boring-http 2.1.0__tar.gz → 2.2.0__tar.gz

{boring_http-2.1.0 → boring_http-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: boring-http
-Version: 2.1.0
+Version: 2.2.0
 Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
 Requires-Dist: boring-ssl2>=1.2.0
 Requires-Dist: ssl2>=2.0.1
@@ -42,7 +42,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 

{boring_http-2.1.0 → boring_http-2.2.0}/README.md

@@ -32,7 +32,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 

{boring_http-2.1.0 → boring_http-2.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.1.0"
+version = "2.2.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.1.0 → boring_http-2.2.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.1.0"
+version = "2.2.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.1.0 → boring_http-2.2.0}/src/boring_http/client.py

@@ -1,5 +1,12 @@
 import base64
-from collections.abc import AsyncGenerator, AsyncIterable, Mapping, Sequence
+from collections.abc import (
+    AsyncGenerator,
+    AsyncIterable,
+    Awaitable,
+    Callable,
+    Mapping,
+    Sequence,
+)
 from contextlib import asynccontextmanager
 from dataclasses import replace
 from time import monotonic
@@ -16,6 +23,7 @@ from ssl2 import (
     ProxyError,
     ProxyScheme,
     SessionCache,
+    SigningChain,
     SocketTransport,
     TLSClientConfiguration,
     TLSError,
@@ -107,10 +115,13 @@ class Client:
         trust_store: TrustStore | None = None,
         verify: bool = True,
         revocation: Revocation = Revocation.SOFT,
+        certificate_chain: SigningChain | None = None,
+        check_peer: Callable[[tuple[bytes, ...], str], Awaitable[None]] | None = None,
         cookies: CookieJar | None = None,
         base_url: str | None = None,
         max_connections: int = 100,
         max_connections_per_host: int = 10,
+        max_idle_time: float | None = 90.0,
         max_redirects: int = 20,
         max_message_size: int = 16 * 1024 * 1024,
         decode: bool = True,
@@ -138,13 +149,17 @@ class Client:
         self._trust_store = trust_store
         self._verify = verify
         self._revocations = Revocations(revocation, self._fetch_crl)
+        self._certificate_chain = certificate_chain
+        self._check_peer = check_peer
         self._base_url = base_url
         self._max_redirects = max_redirects
         self._max_message_size = max_message_size
         self._decode = decode
         self._contexts: dict[tuple[NextProtocol, ...] | None, ClientContext] = {}
         self._memory: dict[tuple[str, int], OriginMemory] = {}
-        self._pool = Pool(self._connect, max_connections, max_connections_per_host)
+        self._pool = Pool(
+            self._connect, max_connections, max_connections_per_host, max_idle_time
+        )
         self.cookies = CookieJar() if cookies is None else cookies
 
     async def __aenter__(self) -> Self:
@@ -442,12 +457,14 @@ class Client:
                     ALPN[version] for version in self._versions if version in ALPN
                 )
                 configuration = TLSClientConfiguration(
+                    certificate_chain=self._certificate_chain,
                     trust_store=self._trust_store,
                     inner_protocols=offered,
                     verify_certificates=self._verify,
                 )
             else:
                 configuration = TLSClientConfiguration(
+                    certificate_chain=self._certificate_chain,
                     trust_store=self._trust_store,
                     client_hello=hello,
                     verify_certificates=self._verify,
@@ -487,11 +504,16 @@ class Client:
 
     async def _checked(self, stream: TLSStream, authority: str) -> None:
         try:
-            await self._revocations.check(stream.buffer.getpeerchain(), authority)
-        except RevocationError:
+            await self._verified(stream.buffer.getpeerchain(), authority)
+        except BaseException:
             await stream.close()
             raise
 
+    async def _verified(self, chain: tuple[bytes, ...], authority: str) -> None:
+        await self._revocations.check(chain, authority)
+        if self._check_peer is not None:
+            await self._check_peer(chain, authority)
+
     async def _fetch_crl(self, url: str) -> bytes:
         async with Client(
             versions=(HTTPVersion.HTTP_1,), revocation=Revocation.NONE, timeout=10
@@ -519,10 +541,8 @@ class Client:
                     memory=memory,
                 )
                 try:
-                    await self._revocations.check(
-                        client.connection.peer_chain, url.authority
-                    )
-                except RevocationError:
+                    await self._verified(client.connection.peer_chain, url.authority)
+                except BaseException:
                     client.close()
                     raise
                 connection = Http3Connection(client, self._http3, memory)

{boring_http-2.1.0 → boring_http-2.2.0}/src/boring_http/cookies.py

@@ -7,14 +7,6 @@ from typing import Self
 from boring_http.public_suffixes import EXCEPTIONS, RULES
 
 
-def is_public_suffix(domain: str) -> bool:
-    # publicsuffix.org's algorithm: an exception rule wins, then a listed rule or a wildcard over the parent, and an unlisted top-level label is one
-    if domain in EXCEPTIONS:
-        return False
-    parent = domain.partition(".")[2]
-    return domain in RULES or f"*.{parent}" in RULES or not parent
-
-
 @dataclass(frozen=True, slots=True)
 class Cookie:
     name: str
@@ -57,7 +49,7 @@ class Cookie:
         if domain and not (host == domain or host.endswith("." + domain)):
             return None
         # RFC 6265 section 5.3 step 5: a public suffix as Domain is refused, unless it is the host itself, which keeps the cookie to that host
-        if domain and is_public_suffix(domain):
+        if domain and cls._public_suffix(domain):
             if domain != host:
                 return None
             domain = ""
@@ -92,6 +84,14 @@ class Cookie:
             domain_ok and path_ok and (secure or not self.secure) and not self.expired
         )
 
+    @staticmethod
+    def _public_suffix(domain: str) -> bool:
+        # publicsuffix.org's algorithm: an exception rule wins, then a listed rule or a wildcard over the parent, and an unlisted top-level label is one
+        if domain in EXCEPTIONS:
+            return False
+        parent = domain.partition(".")[2]
+        return domain in RULES or f"*.{parent}" in RULES or not parent
+
     @staticmethod
     def _date(text: str) -> float | None:
         try:

{boring_http-2.1.0 → boring_http-2.2.0}/src/boring_http/pool.py

@@ -1,5 +1,6 @@
 import asyncio
 from collections.abc import Awaitable, Callable
+from time import monotonic
 from typing import Protocol
 
 from ssl2 import Proxy
@@ -35,15 +36,23 @@ type Connector = Callable[[URL, Proxy | None, bool], Awaitable[Connection]]
 
 class Pool:
     def __init__(
-        self, connector: Connector, max_connections: int, max_connections_per_host: int
+        self,
+        connector: Connector,
+        max_connections: int,
+        max_connections_per_host: int,
+        max_idle_time: float | None,
     ) -> None:
         self._connector = connector
         self._per_host = max_connections_per_host
         self._total = asyncio.Semaphore(max_connections)
+        self._max_idle_time = max_idle_time
         self._limits: dict[Key, asyncio.Semaphore] = {}
         self._locks: dict[Key, asyncio.Lock] = {}
         self._changes: dict[Key, asyncio.Event] = {}
         self._connections: dict[Key, list[Connection]] = {}
+        # the requests each connection is serving, and when it last became idle
+        self._in_use: dict[Connection, int] = {}
+        self._idle_since: dict[Connection, float] = {}
 
     async def acquire(
         self, url: URL, proxy: Proxy | None, deadline: Deadline, *, quic: bool = False
@@ -53,10 +62,13 @@ class Pool:
         changed = self._changes.setdefault(key, asyncio.Event())
         async with self._locks.setdefault(key, asyncio.Lock()):
             while True:
-                for connection in self._connections.get(key, []):
-                    if connection.available:
+                for connection in list(self._connections.get(key, [])):
+                    if self._expired(connection):
+                        await connection.close()
+                    elif connection.available:
                         connection.take()
                         connection.reused = True
+                        self._in_use[connection] += 1
                         return connection
                 if not limit.locked() and not self._total.locked():
                     break
@@ -77,6 +89,7 @@ class Pool:
             connection.take()
             connection.released = lambda: self._changed(key, connection, limit)
             self._connections.setdefault(key, []).append(connection)
+            self._in_use[connection] = 1
             return connection
 
     async def close(self) -> None:
@@ -91,6 +104,21 @@ class Pool:
         connections = self._connections.get(key, [])
         if connection.closed and connection in connections:
             connections.remove(connection)
+            del self._in_use[connection]
+            self._idle_since.pop(connection, None)
             limit.release()
             self._total.release()
+        elif connection in self._in_use:
+            self._in_use[connection] = max(self._in_use[connection] - 1, 0)
+            if not self._in_use[connection]:
+                self._idle_since[connection] = monotonic()
         self._changes[key].set()
+
+    def _expired(self, connection: Connection) -> bool:
+        idle_since = self._idle_since.get(connection)
+        return (
+            self._max_idle_time is not None
+            and idle_since is not None
+            and not self._in_use[connection]
+            and monotonic() - idle_since > self._max_idle_time
+        )