so the first packet is still v1 and a server that speaks v2, such as aioquic, ngtcp2, haproxy or haskell quic, switches to it, while every other server simply stays on v1. Retry packets, version negotiation, loss recovery, pacing, flow control, key updates, path MTU probing from 1200 up to 1452 bytes with the don't-fragment flag set, QPACK with the dynamic table the SETTINGS allow on the decoding side and 0-RTT are handled; connection migration is not. A second connection to an origin resumes the TLS session and sends GET, HEAD and OPTIONS requests before the handshake has finished, under the limits and SETTINGS the server gave last time; other methods wait for the handshake, a 425 answer is retried after it, and a server that declines the early data gets it again under the 1-RTT keys. `TransportParameters` sends the parameters in `order`, in that order; `grease=True` adds a GREASE entry, `grease_version=True` a GREASE version, `shuffle=True` a fresh random order on every connection, and `INITIAL_ROUND_TRIP_TIME` in `order` sends the round trip time measured last time on a resumed connection. The control stream carries the SETTINGS of the `Http3Settings`, a GREASE entry and a GREASE frame with `grease=True`, and a PRIORITY_UPDATE for every request that has a `priority` header.
+The default is `versions=("h2", "h1")`. With `"h3"` in the list the client switches an origin to QUIC after an `Alt-Svc: h3` header and falls back to TCP when the QUIC route stops answering; `versions=("h3",)` goes straight to QUIC. QUIC v1 is the default; `quic_version=QuicVersion.V2` offers v2 through compatible version negotiation (RFC 9368), so the first packet is still v1 and a server that speaks v2, such as aioquic, ngtcp2, haproxy or haskell quic, switches to it, while every other server simply stays on v1; v2 needs `Parameter.VERSION_INFORMATION` in `order`. Retry packets, version negotiation, loss recovery, pacing, flow control, key updates, path MTU probing from 1200 up to 1452 bytes with the don't-fragment flag set, QPACK with the dynamic table the SETTINGS allow on the decoding side and 0-RTT are handled; connection migration is not. A second connection to an origin resumes the TLS session and sends GET, HEAD and OPTIONS requests before the handshake has finished, under the limits and SETTINGS the server gave last time; other methods wait for the handshake, a 425 answer is retried after it, and a server that declines the early data gets it again under the 1-RTT keys. `TransportParameters` sends the parameters in `order`, in that order, and refuses a value the peer would never see: one that differs from the RFC's absent value, or a GREASE version, connection options or round trip time, with its parameter missing from `order`. `max_idle_timeout=0` sets no idle timeout. `grease=True` adds a GREASE entry, `grease_version=True` a GREASE version, `shuffle=True` a fresh random order on every connection, and `INITIAL_ROUND_TRIP_TIME` in `order` sends `initial_round_trip_time`, or else the round trip time measured on the last connection to that origin. The control stream carries the SETTINGS of the `Http3Settings`, a GREASE entry and a GREASE frame with `grease=True`, and a PRIORITY_UPDATE for every request that has a `priority` header.
 
 ## Proxies
 
@@ -415,7 +415,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`tls` is a `ssl2.ClientHello`; BoringSSL sends it byte for byte or the client refuses it with the reason. `http2` is an `Http2Settings` with the SETTINGS, WINDOW_UPDATE, priorities and pseudo-header order. `http3` is an `Http3Settings` with the HTTP/3 SETTINGS, pseudo-header order, QUIC transport parameters and QUIC version. Neither has a default: `h2` in `versions` or in the ClientHello needs `http2`, and `h3` in `versions` needs `http3`.
+`tls` is a `ssl2.ClientHello`; BoringSSL sends it byte for byte or the client refuses it with the reason. `http2` is an `Http2Settings` with the SETTINGS, WINDOW_UPDATE, priorities and pseudo-header order. `http3` is an `Http3Settings` with the HTTP/3 SETTINGS, pseudo-header order, QUIC transport parameters and QUIC version. Neither has a default: `h2` in the ALPN offered over TCP, which is the ClientHello's when `tls` is given and that of `versions` otherwise, needs `http2`, and `h3` in `versions` needs `http3`. A connection that must be HTTP/1.1, such as the TLS hop to an `https` proxy or a WebSocket fallback, offers only `http/1.1` and drops the ALPS extension.
 
 ## WebSocket
 
@@ -443,7 +443,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen.
+Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen. The `total` of `timeout` covers the handshake only; afterwards `read` and `write` still limit each wait, so `Timeout(read=None)` lets `receive()` wait through any silence.
 
 ## uvloop
 

{boring_http-2.0.0 → boring_http-2.0.2}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "boring-http"
-version = "2.0.0"
+version = "2.0.2"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
     "boring-ssl2>=1.2.0",
-    "ssl2>=1.2.0",
+    "ssl2>=2.0.1",
 ]
 
 [project.urls]

{boring_http-2.0.0 → boring_http-2.0.2}/pyproject.toml.orig

@@ -1,12 +1,12 @@
 [project]
 name = "boring-http"
-version = "2.0.0"
+version = "2.0.2"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
     "boring-ssl2>=1.2.0",
-    "ssl2>=1.2.0",
+    "ssl2>=2.0.1",
 ]
 
 [project.urls]

{boring_http-2.0.0 → boring_http-2.0.2}/src/boring_http/client.py

@@ -60,6 +60,10 @@ ALPN = {
     HTTPVersion.HTTP_2: NextProtocol.H2,
     HTTPVersion.HTTP_1: NextProtocol.HTTP1,
 }
+ALPS_EXTENSIONS = (
+    ExtensionType.application_settings,
+    ExtensionType.application_settings_old,
+)
 ACCEPTED_ENCODINGS = "gzip, deflate, br, zstd"
 USER_AGENT = "boring-http"
 DEFAULT_TIMEOUT = Timeout()
@@ -119,10 +123,15 @@ class Client:
         self._http3 = http3
         self._alt_svc: dict[tuple[str, int], float] = {}
         self._versions = tuple(HTTPVersion(version) for version in versions)
-        if http2 is None and (
-            HTTPVersion.HTTP_2 in self._versions
-            or (tls is not None and NextProtocol.H2.value in tls.application_protocols)
-        ):
+        # over TCP the ClientHello's own ALPN goes out when one is given, else the ALPN of versions
+        offered = (
+            tls.application_protocols
+            if tls is not None
+            else tuple(
+                ALPN[version].value for version in self._versions if version in ALPN
+            )
+        )
+        if http2 is None and NextProtocol.H2.value in offered:
             raise ValueError("h2 is offered, so http2= needs an Http2Settings")
         if http3 is None and HTTPVersion.HTTP_3 in self._versions:
             raise ValueError("h3 is in versions, so http3= needs an Http3Settings")
@@ -460,11 +469,19 @@ class Client:
             return self._tls
         # an HTTP/1.1-only connection keeps the ClientHello but can offer only its own protocol
         names = tuple(protocol.value for protocol in protocols)
+        settings = tuple(
+            name for name in self._tls.application_settings if name in names
+        )
         return replace(
             self._tls,
             application_protocols=names,
-            application_settings=tuple(
-                name for name in self._tls.application_settings if name in names
+            application_settings=settings,
+            extensions=self._tls.extensions
+            if settings
+            else tuple(
+                extension
+                for extension in self._tls.extensions
+                if extension not in ALPS_EXTENSIONS
             ),
         )
 
@@ -516,6 +533,9 @@ class Client:
                     self._context((NextProtocol.HTTP1,) if http1_only else None),
                     url.address,
                     proxy=proxy,
+                    proxy_context=self._context((NextProtocol.HTTP1,))
+                    if proxy is not None and proxy.scheme is ProxyScheme.HTTPS
+                    else None,
                 )
                 await self._checked(stream, url.authority)
                 if (
@@ -533,7 +553,7 @@ class Client:
                 transport: AsyncTransport
                 if proxy.scheme is ProxyScheme.HTTPS:
                     secured = await TLSStream.connect(
-                        self._context(), (proxy.host, proxy.port)
+                        self._context((NextProtocol.HTTP1,)), (proxy.host, proxy.port)
                     )
                     await self._checked(secured, f"{proxy.host}:{proxy.port}")
                     transport = secured

{boring_http-2.0.0 → boring_http-2.0.2}/src/boring_http/http3.py

@@ -15,7 +15,7 @@ from boring_http.errors import (
 )
 from boring_http.message import Headers, HTTPVersion, Request, Response
 from boring_http.qpack import Qpack
-from boring_http.quic.connection import TransportParameters
+from boring_http.quic.connection import Parameter, TransportParameters
 from boring_http.quic.packet import Reader, Writer
 from boring_http.quic.protocol import OriginMemory, QuicClient
 from boring_http.timing import Deadline, Timeout
@@ -76,6 +76,16 @@ class Http3Settings:
     tls: ClientHello | None = None
     grease: bool = False
 
+    def __post_init__(self) -> None:
+        # RFC 9368 section 2.1: the first packet is v1 and the other version is offered only in version_information
+        if (
+            self.quic_version is not QuicVersion.V1
+            and Parameter.VERSION_INFORMATION not in self.transport.order
+        ):
+            raise ValueError(
+                f"quic_version {self.quic_version.name} needs VERSION_INFORMATION in transport.order"
+            )
+
     def setting(self, identifier: Setting, default: int) -> int:
         return next(
             (value for key, value in self.settings if key == identifier), default

{boring_http-2.0.0 → boring_http-2.0.2}/src/boring_http/pool.py

@@ -68,7 +68,8 @@ class Pool:
                 await limit.acquire()
                 await self._total.acquire()
             try:
-                connection = await self._connector(url, proxy, quic)
+                async with deadline.phase("connect"):
+                    connection = await self._connector(url, proxy, quic)
             except BaseException:
                 limit.release()
                 self._total.release()

{boring_http-2.0.0 → boring_http-2.0.2}/src/boring_http/quic/connection.py

@@ -113,6 +113,21 @@ NEVER_REMEMBERED = (
     Parameter.ORIGINAL_DESTINATION_CONNECTION_ID,
     Parameter.RETRY_SOURCE_CONNECTION_ID,
 )
+# RFC 9000 section 18.2 and RFC 9221 section 3: the values a peer assumes when a parameter is absent
+ABSENT = {
+    Parameter.MAX_IDLE_TIMEOUT: 0,
+    Parameter.MAX_UDP_PAYLOAD_SIZE: 65527,
+    Parameter.INITIAL_MAX_DATA: 0,
+    Parameter.INITIAL_MAX_STREAM_DATA_BIDI_LOCAL: 0,
+    Parameter.INITIAL_MAX_STREAM_DATA_BIDI_REMOTE: 0,
+    Parameter.INITIAL_MAX_STREAM_DATA_UNI: 0,
+    Parameter.INITIAL_MAX_STREAMS_BIDI: 0,
+    Parameter.INITIAL_MAX_STREAMS_UNI: 0,
+    Parameter.ACK_DELAY_EXPONENT: 3,
+    Parameter.MAX_ACK_DELAY: 25,
+    Parameter.ACTIVE_CONNECTION_ID_LIMIT: 2,
+    Parameter.MAX_DATAGRAM_FRAME_SIZE: 0,
+}
 
 
 @dataclass(frozen=True, slots=True)
@@ -126,26 +141,37 @@ class TransportParameters:
     initial_max_streams_bidi: int
     initial_max_streams_uni: int
     order: tuple[Parameter, ...]
-    # RFC 9000 section 18.2 and RFC 9221 section 3: the values a peer assumes when a parameter is absent
-    ack_delay_exponent: int = 3
-    max_ack_delay: int = 25
-    active_connection_id_limit: int = 2
-    max_datagram_frame_size: int = 0
+    ack_delay_exponent: int = ABSENT[Parameter.ACK_DELAY_EXPONENT]
+    max_ack_delay: int = ABSENT[Parameter.MAX_ACK_DELAY]
+    active_connection_id_limit: int = ABSENT[Parameter.ACTIVE_CONNECTION_ID_LIMIT]
+    max_datagram_frame_size: int = ABSENT[Parameter.MAX_DATAGRAM_FRAME_SIZE]
     google_connection_options: tuple[bytes, ...] = ()
     initial_round_trip_time: int | None = None
     grease: bool = False
     grease_version: bool = False
     shuffle: bool = False
 
-    def encode(
-        self,
-        source_connection_id: bytes,
-        version: QuicVersion,
-        versions: tuple[QuicVersion, ...],
-        round_trip_time: int | None = None,
-    ) -> bytes:
-        writer = Writer()
-        integers = {
+    def __post_init__(self) -> None:
+        # a value left out of order never reaches the peer, which then works from the absent value instead
+        applied = {
+            parameter: value != ABSENT[parameter]
+            for parameter, value in self._integers.items()
+        } | {
+            Parameter.VERSION_INFORMATION: self.grease_version,
+            Parameter.GOOGLE_CONNECTION_OPTIONS: bool(self.google_connection_options),
+            Parameter.INITIAL_ROUND_TRIP_TIME: self.initial_round_trip_time is not None,
+        }
+        unsent = [
+            parameter.name
+            for parameter, changed in applied.items()
+            if changed and parameter not in self.order
+        ]
+        if unsent:
+            raise ValueError(f"{', '.join(unsent)} must be in order to take effect")
+
+    @property
+    def _integers(self) -> dict[Parameter, int]:
+        return {
             Parameter.MAX_IDLE_TIMEOUT: self.max_idle_timeout,
             Parameter.MAX_UDP_PAYLOAD_SIZE: self.max_udp_payload_size,
             Parameter.INITIAL_MAX_DATA: self.initial_max_data,
@@ -159,6 +185,16 @@ class TransportParameters:
             Parameter.ACTIVE_CONNECTION_ID_LIMIT: self.active_connection_id_limit,
             Parameter.MAX_DATAGRAM_FRAME_SIZE: self.max_datagram_frame_size,
         }
+
+    def encode(
+        self,
+        source_connection_id: bytes,
+        version: QuicVersion,
+        versions: tuple[QuicVersion, ...],
+        round_trip_time: int | None = None,
+    ) -> bytes:
+        writer = Writer()
+        integers = self._integers
         pairs: list[tuple[int, bytes]] = []
         for parameter in self.order:
             if parameter in integers:
@@ -361,7 +397,7 @@ class QuicConnection:
         self._closing: ConnectionClose | None = None
         self._close_sent = False
         self._terminated = False
-        self._idle_timeout = parameters.max_idle_timeout / 1000
+        self._idle_timeout: float | None = parameters.max_idle_timeout / 1000 or None
         self._last_activity = now
         self._ack_timer: float | None = None
         self._peer_connection_ids: dict[int, tuple[bytes, bytes]] = {}
@@ -586,18 +622,23 @@ class QuicConnection:
         self._mtu_probe = None
 
     def next_timer(self) -> float | None:
-        candidates = [self._last_activity + self._idle_timeout]
+        candidates: list[float] = []
+        if self._idle_timeout is not None:
+            candidates.append(self._last_activity + self._idle_timeout)
         if self._ack_timer is not None:
             candidates.append(self._ack_timer)
         timer = self._recovery.loss_timer(EncryptionLevel.HANDSHAKE in self._keys)
         if timer is not None:
             candidates.append(timer[0])
-        return min(candidates)
+        return min(candidates, default=None)
 
     def handle_timer(self, now: float) -> None:
         if self._terminated:
             return
-        if now >= self._last_activity + self._idle_timeout:
+        if (
+            self._idle_timeout is not None
+            and now >= self._last_activity + self._idle_timeout
+        ):
             self._terminated = True
             self._events.append(
                 ConnectionTerminated(TransportError.NO_ERROR, "idle timeout", False)
@@ -1010,9 +1051,16 @@ class QuicConnection:
         self._peer_max_streams[False] = peer.integer(
             Parameter.INITIAL_MAX_STREAMS_UNI, 0
         )
-        peer_idle = peer.integer(Parameter.MAX_IDLE_TIMEOUT, 0) / 1000
-        own_idle = self._parameters.max_idle_timeout / 1000
-        self._idle_timeout = min(own_idle, peer_idle) if peer_idle else own_idle
+        # RFC 9000 section 10.1: the smaller advertised timeout, where 0 means that side sets none
+        timeouts = [
+            value / 1000
+            for value in (
+                peer.integer(Parameter.MAX_IDLE_TIMEOUT, 0),
+                self._parameters.max_idle_timeout,
+            )
+            if value
+        ]
+        self._idle_timeout = min(timeouts) if timeouts else None
         self._recovery.max_ack_delay = peer.integer(Parameter.MAX_ACK_DELAY, 25) / 1000
 
     def _reject_early_data(self) -> None:

{boring_http-2.0.0 → boring_http-2.0.2}/src/boring_http/timing.py

@@ -45,6 +45,9 @@ class Deadline:
     def phase(self, name: Phase) -> PhaseTimer:
         return PhaseTimer(self, name)
 
+    def drop_total(self) -> None:
+        self._end = None
+
     def limit(self, name: Phase) -> tuple[float | None, bool]:
         # the total budget wins when it leaves less time than the phase's own limit, and the error then names the total
         limit = self._limits[name]

{boring_http-2.0.0 → boring_http-2.0.2}/src/boring_http/websocket.py

@@ -37,6 +37,8 @@ class WebSocket:
     ) -> None:
         self._transport = transport
         self._buffer = bytearray(leftover)
+        # the total covered the handshake; from here each read and write keeps only its phase limit
+        deadline.drop_total()
         self._deadline = deadline
         self._limit = max_message_size
         self._fragments: list[bytes] = []