boring-http 2.2.0__tar.gz → 2.3.0__tar.gz

{boring_http-2.2.0 → boring_http-2.3.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.3
 Name: boring-http
-Version: 2.2.0
+Version: 2.3.0
 Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
-Requires-Dist: boring-ssl2>=1.2.0
-Requires-Dist: ssl2>=2.0.1
+Requires-Dist: boring-ssl2>=1.3.0
+Requires-Dist: ssl2>=2.1.0
 Requires-Python: >=3.14
 Project-URL: Repository, https://github.com/baobien-dev/boring-http
 Description-Content-Type: text/markdown
@@ -42,7 +42,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. `key_log="keys.txt"` appends the secrets of every TLS and QUIC handshake in the NSS key log format, for Wireshark. `resolve={("example.com", 443): ("203.0.113.7", 443)}` sends a connection without a proxy to that address instead of resolving the name, while SNI and certificate verification keep the name from the URL. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 
@@ -455,7 +455,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen. The `total` of `timeout` covers the handshake only; afterwards `read` and `write` still limit each wait, so `Timeout(read=None)` lets `receive()` wait through any silence.
+Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. Each WebSocket has a connection of its own, which `close()` closes after the closing handshake. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen. The `total` of `timeout` covers the handshake only; afterwards `read` and `write` still limit each wait, so `Timeout(read=None)` lets `receive()` wait through any silence.
 
 ## uvloop
 

{boring_http-2.2.0 → boring_http-2.3.0}/README.md

@@ -32,7 +32,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. `key_log="keys.txt"` appends the secrets of every TLS and QUIC handshake in the NSS key log format, for Wireshark. `resolve={("example.com", 443): ("203.0.113.7", 443)}` sends a connection without a proxy to that address instead of resolving the name, while SNI and certificate verification keep the name from the URL. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 
@@ -445,7 +445,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen. The `total` of `timeout` covers the handshake only; afterwards `read` and `write` still limit each wait, so `Timeout(read=None)` lets `receive()` wait through any silence.
+Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. Each WebSocket has a connection of its own, which `close()` closes after the closing handshake. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen. The `total` of `timeout` covers the handshake only; afterwards `read` and `write` still limit each wait, so `Timeout(read=None)` lets `receive()` wait through any silence.
 
 ## uvloop
 

{boring_http-2.2.0 → boring_http-2.3.0}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "boring-http"
-version = "2.2.0"
+version = "2.3.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
-    "boring-ssl2>=1.2.0",
-    "ssl2>=2.0.1",
+    "boring-ssl2>=1.3.0",
+    "ssl2>=2.1.0",
 ]
 
 [project.urls]

{boring_http-2.2.0 → boring_http-2.3.0}/pyproject.toml.orig

@@ -1,12 +1,12 @@
 [project]
 name = "boring-http"
-version = "2.2.0"
+version = "2.3.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
-    "boring-ssl2>=1.2.0",
-    "ssl2>=2.0.1",
+    "boring-ssl2>=1.3.0",
+    "ssl2>=2.1.0",
 ]
 
 [project.urls]

{boring_http-2.2.0 → boring_http-2.3.0}/src/boring_http/client.py

@@ -1,4 +1,5 @@
 import base64
+import os
 from collections.abc import (
     AsyncGenerator,
     AsyncIterable,
@@ -117,6 +118,8 @@ class Client:
         revocation: Revocation = Revocation.SOFT,
         certificate_chain: SigningChain | None = None,
         check_peer: Callable[[tuple[bytes, ...], str], Awaitable[None]] | None = None,
+        key_log: str | os.PathLike[str] | None = None,
+        resolve: Mapping[tuple[str, int], tuple[str, int]] | None = None,
         cookies: CookieJar | None = None,
         base_url: str | None = None,
         max_connections: int = 100,
@@ -151,6 +154,8 @@ class Client:
         self._revocations = Revocations(revocation, self._fetch_crl)
         self._certificate_chain = certificate_chain
         self._check_peer = check_peer
+        self._key_log = key_log
+        self._resolve = {} if resolve is None else dict(resolve)
         self._base_url = base_url
         self._max_redirects = max_redirects
         self._max_message_size = max_message_size
@@ -475,7 +480,7 @@ class Client:
                 else None
             )
             self._contexts[protocols] = ClientContext(
-                configuration, session_cache=cache
+                configuration, session_cache=cache, key_log=self._key_log
             )
         return self._contexts[protocols]
 
@@ -528,13 +533,19 @@ class Client:
         *,
         http1_only: bool = False,
     ) -> Connection:
+        # a resolve= entry sends a direct connection elsewhere, while the URL's host stays the name sent and verified
+        address = (
+            self._resolve.get(url.address, url.address)
+            if proxy is None
+            else url.address
+        )
         try:
             if quic and self._http3 is not None:
                 memory = self._memory.setdefault(url.address, OriginMemory())
                 client = await QuicClient.connect(
                     self._context((NextProtocol.H3,)),
                     url.host,
-                    url.address,
+                    address,
                     self._http3.transport,
                     version=self._http3.quic_version,
                     proxy=proxy,
@@ -551,11 +562,12 @@ class Client:
             if url.secure:
                 stream = await TLSStream.connect(
                     self._context((NextProtocol.HTTP1,) if http1_only else None),
-                    url.address,
+                    address,
                     proxy=proxy,
                     proxy_context=self._context((NextProtocol.HTTP1,))
                     if proxy is not None and proxy.scheme is ProxyScheme.HTTPS
                     else None,
+                    server_hostname=url.host,
                 )
                 await self._checked(stream, url.authority)
                 if (
@@ -587,7 +599,7 @@ class Client:
                 return Http1Connection(
                     transport, absolute_form=True, proxy_authorization=authorization
                 )
-            tunnel = await TLSStream.tunnel(self._context(), url.address, proxy)
+            tunnel = await TLSStream.tunnel(self._context(), address, proxy)
             return Http1Connection(tunnel.transport, leftover=tunnel.leftover)
         except ProxyError, ConfigurationError, RevocationError:
             raise

{boring_http-2.2.0 → boring_http-2.3.0}/src/boring_http/http2.py

@@ -687,4 +687,8 @@ class Http2StreamTransport:
     async def close(self) -> None:
         if not self._closed:
             self._closed = True
-            await self._connection.write_data(self._stream, b"", end=True)
+            # Client.websocket opens a connection for the tunnel alone, so the connection ends with it
+            try:
+                await self._connection.write_data(self._stream, b"", end=True)
+            finally:
+                await self._connection.close()

{boring_http-2.2.0 → boring_http-2.3.0}/src/boring_http/http3.py

@@ -1,6 +1,6 @@
 import asyncio
 import secrets
-from collections.abc import AsyncGenerator, Callable
+from collections.abc import AsyncGenerator, Awaitable, Callable
 from dataclasses import dataclass
 from enum import IntEnum
 
@@ -311,7 +311,7 @@ class Http3Connection:
         return (
             status,
             headers,
-            Http3StreamTransport(self._quic, stream_id, deadline, frames),
+            Http3StreamTransport(self._quic, stream_id, deadline, frames, self.close),
         )
 
     async def close(self) -> None:
@@ -531,12 +531,18 @@ class Http3Connection:
 
 class Http3StreamTransport:
     def __init__(
-        self, quic: QuicClient, stream_id: int, deadline: Deadline, frames: StreamFrames
+        self,
+        quic: QuicClient,
+        stream_id: int,
+        deadline: Deadline,
+        frames: StreamFrames,
+        close_connection: Callable[[], Awaitable[None]],
     ) -> None:
         self._quic = quic
         self._stream_id = stream_id
         self._frames = frames
         self._deadline = deadline
+        self._close_connection = close_connection
         self._pending = b""
         self._closed = False
 
@@ -564,3 +570,5 @@ class Http3StreamTransport:
         if not self._closed:
             self._closed = True
             self._quic.send(self._stream_id, b"", end=True)
+            # Client.websocket opens a connection for the tunnel alone, so the connection ends with it
+            await self._close_connection()